SAML 2 Artifact decoder/test, with some API adjustments.
authorScott Cantor <cantor.2@osu.edu>
Wed, 11 Oct 2006 15:52:58 +0000 (15:52 +0000)
committerScott Cantor <cantor.2@osu.edu>
Wed, 11 Oct 2006 15:52:58 +0000 (15:52 +0000)
saml/Makefile.am
saml/binding/MessageDecoder.h
saml/binding/impl/MessageDecoder.cpp
saml/saml.vcproj
saml/saml2/binding/SAML2ArtifactDecoder.h [new file with mode: 0644]
saml/saml2/binding/impl/SAML2ArtifactDecoder.cpp [new file with mode: 0644]
samltest/Makefile.am
samltest/data/saml2/binding/SAML2Response.xml
samltest/saml1/binding/SAML1ArtifactTest.h
samltest/saml2/binding/SAML2ArtifactTest.h [new file with mode: 0644]
samltest/samltest.vcproj

index c8e1d03..636ffac 100644 (file)
@@ -74,6 +74,7 @@ saml2coreinclude_HEADERS = \
 saml2bindinclude_HEADERS = \
        saml2/binding/SAML2Artifact.h \
        saml2/binding/SAML2ArtifactType0004.h \
+       saml2/binding/SAML2ArtifactDecoder.h \
        saml2/binding/SAML2ArtifactEncoder.h \
        saml2/binding/SAML2POSTDecoder.h \
        saml2/binding/SAML2POSTEncoder.h
@@ -122,6 +123,7 @@ libsaml_la_SOURCES = \
        saml2/metadata/impl/WhitelistMetadataFilter.cpp \
        saml2/binding/impl/SAML2Artifact.cpp \
        saml2/binding/impl/SAML2ArtifactType0004.cpp \
+       saml2/binding/impl/SAML2ArtifactDecoder.cpp \
        saml2/binding/impl/SAML2ArtifactEncoder.cpp \
        saml2/binding/impl/SAML2POSTDecoder.cpp \
        saml2/binding/impl/SAML2POSTEncoder.cpp \
index 0cfdbba..d0a29a0 100644 (file)
@@ -36,6 +36,7 @@ namespace opensaml {
     };\r
     namespace saml2p {\r
         class SAML_API SAML2Artifact;\r
+        class SAML_API ArtifactResponse;\r
     };\r
     namespace saml2md {\r
         class SAML_API MetadataProvider;\r
@@ -164,7 +165,7 @@ namespace opensaml {
 \r
             /**\r
              * Resolves a SAML 2.0 artifact into the corresponding SAML protocol message.\r
-             * The caller is responsible for the resulting XMLObject.\r
+             * The caller is responsible for the resulting ArtifactResponse message.\r
              * \r
              * @param authenticated     output flag set to true iff the resolution channel was authenticated\r
              * @param artifact          reference to a SAML 2.0 artifact\r
@@ -172,7 +173,7 @@ namespace opensaml {
              * @param trustEngine       optional pointer to X509TrustEngine supplied to MessageDecoder\r
              * @return the corresponding SAML protocol message or NULL\r
              */\r
-            virtual xmltooling::XMLObject* resolve(\r
+            virtual saml2p::ArtifactResponse* resolve(\r
                 bool& authenticated,\r
                 const saml2p::SAML2Artifact& artifact,\r
                 const saml2md::SSODescriptorType& ssoDescriptor,\r
index 14a7d19..dbaff1a 100644 (file)
@@ -43,6 +43,6 @@ void SAML_API opensaml::registerMessageDecoders()
     SAMLConfig& conf=SAMLConfig::getConfig();
     conf.MessageDecoderManager.registerFactory(SAML1_ARTIFACT_DECODER, saml1p::SAML1ArtifactDecoderFactory);
     conf.MessageDecoderManager.registerFactory(SAML1_POST_DECODER, saml1p::SAML1POSTDecoderFactory);
-    //conf.MessageDecoderManager.registerFactory(SAML2_ARTIFACT_DECODER, saml2p::SAML2ArtifactDecoderFactory);
+    conf.MessageDecoderManager.registerFactory(SAML2_ARTIFACT_DECODER, saml2p::SAML2ArtifactDecoderFactory);
     conf.MessageDecoderManager.registerFactory(SAML2_POST_DECODER, saml2p::SAML2POSTDecoderFactory);
 }
index 25beeeb..3f2c224 100644 (file)
                                                        </FileConfiguration>\r
                                                </File>\r
                                                <File\r
