#include <saml/binding/GenericRequest.h>
#include <xmltooling/XMLObject.h>
+#include <xmltooling/security/TrustEngine.h>
namespace opensaml {
- class SAML_API TrustEngine;
-
namespace saml2 {
class SAML_API Issuer;
};
* @param metadataProvider locked MetadataProvider instance to authenticate the message
* @param role identifies the role (generally IdP or SP) of the peer who issued the message
* @param trustEngine TrustEngine to authenticate the message
+ * @param extractor MessageExtractor to use in examining message
* @return the identity of the message issuer, in two forms, or NULL
*
* @throws BindingException thrown if the request/message do not meet the requirements of this rule
const xmltooling::XMLObject& message,
const saml2md::MetadataProvider* metadataProvider,
const xmltooling::QName* role,
- const TrustEngine* trustEngine
+ const xmltooling::TrustEngine* trustEngine
) const=0;
};
void SAML_API registerSecurityPolicyRules();
/**
+ * SecurityPolicyRule for TLS client certificate authentication.
+ *
+ * Requires that messages carry information about the issuer, and then
+ * evaluates the claimed certificates against the issuer's metadata.
+ */
+ #define CLIENTCERTAUTH_POLICY_RULE "org.opensaml.binding.ClientCertAuthRule"
+
+ /**
* SecurityPolicyRule for replay detection and freshness checking.
*
* <p>A ReplayCache instance must be available from the runtime, unless