X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fcpp-opensaml.git;a=blobdiff_plain;f=saml%2Fsaml2%2Fcore%2Fimpl%2FAssertions20SchemaValidators.cpp;h=9048bfb1a14b33d5e7ca9f6a89adf5efc13fba04;hp=d9793964c6f19ad117f5fafee3635ad64827ddab;hb=367dff3d45fd14df5fc72cc93079c1270da55324;hpb=66136f386ddbdd855e1a078e13e19ddbf64a01e2

diff --git a/saml/saml2/core/impl/Assertions20SchemaValidators.cpp b/saml/saml2/core/impl/Assertions20SchemaValidators.cpp
index d979396..9048bfb 100644
--- a/saml/saml2/core/impl/Assertions20SchemaValidators.cpp
+++ b/saml/saml2/core/impl/Assertions20SchemaValidators.cpp
@@ -1,22 +1,26 @@
-/*
-*  Copyright 2001-2006 Internet2
- * 
-* Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+/**
+ * Licensed to the University Corporation for Advanced Internet
+ * Development, Inc. (UCAID) under one or more contributor license
+ * agreements. See the NOTICE file distributed with this work for
+ * additional information regarding copyright ownership.
+ *
+ * UCAID licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the
+ * License at
  *
- *     http://www.apache.org/licenses/LICENSE-2.0
+ * http://www.apache.org/licenses/LICENSE-2.0
  *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
  */
 
 /**
  * Assertions20SchemaValidators.cpp
- * 
+ *
  * Schema-based validators for SAML 2.0 Assertions classes
  */
 
@@ -24,6 +28,7 @@
 #include "exceptions.h"
 #include "saml2/core/Assertions.h"
 
+#include <xmltooling/validation/Validator.h>
 #include <xmltooling/validation/ValidatorSuite.h>
 
 using namespace opensaml::saml2;
@@ -34,7 +39,7 @@ using samlconstants::SAML20_NS;
 
 namespace opensaml {
     namespace saml2 {
-        
+
         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,Action);
         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,AssertionIDRef);
         XMLOBJECTVALIDATOR_SIMPLE(SAML_DLLLOCAL,AssertionURIRef);
@@ -49,7 +54,7 @@ namespace opensaml {
         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,EncryptedElementType);
             XMLOBJECTVALIDATOR_REQUIRE(EncryptedElementType,EncryptedData);
         END_XMLOBJECTVALIDATOR;
-        
+
         BEGIN_XMLOBJECTVALIDATOR_SUB(SAML_DLLLOCAL,EncryptedID,EncryptedElementType);
             EncryptedElementTypeSchemaValidator::validate(xmlObject);
         END_XMLOBJECTVALIDATOR;
@@ -72,9 +77,28 @@ namespace opensaml {
             }
         END_XMLOBJECTVALIDATOR;
 
+        BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,Delegate);
+            int count=0;
+            if (ptr->getBaseID())
+                count++;
+            if (ptr->getNameID())
+                count++;
+            if (ptr->getEncryptedID())
+                count++;
+            if (count != 1)
+                throw ValidationException("Delegate must contain exactly one identifier element.");
+        END_XMLOBJECTVALIDATOR;
+
+        BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,DelegationRestrictionType);
+            XMLOBJECTVALIDATOR_NONEMPTY(DelegationRestrictionType,Delegate);
+        END_XMLOBJECTVALIDATOR;
+
         BEGIN_XMLOBJECTVALIDATOR(SAML_DLLLOCAL,Conditions);
-            if (!ptr->hasChildren()) {
-                XMLOBJECTVALIDATOR_ONEOF(Conditions,NotBefore,NotOnOrAfter);
+            if (ptr->getOneTimeUses().size() > 1) {
+                throw ValidationException("Multiple OneTimeUse condition elements are not permitted.");
+            }
+            else if (ptr->getProxyRestrictions().size() > 1) {
+                throw ValidationException("Multiple ProxyRestriction condition elements are not permitted.");
             }
         END_XMLOBJECTVALIDATOR;
 