+                                                       RelativePath=".\saml2\binding\impl\SAML2ArtifactDecoder.cpp"\r
+                                                       >\r
+                                               </File>\r
+                                               <File\r
                                                        RelativePath=".\saml2\binding\impl\SAML2ArtifactEncoder.cpp"\r
                                                        >\r
                                                </File>\r
                                                >\r
                                        </File>\r
                                        <File\r
+                                               RelativePath=".\saml2\binding\SAML2ArtifactDecoder.h"\r
+                                               >\r
+                                       </File>\r
+                                       <File\r
                                                RelativePath=".\saml2\binding\SAML2ArtifactEncoder.h"\r
                                                >\r
                                        </File>\r
diff --git a/saml/saml2/binding/SAML2ArtifactDecoder.h b/saml/saml2/binding/SAML2ArtifactDecoder.h
new file mode 100644 (file)
index 0000000..fc681eb
--- /dev/null
@@ -0,0 +1,57 @@
+/*
+ *  Copyright 2001-2006 Internet2
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file saml/saml2/binding/SAML2ArtifactDecoder.h
+ * 
+ * SAML 2.0 Artifact binding message decoder
+ */
+
+#include <saml/binding/MessageDecoder.h>
+
+
+namespace opensaml {
+    namespace saml2 {
+        class SAML_API Issuer;
+    };
+    
+    namespace saml2p {
+
+        /**
+         * SAML 2.0 Artifact binding message decoder
+         */
+        class SAML_API SAML2ArtifactDecoder : public MessageDecoder
+        {
+        public:
+            SAML2ArtifactDecoder(const DOMElement* e);
+            virtual ~SAML2ArtifactDecoder();
+            
+            xmltooling::XMLObject* decode(
+                std::string& relayState,
+                const saml2md::RoleDescriptor*& issuer,
+                bool& issuerTrusted,
+                const HTTPRequest& httpRequest,
+                const saml2md::MetadataProvider* metadataProvider=NULL,
+                const xmltooling::QName* role=NULL,
+                const TrustEngine* trustEngine=NULL
+                ) const;
+
+        protected:
+            bool issuerMatches(const saml2::Issuer* messageIssuer, const XMLCh* expectedIssuer) const;
+        };                
+
+    };
+};
diff --git a/saml/saml2/binding/impl/SAML2ArtifactDecoder.cpp b/saml/saml2/binding/impl/SAML2ArtifactDecoder.cpp
new file mode 100644 (file)
index 0000000..d484b2f
--- /dev/null
@@ -0,0 +1,228 @@
+/*
+ *  Copyright 2001-2006 Internet2
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * SAML2ArtifactDecoder.cpp
+ * 
+ * SAML 2.0 Artifact binding message decoder
+ */
+
+#include "internal.h"
+#include "exceptions.h"
+#include "saml/binding/SAMLArtifact.h"
+#include "saml2/core/Protocols.h"
+#include "saml2/metadata/Metadata.h"
+#include "saml2/metadata/MetadataProvider.h"
+#include "saml2/binding/SAML2Artifact.h"
+#include "saml2/binding/SAML2ArtifactDecoder.h"
+#include "security/X509TrustEngine.h"
+
+#include <log4cpp/Category.hh>
+#include <xmltooling/util/NDC.h>
+#include <xmltooling/util/ReplayCache.h>
+
+using namespace opensaml::saml2md;
+using namespace opensaml::saml2p;
+using namespace opensaml::saml2;
+using namespace opensaml;
+using namespace xmlsignature;
+using namespace xmltooling;
+using namespace log4cpp;
+using namespace std;
+
+namespace opensaml {
+    namespace saml2p {              
+        MessageDecoder* SAML_DLLLOCAL SAML2ArtifactDecoderFactory(const DOMElement* const & e)
+        {
