From 3584bf959295cea3729d8211c38f3251856e039d Mon Sep 17 00:00:00 2001
From: Scott Cantor <cantor.2@osu.edu>
Date: Thu, 29 Jul 2010 22:05:31 +0000
Subject: [PATCH] Code for default security policy, make policyId optional.

---
 configs/example-shibboleth2.xml             | 10 +++++-----
 configs/shibboleth2.xml                     | 10 +++++-----
 configs/win-shibboleth2.xml                 |  8 ++++----
 schemas/shibboleth-2.0-native-sp-config.xsd |  2 +-
 shibsp/ServiceProvider.h                    |  4 ++--
 shibsp/impl/XMLSecurityPolicyProvider.cpp   | 19 ++++++++++++++++---
 shibsp/security/SecurityPolicyProvider.h    |  8 ++++----
 7 files changed, 37 insertions(+), 24 deletions(-)

diff --git a/configs/example-shibboleth2.xml b/configs/example-shibboleth2.xml
index 40ee148..25cd37b 100644
--- a/configs/example-shibboleth2.xml
+++ b/configs/example-shibboleth2.xml
@@ -91,10 +91,9 @@
     Resource requests are mapped by the RequestMapper to an applicationId that
     points into to this section (or to the defaults here).
     -->
-    <ApplicationDefaults policyId="default"
-        entityID="https://sp.example.org/shibboleth"
-        REMOTE_USER="eppn persistent-id targeted-id"
-        signing="false" encryption="false">
+    <ApplicationDefaults entityID="https://sp.example.org/shibboleth"
+                         REMOTE_USER="eppn persistent-id targeted-id"
+                         signing="false" encryption="false">
 
         <!--
         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
@@ -118,7 +117,8 @@
 
             <!-- Default directs to a specific IdP (favoring SAML 2 over Shib 1). -->
             <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
-                    relayState="cookie" entityID="https://idp.example.org/shibboleth">
+                              relayState="cookie" entityID="https://idp.example.org/shibboleth">
+              
                 <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
                 <SessionInitiator type="Shib1" acsIndex="5"/>
                 <!--
diff --git a/configs/shibboleth2.xml b/configs/shibboleth2.xml
index 77dd551..8a4ad14 100644
--- a/configs/shibboleth2.xml
+++ b/configs/shibboleth2.xml
@@ -20,9 +20,8 @@
     -->
 
     <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
-    <ApplicationDefaults policyId="default"
-        entityID="https://sp.example.org/shibboleth"
-        REMOTE_USER="eppn persistent-id targeted-id">
+    <ApplicationDefaults entityID="https://sp.example.org/shibboleth"
+                         REMOTE_USER="eppn persistent-id targeted-id">
 
         <!--
         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
@@ -34,7 +33,7 @@
         impact on the security of the SP. Stealing cookies/sessions is much easier with this disabled.
         -->
         <Sessions lifetime="28800" timeout="3600" checkAddress="false"
-            handlerURL="/Shibboleth.sso" handlerSSL="false">
+                  handlerURL="/Shibboleth.sso" handlerSSL="false">
             
             <!--
             SessionInitiators handle session requests and relay them to a Discovery page,
@@ -44,7 +43,8 @@
 
             <!-- Default directs to a specific IdP (favoring SAML 2 over Shib 1). -->
             <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
-                    relayState="cookie" entityID="https://idp.example.org/shibboleth">
+                              relayState="cookie" entityID="https://idp.example.org/shibboleth">
+              
                 <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
                 <SessionInitiator type="Shib1" acsIndex="5"/>
                 <!--
diff --git a/configs/win-shibboleth2.xml b/configs/win-shibboleth2.xml
index a6dc081..68d2af8 100644
--- a/configs/win-shibboleth2.xml
+++ b/configs/win-shibboleth2.xml
@@ -63,9 +63,8 @@
     Resource requests are mapped by the RequestMapper to an applicationId that
     points into to this section (or to the defaults here).
     -->
-    <ApplicationDefaults policyId="default"
-        entityID="https://sp.example.org/shibboleth"
-        REMOTE_USER="eppn persistent-id targeted-id">
+    <ApplicationDefaults entityID="https://sp.example.org/shibboleth"
+                         REMOTE_USER="eppn persistent-id targeted-id">
 
         <!--
         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
@@ -87,7 +86,8 @@
 
