saml/saml2/metadata/impl/MetadataSchemaValidators.cpp

   1 /*
   2 *  Copyright 2001-2006 Internet2
   3  *
   4 * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /**
  18  * MetadataSchemaValidators.cpp
  19  *
  20  * Schema-based validators for SAML 2.0 Metadata classes
  21  */
  22
  23 #include "internal.h"
  24 #include "exceptions.h"
  25 #include "saml2/metadata/Metadata.h"
  26
  27 using namespace opensaml::saml2md;
  28 using namespace opensaml::saml2;
  29 using namespace opensaml;
  30 using namespace xmltooling;
  31 using namespace std;
  32
  33 namespace opensaml {
  34     namespace saml2md {
  35
  36         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,AffiliateMember);
  37         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,AttributeProfile);
  38         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,Company);
  39         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,EmailAddress);
  40         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,GivenName);
  41         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,NameIDFormat);
  42         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,SurName);
  43         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,TelephoneNumber);
  44
  45         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,localizedNameType);
  46             XMLOBJECTVALIDATOR_REQUIRE(localizedNameType,TextContent);
  47             XMLOBJECTVALIDATOR_REQUIRE(localizedNameType,Lang);
  48         END_XMLOBJECTVALIDATOR;
  49
  50         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,localizedURIType);
  51             XMLOBJECTVALIDATOR_REQUIRE(localizedNameType,TextContent);
  52             XMLOBJECTVALIDATOR_REQUIRE(localizedURIType,Lang);
  53         END_XMLOBJECTVALIDATOR;
  54
  55         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,OrganizationName,localizedNameType);
  56             localizedNameTypeSchemaValidator::validate(xmlObject);
  57         END_XMLOBJECTVALIDATOR;
  58
  59         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,OrganizationDisplayName,localizedNameType);
  60             localizedNameTypeSchemaValidator::validate(xmlObject);
  61         END_XMLOBJECTVALIDATOR;
  62
  63         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,OrganizationURL,localizedURIType);
  64             localizedURITypeSchemaValidator::validate(xmlObject);
  65         END_XMLOBJECTVALIDATOR;
  66
  67         class SAML_DLLLOCAL checkWildcardNS {
  68         public:
  69             void operator()(const XMLObject* xmlObject) const {
  70                 const XMLCh* ns=xmlObject->getElementQName().getNamespaceURI();
  71                 if (XMLString::equals(ns,SAMLConstants::SAML20MD_NS) || !ns || !*ns) {
  72                     throw ValidationException(
  73                         "Object contains an illegal extension child element ($1).",
  74                         params(1,xmlObject->getElementQName().toString().c_str())
  75                         );
  76                 }
  77             }
  78         };
  79
  80         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,Extensions);
  81             if (!ptr->hasChildren())
  82                 throw ValidationException("Extensions must have at least one child element.");
  83             const list<XMLObject*>& anys=ptr->getXMLObjects();
  84             for_each(anys.begin(),anys.end(),checkWildcardNS());
  85         END_XMLOBJECTVALIDATOR;
  86
  87         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,Organization);
  88             XMLOBJECTVALIDATOR_NONEMPTY(Organization,OrganizationName);
  89             XMLOBJECTVALIDATOR_NONEMPTY(Organization,OrganizationDisplayName);
  90             XMLOBJECTVALIDATOR_NONEMPTY(Organization,OrganizationURL);
  91         END_XMLOBJECTVALIDATOR;
  92
  93         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,ContactPerson);
  94             if (!ptr->hasChildren())
  95                 throw ValidationException("ContactPerson must have at least one child element.");