+            return new SAML2ArtifactDecoder(e);
+        }
+    };
+};
+
+SAML2ArtifactDecoder::SAML2ArtifactDecoder(const DOMElement* e) {}
+
+SAML2ArtifactDecoder::~SAML2ArtifactDecoder() {}
+
+XMLObject* SAML2ArtifactDecoder::decode(
+    string& relayState,
+    const RoleDescriptor*& issuer,
+    bool& issuerTrusted,
+    const HTTPRequest& httpRequest,
+    const MetadataProvider* metadataProvider,
+    const QName* role,
+    const opensaml::TrustEngine* trustEngine
+    ) const
+{
+#ifdef _DEBUG
+    xmltooling::NDC ndc("decode");
+#endif
+    Category& log = Category::getInstance(SAML_LOGCAT".MessageDecoder.SAML2Artifact");
+
+    log.debug("validating input");
+    const char* SAMLart = httpRequest.getParameter("SAMLart");
+    if (!SAMLart)
+        return NULL;
+    const char* state = httpRequest.getParameter("RelayState");
+    if (state)
+        relayState = state;
+
+    if (!m_artifactResolver || !metadataProvider)
+        throw BindingException("Artifact binding requires ArtifactResolver and MetadataProvider implementations be supplied.");
+
+    // Import the artifact.
+    SAMLArtifact* artifact=NULL;
+    ReplayCache* replayCache = XMLToolingConfig::getConfig().getReplayCache();
+    try {
+        log.debug("processing encoded artifact (%s)", SAMLart);
+        
+        // Check replay.
+        if (replayCache) {
+            if (!replayCache->check("SAML2Artifact", SAMLart, time(NULL) + (2*XMLToolingConfig::getConfig().clock_skew_secs))) {
+                log.error("replay detected of artifact (%s)", SAMLart);
+                throw BindingException("Rejecting replayed artifact ($1).", params(1,SAMLart));
+            }
+        }
+        else
+            log.warn("replay cache was not provided, this is a serious security risk!");
+
+        artifact = SAMLArtifact::parse(SAMLart);
+    }
+    catch (ArtifactException&) {
+        log.error("error parsing artifact (%s)", SAMLart);
+        throw;
+    }
+    
+    // Check the type.
+    auto_ptr<SAML2Artifact> artifact2(dynamic_cast<SAML2Artifact*>(artifact));
+    if (!artifact2.get()) {
+        throw BindingException("Artifact binding requires SAML 2.0 artifact.");
+        delete artifact;
+    }
+    
+    issuer = NULL;
+    issuerTrusted = false;
+    log.debug("attempting to determine source of artifact...");
+    const EntityDescriptor* provider=metadataProvider->getEntityDescriptor(artifact);
+    if (!provider) {
+        log.error(
+            "metadata lookup failed, unable to determine issuer of artifact (0x%s)",
+            SAMLArtifact::toHex(artifact->getBytes()).c_str()
+            );
+        throw BindingException("Metadata lookup failed, unable to determine artifact issuer.");
+    }
+    
+    if (log.isDebugEnabled()) {
+        auto_ptr_char issuer(provider->getEntityID());
+        log.debug("lookup succeeded, artifact issued by (%s)", issuer.get());
+    }
+    
+    log.debug("attempting to find artifact issuing role...");
+    issuer=provider->getRoleDescriptor(*role, SAMLConstants::SAML20P_NS);
+    if (!issuer || !dynamic_cast<const SSODescriptorType*>(issuer)) {
+        log.error("unable to find compatible SAML role (%s) in metadata", role->toString().c_str());
+        BindingException ex("Unable to find compatible metadata role for artifact issuer.");
+        annotateException(&ex,provider); // throws it
+    }
+    
+    try {
+        auto_ptr<ArtifactResponse> response(
+            m_artifactResolver->resolve(
+                issuerTrusted,
+                *(artifact2.get()),
+                dynamic_cast<const SSODescriptorType&>(*issuer),
+                dynamic_cast<const X509TrustEngine*>(trustEngine)
+                )
+            );
+        
+        // Check Issuer of outer message.
