Change license header, remove stale pkg files.

[shibboleth/cpp-opensaml.git] / saml / binding / SecurityPolicyRule.h

diff --git a/saml/binding/SecurityPolicyRule.h b/saml/binding/SecurityPolicyRule.h
index 003e7ec..644cd45 100644 (file)
--- a/saml/binding/SecurityPolicyRule.h
+++ b/saml/binding/SecurityPolicyRule.h
@@ -1,17 +1,21 @@
-/*
- *  Copyright 2001-2009 Internet2
+/**
+ * Licensed to the University Corporation for Advanced Internet
+ * Development, Inc. (UCAID) under one or more contributor license
+ * agreements. See the NOTICE file distributed with this work for
+ * additional information regarding copyright ownership.
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * UCAID licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the
+ * License at
  *
- *     http://www.apache.org/licenses/LICENSE-2.0
+ * http://www.apache.org/licenses/LICENSE-2.0
  *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
  */
 
 /**
@@ -23,9 +27,15 @@
 #ifndef __saml_secrule_h__
 #define __saml_secrule_h__
 
-#include <saml/binding/SecurityPolicy.h>
+#include <saml/base.h>
+
+namespace xmltooling {
+    class XMLTOOL_API GenericRequest;
+    class XMLTOOL_API XMLObject;
+};
 
 namespace opensaml {
+    class SAML_API SecurityPolicy;
 
     /**
      * A rule that a protocol request and message must meet in order to be valid and secure.
@@ -38,9 +48,9 @@ namespace opensaml {
     {
         MAKE_NONCOPYABLE(SecurityPolicyRule);
     protected:
-        SecurityPolicyRule() {}
+        SecurityPolicyRule();
     public:
-        virtual ~SecurityPolicyRule() {}
+        virtual ~SecurityPolicyRule();
 
         /**
          * Returns the rule's class/type.
@@ -52,12 +62,13 @@ namespace opensaml {
         /**
          * Evaluates the rule against the given request and message.
          *
-         * <p>An exception will be raised if the message is invalid according to
+         * <p>An exception will be raised if the message is fatally invalid according to
          * a policy rule.
          *
          * <p>The return value is used to indicate whether a message was ignored or
          * successfully processed. A false value signals that the rule wasn't successful
-         * but was also not unsuccessful, because the rule was inapplicable to the message.
+         * because the rule was inapplicable to the message, but allows other rules to
+         * return an alternate result.
          *
          * @param message   the incoming message
          * @param request   the protocol request
@@ -82,6 +93,11 @@ namespace opensaml {
     #define AUDIENCE_POLICY_RULE        "Audience"
 
     /**
+     * SecurityPolicyRule for evaluation of SAML DelegationRestriction Conditions.
+     */
+    #define DELEGATION_POLICY_RULE        "Delegation"
+
+    /**
      * SecurityPolicyRule for TLS client certificate authentication.
      *
      * Evaluates client certificates against the issuer's metadata.
@@ -135,6 +151,24 @@ namespace opensaml {
      * over the message. The transport layer is not considered.
      */
     #define XMLSIGNING_POLICY_RULE      "XMLSigning"
+
+    /**
+     * SecurityPolicyRule for SAML 1.x Browser SSO profile validation.
+     *
+     * Enforces presence of time conditions and proper subject confirmation.
+     */
+    #define SAML1BROWSERSSO_POLICY_RULE "SAML1BrowserSSO"
+
+    /**
+     * SecurityPolicyRule for SAML 2.0 bearer SubjectConfirmation.
+     *
+     * <p>Optionally enforces message delivery requirements based on SubjectConfirmationData.
+     *
+     * <p>The XML attributes "checkValidity", "checkRecipient", and "checkCorrelation" can be set
+     * "false" to disable checks of NotBefore/NotOnOrAfter, Recipient, and InResponseTo confirmation
+     * data respectively.
+     */
+    #define BEARER_POLICY_RULE "Bearer"
 };
 
 #endif /* __saml_secrule_h__ */