  96             if (!XMLString::equals(ptr->getContactType(),ContactPerson::CONTACT_TECHNICAL) &&
  97                 !XMLString::equals(ptr->getContactType(),ContactPerson::CONTACT_SUPPORT) &&
  98                 !XMLString::equals(ptr->getContactType(),ContactPerson::CONTACT_ADMINISTRATIVE) &&
  99                 !XMLString::equals(ptr->getContactType(),ContactPerson::CONTACT_BILLING) &&
 100                 !XMLString::equals(ptr->getContactType(),ContactPerson::CONTACT_OTHER))
 101                 throw ValidationException("ContactPerson contactType must be one of the defined values.");
 102         END_XMLOBJECTVALIDATOR;
 103
 104         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,AdditionalMetadataLocation);
 105             XMLOBJECTVALIDATOR_REQUIRE(AdditionalMetadataLocation,Namespace);
 106             XMLOBJECTVALIDATOR_REQUIRE(AdditionalMetadataLocation,Location);
 107         END_XMLOBJECTVALIDATOR;
 108
 109         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,KeyDescriptor);
 110             XMLOBJECTVALIDATOR_REQUIRE(KeyDescriptor,KeyInfo);
 111             if (ptr->getUse() &&
 112                 !XMLString::equals(ptr->getUse(),KeyDescriptor::KEYTYPE_ENCRYPTION) &&
 113                 !XMLString::equals(ptr->getUse(),KeyDescriptor::KEYTYPE_SIGNING))
 114                 throw ValidationException("KeyDescriptor use must be empty or one of the defined values.");
 115         END_XMLOBJECTVALIDATOR;
 116
 117         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,RoleDescriptor);
 118             XMLOBJECTVALIDATOR_REQUIRE(RoleDescriptor,ProtocolSupportEnumeration);
 119         END_XMLOBJECTVALIDATOR;
 120
 121         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,EndpointType);
 122             XMLOBJECTVALIDATOR_REQUIRE(EndpointType,Binding);
 123             XMLOBJECTVALIDATOR_REQUIRE(EndpointType,Location);
 124             const list<XMLObject*>& anys=ptr->getXMLObjects();
 125             for_each(anys.begin(),anys.end(),checkWildcardNS());
 126         END_XMLOBJECTVALIDATOR;
 127
 128         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,IndexedEndpointType,EndpointType);
 129             EndpointTypeSchemaValidator::validate(xmlObject);
 130             XMLOBJECTVALIDATOR_REQUIRE(IndexedEndpointType,Index);
 131         END_XMLOBJECTVALIDATOR;
 132
 133         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,ArtifactResolutionService,IndexedEndpointType);
 134             IndexedEndpointTypeSchemaValidator::validate(xmlObject);
 135         END_XMLOBJECTVALIDATOR;
 136
 137         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,SingleLogoutService,EndpointType);
 138             EndpointTypeSchemaValidator::validate(xmlObject);
 139         END_XMLOBJECTVALIDATOR;
 140
 141         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,ManageNameIDService,EndpointType);
 142             EndpointTypeSchemaValidator::validate(xmlObject);
 143         END_XMLOBJECTVALIDATOR;
 144
 145         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,SingleSignOnService,EndpointType);
 146             EndpointTypeSchemaValidator::validate(xmlObject);
 147         END_XMLOBJECTVALIDATOR;
 148
 149         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,NameIDMappingService,EndpointType);
 150             EndpointTypeSchemaValidator::validate(xmlObject);
 151         END_XMLOBJECTVALIDATOR;
 152
 153         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,AssertionIDRequestService,EndpointType);
 154             EndpointTypeSchemaValidator::validate(xmlObject);
 155         END_XMLOBJECTVALIDATOR;
 156
 157         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,IDPSSODescriptor,RoleDescriptor);
 158             RoleDescriptorSchemaValidator::validate(xmlObject);
 159             XMLOBJECTVALIDATOR_NONEMPTY(IDPSSODescriptor,SingleSignOnService);
 160         END_XMLOBJECTVALIDATOR;
 161
 162         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,ServiceName,localizedNameType);
