2 * Copyright 2001-2007 Internet2
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 * @file saml/saml2/core/Assertions.h
20 * XMLObjects representing the SAML 2.0 Assertions schema
23 #ifndef __saml2_assertions_h__
24 #define __saml2_assertions_h__
26 #include <saml/Assertion.h>
27 #include <saml/util/SAMLConstants.h>
29 #include <xmltooling/XMLObjectBuilder.h>
30 #include <xmltooling/encryption/Encryption.h>
31 #include <xmltooling/security/CredentialCriteria.h>
32 #include <xmltooling/security/CredentialResolver.h>
33 #include <xmltooling/signature/Signature.h>
34 #include <xmltooling/util/DateTime.h>
36 #define DECL_SAML2OBJECTBUILDER(cname) \
37 DECL_XMLOBJECTBUILDER(SAML_API,cname,samlconstants::SAML20_NS,samlconstants::SAML20_PREFIX)
42 class SAML_API MetadataProvider;
43 class SAML_API MetadataCredentialCriteria;
47 * @namespace opensaml::saml2
48 * SAML 2.0 assertion namespace
53 class SAML_API Assertion;
54 class SAML_API EncryptedAssertion;
57 * Marker interface for SAML types that can be encrypted.
59 class SAML_API EncryptableObject : public virtual xmltooling::XMLObject
62 EncryptableObject() {}
63 virtual ~EncryptableObject() {}
66 DECL_XMLOBJECT_SIMPLE(SAML_API,AssertionIDRef,AssertionID,SAML 2.0 AssertionIDRef element);
67 DECL_XMLOBJECT_SIMPLE(SAML_API,AssertionURIRef,AssertionURI,SAML 2.0 AssertionURIRef element);
68 DECL_XMLOBJECT_SIMPLE(SAML_API,Audience,AudienceURI,SAML 2.0 Audience element);
69 DECL_XMLOBJECT_SIMPLE(SAML_API,AuthnContextClassRef,Reference,SAML 2.0 AuthnContextClassRef element);
70 DECL_XMLOBJECT_SIMPLE(SAML_API,AuthnContextDeclRef,Reference,SAML 2.0 AuthnContextDeclRef element);
71 DECL_XMLOBJECT_SIMPLE(SAML_API,AuthenticatingAuthority,ID,SAML 2.0 AuthenticatingAuthority element);
73 BEGIN_XMLOBJECT(SAML_API,EncryptedElementType,xmltooling::XMLObject,SAML 2.0 EncryptedElementType type);
74 DECL_TYPED_FOREIGN_CHILD(EncryptedData,xmlencryption);
75 DECL_TYPED_FOREIGN_CHILDREN(EncryptedKey,xmlencryption);
76 /** EncryptedElementType local name */
77 static const XMLCh TYPE_NAME[];
80 * Encrypts an object to a single recipient using this object as a container.
82 * @param xmlObject object to encrypt
83 * @param metadataProvider a locked MetadataProvider to supply encryption keys
84 * @param criteria metadata-based CredentialCriteria to use
85 * @param compact true iff compact KeyInfo should be used
86 * @param algorithm optionally specifies data encryption algorithm if none can be determined from metadata
87 * @return the encrypted object
90 const EncryptableObject& xmlObject,
91 const saml2md::MetadataProvider& metadataProvider,
92 saml2md::MetadataCredentialCriteria& criteria,
94 const XMLCh* algorithm=NULL
98 * Encrypts an object to multiple recipients using this object as a container.
100 * @param recipients pairs containing a locked MetadataProvider to supply encryption keys,
101 * and a metadata-based CredentialCriteria to use
102 * @param compact true iff compact KeyInfo should be used
103 * @param algorithm optionally specifies data encryption algorithm if none can be determined from metadata
104 * @return the encrypted object
106 virtual void encrypt(
107 const EncryptableObject& xmlObject,
108 const std::vector< std::pair<const saml2md::MetadataProvider*, saml2md::MetadataCredentialCriteria*> >& recipients,
110 const XMLCh* algorithm=NULL
114 * Decrypts the element using the supplied CredentialResolver.