             <!-- Default directs to a specific IdP (favoring SAML 2 over Shib 1). -->
             <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
-                    relayState="cookie" entityID="https://idp.example.org/shibboleth">
+                              relayState="cookie" entityID="https://idp.example.org/shibboleth">
+              
                 <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
                 <SessionInitiator type="Shib1" acsIndex="5"/>
                 <!--
diff --git a/schemas/shibboleth-2.0-native-sp-config.xsd b/schemas/shibboleth-2.0-native-sp-config.xsd
index d40b353..09179ea 100644
--- a/schemas/shibboleth-2.0-native-sp-config.xsd
+++ b/schemas/shibboleth-2.0-native-sp-config.xsd
@@ -382,7 +382,7 @@
     </sequence>
     <attribute name="id" type="conf:string" fixed="default"/>
     <attribute name="entityID" type="anyURI" use="required"/>
-    <attribute name="policyId" type="conf:string" use="required"/>
+    <attribute name="policyId" type="conf:string"/>
     <attributeGroup ref="conf:ApplicationGroup"/>
     <attributeGroup ref="conf:RelyingPartyGroup"/>
     <anyAttribute namespace="##other" processContents="lax"/>
diff --git a/shibsp/ServiceProvider.h b/shibsp/ServiceProvider.h
index 3bb95ca..59f75a4 100644
--- a/shibsp/ServiceProvider.h
+++ b/shibsp/ServiceProvider.h
@@ -121,7 +121,7 @@ namespace shibsp {
          * @deprecated
 		 * Returns the security policy settings for an identified policy.
          *
-		 * @param id    identifies the policy to return
+		 * @param id    identifies the policy to return, or nullptr for default
          * @return a PropertySet
 		 */
         virtual const PropertySet* getPolicySettings(const char* id) const=0;
@@ -130,7 +130,7 @@ namespace shibsp {
          * @deprecated
 		 * Returns the security policy rules for an identified policy.
          *
-		 * @param id    identifies the policy to return
+		 * @param id    identifies the policy to return, or nullptr for default
          * @return an array of policy rules
 		 */
         virtual const std::vector<const opensaml::SecurityPolicyRule*>& getPolicyRules(const char* id) const=0;
diff --git a/shibsp/impl/XMLSecurityPolicyProvider.cpp b/shibsp/impl/XMLSecurityPolicyProvider.cpp
index 75e39c5..ac15595 100644
--- a/shibsp/impl/XMLSecurityPolicyProvider.cpp
+++ b/shibsp/impl/XMLSecurityPolicyProvider.cpp
@@ -74,6 +74,7 @@ namespace shibsp {
         DOMDocument* m_document;
         vector<xstring> m_whitelist,m_blacklist;
         map< string,pair< PropertySet*,vector<const SecurityPolicyRule*> > > m_policyMap;
+        map< string,pair< PropertySet*,vector<const SecurityPolicyRule*> > >::const_iterator m_defaultPolicy;
 
         friend class SHIBSP_DLLLOCAL XMLSecurityPolicyProvider;
     };
@@ -91,14 +92,18 @@ namespace shibsp {
             delete m_impl;
         }
 
-        const PropertySet* getPolicySettings(const char* id) const {
+        const PropertySet* getPolicySettings(const char* id=nullptr) const {
+            if (!id || !*id)
+                return m_impl->m_defaultPolicy->second.first;
             map<string,pair<PropertySet*,vector<const SecurityPolicyRule*> > >::const_iterator i = m_impl->m_policyMap.find(id);
             if (i != m_impl->m_policyMap.end())
                 return i->second.first;
             throw ConfigurationException("Security Policy ($1) not found, check <SecurityPolicies> element.", params(1,id));
         }
 
-        const vector<const SecurityPolicyRule*>& getPolicyRules(const char* id) const {
+        const vector<const SecurityPolicyRule*>& getPolicyRules(const char* id=nullptr) const {
+            if (!id || !*id)
+                return m_impl->m_defaultPolicy->second.second;
             map<string,pair<PropertySet*,vector<const SecurityPolicyRule*> > >::const_iterator i = m_impl->m_policyMap.find(id);
             if (i != m_impl->m_policyMap.end())
                 return i->second.second;
@@ -172,7 +177,8 @@ SecurityPolicy* SecurityPolicyProvider::createSecurityPolicy(
     return new SecurityPolicy(application, role, (validate.first && validate.second), policyId);
 }
 
-XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl(const DOMElement* e, Category& log) : m_document(nullptr)
+XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl(const DOMElement* e, Category& log)
+    : m_document(nullptr), m_defaultPolicy(m_policyMap.end())
 {
 #ifdef _DEBUG
     xmltooling::NDC ndc("XMLSecurityPolicyProviderImpl");
@@ -214,6 +220,10 @@ XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl(const DOMElement* e
         settings->load(e, nullptr, &filter);
         rules.first = settings.release();
 
+        // Set default policy if not set, or id is "default".
+        if (m_defaultPolicy == m_policyMap.end() || id == "default")
+            m_defaultPolicy = m_policyMap.find(id);
+
         // Process PolicyRule elements.
         const DOMElement* rule = XMLHelper::getFirstChildElement(e, PolicyRule);
         while (rule) {
@@ -253,6 +263,9 @@ XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl(const DOMElement* e
 
         e = XMLHelper::getNextSiblingElement(e, Policy);
     }
+
+    if (m_defaultPolicy == m_policyMap.end())
+        throw ConfigurationException("XML SecurityPolicyProvider requires at least one Policy.");
 }
 
 pair<bool,DOMElement*> XMLSecurityPolicyProvider::load(bool backup)
diff --git a/shibsp/security/SecurityPolicyProvider.h b/shibsp/security/SecurityPolicyProvider.h
index 3d8c41b..ec84baf 100644
--- a/shibsp/security/SecurityPolicyProvider.h
+++ b/shibsp/security/SecurityPolicyProvider.h
@@ -59,18 +59,18 @@ namespace shibsp {
         /**
 		 * Returns the security policy settings for an identified policy.
          *
-		 * @param id    identifies the policy to return
+		 * @param id    identifies the policy to return, or nullptr for default
          * @return a PropertySet
 		 */
-        virtual const PropertySet* getPolicySettings(const char* id) const=0;
+        virtual const PropertySet* getPolicySettings(const char* id=nullptr) const=0;
 
         /**
 		 * Returns the security policy rules for an identified policy.
          *
-		 * @param id    identifies the policy to return
+		 * @param id    identifies the policy to return, or nullptr for default
          * @return an array of policy rules
 		 */
-        virtual const std::vector<const opensaml::SecurityPolicyRule*>& getPolicyRules(const char* id) const=0;
+        virtual const std::vector<const opensaml::SecurityPolicyRule*>& getPolicyRules(const char* id=nullptr) const=0;
 
         /**
          * Returns a set of XML Signature/Encryption algorithm identifiers to block.
-- 
2.1.4