/*
- * Copyright 2001-2007 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
#include "saml2/metadata/MetadataCredentialCriteria.h"
#include <xercesc/util/XMLUniDefs.hpp>
+#include <xmltooling/logging.h>
+#include <xmltooling/XMLToolingConfig.h>
+#include <xmltooling/security/Credential.h>
#include <xmltooling/security/KeyInfoResolver.h>
+#include <xmltooling/security/SecurityHelper.h>
+#include <xmltooling/util/Threads.h>
#include <xmltooling/util/XMLHelper.h>
using namespace opensaml::saml2md;
+using namespace xmltooling::logging;
using namespace xmltooling;
using namespace std;
using opensaml::SAMLArtifact;
static const XMLCh type[] = UNICODE_LITERAL_4(t,y,p,e);
AbstractMetadataProvider::AbstractMetadataProvider(const DOMElement* e)
- : ObservableMetadataProvider(e), m_resolver(NULL), m_credentialLock(NULL)
+ : ObservableMetadataProvider(e), m_resolver(nullptr), m_credentialLock(nullptr)
{
- e = e ? XMLHelper::getFirstChildElement(e, _KeyInfoResolver) : NULL;
+ e = e ? XMLHelper::getFirstChildElement(e, _KeyInfoResolver) : nullptr;
if (e) {
- auto_ptr_char t(e->getAttributeNS(NULL,type));
+ auto_ptr_char t(e->getAttributeNS(nullptr,type));
if (t.get())
m_resolver = XMLToolingConfig::getConfig().KeyInfoResolverManager.newPlugin(t.get(),e);
else
ObservableMetadataProvider::emitChangeEvent();
}
-void AbstractMetadataProvider::index(EntityDescriptor* site, time_t validUntil)
+void AbstractMetadataProvider::index(EntityDescriptor* site, time_t validUntil, bool replace) const
{
if (validUntil < site->getValidUntilEpoch())
site->setValidUntil(validUntil);
auto_ptr_char id(site->getEntityID());
if (id.get()) {
+ if (replace) {
+ m_sites.erase(id.get());
+ for (sitemap_t::iterator s = m_sources.begin(); s != m_sources.end();) {
+ if (s->second == site) {
+ sitemap_t::iterator temp = s;
+ ++s;
+ m_sources.erase(temp);
+ }
+ else {
+ ++s;
+ }
+ }
+ }
m_sites.insert(sitemap_t::value_type(id.get(),site));
}
}
// Hash the ID.
- m_sources.insert(sitemap_t::value_type(SAMLConfig::getConfig().hashSHA1(id.get(), true),site));
+ m_sources.insert(sitemap_t::value_type(SecurityHelper::doHash("SHA1", id.get(), strlen(id.get())),site));
// Load endpoints for type 0x0002 artifacts.
const vector<ArtifactResolutionService*>& locs=const_cast<const IDPSSODescriptor*>(*i)->getArtifactResolutionServices();
// SAML 2.0?
if ((*i)->hasSupport(samlconstants::SAML20P_NS)) {
// Hash the ID.