116 * <p>The object returned will be unmarshalled around the decrypted DOM element in a
117 * new Document owned by the object.
119 * @param credResolver locked resolver supplying decryption keys
120 * @param recipient identifier naming the recipient (the entity performing the decryption)
121 * @param criteria optional external criteria to use with resolver
122 * @return the decrypted and unmarshalled object
124 virtual xmltooling::XMLObject* decrypt(
125 const xmltooling::CredentialResolver& credResolver, const XMLCh* recipient, xmltooling::CredentialCriteria* criteria=NULL
129 BEGIN_XMLOBJECT(SAML_API,EncryptedID,EncryptedElementType,SAML 2.0 EncryptedID element);
132 BEGIN_XMLOBJECT(SAML_API,BaseID,EncryptableObject,SAML 2.0 BaseID abstract element);
133 DECL_STRING_ATTRIB(NameQualifier,NAMEQUALIFIER);
134 DECL_STRING_ATTRIB(SPNameQualifier,SPNAMEQUALIFIER);
137 BEGIN_XMLOBJECT(SAML_API,NameIDType,xmltooling::XMLObject,SAML 2.0 NameIDType type);
138 DECL_STRING_ATTRIB(NameQualifier,NAMEQUALIFIER);
139 DECL_STRING_ATTRIB(SPNameQualifier,SPNAMEQUALIFIER);
140 DECL_STRING_ATTRIB(Format,FORMAT);
141 DECL_STRING_ATTRIB(SPProvidedID,SPPROVIDEDID);
142 DECL_SIMPLE_CONTENT(Name);
143 /** NameIDType local name */
144 static const XMLCh TYPE_NAME[];
145 /** Unspecified name format ID */
146 static const XMLCh UNSPECIFIED[];
147 /** Email address name format ID */
148 static const XMLCh EMAIL[];
149 /** X.509 subject name format ID */
150 static const XMLCh X509_SUBJECT[];
151 /** Windows domain qualified name format ID */
152 static const XMLCh WIN_DOMAIN_QUALIFIED[];
153 /** Kerberos principal name format ID */
154 static const XMLCh KERBEROS[];
155 /** Entity identifier name format ID */
156 static const XMLCh ENTITY[];
157 /** Persistent identifier name format ID */
158 static const XMLCh PERSISTENT[];
159 /** Transient identifier name format ID */
160 static const XMLCh TRANSIENT[];
163 BEGIN_XMLOBJECT2(SAML_API,NameID,NameIDType,EncryptableObject,SAML 2.0 NameID element);
166 BEGIN_XMLOBJECT(SAML_API,Issuer,NameIDType,SAML 2.0 Issuer element);
169 BEGIN_XMLOBJECT(SAML_API,Condition,xmltooling::XMLObject,SAML 2.0 Condition element);
172 BEGIN_XMLOBJECT(SAML_API,AudienceRestriction,Condition,SAML 2.0 AudienceRestriction element);
173 DECL_TYPED_CHILDREN(Audience);
174 /** AudienceRestrictionType local name */
175 static const XMLCh TYPE_NAME[];
178 BEGIN_XMLOBJECT(SAML_API,OneTimeUse,Condition,SAML 2.0 OneTimeUse element);
179 /** OneTimeUseType local name */
180 static const XMLCh TYPE_NAME[];
183 BEGIN_XMLOBJECT(SAML_API,ProxyRestriction,Condition,SAML 2.0 ProxyRestriction element);
184 DECL_INTEGER_ATTRIB(Count,COUNT);
185 DECL_TYPED_CHILDREN(Audience);
186 /** ProxyRestrictionType local name */
187 static const XMLCh TYPE_NAME[];
190 BEGIN_XMLOBJECT(SAML_API,Conditions,xmltooling::XMLObject,SAML 2.0 Conditions element);
191 DECL_DATETIME_ATTRIB(NotBefore,NOTBEFORE);
192 DECL_DATETIME_ATTRIB(NotOnOrAfter,NOTONORAFTER);
193 DECL_TYPED_CHILDREN(AudienceRestriction);
194 DECL_TYPED_CHILDREN(OneTimeUse);
195 DECL_TYPED_CHILDREN(ProxyRestriction);