@@ -180,25 +204,25 @@ namespace opensaml {
 };
 
 #define REGISTER_ELEMENT(cname) \
-    q=QName(SAML20_NS,cname::LOCAL_NAME); \
+    q=xmltooling::QName(SAML20_NS,cname::LOCAL_NAME); \
     XMLObjectBuilder::registerBuilder(q,new cname##Builder()); \
     SchemaValidators.registerValidator(q,new cname##SchemaValidator())
-    
+
 #define REGISTER_TYPE(cname) \
-    q=QName(SAML20_NS,cname::TYPE_NAME); \
+    q=xmltooling::QName(SAML20_NS,cname::TYPE_NAME); \
     XMLObjectBuilder::registerBuilder(q,new cname##Builder()); \
     SchemaValidators.registerValidator(q,new cname##SchemaValidator())
 
 #define REGISTER_ELEMENT_NOVAL(cname) \
-    q=QName(SAML20_NS,cname::LOCAL_NAME); \
+    q=xmltooling::QName(SAML20_NS,cname::LOCAL_NAME); \
     XMLObjectBuilder::registerBuilder(q,new cname##Builder());
-    
+
 #define REGISTER_TYPE_NOVAL(cname) \
-    q=QName(SAML20_NS,cname::TYPE_NAME); \
+    q=xmltooling::QName(SAML20_NS,cname::TYPE_NAME); \
     XMLObjectBuilder::registerBuilder(q,new cname##Builder());
 
 void opensaml::saml2::registerAssertionClasses() {
-    QName q;
+    xmltooling::QName q;
     REGISTER_ELEMENT(Action);
     REGISTER_ELEMENT(Advice);
     REGISTER_ELEMENT(Assertion);
@@ -216,6 +240,7 @@ void opensaml::saml2::registerAssertionClasses() {
     REGISTER_ELEMENT(AuthnContextDeclRef);
     REGISTER_ELEMENT(AuthnStatement);
     REGISTER_ELEMENT(AuthzDecisionStatement);
+    REGISTER_ELEMENT_NOVAL(Condition);
     REGISTER_ELEMENT(Conditions);
     REGISTER_ELEMENT(EncryptedAssertion);
     REGISTER_ELEMENT(EncryptedAttribute);
@@ -225,6 +250,7 @@ void opensaml::saml2::registerAssertionClasses() {
     REGISTER_ELEMENT(NameID);
     REGISTER_ELEMENT_NOVAL(OneTimeUse);
     REGISTER_ELEMENT(ProxyRestriction);
+    REGISTER_ELEMENT_NOVAL(Statement);
     REGISTER_ELEMENT(Subject);
     REGISTER_ELEMENT(SubjectConfirmation);
     REGISTER_ELEMENT_NOVAL(SubjectConfirmationData);
@@ -247,4 +273,15 @@ void opensaml::saml2::registerAssertionClasses() {
     REGISTER_TYPE(Subject);
     REGISTER_TYPE(SubjectConfirmation);
     REGISTER_TYPE(SubjectLocality);
+
+    q=xmltooling::QName(samlconstants::SAML20_DELEGATION_CONDITION_NS,Delegate::LOCAL_NAME);
+    XMLObjectBuilder::registerBuilder(q,new DelegateBuilder());
+    SchemaValidators.registerValidator(q,new DelegateSchemaValidator());
+    q=xmltooling::QName(samlconstants::SAML20_DELEGATION_CONDITION_NS,Delegate::TYPE_NAME);
+    XMLObjectBuilder::registerBuilder(q,new DelegateBuilder());
+    SchemaValidators.registerValidator(q,new DelegateSchemaValidator());
+
+    q=xmltooling::QName(samlconstants::SAML20_DELEGATION_CONDITION_NS,DelegationRestrictionType::TYPE_NAME);
+    XMLObjectBuilder::registerBuilder(q,new DelegationRestrictionTypeBuilder());
+    SchemaValidators.registerValidator(q,new DelegationRestrictionTypeSchemaValidator());
 }