 163             localizedNameTypeSchemaValidator::validate(xmlObject);
 164         END_XMLOBJECTVALIDATOR;
 165
 166         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,ServiceDescription,localizedNameType);
 167             localizedNameTypeSchemaValidator::validate(xmlObject);
 168         END_XMLOBJECTVALIDATOR;
 169
 170         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,RequestedAttribute);
 171             XMLOBJECTVALIDATOR_REQUIRE(RequestedAttribute,Name);
 172         END_XMLOBJECTVALIDATOR;
 173
 174         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,AttributeConsumingService);
 175             XMLOBJECTVALIDATOR_REQUIRE(AttributeConsumingService,Index);
 176             XMLOBJECTVALIDATOR_NONEMPTY(AttributeConsumingService,ServiceName);
 177             XMLOBJECTVALIDATOR_NONEMPTY(AttributeConsumingService,RequestedAttribute);
 178         END_XMLOBJECTVALIDATOR;
 179
 180         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,AssertionConsumerService,IndexedEndpointType);
 181             IndexedEndpointTypeSchemaValidator::validate(xmlObject);
 182         END_XMLOBJECTVALIDATOR;
 183
 184         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,SPSSODescriptor,RoleDescriptor);
 185             RoleDescriptorSchemaValidator::validate(xmlObject);
 186             XMLOBJECTVALIDATOR_NONEMPTY(SPSSODescriptor,AssertionConsumerService);
 187         END_XMLOBJECTVALIDATOR;
 188
 189         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,AuthnQueryService,EndpointType);
 190             EndpointTypeSchemaValidator::validate(xmlObject);
 191         END_XMLOBJECTVALIDATOR;
 192
 193         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,AuthnAuthorityDescriptor,RoleDescriptor);
 194             RoleDescriptorSchemaValidator::validate(xmlObject);
 195             XMLOBJECTVALIDATOR_NONEMPTY(AuthnAuthorityDescriptor,AuthnQueryService);
 196         END_XMLOBJECTVALIDATOR;
 197
 198         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,AuthzService,EndpointType);
 199             EndpointTypeSchemaValidator::validate(xmlObject);
 200         END_XMLOBJECTVALIDATOR;
 201
 202         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,PDPDescriptor,RoleDescriptor);
 203             RoleDescriptorSchemaValidator::validate(xmlObject);
 204             XMLOBJECTVALIDATOR_NONEMPTY(PDPDescriptor,AuthzService);
 205         END_XMLOBJECTVALIDATOR;
 206
 207         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,AttributeService,EndpointType);
 208             EndpointTypeSchemaValidator::validate(xmlObject);
 209         END_XMLOBJECTVALIDATOR;
 210
 211         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,AttributeAuthorityDescriptor,RoleDescriptor);
 212             RoleDescriptorSchemaValidator::validate(xmlObject);
 213             XMLOBJECTVALIDATOR_NONEMPTY(AttributeAuthorityDescriptor,AttributeService);
 214         END_XMLOBJECTVALIDATOR;
 215
 216         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,AffiliationDescriptor);
 217             XMLOBJECTVALIDATOR_REQUIRE(AffiliationDescriptor,AffiliationOwnerID);
 218             XMLOBJECTVALIDATOR_NONEMPTY(AffiliationDescriptor,AffiliateMember);
 219         END_XMLOBJECTVALIDATOR;
 220
 221         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,EntityDescriptor);
 222             XMLOBJECTVALIDATOR_REQUIRE(EntityDescriptor,EntityID);
 223             if (ptr->getRoleDescriptors().empty() &&
 224                 ptr->getIDPSSODescriptors().empty() &&
 225                 ptr->getSPSSODescriptors().empty() &&
 226                 ptr->getAuthnAuthorityDescriptors().empty() &&
 227                 ptr->getAttributeAuthorityDescriptors().empty() &&
 228                 ptr->getPDPDescriptors().empty()) {
 229
 230                 if (!ptr->getAffiliationDescriptor())
 231                     throw ValidationException("EntityDescriptor must have at least one child role or affiliation descriptor.");
 232             }
 233             else if (ptr->getAffiliationDescriptor()) {
