* limitations under the License.
*/
-#include <gssapi/gssapi.h>
-#include <gssapi/gssapi_ext.h>
-#include "util.h"
+#include "gssapiP_eap.h"
#include <shibsp/Application.h>
#include <shibsp/exceptions.h>
#include <shibsp/SPConfig.h>
#include <shibsp/ServiceProvider.h>
#include <shibsp/attribute/Attribute.h>
+#include <shibsp/attribute/SimpleAttribute.h>
#include <shibsp/attribute/resolver/ResolutionContext.h>
#include <shibsp/handler/AssertionConsumerService.h>
#include <shibsp/metadata/MetadataProviderCriteria.h>
#include <xmltooling/XMLToolingConfig.h>
#include <xmltooling/util/XMLHelper.h>
+#include "resolver.h"
+
using namespace shibsp;
+using namespace shibresolver;
using namespace opensaml::saml2md;
using namespace opensaml;
using namespace xmltooling::logging;
using namespace xercesc;
using namespace std;
-class GSSEAPResolver : public shibsp::AssertionConsumerService
+static vector <Attribute *>
+duplicateAttributes(const vector <Attribute *>src);
+
+struct gss_eap_saml_attr_ctx
{
public:
- GSSEAPResolver(const DOMElement *e, const char *appId)
- : shibsp::AssertionConsumerService(e, appId, Category::getInstance(SHIBSP_LOGCAT".GSSEAPResolver")) {
- }
- virtual ~GSSEAPResolver() {}
-
- ResolutionContext* resolveAttributes (
- const Application& application,
- const RoleDescriptor* issuer,
- const XMLCh* protocol,
- const saml1::NameIdentifier* v1nameid,
- const saml2::NameID* nameid,
- const XMLCh* authncontext_class,
- const XMLCh* authncontext_decl,
- const vector<const Assertion*>* tokens
- ) const {
- return shibsp::AssertionConsumerService::resolveAttributes(
- application, issuer, protocol, v1nameid,
- nameid, authncontext_class, authncontext_decl, tokens
- );
+ gss_eap_saml_attr_ctx(const gss_buffer_t buffer = GSS_C_NO_BUFFER) {
+ if (buffer != GSS_C_NO_BUFFER && buffer->length != 0)
+ parseAssertion(buffer);
}
-private:
- void implementProtocol(
- const Application& application,
- const HTTPRequest& httpRequest,
- HTTPResponse& httpResponse,
- SecurityPolicy& policy,
- const PropertySet* settings,
- const XMLObject& xmlObject
- ) const {
- throw FatalProfileException("Should never be called.");
+ gss_eap_saml_attr_ctx(const vector<Attribute*>& attributes,
+ const saml2::Assertion *assertion = NULL) {
+ if (assertion != NULL)
+ m_assertion = dynamic_cast<saml2::Assertion *>(assertion->clone());
+ if (attributes.size())
+ setAttributes(duplicateAttributes(attributes));
}
-};
-class SHIBSP_DLLLOCAL DummyContext : public ResolutionContext
-{
-public:
- DummyContext(const vector<Attribute*>& attributes) : m_attributes(attributes) {
+ gss_eap_saml_attr_ctx(const gss_eap_saml_attr_ctx &ctx) {
+ gss_eap_saml_attr_ctx(ctx.m_attributes, ctx.m_assertion);
}
- virtual ~DummyContext() {
- for_each(m_attributes.begin(), m_attributes.end(), xmltooling::cleanup<Attribute>());
+ ~gss_eap_saml_attr_ctx() {
+ for_each(m_attributes.begin(),
+ m_attributes.end(),
+ xmltooling::cleanup<Attribute>())
+ ;
+ delete m_assertion;
}
- vector<Attribute*>& getResolvedAttributes() {
