X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fcpp-opensaml.git;a=blobdiff_plain;f=saml%2Fsaml1%2Fbinding%2Fimpl%2FSAML1POSTDecoder.cpp;h=773a2bcfbe232c0d32c60cb67ac7fed90fd78752;hp=b9651abc7d26731f90da915f4e05f15aaa71d38b;hb=1462057b3b9ae7e165d34d988e30b14c213672ca;hpb=11cd3b15c71ee22f2818d810a17c213123e8c248 diff --git a/saml/saml1/binding/impl/SAML1POSTDecoder.cpp b/saml/saml1/binding/impl/SAML1POSTDecoder.cpp index b9651ab..773a2bc 100644 --- a/saml/saml1/binding/impl/SAML1POSTDecoder.cpp +++ b/saml/saml1/binding/impl/SAML1POSTDecoder.cpp @@ -1,55 +1,64 @@ -/* - * Copyright 2001-2007 Internet2 - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at +/** + * Licensed to the University Corporation for Advanced Internet + * Development, Inc. (UCAID) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for + * additional information regarding copyright ownership. * - * http://www.apache.org/licenses/LICENSE-2.0 + * UCAID licenses this file to you under the Apache License, + * Version 2.0 (the "License"); you may not use this file except + * in compliance with the License. You may obtain a copy of the + * License at * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific + * language governing permissions and limitations under the License. */ /** * SAML1POSTDecoder.cpp * - * SAML 1.x POST binding/profile message decoder + * SAML 1.x POST binding/profile message decoder. */ #include "internal.h" #include "exceptions.h" -#include "binding/MessageDecoder.h" +#include "binding/SecurityPolicy.h" +#include "saml1/binding/SAML1MessageDecoder.h" #include "saml1/core/Assertions.h" #include "saml1/core/Protocols.h" #include "saml2/metadata/Metadata.h" #include "saml2/metadata/MetadataProvider.h" -#include +#include +#include #include +#include +#include #include #include +#include #include using namespace opensaml::saml2md; using namespace opensaml::saml1p; using namespace opensaml::saml1; using namespace opensaml; +using namespace xmltooling::logging; using namespace xmltooling; -using namespace log4cpp; using namespace std; namespace opensaml { namespace saml1p { - class SAML_DLLLOCAL SAML1POSTDecoder : public MessageDecoder + class SAML_DLLLOCAL SAML1POSTDecoder : public SAML1MessageDecoder { public: SAML1POSTDecoder() {} virtual ~SAML1POSTDecoder() {} - + xmltooling::XMLObject* decode( std::string& relayState, const GenericRequest& genericRequest, @@ -73,7 +82,7 @@ XMLObject* SAML1POSTDecoder::decode( #ifdef _DEBUG xmltooling::NDC ndc("decode"); #endif - Category& log = Category::getInstance(SAML_LOGCAT".MessageDecoder.SAML1POST"); + Category& log = Category::getInstance(SAML_LOGCAT ".MessageDecoder.SAML1POST"); log.debug("validating input"); const HTTPRequest* httpRequest=dynamic_cast(&genericRequest); @@ -84,21 +93,21 @@ XMLObject* SAML1POSTDecoder::decode( const char* samlResponse = httpRequest->getParameter("SAMLResponse"); const char* TARGET = httpRequest->getParameter("TARGET"); if (!samlResponse || !TARGET) - throw BindingException("Request missing SAMLResponse or TARGET parameters."); + throw BindingException("Request missing SAMLResponse or TARGET form parameters."); relayState = TARGET; - // Decode the base64 into SAML. - unsigned int x; + // Decode the base64 into XML. + xsecsize_t x; XMLByte* decoded=Base64::decode(reinterpret_cast(samlResponse),&x); if (!decoded) throw BindingException("Unable to decode base64 in POST profile response."); - log.debug("decoded SAML response:\n%s", decoded); - istringstream is(reinterpret_cast(decoded)); - XMLString::release(&decoded); - + log.debugStream() << "decoded SAML response:\n" << decoded << logging::eol; + // Parse and bind the document into an XMLObject. + MemBufInputSource src(decoded, x, "SAMLResponse", true); + Wrapper4InputSource dsrc(&src, false); DOMDocument* doc = (policy.getValidating() ? XMLToolingConfig::getConfig().getValidatingParser() - : XMLToolingConfig::getConfig().getParser()).parse(is); + : XMLToolingConfig::getConfig().getParser()).parse(dsrc); XercesJanitor janitor(doc); auto_ptr xmlObject(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true)); janitor.release(); @@ -107,21 +116,29 @@ XMLObject* SAML1POSTDecoder::decode( if (!response) throw BindingException("Decoded message was not a SAML 1.x Response."); - if (!policy.getValidating()) - SchemaValidators.validate(xmlObject.get()); + SchemaValidators.validate(response); + + pair minor = response->getMinorVersion(); + extractMessageDetails( + *response, + genericRequest, + (minor.first && minor.second==0) ? samlconstants::SAML10_PROTOCOL_ENUM : samlconstants::SAML11_PROTOCOL_ENUM, + policy + ); // Run through the policy. - policy.evaluate(*response, &genericRequest); + policy.evaluate(*response,&genericRequest); // Check recipient URL. auto_ptr_char recipient(response->getRecipient()); const char* recipient2 = httpRequest->getRequestURL(); + const char* delim = strchr(recipient2, '?'); if (!recipient.get() || !*(recipient.get())) { log.error("response missing Recipient attribute"); throw BindingException("SAML response did not contain Recipient attribute identifying intended destination."); } - else if (!recipient2 || !*recipient2 || strcmp(recipient.get(),recipient2)) { - log.error("POST targeted at (%s), but delivered to (%s)", recipient.get(), recipient2 ? recipient2 : "none"); + else if ((delim && strncmp(recipient.get(), recipient2, delim - recipient2)) || (!delim && strcmp(recipient.get(),recipient2))) { + log.error("POST targeted at (%s), but delivered to (%s)", recipient.get(), recipient2); throw BindingException("SAML message delivered with POST to incorrect server URL."); }