196 DECL_TYPED_CHILDREN(Condition);
197 /** ConditionsType local name */
198 static const XMLCh TYPE_NAME[];
201 BEGIN_XMLOBJECT(SAML_API,SubjectConfirmationDataType,xmltooling::XMLObject,SAML 2.0 SubjectConfirmationDataType base type);
202 DECL_DATETIME_ATTRIB(NotBefore,NOTBEFORE);
203 DECL_DATETIME_ATTRIB(NotOnOrAfter,NOTONORAFTER);
204 DECL_STRING_ATTRIB(Recipient,RECIPIENT);
205 DECL_STRING_ATTRIB(InResponseTo,INRESPONSETO);
206 DECL_STRING_ATTRIB(Address,ADDRESS);
209 BEGIN_XMLOBJECT2(SAML_API,SubjectConfirmationData,SubjectConfirmationDataType,xmltooling::ElementProxy,SAML 2.0 SubjectConfirmationData element);
210 DECL_SIMPLE_CONTENT(Data);
213 BEGIN_XMLOBJECT2(SAML_API,KeyInfoConfirmationDataType,SubjectConfirmationDataType,xmltooling::AttributeExtensibleXMLObject,SAML 2.0 KeyInfoConfirmationDataType type);
214 DECL_TYPED_FOREIGN_CHILDREN(KeyInfo,xmlsignature);
215 /** KeyInfoConfirmationDataType local name */
216 static const XMLCh TYPE_NAME[];
219 BEGIN_XMLOBJECT(SAML_API,SubjectConfirmation,xmltooling::XMLObject,SAML 2.0 SubjectConfirmation element);
220 DECL_STRING_ATTRIB(Method,METHOD);
221 DECL_TYPED_CHILD(BaseID);
222 DECL_TYPED_CHILD(NameID);
223 DECL_TYPED_CHILD(EncryptedID);
224 DECL_XMLOBJECT_CHILD(SubjectConfirmationData);
225 /** SubjectConfirmationType local name */
226 static const XMLCh TYPE_NAME[];
227 /** Bearer confirmation method */
228 static const XMLCh BEARER[];
229 /** Holder of key confirmation method */
230 static const XMLCh HOLDER_KEY[];
231 /** Sender vouches confirmation method */
232 static const XMLCh SENDER_VOUCHES[];
235 BEGIN_XMLOBJECT(SAML_API,Subject,xmltooling::XMLObject,SAML 2.0 Subject element);
236 DECL_TYPED_CHILD(BaseID);
237 DECL_TYPED_CHILD(NameID);
238 DECL_TYPED_CHILD(EncryptedID);
239 DECL_TYPED_CHILDREN(SubjectConfirmation);
240 /** SubjectType local name */
241 static const XMLCh TYPE_NAME[];
244 BEGIN_XMLOBJECT(SAML_API,Statement,xmltooling::XMLObject,SAML 2.0 Statement element);
247 BEGIN_XMLOBJECT(SAML_API,SubjectLocality,xmltooling::XMLObject,SAML 2.0 SubjectLocality element);
248 DECL_STRING_ATTRIB(Address,ADDRESS);
249 DECL_STRING_ATTRIB(DNSName,DNSNAME);
250 /** SubjectLocalityType local name */
251 static const XMLCh TYPE_NAME[];
254 BEGIN_XMLOBJECT(SAML_API,AuthnContextDecl,xmltooling::ElementProxy,SAML 2.0 AuthnContextDecl element);
257 BEGIN_XMLOBJECT(SAML_API,AuthnContext,xmltooling::XMLObject,SAML 2.0 AuthnContext element);
258 DECL_TYPED_CHILD(AuthnContextClassRef);
259 DECL_XMLOBJECT_CHILD(AuthnContextDecl);
260 DECL_TYPED_CHILD(AuthnContextDeclRef);
261 DECL_TYPED_CHILDREN(AuthenticatingAuthority);
262 /** AuthnContextType local name */
263 static const XMLCh TYPE_NAME[];
266 BEGIN_XMLOBJECT(SAML_API,AuthnStatement,Statement,SAML 2.0 AuthnStatement element);
267 DECL_DATETIME_ATTRIB(AuthnInstant,AUTHNINSTANT);
268 DECL_STRING_ATTRIB(SessionIndex,SESSIONINDEX);
269 DECL_DATETIME_ATTRIB(SessionNotOnOrAfter,SESSIONNOTONORAFTER);
270 DECL_TYPED_CHILD(SubjectLocality);
271 DECL_TYPED_CHILD(AuthnContext);
272 /** AuthnStatementType local name */
273 static const XMLCh TYPE_NAME[];