+ const vector <Attribute *> getAttributes(void) const {
return m_attributes;
}
- vector<Assertion*>& getResolvedAssertions() {
- return m_tokens;
+
+ void addAttribute(Attribute *attr, bool copy = true);
+ void setAttributes(const vector<Attribute*> attributes);
+
+ void setAttribute(int complete,
+ const gss_buffer_t attr,
+ const gss_buffer_t value);
+ void deleteAttribute(const gss_buffer_t attr);
+
+ int getAttributeIndex(const gss_buffer_t attr) const;
+ const Attribute *getAttribute(const gss_buffer_t attr) const;
+
+ bool getAttribute(const gss_buffer_t attr,
+ int *authenticated,
+ int *complete,
+ gss_buffer_t value,
+ gss_buffer_t display_value,
+ int *more);
+
+ const saml2::Assertion *getAssertion(void) const {
+ return m_assertion;
}
+ bool getAssertion(gss_buffer_t buffer);
+
+ DDF marshall() const;
+ static gss_eap_saml_attr_ctx *unmarshall(DDF &in);
+
+ void marshall(gss_buffer_t buffer);
+ static gss_eap_saml_attr_ctx *unmarshall(const gss_buffer_t buffer);
+
private:
- vector<Attribute*> m_attributes;
- static vector<Assertion*> m_tokens; // never any tokens, so just share an empty vector
-};
+ mutable vector<Attribute*> m_attributes;
+ mutable saml2::Assertion *m_assertion;
-struct eap_gss_saml_attr_ctx {
- ResolutionContext *resCtx;
- gss_buffer_desc assertion;
+ bool parseAssertion(const gss_buffer_t buffer);
};
static OM_uint32
-samlAllocAttrContext(OM_uint32 *minor,
- struct eap_gss_saml_attr_ctx **pCtx)
+mapException(OM_uint32 *minor, exception &e)
{
- struct eap_gss_saml_attr_ctx *ctx;
+ *minor = 0;
+ return GSS_S_FAILURE;
+}
- ctx = (struct eap_gss_saml_attr_ctx *)GSSEAP_CALLOC(1, sizeof(*ctx));
- if (ctx == NULL) {
- *minor = ENOMEM;
- return GSS_S_FAILURE;
+bool
+gss_eap_saml_attr_ctx::parseAssertion(const gss_buffer_t buffer)
+{
+ DOMDocument *doc;
+ const XMLObjectBuilder *b;
+ DOMElement *elem;
+ XMLObject *xobj;
+ string str((char *)buffer->value, buffer->length);
+ istringstream istream(str);
+
+ doc = XMLToolingConfig::getConfig().getParser().parse(istream);
+ b = XMLObjectBuilder::getDefaultBuilder();
+ elem = doc->getDocumentElement();
+ xobj = b->buildOneFromElement(elem, true);
+
+ m_assertion = dynamic_cast<saml2::Assertion *>(xobj);
+
+ return (m_assertion != NULL);
+}
+
+static inline void
+duplicateBuffer(gss_buffer_desc &src, gss_buffer_t dst)
+{
+ OM_uint32 minor;
+
+ if (GSS_ERROR(duplicateBuffer(&minor, &src, dst)))
+ throw new bad_alloc();
+}
+
+static inline void
+duplicateBuffer(string &str, gss_buffer_t buffer)
+{
+ gss_buffer_desc tmp;
+
+ tmp.length = str.length();
+ tmp.value = (char *)str.c_str();
+
+ duplicateBuffer(tmp, buffer);
+}
+
+DDF
+gss_eap_saml_attr_ctx::marshall() const
+{
+ DDF obj(NULL);
+ DDF attrs;
+ DDF assertion;
+
+ obj.addmember("version").integer(1);
+
+ attrs = obj.addmember("attributes").list();
+ for (vector<Attribute*>::const_iterator a = m_attributes.begin();
+ a != m_attributes.end(); ++a) {
+ DDF attr = (*a)->marshall();
+ attrs.add(attr);
}
- *pCtx = ctx;
- *minor = 0;
- return GSS_S_COMPLETE;
+ ostringstream sink;
+ sink << *m_assertion;