- m_sources.insert(sitemap_t::value_type(SAMLConfig::getConfig().hashSHA1(id.get(), true),site));
+ m_sources.insert(sitemap_t::value_type(SecurityHelper::doHash("SHA1", id.get(), strlen(id.get())),site));
}
}
}
-void AbstractMetadataProvider::index(EntitiesDescriptor* group, time_t validUntil)
+void AbstractMetadataProvider::index(EntitiesDescriptor* group, time_t validUntil) const
{
if (validUntil < group->getValidUntilEpoch())
group->setValidUntil(validUntil);
index(*j,group->getValidUntilEpoch());
}
-void AbstractMetadataProvider::clearDescriptorIndex()
+void AbstractMetadataProvider::clearDescriptorIndex(bool freeSites)
{
- m_sources.clear();
+ if (freeSites)
+ for_each(m_sites.begin(), m_sites.end(), cleanup_const_pair<string,EntityDescriptor>());
m_sites.clear();
m_groups.clear();
+ m_sources.clear();
}
const EntitiesDescriptor* AbstractMetadataProvider::getEntitiesDescriptor(const char* name, bool strict) const
{
- pair<groupmap_t::const_iterator,groupmap_t::const_iterator> range=m_groups.equal_range(name);
+ pair<groupmap_t::const_iterator,groupmap_t::const_iterator> range=const_cast<const groupmap_t&>(m_groups).equal_range(name);
- time_t now=time(NULL);
+ time_t now=time(nullptr);
for (groupmap_t::const_iterator i=range.first; i!=range.second; i++)
if (now < i->second->getValidUntilEpoch())
return i->second;
- if (!strict && range.first!=range.second)
- return range.first->second;
-
- return NULL;
-}
-
-const EntityDescriptor* AbstractMetadataProvider::getEntityDescriptor(const char* name, bool strict) const
-{
- pair<sitemap_t::const_iterator,sitemap_t::const_iterator> range=m_sites.equal_range(name);
+ if (range.first != range.second) {
+ Category& log = Category::getInstance(SAML_LOGCAT".MetadataProvider");
+ if (strict) {
+ log.warn("ignored expired metadata group (%s)", range.first->first.c_str());
+ }
+ else {
+ log.info("no valid metadata found, returning expired metadata group (%s)", range.first->first.c_str());
+ return range.first->second;
+ }
+ }
- time_t now=time(NULL);
- for (sitemap_t::const_iterator i=range.first; i!=range.second; i++)
- if (now < i->second->getValidUntilEpoch())
- return i->second;
-
- if (!strict && range.first!=range.second)
- return range.first->second;
-
- return NULL;
+ return nullptr;
}
-const EntityDescriptor* AbstractMetadataProvider::getEntityDescriptor(const SAMLArtifact* artifact) const
+pair<const EntityDescriptor*,const RoleDescriptor*> AbstractMetadataProvider::getEntityDescriptor(const Criteria& criteria) const
{
- pair<sitemap_t::const_iterator,sitemap_t::const_iterator> range=m_sources.equal_range(artifact->getSource());
-
- time_t now=time(NULL);
- for (sitemap_t::const_iterator i=range.first; i!=range.second; i++)
- if (now < i->second->getValidUntilEpoch())
- return i->second;
+ pair<sitemap_t::const_iterator,sitemap_t::const_iterator> range;
+ if (criteria.entityID_ascii)
+ range = const_cast<const sitemap_t&>(m_sites).equal_range(criteria.entityID_ascii);
+ else if (criteria.entityID_unicode) {
+ auto_ptr_char id(criteria.entityID_unicode);
+ range = const_cast<const sitemap_t&>(m_sites).equal_range(id.get());
+ }
+ else if (criteria.artifact)
+ range = const_cast<const sitemap_t&>(m_sources).equal_range(criteria.artifact->getSource());
+ else
+ return pair<const EntityDescriptor*,const RoleDescriptor*>(nullptr,nullptr);
+
+ pair<const EntityDescriptor*,const RoleDescriptor*> result;
+ result.first = nullptr;
+ result.second = nullptr;
+
+ time_t now=time(nullptr);
+ for (sitemap_t::const_iterator i=range.first; i!=range.second; i++) {
+ if (now < i->second->getValidUntilEpoch()) {
+ result.first = i->second;
+ break;
+ }
+ }
+
+ if (!result.first && range.first!=range.second) {
+ Category& log = Category::getInstance(SAML_LOGCAT".MetadataProvider");
+ if (criteria.validOnly) {
+ log.warn("ignored expired metadata instance for (%s)", range.first->first.c_str());
+ }
+ else {
+ log.info("no valid metadata found, returning expired instance for (%s)", range.first->first.c_str());
+ result.first = range.first->second;
+ }
+ }
- return NULL;
+ if (result.first && criteria.role) {
+ result.second = result.first->getRoleDescriptor(*criteria.role, criteria.protocol);
+ if (!result.second && criteria.protocol2)
+ result.second = result.first->getRoleDescriptor(*criteria.role, criteria.protocol2);
+ }
+
+ return result;
}
const Credential* AbstractMetadataProvider::resolve(const CredentialCriteria* criteria) const
for (credmap_t::mapped_type::const_iterator c = creds.begin(); c!=creds.end(); ++c)
if (metacrit->matches(*(*c)))
return *c;
- return NULL;
+ return nullptr;
}
vector<const Credential*>::size_type AbstractMetadataProvider::resolve(