276 BEGIN_XMLOBJECT(SAML_API,Action,xmltooling::XMLObject,SAML 2.0 Action element);
277 DECL_STRING_ATTRIB(Namespace,NAMESPACE);
278 DECL_SIMPLE_CONTENT(Action);
279 /** ActionType local name */
280 static const XMLCh TYPE_NAME[];
281 /** Read/Write/Execute/Delete/Control Action Namespace */
282 static const XMLCh RWEDC_NEG_ACTION_NAMESPACE[];
283 /** Read/Write/Execute/Delete/Control with Negation Action Namespace */
284 static const XMLCh RWEDC_ACTION_NAMESPACE[];
285 /** Get/Head/Put/Post Action Namespace */
286 static const XMLCh GHPP_ACTION_NAMESPACE[];
287 /** UNIX File Permissions Action Namespace */
288 static const XMLCh UNIX_ACTION_NAMESPACE[];
291 BEGIN_XMLOBJECT(SAML_API,Evidence,xmltooling::XMLObject,SAML 2.0 Evidence element);
292 DECL_TYPED_CHILDREN(AssertionIDRef);
293 DECL_TYPED_CHILDREN(AssertionURIRef);
294 DECL_TYPED_CHILDREN(Assertion);
295 DECL_TYPED_CHILDREN(EncryptedAssertion);
296 /** EvidenceType local name */
297 static const XMLCh TYPE_NAME[];
300 BEGIN_XMLOBJECT(SAML_API,AuthzDecisionStatement,Statement,SAML 2.0 AuthzDecisionStatement element);
301 DECL_STRING_ATTRIB(Resource,RESOURCE);
302 DECL_STRING_ATTRIB(Decision,DECISION);
303 DECL_TYPED_CHILDREN(Action);
304 DECL_TYPED_CHILD(Evidence);
305 /** AuthzDecisionStatementType local name */
306 static const XMLCh TYPE_NAME[];
307 /** Permit Decision */
308 static const XMLCh DECISION_PERMIT[];
310 static const XMLCh DECISION_DENY[];
311 /** Indeterminate Decision */
312 static const XMLCh DECISION_INDETERMINATE[];
315 BEGIN_XMLOBJECT(SAML_API,AttributeValue,xmltooling::ElementProxy,SAML 2.0 AttributeValue element);
318 BEGIN_XMLOBJECT2(SAML_API,Attribute,xmltooling::AttributeExtensibleXMLObject,EncryptableObject,SAML 2.0 Attribute element);
319 DECL_STRING_ATTRIB(Name,NAME);
320 DECL_STRING_ATTRIB(NameFormat,NAMEFORMAT);
321 DECL_STRING_ATTRIB(FriendlyName,FRIENDLYNAME);
322 DECL_XMLOBJECT_CHILDREN(AttributeValue);
323 /** AttributeType local name */
324 static const XMLCh TYPE_NAME[];
325 /** Unspecified attribute name format ID */
326 static const XMLCh UNSPECIFIED[];
327 /** URI reference attribute name format ID */
328 static const XMLCh URI_REFERENCE[];
329 /** Basic attribute name format ID */
330 static const XMLCh BASIC[];
333 BEGIN_XMLOBJECT(SAML_API,EncryptedAttribute,EncryptedElementType,SAML 2.0 EncryptedAttribute element);
336 BEGIN_XMLOBJECT(SAML_API,AttributeStatement,Statement,SAML 2.0 AttributeStatement element);
337 DECL_TYPED_CHILDREN(Attribute);
338 DECL_TYPED_CHILDREN(EncryptedAttribute);
339 /** AttributeStatementType local name */
340 static const XMLCh TYPE_NAME[];
343 BEGIN_XMLOBJECT(SAML_API,EncryptedAssertion,EncryptedElementType,SAML 2.0 EncryptedAssertion element);
346 BEGIN_XMLOBJECT(SAML_API,Advice,xmltooling::ElementExtensibleXMLObject,SAML 2.0 Advice element);
347 DECL_TYPED_CHILDREN(AssertionIDRef);
348 DECL_TYPED_CHILDREN(AssertionURIRef);
349 DECL_TYPED_CHILDREN(Assertion);
350 DECL_TYPED_CHILDREN(EncryptedAssertion);
351 /** AdviceType local name */
352 static const XMLCh TYPE_NAME[];
356 * SAML 2.0 assertion or protocol message.