+ assertion = obj.addmember("assertion").string(sink.str().c_str());
+
+ return obj;
}
-static OM_uint32
-samlImportAssertion(OM_uint32 *minor,
- gss_buffer_t buffer,
- saml2::Assertion **pAssertion)
+gss_eap_saml_attr_ctx *
+gss_eap_saml_attr_ctx::unmarshall(DDF &obj)
{
- *pAssertion = NULL;
+ gss_eap_saml_attr_ctx *ctx = new gss_eap_saml_attr_ctx();
- try {
- DOMDocument *doc;
- const XMLObjectBuilder *b;
- DOMElement *elem;
- XMLObject *xobj;
- string samlBuf((char *)buffer->value, buffer->length);
- istringstream samlIn(samlBuf);
-
- doc = XMLToolingConfig::getConfig().getParser().parse(samlIn);
- b = XMLObjectBuilder::getDefaultBuilder();
- elem = doc->getDocumentElement();
- xobj = b->buildOneFromElement(elem, true);
-
- *pAssertion = dynamic_cast<saml2::Assertion *>(xobj);
- if (*pAssertion == NULL) {
- /* TODO minor_status */
- return GSS_S_BAD_NAME;
+ DDF version = obj["version"];
+ if (version.integer() != 1)
+ return NULL;
+
+ DDF assertion = obj["assertion"];
+ gss_buffer_desc buffer;
+
+ if (!assertion.isnull()) {
+ buffer.length = assertion.strlen();
+ buffer.value = (void *)assertion.string();
+ } else {
+ buffer.length = 0;
+ }
+
+ if (buffer.length != 0)
+ ctx->parseAssertion(&buffer);
+
+ DDF attrs = obj["attributes"];
+ DDF attr = attrs.first();
+ while (!attr.isnull()) {
+ Attribute *attribute = Attribute::unmarshall(attr);
+ ctx->addAttribute(attribute, false);
+ attr = attrs.next();
+ }
+
+ return ctx;
+}
+
+void
+gss_eap_saml_attr_ctx::marshall(gss_buffer_t buffer)
+{
+ DDF obj = marshall();
+ ostringstream sink;
+ sink << obj;
+ string str = sink.str();
+
+ duplicateBuffer(str, buffer);
+
+ obj.destroy();
+}
+
+gss_eap_saml_attr_ctx *
+gss_eap_saml_attr_ctx::unmarshall(const gss_buffer_t buffer)
+{
+ gss_eap_saml_attr_ctx *ctx;
+
+ string str((const char *)buffer->value, buffer->length);
+ istringstream source(str);
+ DDF obj(NULL);
+ source >> obj;
+
+ ctx = unmarshall(obj);
+
+ obj.destroy();
+
+ return ctx;
+}
+
+bool
+gss_eap_saml_attr_ctx::getAssertion(gss_buffer_t buffer)
+{
+ string str;
+
+ if (m_assertion == NULL)
+ return false;
+
+ buffer->value = NULL;
+ buffer->length = 0;
+
+ XMLHelper::serialize(m_assertion->marshall((DOMDocument *)NULL), str);
+
+ duplicateBuffer(str, buffer);
+
+ return true;
+}
+
+static Attribute *
+duplicateAttribute(const Attribute *src)
+{
+ Attribute *attribute;
+
+ DDF obj = src->marshall();
+ attribute = Attribute::unmarshall(obj);
+ obj.destroy();
+
+ return attribute;
+}
+
+static vector <Attribute *>
+duplicateAttributes(const vector <Attribute *>src)
+{
+ vector <Attribute *> dst;
+
+ for (vector<Attribute *>::const_iterator a = src.begin();
+ a != src.end();
+ ++a)
+ dst.push_back(duplicateAttribute(*a));
+
+ return dst;
+}
+
+void
+gss_eap_saml_attr_ctx::addAttribute(Attribute *attribute, bool copy)
+{
+ Attribute *a;
+
+ a = copy ? duplicateAttribute(attribute) : attribute;
+
+ m_attributes.push_back(a);
+}
+
+void
+gss_eap_saml_attr_ctx::setAttributes(const vector<Attribute*> attributes)
+{
