samltest/security/AbstractPKIXTrustEngineTest.h

   1 /*
   2  *  Copyright 2001-2007 Internet2
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 #include "internal.h"
  18 #include <saml/SAMLConfig.h>
  19 #include <saml/saml2/metadata/Metadata.h>
  20 #include <saml/saml2/metadata/MetadataProvider.h>
  21 #include <xmltooling/security/AbstractPKIXTrustEngine.h>
  22
  23 using namespace opensaml::saml2;
  24 using namespace opensaml::saml2md;
  25 using namespace xmlsignature;
  26
  27 namespace {
  28     class SampleTrustEngine : public AbstractPKIXTrustEngine {
  29     public:
  30         SampleTrustEngine() {}
  31         ~SampleTrustEngine() {}
  32
  33         class SampleIterator : public PKIXValidationInfoIterator {
  34             vector<XSECCryptoX509CRL*> m_crls;
  35             KeyResolver::ResolvedCertificates m_certs;
  36             KeyResolver* m_resolver;
  37             bool m_done;
  38         public:
  39             SampleIterator(const KeyResolver& keyResolver)
  40                     : PKIXValidationInfoIterator(keyResolver), m_resolver(NULL), m_done(false) {
  41                 string config = data_path + "security/FilesystemKeyResolver.xml";
  42                 ifstream in(config.c_str());
  43                 DOMDocument* doc=XMLToolingConfig::getConfig().getParser().parse(in);
  44                 XercesJanitor<DOMDocument> janitor(doc);
  45                 m_resolver = XMLToolingConfig::getConfig().KeyResolverManager.newPlugin(
  46                     FILESYSTEM_KEY_RESOLVER,doc->getDocumentElement()
  47                     );
  48                 m_resolver->resolveCertificates((KeyInfo*)NULL,m_certs);
  49             }
  50
  51             ~SampleIterator() {
  52                 delete m_resolver;
  53             }
  54
  55             bool next() {
  56                 if (m_done)
  57                     return false;
  58                 m_done = true;
  59                 return true;
  60             }
  61
  62             int getVerificationDepth() const {
  63                 return 0;
  64             }
  65
  66             const vector<XSECCryptoX509*>& getTrustAnchors() const {
  67                 return m_certs.v();
  68             }
  69
  70             const vector<XSECCryptoX509CRL*>& getCRLs() const {
  71                 return m_crls;
  72             }
  73         };
  74
  75         PKIXValidationInfoIterator* getPKIXValidationInfoIterator(
  76             const KeyInfoSource& keyInfoSource,
  77             const KeyResolver& keyResolver
  78             ) const {
  79             dynamic_cast<const RoleDescriptor&>(keyInfoSource);
  80             return new SampleIterator(keyResolver);
  81         }
  82     };
  83 };
  84
  85 class AbstractPKIXTrustEngineTest : public CxxTest::TestSuite, public SAMLObjectBaseTestCase {
  86 public:
  87     void setUp() {
  88         SAMLObjectBaseTestCase::setUp();
  89     }
  90
  91     void tearDown() {
  92         SAMLObjectBaseTestCase::tearDown();
  93     }
  94
  95     void testExplicitKeyTrustEngine() {
  96         string config = data_path + "security/XMLMetadataProvider.xml";
  97         ifstream in(config.c_str());
  98         DOMDocument* doc=XMLToolingConfig::getConfig().getParser().parse(in);
  99         XercesJanitor<DOMDocument> janitor(doc);
 100
 101         auto_ptr_XMLCh path("path");
 102         string s = data_path + "security/example-metadata.xml";
 103         auto_ptr_XMLCh file(s.c_str());
 104         doc->getDocumentElement()->setAttributeNS(NULL,path.get(),file.get());
 105
 106         // Build metadata provider.
 107         auto_ptr<MetadataProvider> metadataProvider(
 108             opensaml::SAMLConfig::getConfig().MetadataProviderManager.newPlugin(XML_METADATA_PROVIDER,doc->getDocumentElement())
 109             );
 110         try {
 111             metadataProvider->init();
 112         }
 113         catch (XMLToolingException& ex) {
 114             TS_TRACE(ex.what());
 115             throw;
 116         }
 117
 118         // Build trust engine.
 119         auto_ptr<TrustEngine> trustEngine(new SampleTrustEngine());
 120
 121         // Get signed assertion.
 122         config = data_path + "signature/SAML2Assertion.xml";
 123         ifstream in2(config.c_str());
 124         DOMDocument* doc2=XMLToolingConfig::getConfig().getParser().parse(in2);
 125         XercesJanitor<DOMDocument> janitor2(doc2);
 126         auto_ptr<Assertion> assertion(dynamic_cast<Assertion*>(XMLObjectBuilder::getBuilder(doc2->getDocumentElement())->buildFromDocument(doc2)));
 127         janitor2.release();
 128
 129         Locker locker(metadataProvider.get());
 130         const EntityDescriptor* descriptor = metadataProvider->getEntityDescriptor("https://idp.example.org");
 131         TSM_ASSERT("Retrieved entity descriptor was null", descriptor!=NULL);
 132
 133         RoleDescriptor* role=descriptor->getIDPSSODescriptors().front();
 134         TSM_ASSERT("Role not present", role!=NULL);
 135
 136         Signature* sig=assertion->getSignature();
 137         TSM_ASSERT("Signature not present", sig!=NULL);
 138         TSM_ASSERT("Signature failed to validate.", trustEngine->validate(*sig, *role, metadataProvider->getKeyResolver()));
 139
 140         descriptor = metadataProvider->getEntityDescriptor("https://idp2.example.org");
 141         TSM_ASSERT("Retrieved entity descriptor was null", descriptor!=NULL);
 142
 143         role=descriptor->getIDPSSODescriptors().front();
 144         TSM_ASSERT("Role not present", role!=NULL);
 145
 146         TSM_ASSERT("Signature validated.", !trustEngine->validate(*sig, *role, metadataProvider->getKeyResolver()));
 147     }
 148 };