358 class SAML_API RootObject : virtual public opensaml::RootObject
363 virtual ~RootObject() {}
365 /** Gets the Version attribute. */
366 virtual const XMLCh* getVersion() const=0;
368 /** Gets the Issuer. */
369 virtual Issuer* getIssuer() const=0;
372 BEGIN_XMLOBJECT3(SAML_API,Assertion,saml2::RootObject,opensaml::Assertion,EncryptableObject,SAML 2.0 Assertion element);
373 DECL_INHERITED_STRING_ATTRIB(Version,VER);
374 DECL_INHERITED_STRING_ATTRIB(ID,ID);
375 DECL_INHERITED_DATETIME_ATTRIB(IssueInstant,ISSUEINSTANT);
376 DECL_INHERITED_TYPED_CHILD(Issuer);
377 DECL_TYPED_CHILD(Subject);
378 DECL_TYPED_CHILD(Conditions);
379 DECL_TYPED_CHILD(Advice);
380 DECL_TYPED_CHILDREN(Statement);
381 DECL_TYPED_CHILDREN(AuthnStatement);
382 DECL_TYPED_CHILDREN(AttributeStatement);
383 DECL_TYPED_CHILDREN(AuthzDecisionStatement);
384 /** AssertionType local name */
385 static const XMLCh TYPE_NAME[];
388 DECL_SAML2OBJECTBUILDER(Action);
389 DECL_SAML2OBJECTBUILDER(Advice);
390 DECL_SAML2OBJECTBUILDER(Assertion);
391 DECL_SAML2OBJECTBUILDER(AssertionIDRef);
392 DECL_SAML2OBJECTBUILDER(AssertionURIRef);
393 DECL_SAML2OBJECTBUILDER(Attribute);
394 DECL_SAML2OBJECTBUILDER(AttributeStatement);
395 DECL_SAML2OBJECTBUILDER(AttributeValue);
396 DECL_SAML2OBJECTBUILDER(Audience);
397 DECL_SAML2OBJECTBUILDER(AudienceRestriction);
398 DECL_SAML2OBJECTBUILDER(AuthenticatingAuthority);
399 DECL_SAML2OBJECTBUILDER(AuthnContext);
400 DECL_SAML2OBJECTBUILDER(AuthnContextClassRef);
401 DECL_SAML2OBJECTBUILDER(AuthnContextDecl);
402 DECL_SAML2OBJECTBUILDER(AuthnContextDeclRef);
403 DECL_SAML2OBJECTBUILDER(AuthnStatement);
404 DECL_SAML2OBJECTBUILDER(AuthzDecisionStatement);
405 DECL_SAML2OBJECTBUILDER(Conditions);
406 DECL_SAML2OBJECTBUILDER(EncryptedAssertion);
407 DECL_SAML2OBJECTBUILDER(EncryptedAttribute);
408 DECL_SAML2OBJECTBUILDER(EncryptedID);
409 DECL_SAML2OBJECTBUILDER(Evidence);
410 DECL_SAML2OBJECTBUILDER(Issuer);
411 DECL_SAML2OBJECTBUILDER(NameID);
412 DECL_SAML2OBJECTBUILDER(OneTimeUse);
413 DECL_SAML2OBJECTBUILDER(ProxyRestriction);
414 DECL_SAML2OBJECTBUILDER(Subject);
415 DECL_SAML2OBJECTBUILDER(SubjectConfirmation);
416 DECL_SAML2OBJECTBUILDER(SubjectConfirmationData);
417 DECL_SAML2OBJECTBUILDER(SubjectLocality);
420 * Builder for NameIDType objects.