+        if (!issuerMatches(response->getIssuer(), provider->getEntityID())) {
+            log.error("issuer of ArtifactResponse did not match source of artifact");
+            throw BindingException("Issuer of ArtifactResponse did not match source of artifact.");
+        }
+
+        // Extract payload and check that Issuer.
+        XMLObject* payload = response->getPayload();
+        RequestAbstractType* req = NULL;
+        StatusResponseType* res = dynamic_cast<StatusResponseType*>(payload);
+        if (!res)
+            req = dynamic_cast<RequestAbstractType*>(payload);
+        if (!res && !req)
+            throw BindingException("ArtifactResponse payload was not a recognized SAML 2.0 protocol message.");
+            
+        if (!issuerMatches(res ? res->getIssuer() : req->getIssuer(), provider->getEntityID())) {
+            log.error("issuer of ArtifactResponse payload did not match source of artifact");
+            throw BindingException("Issuer of ArtifactResponse payload did not match source of artifact.");
+        }
+
+        // Check payload freshness.
+        time_t now = time(NULL);
+        if ((res ? res->getIssueInstant() : req->getIssueInstant())->getEpoch() < now-(2*XMLToolingConfig::getConfig().clock_skew_secs))
+            throw BindingException("Detected expired ArtifactResponse payload.");
+
+        // Check replay.
+        if (replayCache) {
+            auto_ptr_char mid(res ? res->getID() : req->getID());
+            if (!replayCache->check("SAML2ArtifactPayload", mid.get(), now + (2*XMLToolingConfig::getConfig().clock_skew_secs))) {
+                log.error("replay detected of ArtifactResponse payload message ID (%s)", mid.get());
+                throw BindingException("Rejecting replayed ArtifactResponse payload ($1).", params(1,mid.get()));
+            }
+        }
+        
+        // Check signatures.
+        if (trustEngine) {
+            if (response->getSignature()) {
+                issuerTrusted = trustEngine->validate(*(response->getSignature()), *issuer, metadataProvider->getKeyResolver());
+                if (!issuerTrusted) {
+                    log.error("unable to verify signature on ArtifactResponse message with supplied trust engine");
+                    throw BindingException("Message signature failed verification.");
+                }
+            }
+            Signature* sig = (res ? res->getSignature() : req->getSignature());
+            if (sig) {
+                issuerTrusted = trustEngine->validate(*sig, *issuer, metadataProvider->getKeyResolver());
+                if (!issuerTrusted) {
+                    log.error("unable to verify signature on ArtifactResponse payload with supplied trust engine");
+                    throw BindingException("Message signature failed verification.");
+                }
+            }
+        }
+        
+        if (!issuerTrusted) {
+            log.warn("unable to verify integrity of ArtifactResponse message or payload, leaving untrusted");
+        }
+        
+        // Return the payload only.