+ for_each(m_attributes.begin(), m_attributes.end(), xmltooling::cleanup<Attribute>());
+ m_attributes = attributes;
+}
+
+int
+gss_eap_saml_attr_ctx::getAttributeIndex(const gss_buffer_t attr) const
+{
+ int i = 0;
+
+ for (vector<Attribute *>::const_iterator a = getAttributes().begin();
+ a != getAttributes().end();
+ ++a)
+ {
+ for (vector<string>::const_iterator s = (*a)->getAliases().begin();
+ s != (*a)->getAliases().end();
+ ++s) {
+ if (attr->length == (*s).length() &&
+ memcmp((*s).c_str(), attr->value, attr->length) == 0) {
+ return i;
+ }
}
- } catch (exception &e){
- /* TODO minor_status */
- return GSS_S_BAD_NAME;
}
- *minor = 0;
- return GSS_S_COMPLETE;
+ return -1;
}
-OM_uint32
-samlDuplicateAttrContext(OM_uint32 *minor,
- const struct eap_gss_saml_attr_ctx *in,
- struct eap_gss_saml_attr_ctx **out)
+const Attribute *
+gss_eap_saml_attr_ctx::getAttribute(const gss_buffer_t attr) const
{
- OM_uint32 major, tmpMinor;
- struct eap_gss_saml_attr_ctx *ctx;
+ const Attribute *ret = NULL;
- major = samlAllocAttrContext(minor, &ctx);
- if (GSS_ERROR(major))
- goto cleanup;
+ for (vector<Attribute *>::const_iterator a = getAttributes().begin();
+ a != getAttributes().end();
+ ++a)
+ {
+ for (vector<string>::const_iterator s = (*a)->getAliases().begin();
+ s != (*a)->getAliases().end();
+ ++s) {
+ if (attr->length == (*s).length() &&
+ memcmp((*s).c_str(), attr->value, attr->length) == 0) {
+ ret = *a;
+ break;
+ }
+ }
+ if (ret != NULL)
+ break;
+ }
- ctx->resCtx = new DummyContext(in->resCtx->getResolvedAttributes());
+ return ret;
+}
-cleanup:
- if (GSS_ERROR(major))
- samlReleaseAttrContext(&tmpMinor, &ctx);
+bool
+gss_eap_saml_attr_ctx::getAttribute(const gss_buffer_t attr,
+ int *authenticated,
+ int *complete,
+ gss_buffer_t value,
+ gss_buffer_t display_value,
+ int *more)
+{
+ const Attribute *shibAttr = NULL;
+ gss_buffer_desc buf;
- return major;
+ shibAttr = getAttribute(attr);
+ if (shibAttr == NULL)
+ return false;
+
+ if (*more == -1) {
+ *more = 0;
+ } else if (*more >= (int)shibAttr->valueCount()) {
+ *more = 0;
+ return true;
+ }
+
+ buf.value = (void *)shibAttr->getString(*more);
+ buf.length = strlen((char *)buf.value);
+
+ duplicateBuffer(buf, value);
+
+ *authenticated = TRUE;
+ *complete = FALSE;
+
+ return true;
+}
+
+static Attribute *
+samlAttributeFromGssBuffers(const gss_buffer_t attr,
+ const gss_buffer_t value)
+{
+ string attrStr((char *)attr->value, attr->length);
+ vector <string> ids(1);
+ SimpleAttribute *a;
+
+ ids.push_back(attrStr);
+
+ a = new SimpleAttribute(ids);
+
+ if (value->length != 0) {
+ string valStr((char *)value->value, value->length);
+
+ a->getValues().push_back(valStr);
+ }
+
+ return a;
+}
+
+void
+gss_eap_saml_attr_ctx::setAttribute(int complete,
+ const gss_buffer_t attr,
+ const gss_buffer_t value)
+{
+ Attribute *a = samlAttributeFromGssBuffers(attr, value);
+
+ addAttribute(a, false);
+}
+
+void
+gss_eap_saml_attr_ctx::deleteAttribute(const gss_buffer_t attr)
+{
+ int i;
+
+ i = getAttributeIndex(attr);
+ if (i >= 0)