422 * This is customized to force the element name to be specified.
424 class SAML_API NameIDTypeBuilder : public xmltooling::XMLObjectBuilder {
426 virtual ~NameIDTypeBuilder() {}
427 /** Builder that allows element/type override. */
428 #ifdef HAVE_COVARIANT_RETURNS
429 virtual NameIDType* buildObject(
431 virtual xmltooling::XMLObject* buildObject(
433 const XMLCh* nsURI, const XMLCh* localName, const XMLCh* prefix=NULL, const xmltooling::QName* schemaType=NULL
436 /** Singleton builder. */
437 static NameIDType* buildNameIDType(const XMLCh* nsURI, const XMLCh* localName, const XMLCh* prefix=NULL) {
438 const NameIDTypeBuilder* b = dynamic_cast<const NameIDTypeBuilder*>(
439 XMLObjectBuilder::getBuilder(xmltooling::QName(samlconstants::SAML20_NS,NameIDType::TYPE_NAME))
442 xmltooling::QName schemaType(samlconstants::SAML20_NS,NameIDType::TYPE_NAME,samlconstants::SAML20_PREFIX);
443 #ifdef HAVE_COVARIANT_RETURNS
444 return b->buildObject(nsURI, localName, prefix, &schemaType);
446 return dynamic_cast<NameIDType*>(b->buildObject(nsURI, localName, prefix, &schemaType));
449 throw xmltooling::XMLObjectException("Unable to obtain typed builder for NameIDType.");
454 * Builder for KeyInfoConfirmationDataType objects.
456 * This is customized to return a SubjectConfirmationData element with an
457 * xsi:type of KeyInfoConfirmationDataType.
459 class SAML_API KeyInfoConfirmationDataTypeBuilder : public xmltooling::XMLObjectBuilder {
461 virtual ~KeyInfoConfirmationDataTypeBuilder() {}
462 /** Default builder. */
463 #ifdef HAVE_COVARIANT_RETURNS
464 virtual KeyInfoConfirmationDataType* buildObject() const {
466 virtual xmltooling::XMLObject* buildObject() const {
468 xmltooling::QName schemaType(
469 samlconstants::SAML20_NS,KeyInfoConfirmationDataType::TYPE_NAME,samlconstants::SAML20_PREFIX
472 samlconstants::SAML20_NS,KeyInfoConfirmationDataType::LOCAL_NAME,samlconstants::SAML20_PREFIX,&schemaType
475 /** Builder that allows element/type override. */
476 #ifdef HAVE_COVARIANT_RETURNS
477 virtual KeyInfoConfirmationDataType* buildObject(
479 virtual xmltooling::XMLObject* buildObject(
481 const XMLCh* nsURI, const XMLCh* localName, const XMLCh* prefix=NULL, const xmltooling::QName* schemaType=NULL
484 /** Singleton builder. */
485 static KeyInfoConfirmationDataType* buildKeyInfoConfirmationDataType() {
486 const KeyInfoConfirmationDataTypeBuilder* b = dynamic_cast<const KeyInfoConfirmationDataTypeBuilder*>(
487 XMLObjectBuilder::getBuilder(xmltooling::QName(samlconstants::SAML20_NS,KeyInfoConfirmationDataType::TYPE_NAME))
490 #ifdef HAVE_COVARIANT_RETURNS
491 return b->buildObject();
493 return dynamic_cast<KeyInfoConfirmationDataType*>(b->buildObject());
495 throw xmltooling::XMLObjectException("Unable to obtain typed builder for KeyInfoConfirmationDataType.");
500 * Registers builders and validators for SAML 2.0 Assertion classes into the runtime.
502 void SAML_API registerAssertionClasses();
506 #endif /* __saml2_assertions_h__ */