+        response.release();
+        payload->detach(); 
+        return payload;
+    }
+    catch (XMLToolingException& ex) {
+        annotateException(&ex,issuer,false);
+        throw;
+    }
+}
+
+bool SAML2ArtifactDecoder::issuerMatches(const Issuer* messageIssuer, const XMLCh* expectedIssuer) const
+{
+    if (messageIssuer && messageIssuer->getName()) {
+        if (messageIssuer->getFormat() && !XMLString::equals(messageIssuer->getFormat(), NameIDType::ENTITY))
+            return false;
+        else if (!XMLString::equals(expectedIssuer, messageIssuer->getName()))
+            return false;
+    }
+    return true;
+}
+
index fa73fa7..cb82f02 100644 (file)
@@ -20,8 +20,6 @@ samltest_h = \
     signature/SAML2AssertionTest.h \
     security/AbstractPKIXTrustEngineTest.h \
     security/ExplicitKeyTrustEngineTest.h \
-    saml1/binding/impl/SAML1ArtifactTest.h \
-    saml1/binding/impl/SAML1POSTTest.h \
     saml1/core/impl/ActionTest.h \
     saml1/core/impl/AdviceTest.h \
     saml1/core/impl/AssertionIDReferenceTest.h \
@@ -32,7 +30,8 @@ samltest_h = \
     saml1/core/impl/AudienceRestrictionConditionTest.h \
     saml1/core/impl/AudienceTest.h \
     saml1/core/impl/AuthenticationStatementTest.h \
-    saml2/binding/impl/SAML2POSTTest.h \
+    saml1/binding/SAML1ArtifactTest.h \
+    saml1/binding/SAML1POSTTest.h \
     saml2/core/impl/Action20Test.h \
     saml2/core/impl/Advice20Test.h \
     saml2/core/impl/Artifact20Test.h \
@@ -90,6 +89,8 @@ samltest_h = \
     saml2/core/impl/SubjectConfirmationData20Test.h\
     saml2/core/impl/SubjectLocality20Test.h\
     saml2/core/impl/Terminate20Test.h \
+    saml2/binding/SAML2ArtifactTest.h \
+    saml2/binding/SAML2POSTTest.h \
     saml2/metadata/FilesystemMetadataProviderTest.h
 
 noinst_HEADERS = \
index feaf0c4..78e9c09 100644 (file)
@@ -1,14 +1,6 @@
 <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
-IssueInstant="1970-01-02T01:01:02.100Z" Version="2.0" ID="rident" Destination="https://sp.example.org/SAML/POST">
-    <saml:Issuer>https://idp.example.org/</saml:Issuer> 
-    <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
-    <saml:Assertion ID="aident" IssueInstant="1970-01-02T01:01:02.100Z" Version="2.0">
-        <saml:Issuer>https://idp.example.org/</saml:Issuer> 
-        <saml:Subject><saml:NameID>John Doe</saml:NameID></saml:Subject>
-        <saml:AuthnStatement AuthnInstant="1970-01-02T01:01:02.100Z">
-            <saml:AuthnContext>
-                <saml:AuthnContextClassRef>foo</saml:AuthnContextClassRef>
-            </saml:AuthnContext>
-        </saml:AuthnStatement>
-    </saml:Assertion>
-</samlp:Response>
+IssueInstant="1970-01-02T01:01:02.100Z" Version="2.0" ID="rident"
+Destination="https://sp.example.org/SAML/POST"><saml:Issuer>https://idp.example.org/</saml:Issuer><samlp:Status><samlp:StatusCode
+Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion ID="aident"
+IssueInstant="1970-01-02T01:01:02.100Z" Version="2.0"><saml:Issuer>https://idp.example.org/</saml:Issuer><saml:Subject><saml:NameID>John Doe</saml:NameID></saml:Subject><saml:AuthnStatement
+AuthnInstant="1970-01-02T01:01:02.100Z"><saml:AuthnContext><saml:AuthnContextClassRef>foo</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></samlp:Response>
\ No newline at end of file
index decc34f..b36c040 100644 (file)
@@ -131,7 +131,7 @@ public:
         return response.release();\r
     }\r
 \r
-    XMLObject* resolve(\r
+    saml2p::ArtifactResponse* resolve(\r
         bool& authenticated,\r
         const saml2p::SAML2Artifact& artifact,\r
         const SSODescriptorType& ssoDescriptor,\r