+ m_attributes.erase(m_attributes.begin() + i);
}
OM_uint32
-samlReleaseAttrContext(OM_uint32 *minor,
- struct eap_gss_saml_attr_ctx **pCtx)
+samlReleaseAttrContext(OM_uint32 *minor, gss_name_t name)
{
- struct eap_gss_saml_attr_ctx *ctx = *pCtx;
+ try {
+ delete name->samlCtx;
+ name->samlCtx = NULL;
+ } catch (exception &e) {
+ return mapException(minor, e);
+ }
+
+ return GSS_S_COMPLETE;
+}
+
+static gss_buffer_desc
+gssEapRadiusAssertionAttr = { 3, (void *)"128" };
- if (ctx != NULL) {
- delete ctx->resCtx;
- GSSEAP_FREE(ctx);
- *pCtx = NULL;
+static OM_uint32
+samlAddRadiusAttribute(OM_uint32 *minor,
+ gss_name_t name,
+ gss_buffer_t attr,
+ void *data)
+{
+ OM_uint32 major;
+ ShibbolethResolver *resolver = (ShibbolethResolver *)resolver;
+ Attribute *a;
+ int authenticated, complete, more = -1;
+ gss_buffer_desc value;
+
+ if (bufferEqual(attr, &gssEapRadiusAssertionAttr)) {
+ return GSS_S_COMPLETE;
}
- *minor = 0;
+ major = radiusGetAttribute(minor, name, attr,
+ &authenticated, &complete,
+ &value, GSS_C_NO_BUFFER, &more);
+ if (major == GSS_S_COMPLETE) {
+ /* Do some prefixing? */
+ a = samlAttributeFromGssBuffers(attr, &value);
+ /* XXX leaky */
+ resolver->addAttribute(a);
+ }
+
+ return GSS_S_COMPLETE;
+}
+
+static OM_uint32
+samlAddRadiusAttributes(OM_uint32 *minor,
+ gss_name_t name,
+ ShibbolethResolver *resolver)
+{
+ return radiusGetAttributeTypes(minor,
+ name,
+ samlAddRadiusAttribute,
+ (void *)resolver);
+}
+
+static OM_uint32
+samlInitAttrContextFromRadius(OM_uint32 *minor,
+ gss_name_t name,
+ gss_eap_saml_attr_ctx **pSamlCtx)
+{
+ OM_uint32 major;
+ int authenticated, complete, more = -1;
+ gss_buffer_desc value;
+
+ value.value = NULL;
+ value.length = 0;
+
+ major = radiusGetAttribute(minor, name, &gssEapRadiusAssertionAttr,
+ &authenticated, &complete,
+ &value, GSS_C_NO_BUFFER, &more);
+ if (major == GSS_S_UNAVAILABLE) {
+ /* No assertion provided via RADIUS. */
+ value.length = 0;
+ value.value = NULL;
+ } else if (GSS_ERROR(major)) {
+ /* Some other error */
+ return major;
+ }
+
+ *pSamlCtx = new gss_eap_saml_attr_ctx(&value);
+
+ gss_release_buffer(minor, &value);
+
return GSS_S_COMPLETE;
}
OM_uint32
samlCreateAttrContext(OM_uint32 *minor,
- gss_buffer_t buffer,
- gss_name_t acceptorName,
- struct eap_gss_saml_attr_ctx **pCtx)
+ gss_cred_id_t acceptorCred,
+ gss_name_t initiatorName,
+ time_t *pExpiryTime)
{
OM_uint32 major, tmpMinor;
- struct eap_gss_saml_attr_ctx *ctx;
- SPConfig &conf = SPConfig::getConfig();
- ServiceProvider *sp;
- const Application *app;
- MetadataProvider *m;
gss_buffer_desc nameBuf;
- const XMLCh *issuer = NULL;
- saml2::NameID *subjectName = NULL;
- saml2::Assertion *assertion;
+ gss_eap_saml_attr_ctx *ctx = NULL;
+ ShibbolethResolver *resolver = NULL;
+
+ assert(initiatorName != GSS_C_NO_NAME);
nameBuf.length = 0;
nameBuf.value = NULL;
- conf.setFeatures(SPConfig::Metadata |
- SPConfig::Trust |
- SPConfig::AttributeResolution |
- SPConfig::Credentials |
- SPConfig::OutOfProcess);
- if (!conf.init())
- return GSS_S_FAILURE;
- if (!conf.instantiate())