 234                 throw ValidationException("EntityDescriptor cannot have both an AffiliationDescriptor and role descriptors.");
 235             }
 236         END_XMLOBJECTVALIDATOR;
 237
 238         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,EntitiesDescriptor);
 239             if (ptr->getEntityDescriptors().empty() && ptr->getEntitiesDescriptors().empty())
 240                 throw ValidationException("EntitiesDescriptor must contain at least one child descriptor.");
 241         END_XMLOBJECTVALIDATOR;
 242     };
 243 };
 244
 245 #define REGISTER_ELEMENT(cname) \
 246     q=QName(SAMLConstants::SAML20MD_NS,cname::LOCAL_NAME); \
 247     XMLObjectBuilder::registerBuilder(q,new cname##Builder()); \
 248     Validator::registerValidator(q,new cname##SchemaValidator())
 249
 250 #define REGISTER_TYPE(cname) \
 251     q=QName(SAMLConstants::SAML20MD_NS,cname::TYPE_NAME); \
 252     XMLObjectBuilder::registerBuilder(q,new cname##Builder()); \
 253     Validator::registerValidator(q,new cname##SchemaValidator())
 254
 255 #define REGISTER_ELEMENT_NOVAL(cname) \
 256     q=QName(SAMLConstants::SAML20MD_NS,cname::LOCAL_NAME); \
 257     XMLObjectBuilder::registerBuilder(q,new cname##Builder());
 258
 259 #define REGISTER_TYPE_NOVAL(cname) \
 260     q=QName(SAMLConstants::SAML20MD_NS,cname::TYPE_NAME); \
 261     XMLObjectBuilder::registerBuilder(q,new cname##Builder());
 262
 263 void opensaml::saml2md::registerMetadataClasses() {
 264     QName q;
 265     REGISTER_ELEMENT(AdditionalMetadataLocation);
 266     REGISTER_ELEMENT(AffiliateMember);
 267     REGISTER_ELEMENT(AffiliationDescriptor);
 268     REGISTER_ELEMENT(ArtifactResolutionService);
 269     REGISTER_ELEMENT(AssertionConsumerService);
 270     REGISTER_ELEMENT(AssertionIDRequestService);
 271     REGISTER_ELEMENT(AttributeAuthorityDescriptor);;
 272     REGISTER_ELEMENT(AttributeConsumingService);
 273     REGISTER_ELEMENT(AttributeProfile);
 274     REGISTER_ELEMENT(AttributeService);
 275     REGISTER_ELEMENT(AuthnAuthorityDescriptor);
 276     REGISTER_ELEMENT(AuthnQueryService);
 277     REGISTER_ELEMENT(AuthzService);
 278     REGISTER_ELEMENT(Company);
 279     REGISTER_ELEMENT(ContactPerson);
 280     REGISTER_ELEMENT(EmailAddress);
 281     REGISTER_ELEMENT(EntitiesDescriptor);
 282     REGISTER_ELEMENT(EntityDescriptor);
 283     REGISTER_ELEMENT(Extensions);
 284     REGISTER_ELEMENT(GivenName);
 285     REGISTER_ELEMENT(IDPSSODescriptor);
 286     REGISTER_ELEMENT(KeyDescriptor);
 287     REGISTER_ELEMENT(ManageNameIDService);
 288     REGISTER_ELEMENT(NameIDFormat);
 289     REGISTER_ELEMENT(NameIDMappingService);
 290     REGISTER_ELEMENT(Organization);
 291     REGISTER_ELEMENT(OrganizationDisplayName);
 292     REGISTER_ELEMENT(OrganizationName);
 293     REGISTER_ELEMENT(OrganizationURL);
 294     REGISTER_ELEMENT(PDPDescriptor);
 295     REGISTER_ELEMENT(RequestedAttribute);
 296     REGISTER_ELEMENT(ServiceDescription);
 297     REGISTER_ELEMENT(ServiceName);
 298     REGISTER_ELEMENT(SingleLogoutService);
 299     REGISTER_ELEMENT(SingleSignOnService);
 300     REGISTER_ELEMENT(SPSSODescriptor);
 301     REGISTER_ELEMENT(SurName);
 302     REGISTER_ELEMENT(TelephoneNumber);
 303     REGISTER_TYPE(AdditionalMetadataLocation);
 304     REGISTER_TYPE(AffiliationDescriptor);
 305     REGISTER_TYPE(AttributeAuthorityDescriptor);;
 306     REGISTER_TYPE(AttributeConsumingService);
 307     REGISTER_TYPE(AuthnAuthorityDescriptor);
 308     REGISTER_TYPE(ContactPerson);
 309     REGISTER_TYPE(EndpointType);
 310     REGISTER_TYPE(EntitiesDescriptor);
 311     REGISTER_TYPE(EntityDescriptor);
 312     REGISTER_TYPE(Extensions);
 313     REGISTER_TYPE(IDPSSODescriptor);
 314     REGISTER_TYPE(IndexedEndpointType);
 315     REGISTER_TYPE(KeyDescriptor);
 316     REGISTER_TYPE(localizedNameType);
 317     REGISTER_TYPE(localizedURIType);
 318     REGISTER_TYPE(Organization);
 319     REGISTER_TYPE(PDPDescriptor);
 320     REGISTER_TYPE(RequestedAttribute);
 321     REGISTER_TYPE(SPSSODescriptor);
 322 }