saml/saml2/profile/impl/BearerConfirmationRule.cpp

   1 /*
   2  *  Copyright 2009-2010 Internet2
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /**
  18  * BearerConfirmationRule.cpp
  19  *
  20  * SAML 2.0 Bearer SubjectConfirmation SecurityPolicyRule.
  21  */
  22
  23 #include "internal.h"
  24 #include "exceptions.h"
  25 #include "binding/SecurityPolicyRule.h"
  26 #include "saml2/core/Assertions.h"
  27 #include "saml2/profile/SAML2AssertionPolicy.h"
  28
  29 #include <xercesc/util/XMLUniDefs.hpp>
  30 #include <xmltooling/logging.h>
  31 #include <xmltooling/XMLToolingConfig.h>
  32 #include <xmltooling/io/HTTPRequest.h>
  33
  34 using namespace opensaml::saml2;
  35 using namespace xmltooling;
  36 using namespace std;
  37
  38 namespace opensaml {
  39     namespace saml2 {
  40
  41         class SAML_DLLLOCAL BearerConfirmationRule : public opensaml::SecurityPolicyRule
  42         {
  43         public:
  44             BearerConfirmationRule(const DOMElement* e);
  45
  46             virtual ~BearerConfirmationRule() {
  47             }
  48             const char* getType() const {
  49                 return BEARER_POLICY_RULE;
  50             }
  51             bool evaluate(const XMLObject& message, const GenericRequest* request, opensaml::SecurityPolicy& policy) const;
  52
  53         private:
  54             bool m_validity, m_recipient, m_correlation, m_fatal;
  55         };
  56
  57         opensaml::SecurityPolicyRule* SAML_DLLLOCAL BearerConfirmationRuleFactory(const DOMElement* const & e)
  58         {
  59             return new BearerConfirmationRule(e);
  60         }
  61
  62         static const XMLCh checkValidity[] =    UNICODE_LITERAL_13(c,h,e,c,k,V,a,l,i,d,i,t,y);
  63         static const XMLCh checkRecipient[] =   UNICODE_LITERAL_14(c,h,e,c,k,R,e,c,i,p,i,e,n,t);
  64         static const XMLCh checkCorrelation[] = UNICODE_LITERAL_16(c,h,e,c,k,C,o,r,r,e,l,a,t,i,o,n);
  65         static const XMLCh missingFatal[] =     UNICODE_LITERAL_12(m,i,s,s,i,n,g,F,a,t,a,l);
  66     };
  67 };
  68
  69 BearerConfirmationRule::BearerConfirmationRule(const DOMElement* e)
  70     : m_validity(XMLHelper::getAttrBool(e, true, checkValidity)),
  71         m_recipient(XMLHelper::getAttrBool(e, true, checkRecipient)),
  72         m_correlation(XMLHelper::getAttrBool(e, true, checkCorrelation)),
  73         m_fatal(XMLHelper::getAttrBool(e, true, missingFatal))
  74 {
  75 }
  76
  77 bool BearerConfirmationRule::evaluate(const XMLObject& message, const GenericRequest* request, opensaml::SecurityPolicy& policy) const
  78 {
  79     const Assertion* a=dynamic_cast<const Assertion*>(&message);
  80     if (!a)
  81         return false;
  82
  83     logging::Category& log = logging::Category::getInstance(SAML_LOGCAT".SecurityPolicyRule.BearerConfirmation");
  84
  85     const char* msg="assertion is missing bearer SubjectConfirmation";
  86     const Subject* subject = a->getSubject();
  87     if (subject) {
  88         const vector<SubjectConfirmation*>& confs = subject->getSubjectConfirmations();
  89         for (vector<SubjectConfirmation*>::const_iterator sc = confs.begin(); sc!=confs.end(); ++sc) {
  90             if (XMLString::equals((*sc)->getMethod(), SubjectConfirmation::BEARER)) {
  91
  92                 const SubjectConfirmationDataType* data = dynamic_cast<const SubjectConfirmationDataType*>((*sc)->getSubjectConfirmationData());
  93
  94                 if (m_recipient) {
  95                     const HTTPRequest* httpRequest = dynamic_cast<const HTTPRequest*>(request);
  96                     if (httpRequest && httpRequest->getRequestURL()) {
  97                         string dest = httpRequest->getRequestURL();
  98                         auto_ptr_XMLCh destination(dest.substr(0,dest.find('?')).c_str());
  99                         if (!XMLString::equals(destination.get(), data ? data->getRecipient() : nullptr)) {
 100                             msg = "bearer confirmation failed with recipient mismatch";
 101                             continue;
 102                         }
 103                     }
 104                 }
 105
 106                 if (m_correlation && policy.getCorrelationID() && *(policy.getCorrelationID())) {
 107                     if (!XMLString::equals(policy.getCorrelationID(), data ? data->getInResponseTo() : nullptr)) {
 108                         msg = "bearer confirmation failed with request correlation mismatch";
 109                         continue;
 110                     }
 111                 }
 112
 113                 if (m_validity) {
 114                     if (!data || !data->getNotOnOrAfter()) {
 115                         msg = "bearer SubjectConfirmationData missing NotOnOrAfter attribute";
 116                         continue;
 117                     }
 118                     else if (data->getNotOnOrAfterEpoch() <= policy.getTime() - XMLToolingConfig::getConfig().clock_skew_secs) {
 119                         msg = "bearer confirmation has expired";
 120                         continue;
 121                     }
 122
 123                     if (data && data->getNotBefore() && policy.getTime() + XMLToolingConfig::getConfig().clock_skew_secs < data->getNotBeforeEpoch()) {
 124                         msg = "bearer confirmation not yet valid";
 125                         continue;
 126                     }
 127                 }
 128
 129                 SAML2AssertionPolicy* saml2policy = dynamic_cast<SAML2AssertionPolicy*>(&policy);
 130                 if (saml2policy)
 131                     saml2policy->setSubjectConfirmation(*sc);
 132                 log.debug("assertion satisfied bearer confirmation requirements");
 133                 return true;
 134             }
 135         }
 136     }
 137
 138     log.error(msg ? msg : "no error message");
 139     if (m_fatal)
 140         throw SecurityPolicyException("Unable to locate satisfiable bearer SubjectConfirmation in assertion.");
 141     return false;
 142 }