X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fcpp-opensaml.git;a=blobdiff_plain;f=saml%2Fsaml1%2Fbinding%2Fimpl%2FSAML1ArtifactDecoder.cpp;h=4c56f2e68ab7e62da595431185c04158370ccb5b;hp=24b84237a845f1c1c3a42584bcea529b96f1b59e;hb=003e73203da5cdf8c3d001a75a56b9e45ef6465b;hpb=90ade2861c4d44e13d4d0013034fbd66cd294069 diff --git a/saml/saml1/binding/impl/SAML1ArtifactDecoder.cpp b/saml/saml1/binding/impl/SAML1ArtifactDecoder.cpp index 24b8423..4c56f2e 100644 --- a/saml/saml1/binding/impl/SAML1ArtifactDecoder.cpp +++ b/saml/saml1/binding/impl/SAML1ArtifactDecoder.cpp @@ -1,6 +1,6 @@ /* - * Copyright 2001-2006 Internet2 - * + * Copyright 2001-2007 Internet2 + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -16,52 +16,56 @@ /** * SAML1ArtifactDecoder.cpp - * + * * SAML 1.x Artifact binding/profile message decoder */ #include "internal.h" #include "exceptions.h" -#include "saml/binding/SAMLArtifact.h" -#include "saml1/binding/SAML1ArtifactDecoder.h" +#include "binding/SAMLArtifact.h" +#include "saml1/binding/SAML1MessageDecoder.h" +#include "saml1/core/Protocols.h" #include "saml2/metadata/Metadata.h" #include "saml2/metadata/MetadataProvider.h" -#include "security/X509TrustEngine.h" -#include +#include +#include #include #include using namespace opensaml::saml2md; using namespace opensaml::saml1p; -using namespace opensaml::saml1; using namespace opensaml; -using namespace xmlsignature; +using namespace xmltooling::logging; using namespace xmltooling; -using namespace log4cpp; using namespace std; namespace opensaml { - namespace saml1p { - MessageDecoder* SAML_DLLLOCAL SAML1ArtifactDecoderFactory(const DOMElement* const & e) + namespace saml1p { + class SAML_DLLLOCAL SAML1ArtifactDecoder : public SAML1MessageDecoder + { + public: + SAML1ArtifactDecoder() {} + virtual ~SAML1ArtifactDecoder() {} + + xmltooling::XMLObject* decode( + std::string& relayState, + const GenericRequest& genericRequest, + SecurityPolicy& policy + ) const; + }; + + MessageDecoder* SAML_DLLLOCAL SAML1ArtifactDecoderFactory(const pair& p) { - return new SAML1ArtifactDecoder(e); + return new SAML1ArtifactDecoder(); } }; }; -SAML1ArtifactDecoder::SAML1ArtifactDecoder(const DOMElement* e) {} - -SAML1ArtifactDecoder::~SAML1ArtifactDecoder() {} - -Response* SAML1ArtifactDecoder::decode( +XMLObject* SAML1ArtifactDecoder::decode( string& relayState, - const RoleDescriptor*& issuer, - bool& issuerTrusted, - const HTTPRequest& httpRequest, - const MetadataProvider* metadataProvider, - const QName* role, - const opensaml::TrustEngine* trustEngine + const GenericRequest& genericRequest, + SecurityPolicy& policy ) const { #ifdef _DEBUG @@ -70,23 +74,26 @@ Response* SAML1ArtifactDecoder::decode( Category& log = Category::getInstance(SAML_LOGCAT".MessageDecoder.SAML1Artifact"); log.debug("validating input"); - if (strcmp(httpRequest.getMethod(),"GET")) - return NULL; + const HTTPRequest* httpRequest=dynamic_cast(&genericRequest); + if (!httpRequest) + throw BindingException("Unable to cast request object to HTTPRequest type."); + if (strcmp(httpRequest->getMethod(),"GET")) + throw BindingException("Invalid HTTP method ($1).", params(1, httpRequest->getMethod())); vector SAMLart; - const char* TARGET = httpRequest.getParameter("TARGET"); - if (httpRequest.getParameters("SAMLart", SAMLart)==0 || !TARGET) - return NULL; + const char* TARGET = httpRequest->getParameter("TARGET"); + if (httpRequest->getParameters("SAMLart", SAMLart)==0 || !TARGET) + throw BindingException("Request missing SAMLart or TARGET query string parameters."); relayState = TARGET; - if (!m_artifactResolver || !metadataProvider) - throw BindingException("Artifact binding requires ArtifactResolver and MetadataProvider implementations be supplied."); + if (!m_artifactResolver || !policy.getMetadataProvider() || !policy.getRole()) + throw BindingException("Artifact profile requires ArtifactResolver and MetadataProvider implementations be supplied."); // Import the artifacts. vector artifacts; for (vector::const_iterator raw=SAMLart.begin(); raw!