X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fcpp-opensaml.git;a=blobdiff_plain;f=saml%2Fbinding%2FSecurityPolicyRule.h;h=f4b746dce4b1d4a1f26b1b5ae3c4c004f4bf18b5;hp=f5472511162682a91a7193ab19c73fa5a8ac559b;hb=69a716dedfd9e239bcc9206a7b8dc137b43f5f89;hpb=1bc8e721db3a50294df852662e1eddcdbdae8f9f diff --git a/saml/binding/SecurityPolicyRule.h b/saml/binding/SecurityPolicyRule.h index f547251..f4b746d 100644 --- a/saml/binding/SecurityPolicyRule.h +++ b/saml/binding/SecurityPolicyRule.h @@ -1,6 +1,6 @@ /* - * Copyright 2001-2006 Internet2 - * + * Copyright 2001-2009 Internet2 + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -16,32 +16,23 @@ /** * @file saml/binding/SecurityPolicyRule.h - * + * * Policy rules that secure and authenticate bindings. */ #ifndef __saml_secrule_h__ #define __saml_secrule_h__ -#include -#include +#include namespace opensaml { - class SAML_API TrustEngine; - - namespace saml2 { - class SAML_API Issuer; - }; - namespace saml2md { - class SAML_API RoleDescriptor; - }; - + /** * A rule that a protocol request and message must meet in order to be valid and secure. - * + * *

Rules must be stateless and thread-safe across evaluations. Evaluation should not * result in an exception if the request/message properties do not apply to the rule - * (e.g. particular security mechanisms that are not present). + * (e.g. particular security mechanisms that are not present). */ class SAML_API SecurityPolicyRule { @@ -52,24 +43,31 @@ namespace opensaml { virtual ~SecurityPolicyRule() {} /** - * Evaluates the rule against the given request and message. If an Issuer is - * returned, the caller is responsible for freeing the Issuer object. - * - * @param request the protocol request - * @param message the incoming message - * @param metadataProvider locked MetadataProvider instance to authenticate the message - * @param role identifies the role (generally IdP or SP) of the peer who issued the message - * @param trustEngine TrustEngine to authenticate the message - * @return the identity of the message issuer, in two forms, or NULL - * - * @throws BindingException thrown if the request/message do not meet the requirements of this rule + * Returns the rule's class/type. + * + * @return the class/type of the object + */ + virtual const char* getType() const=0; + + /** + * Evaluates the rule against the given request and message. + * + *

An exception will be raised if the message is invalid according to + * a policy rule. + * + *

The return value is used to indicate whether a message was ignored or + * successfully processed. A false value signals that the rule wasn't successful + * but was also not unsuccessful, because the rule was inapplicable to the message. + * + * @param message the incoming message + * @param request the protocol request + * @param policy SecurityPolicy to provide various components and track message data + * @return indicator as to whether a message was understood and processed */ - virtual std::pair evaluate( - const GenericRequest& request, + virtual bool evaluate( const xmltooling::XMLObject& message, - const saml2md::MetadataProvider* metadataProvider, - const xmltooling::QName* role, - const TrustEngine* trustEngine + const xmltooling::GenericRequest* request, + SecurityPolicy& policy ) const=0; }; @@ -79,25 +77,82 @@ namespace opensaml { void SAML_API registerSecurityPolicyRules(); /** + * SecurityPolicyRule for evaluation of SAML AudienceRestriction Conditions. + */ + #define AUDIENCE_POLICY_RULE "Audience" + + /** + * SecurityPolicyRule for TLS client certificate authentication. + * + * Evaluates client certificates against the issuer's metadata. + */ + #define CLIENTCERTAUTH_POLICY_RULE "ClientCertAuth" + + /** + * SecurityPolicyRule for evaluation of SAML Conditions. + */ + #define CONDITIONS_POLICY_RULE "Conditions" + + /** + * SecurityPolicyRule for ignoring a SAML Condition. + */ + #define IGNORE_POLICY_RULE "Ignore" + + /** * SecurityPolicyRule for replay detection and freshness checking. - * + * *

A ReplayCache instance must be available from the runtime, unless * a "checkReplay" XML attribute is set to "0" or "false" when instantiating - * the policy. - * + * the policy rule. + * *

Messages must have been issued in the past, but no more than 60 seconds ago, * or up to a number of seconds set by an "expires" XML attribute when - * instantiating the policy. + * instantiating the policy rule. + */ + #define MESSAGEFLOW_POLICY_RULE "MessageFlow" + + /** + * SecurityPolicyRule for disabling security. + * + * Allows the message issuer to be authenticated regardless of the message or + * transport. Used mainly for debugging or in situations that I wouldn't care to + * comment on. + */ + #define NULLSECURITY_POLICY_RULE "NullSecurity" + + /** + * SecurityPolicyRule for protocol message "blob" signing. + * + * Allows the message issuer to be authenticated using a non-XML digital signature + * over the message body. The transport layer is not considered. + */ + #define SIMPLESIGNING_POLICY_RULE "SimpleSigning" + + /** + * SecurityPolicyRule for protocol message XML signing. + * + * Allows the message issuer to be authenticated using an XML digital signature + * over the message. The transport layer is not considered. + */ + #define XMLSIGNING_POLICY_RULE "XMLSigning" + + /** + * SecurityPolicyRule for SAML 1.x Browser SSO profile validation. + * + * Enforces presence of time conditions and proper subject confirmation. */ - #define MESSAGEFLOW_POLICY_RULE "org.opensaml.binding.MessageFlowRule" + #define SAML1BROWSERSSO_POLICY_RULE "SAML1BrowserSSO" /** - * SecurityPolicyRule for protocol message signing. - * - * Allows the message issuer to be authenticated using an XML or binding-specific - * digital signature over the message. The transport layer is not considered. + * SecurityPolicyRule for SAML 2.0 bearer SubjectConfirmation. + * + *

Optionally enforces message delivery requirements based on SubjectConfirmationData. + * + *

The XML attributes "checkValidity", "checkRecipient", and "checkCorrelation" can be set + * "false" to disable checks of NotBefore/NotOnOrAfter, Recipient, and InResponseTo confirmation + * data respectively. */ - #define MESSAGESIGNING_POLICY_RULE "org.opensaml.binding.MessageSigningRule" + #define BEARER_POLICY_RULE "Bearer" }; #endif /* __saml_secrule_h__ */