Option for fatal errors when signatures fail.

diff --git a/saml/binding/SimpleSigningRule.h b/saml/binding/SimpleSigningRule.h
index 5ae409a..e7d3abd 100644 (file)
--- a/saml/binding/SimpleSigningRule.h
+++ b/saml/binding/SimpleSigningRule.h
@@ -34,10 +34,14 @@ namespace opensaml {
     class SAML_API SimpleSigningRule : public SecurityPolicyRule
     {
     public:
-        SimpleSigningRule(const DOMElement* e) {}
+        SimpleSigningRule(const DOMElement* e);
         virtual ~SimpleSigningRule() {}
         
         void evaluate(const xmltooling::XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const;
+
+    protected:
+        /** Flag determining whether to raise exceptions if a signature fails to validate. */
+        bool m_errorsFatal;
     };
     
 };

diff --git a/saml/binding/XMLSigningRule.h b/saml/binding/XMLSigningRule.h
index 2aec46a..b6f42c7 100644 (file)
--- a/saml/binding/XMLSigningRule.h
+++ b/saml/binding/XMLSigningRule.h
@@ -33,10 +33,14 @@ namespace opensaml {
     class SAML_API XMLSigningRule : public SecurityPolicyRule
     {
     public:
-        XMLSigningRule(const DOMElement* e) {}
+        XMLSigningRule(const DOMElement* e);
         virtual ~XMLSigningRule() {}
         
         void evaluate(const xmltooling::XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const;
+
+    protected:
+        /** Flag determining whether to raise exceptions if a signature fails to validate. */
+        bool m_errorsFatal;
     };
     
 };

diff --git a/saml/binding/impl/SimpleSigningRule.cpp b/saml/binding/impl/SimpleSigningRule.cpp
index a7a4759..c7fd46a 100644 (file)
--- a/saml/binding/impl/SimpleSigningRule.cpp
+++ b/saml/binding/impl/SimpleSigningRule.cpp
@@ -38,6 +38,7 @@ using namespace log4cpp;
 using namespace std;
 
 using xmlsignature::KeyInfo;
+using xmlsignature::SignatureException;
 
 namespace opensaml {
     SecurityPolicyRule* SAML_DLLLOCAL SimpleSigningRuleFactory(const DOMElement* const & e)
@@ -60,8 +61,17 @@ namespace opensaml {
             s.append(start);
         return true;
     }
+
+    static const XMLCh errorsFatal[] = UNICODE_LITERAL_11(e,r,r,o,r,s,F,a,t,a,l);
 };
 
+SimpleSigningRule::SimpleSigningRule(const DOMElement* e) : m_errorsFatal(false)
+{
+    if (e) {
+        const XMLCh* flag = e->getAttributeNS(NULL, errorsFatal);
+        m_errorsFatal = (flag && (*flag==chLatin_t || *flag==chDigit_1)); 
+    }
+}
 
 void SimpleSigningRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
 {
@@ -174,6 +184,8 @@ void SimpleSigningRule::evaluate(const XMLObject& message, const GenericRequest*
             *(policy.getIssuerMetadata()), policy.getMetadataProvider()->getKeyResolver()
             )) {
         log.error("unable to verify message signature with supplied trust engine");
+        if (m_errorsFatal)
+            throw SignatureException("Message was signed, but signature could not be verified.");
         return;
     }
 

diff --git a/saml/binding/impl/XMLSigningRule.cpp b/saml/binding/impl/XMLSigningRule.cpp
index 697c49a..e437041 100644 (file)
--- a/saml/binding/impl/XMLSigningRule.cpp
+++ b/saml/binding/impl/XMLSigningRule.cpp
@@ -36,13 +36,25 @@ using namespace xmltooling;
 using namespace log4cpp;
 using namespace std;
 
+using xmlsignature::SignatureException;
+
 namespace opensaml {
     SecurityPolicyRule* SAML_DLLLOCAL XMLSigningRuleFactory(const DOMElement* const & e)
     {
         return new XMLSigningRule(e);
     }
+    
+    static const XMLCh errorsFatal[] = UNICODE_LITERAL_11(e,r,r,o,r,s,F,a,t,a,l);
 };
 
+XMLSigningRule::XMLSigningRule(const DOMElement* e) : m_errorsFatal(false)
+{
+    if (e) {
+        const XMLCh* flag = e->getAttributeNS(NULL, errorsFatal);
+        m_errorsFatal = (flag && (*flag==chLatin_t || *flag==chDigit_1)); 
+    }
+}
+
 void XMLSigningRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
 {
     Category& log=Category::getInstance(SAML_LOGCAT".SecurityPolicyRule.XMLSigning");
@@ -70,6 +82,8 @@ void XMLSigningRule::evaluate(const XMLObject& message, const GenericRequest* re
     }
     catch (ValidationException& ve) {
         log.error("signature profile failed to validate: %s", ve.what());
+        if (m_errorsFatal)
+            throw;
         return;
     }
     
@@ -77,6 +91,8 @@ void XMLSigningRule::evaluate(const XMLObject& message, const GenericRequest* re
             *(signable->getSignature()), *(policy.getIssuerMetadata()), policy.getMetadataProvider()->getKeyResolver()
             )) {
         log.error("unable to verify message signature with supplied trust engine");
+        if (m_errorsFatal)
+            throw SignatureException("Message was signed, but signature could not be verified.");
         return;
     }