=SAMLart.end(); ++raw) { try { log.debug("processing encoded artifact (%s)", *raw); - + // Check replay. ReplayCache* replayCache = XMLToolingConfig::getConfig().getReplayCache(); if (replayCache) { @@ -110,12 +117,15 @@ Response* SAML1ArtifactDecoder::decode( throw; } } - - issuer = NULL; - issuerTrusted = false; + log.debug("attempting to determine source of artifact(s)..."); - const EntityDescriptor* provider=metadataProvider->getEntityDescriptor(artifacts.front()); - if (!provider) { + MetadataProvider::Criteria& mc = policy.getMetadataProviderCriteria(); + mc.artifact = artifacts.front(); + mc.role = policy.getRole(); + mc.protocol = samlconstants::SAML11_PROTOCOL_ENUM; + mc.protocol2 = samlconstants::SAML10_PROTOCOL_ENUM; + pair provider=policy.getMetadataProvider()->getEntityDescriptor(mc); + if (!provider.first) { log.error( "metadata lookup failed, unable to determine issuer of artifact (0x%s)", SAMLArtifact::toHex(artifacts.front()->getBytes()).c_str() @@ -123,50 +133,34 @@ Response* SAML1ArtifactDecoder::decode( for_each(artifacts.begin(), artifacts.end(), xmltooling::cleanup()); throw BindingException("Metadata lookup failed, unable to determine artifact issuer"); } - + if (log.isDebugEnabled()) { - auto_ptr_char issuer(provider->getEntityID()); - log.debug("lookup succeeded, artifact issued by (%s)", issuer.get()); + auto_ptr_char issuer(provider.first->getEntityID()); + log.debug("artifact issued by (%s)", issuer.get()); } - - log.debug("attempting to find artifact issuing role..."); - issuer=provider->getRoleDescriptor(*role, SAMLConstants::SAML11_PROTOCOL_ENUM); - if (!issuer) - issuer=provider->getRoleDescriptor(*role, SAMLConstants::SAML10_PROTOCOL_ENUM); - if (!issuer || !dynamic_cast(issuer)) { - log.error("unable to find compatible SAML role (%s) in metadata", role->toString().c_str()); + + if (!provider.second || !dynamic_cast(provider.second)) { + log.error("unable to find compatible SAML 1.x role (%s) in metadata", policy.getRole()->toString().c_str()); for_each(artifacts.begin(), artifacts.end(), xmltooling::cleanup()); - BindingException ex("Unable to find compatible metadata role for artifact issuer."); - annotateException(&ex,provider); // throws it + throw BindingException("Unable to find compatible metadata role for artifact issuer."); } - + // Set Issuer for the policy. + policy.setIssuer(provider.first->getEntityID()); + policy.setIssuerMetadata(provider.second); + try { + log.debug("calling ArtifactResolver..."); auto_ptr response( - m_artifactResolver->resolve( - issuerTrusted, - artifacts, - dynamic_cast(*issuer), - dynamic_cast(trustEngine) - ) + m_artifactResolver->resolve(artifacts, dynamic_cast(*provider.second), policy) ); - - if (trustEngine && response->getSignature()) { - issuerTrusted = trustEngine->validate(*(response->getSignature()), *issuer, metadataProvider->getKeyResolver()); - if (!issuerTrusted) { - log.error("unable to verify signature on message with supplied trust engine"); - throw BindingException("Message signature failed verification."); - } - } - else if (!issuerTrusted) { - log.warn("unable to verify integrity of the message, leaving untrusted"); - } - + + // The policy should be enforced against the Response by the resolve step. + for_each(artifacts.begin(), artifacts.end(), xmltooling::cleanup()); return response.release(); } - catch (XMLToolingException& ex) { + catch (XMLToolingException&) { for_each(artifacts.begin(), artifacts.end(), xmltooling::cleanup()); - annotateException(&ex,issuer,false); throw; } }