+ resolver = ShibbolethResolver::create();
+ if (resolver == NULL)
return GSS_S_FAILURE;
- sp = conf.getServiceProvider();
- sp->lock();
+ if (acceptorCred != GSS_C_NO_CREDENTIAL) {
+ major = gss_display_name(minor, acceptorCred->name, &nameBuf, NULL);
+ if (GSS_ERROR(major))
+ goto cleanup;
+ }
- major = gss_display_name(minor, acceptorName, &nameBuf, NULL);
- if (GSS_ERROR(major))
- goto cleanup;
+ try {
+ const saml2::Assertion *assertion;
+ vector <Attribute *> attrs;
- app = sp->getApplication((const char *)nameBuf.value);
- if (app == NULL) {
- major = GSS_S_FAILURE;
- goto cleanup;
- }
+ major = samlInitAttrContextFromRadius(minor, initiatorName, &ctx);
+ if (GSS_ERROR(major))
+ goto cleanup;
- major = samlAllocAttrContext(minor, &ctx);
- if (GSS_ERROR(major))
- goto cleanup;
+ assertion = ctx->getAssertion();
- major = samlImportAssertion(minor, buffer, &assertion);
- if (GSS_ERROR(major))
- goto cleanup;
+ if (assertion != NULL) {
+ if (assertion->getConditions()) {
+ *pExpiryTime =
+ assertion->getConditions()->getNotOnOrAfter()->getEpoch();
+ }
- if (assertion->getIssuer() != NULL)
- issuer = assertion->getIssuer()->getName();
- if (assertion->getSubject() != NULL)
- subjectName = assertion->getSubject()->getNameID();
+ resolver->addToken(assertion);
+ }
- try {
- m = app->getMetadataProvider();
- xmltooling::Locker mlocker(m);
- MetadataProviderCriteria mc(*app, issuer,
- &IDPSSODescriptor::ELEMENT_QNAME,
- samlconstants::SAML20P_NS);
- pair<const EntityDescriptor *, const RoleDescriptor *> site =
- m->getEntityDescriptor(mc);
- if (!site.first) {
- auto_ptr_char temp(issuer);
- throw MetadataException("Unable to locate metadata for IdP ($1).",
- params(1,temp.get()));
+ if (initiatorName->radiusCtx != NULL) {
+ samlAddRadiusAttributes(minor, initiatorName, resolver);
}
- vector<const Assertion*> tokens(1, assertion);
- GSSEAPResolver gssResolver(NULL, (const char *)nameBuf.value);
- ctx->resCtx = gssResolver.resolveAttributes(*app, site.second,
- samlconstants::SAML20P_NS,
- NULL, subjectName, NULL,
- NULL, &tokens);
+
+ resolver->resolveAttributes(attrs);
+ ctx->setAttributes(attrs);
} catch (exception &ex) {
- major = GSS_S_BAD_NAME;
+ major = mapException(minor, ex);
goto cleanup;
}
+ *minor = 0;
major = GSS_S_COMPLETE;
- *pCtx = ctx;
-cleanup:
- sp->unlock();
- conf.term();
+ initiatorName->samlCtx = ctx;
- if (GSS_ERROR(major))
- samlReleaseAttrContext(&tmpMinor, &ctx);
+cleanup:
gss_release_buffer(&tmpMinor, &nameBuf);
+ if (GSS_ERROR(major))
+ delete ctx;
+ delete resolver;
return major;
}
OM_uint32
samlGetAttributeTypes(OM_uint32 *minor,
- const struct eap_gss_saml_attr_ctx *ctx,
- void *data,
- OM_uint32 (*addAttribute)(OM_uint32 *, void *, gss_buffer_t))
+ gss_name_t name,
+ enum gss_eap_attribute_type type,
+ gss_eap_add_attr_cb addAttribute,
+ void *data)
{
OM_uint32 major = GSS_S_COMPLETE;
+ gss_eap_saml_attr_ctx *ctx = name->samlCtx;
if (ctx == NULL)
return GSS_S_COMPLETE;
- for (vector<Attribute*>::const_iterator a = ctx->resCtx->getResolvedAttributes().begin();
- a != ctx->resCtx->getResolvedAttributes().end();
+ if (type != ATTR_TYPE_NONE)
+ return GSS_S_UNAVAILABLE;
+
+ for (vector<Attribute*>::const_iterator a = ctx->getAttributes().begin();
+ a != ctx->getAttributes().end();
++a)
{
gss_buffer_desc attribute;
attribute.value = (void *)((*a)->getId());
attribute.length = strlen((char *)attribute.value);
- major = addAttribute(minor, data, &attribute);
+ major = addAttribute(minor, name, &attribute, data);
if (GSS_ERROR(major))
break;
}
return major;
}
+/*
+ * SAML implementation of gss_get_name_attribute
+ */
OM_uint32
samlGetAttribute(OM_uint32 *minor,
- const struct eap_gss_saml_attr_ctx *ctx,
+ enum gss_eap_attribute_type type,
+ gss_name_t name,
gss_buffer_t attr,
int *authenticated,
int *complete,
gss_buffer_t display_value,
int *more)
{
- OM_uint32 major;
- Attribute *shibAttr = NULL;
- gss_buffer_desc buf;
+ struct gss_eap_saml_attr_ctx *ctx = name->samlCtx;
+ bool ret;
if (ctx == NULL)
return GSS_S_UNAVAILABLE;
- for (vector<Attribute *>::const_iterator a = ctx->resCtx->getResolvedAttributes().begin();
- a != ctx->resCtx->getResolvedAttributes().end();
- ++a) {
- for (vector<string>::const_iterator s = (*a)->getAliases().begin();
- s != (*a)->getAliases().end();
- ++s) {
- if (attr->length == strlen((*s).c_str()) &&
- memcmp((*s).c_str(), attr->value, attr->length) == 0) {
- shibAttr = *a;
- break;
- }
- }
- if (shibAttr != NULL)
- break;
+ switch (type) {
+ case ATTR_TYPE_NONE:
+ ret = ctx->getAttribute(attr, authenticated, complete,
+ value, display_value, more);
+ break;
+ default:
+ ret = false;
+ break;
}
- if (shibAttr == NULL)
- return GSS_S_UNAVAILABLE;
+ return ret ? GSS_S_COMPLETE : GSS_S_UNAVAILABLE;
+}
- if (*more == -1) {
- *more = 0;
- } else if (*more >= (int)shibAttr->valueCount()) {
- *more = 0;
- return GSS_S_COMPLETE;
- }
+OM_uint32
+samlSetAttribute(OM_uint32 *minor,
+ gss_name_t name,
+ int complete,
+ gss_buffer_t attr,
+ gss_buffer_t value)
+{
+ struct gss_eap_saml_attr_ctx *ctx = name->samlCtx;
- buf.value = (void *)shibAttr->getString(*more);
- buf.length = strlen((char *)buf.value);
+ if (ctx == NULL)
+ return GSS_S_UNAVAILABLE;
- major = duplicateBuffer(minor, &buf, value);
- if (GSS_ERROR(major))
- return major;
-
- *authenticated = TRUE;
- *complete = FALSE;
+ try {
+ ctx->setAttribute(complete, attr, value);
+ } catch (exception &e) {
+ return mapException(minor, e);
+ }
return GSS_S_COMPLETE;
}
OM_uint32
-samlSetAttribute(OM_uint32 *minor,
- struct eap_gss_saml_attr_ctx *ctx,
- int complete,
- gss_buffer_t attr,
- gss_buffer_t value)
+samlDeleteAttribute(OM_uint32 *minor,
+ gss_name_t name,
+ gss_buffer_t attr)
{
- return GSS_S_UNAVAILABLE;
+ struct gss_eap_saml_attr_ctx *ctx = name->samlCtx;
+
+ if (ctx == NULL)
+ return GSS_S_UNAVAILABLE;
+
+ try {
+ ctx->deleteAttribute(attr);
+ } catch (exception &e) {
+ return mapException(minor, e);
+ }
+
+ return GSS_S_COMPLETE;
}
+/*
+ * In order to implement gss_export_name and gss_export_sec_context,
+ * we need to serialise a resolved attribute context to a buffer.
+ */
OM_uint32
samlExportAttrContext(OM_uint32 *minor,
- struct eap_gss_saml_attr_ctx *ctx,
+ gss_name_t name,
gss_buffer_t buffer)
{
- GSSEAP_NOT_IMPLEMENTED;
+ struct gss_eap_saml_attr_ctx *ctx = name->samlCtx;
+
+ try {
+ ctx->marshall(buffer);
+ } catch (exception &e) {
+ return mapException(minor, e);
+ }
+
+ return GSS_S_COMPLETE;
}
+/*
+ * In order to implement gss_import_name and gss_import_sec_context,
+ * we need to deserialise a resolved attribute context from a buffer.
+ */
OM_uint32
samlImportAttrContext(OM_uint32 *minor,
gss_buffer_t buffer,
- struct eap_gss_saml_attr_ctx **ppCtx)
+ gss_name_t name)
+{
+ try {
+ assert(name->samlCtx == NULL);
+ name->samlCtx = gss_eap_saml_attr_ctx::unmarshall(buffer);
+ } catch (exception &e) {
+ return mapException(minor, e);
+ }
+
+ return GSS_S_COMPLETE;
+}
+
+OM_uint32
+samlGetAssertion(OM_uint32 *minor,
+ gss_name_t name,
+ gss_buffer_t assertion)
+{
+ struct gss_eap_saml_attr_ctx *ctx = name->samlCtx;
+
+ if (ctx == NULL)
+ return GSS_S_UNAVAILABLE;
+
+ try {
+ ctx->getAssertion(assertion);
+ } catch (exception &e) {
+ return mapException(minor, e);
+ }
+
+ return GSS_S_COMPLETE;
+}
+
+OM_uint32
+samlDuplicateAttrContext(OM_uint32 *minor,
+ gss_name_t in,
+ gss_name_t out)
+{
+ try {
+ if (in->samlCtx != NULL)
+ out->samlCtx = new gss_eap_saml_attr_ctx(*(in->samlCtx));
+ else
+ out->samlCtx = NULL;
+ } catch (exception &e) {
+ return mapException(minor, e);
+ }
+
+ return GSS_S_COMPLETE;
+}
+
+OM_uint32
+samlMapNameToAny(OM_uint32 *minor,
+ gss_name_t name,
+ int authenticated,
+ gss_buffer_t type_id,
+ gss_any_t *output)
+{
+ struct gss_eap_saml_attr_ctx *ctx = name->samlCtx;
+
+ if (bufferEqualString(type_id, "shibsp::Attribute")) {
+ vector <Attribute *>v = duplicateAttributes(ctx->getAttributes());
+
+ *output = (gss_any_t)new vector <Attribute *>(v);
+ } else if (bufferEqualString(type_id, "opensaml::Assertion")) {
+ *output = (gss_any_t)ctx->getAssertion()->clone();
+ } else {
+ *output = (gss_any_t)NULL;
+ return GSS_S_UNAVAILABLE;
+ }
+
+ return GSS_S_COMPLETE;
+}
+
+OM_uint32
+samlReleaseAnyNameMapping(OM_uint32 *minor,
+ gss_name_t name,
+ gss_buffer_t type_id,
+ gss_any_t *input)
+{
+ if (bufferEqualString(type_id, "vector<shibsp::Attribute>")) {
+ vector <Attribute *> *v = ((vector <Attribute *> *)*input);
+ delete v;
+ } else if (bufferEqualString(type_id, "opensaml::Assertion")) {
+ delete (Assertion *)*input;
+ } else {
+ return GSS_S_UNAVAILABLE;
+ }
+
+ *input = (gss_any_t)NULL;
+ return GSS_S_COMPLETE;
+}
+
+OM_uint32
+samlInit(OM_uint32 *minor)
+{
+ *minor = 0;
+
+ return ShibbolethResolver::init() ? GSS_S_COMPLETE : GSS_S_FAILURE;
+}
+
+OM_uint32
+samlFinalize(OM_uint32 *minor)
{
- GSSEAP_NOT_IMPLEMENTED;
+ *minor = 0;
+
+ ShibbolethResolver::term();
+ return GSS_S_COMPLETE;
}
projects / mech_eap.orig / blobdiff