diff --git a/samltest/saml2/binding/SAML2ArtifactTest.h b/samltest/saml2/binding/SAML2ArtifactTest.h
new file mode 100644 (file)
index 0000000..f555e13
--- /dev/null
@@ -0,0 +1,144 @@
+/*\r
+ *  Copyright 2001-2005 Internet2\r
+ * \r
+ * Licensed under the Apache License, Version 2.0 (the "License");\r
+ * you may not use this file except in compliance with the License.\r
+ * You may obtain a copy of the License at\r
+ *\r
+ *     http://www.apache.org/licenses/LICENSE-2.0\r
+ *\r
+ * Unless required by applicable law or agreed to in writing, software\r
+ * distributed under the License is distributed on an "AS IS" BASIS,\r
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
+ * See the License for the specific language governing permissions and\r
+ * limitations under the License.\r
+ */\r
+\r
+#include "binding.h"\r
+\r
+#include <saml/binding/ArtifactMap.h>\r
+#include <saml/saml2/core/Protocols.h>\r
+#include <saml/saml2/binding/SAML2ArtifactType0004.h>\r
+\r
+using namespace opensaml::saml2p;\r
+using namespace opensaml::saml2;\r
+\r
+class SAML2ArtifactTest : public CxxTest::TestSuite,\r
+    public SAMLBindingBaseTestCase, public MessageEncoder::ArtifactGenerator, public MessageDecoder::ArtifactResolver {\r
+public:\r
+    void setUp() {\r
+        m_fields.clear();\r
+        SAMLBindingBaseTestCase::setUp();\r
+    }\r
+\r
+    void tearDown() {\r
+        m_fields.clear();\r
+        SAMLBindingBaseTestCase::tearDown();\r
+    }\r
+\r
+    void testSAML2Artifact() {\r
+        try {\r
+            // Read message to use from file.\r
+            string path = data_path + "saml2/binding/SAML2Response.xml";\r
+            ifstream in(path.c_str());\r
+            DOMDocument* doc=XMLToolingConfig::getConfig().getParser().parse(in);\r
+            XercesJanitor<DOMDocument> janitor(doc);\r
+            auto_ptr<Response> toSend(\r
+                dynamic_cast<Response*>(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(),true))\r
+                );\r
+            janitor.release();\r
+\r
+            // Freshen timestamp.\r
+            toSend->setIssueInstant(time(NULL));\r
+\r
+            // Encode message.\r
+            auto_ptr<MessageEncoder> encoder(SAMLConfig::getConfig().MessageEncoderManager.newPlugin(SAML2_ARTIFACT_ENCODER, NULL));\r
+            encoder->setArtifactGenerator(this);\r
+            encoder->encode(m_fields,toSend.get(),"https://sp.example.org/","state",m_creds);\r
+            toSend.release();\r
+            \r
+            // Decode message.\r
+            string relayState;\r
+            const RoleDescriptor* issuer=NULL;\r
+            bool trusted=false;\r
+            QName idprole(SAMLConstants::SAML20MD_NS, IDPSSODescriptor::LOCAL_NAME);\r
+            auto_ptr<MessageDecoder> decoder(SAMLConfig::getConfig().MessageDecoderManager.newPlugin(SAML2_ARTIFACT_DECODER, NULL));\r
+            decoder->setArtifactResolver(this);\r
+            Locker locker(m_metadata);\r
+            auto_ptr<Response> response(\r
+                dynamic_cast<Response*>(\r
+                    decoder->decode(relayState,issuer,trusted,*this,m_metadata,&idprole,m_trust)\r
+                    )\r
+                );\r
+            \r
+            // Test the results.\r
+            TSM_ASSERT_EQUALS("RelayState was not the expected result.", relayState, "state");\r
+            TSM_ASSERT("SAML Response not decoded successfully.", response.get());\r
+            TSM_ASSERT("Message was not verified.", issuer && trusted);\r
+            auto_ptr_char entityID(dynamic_cast<const EntityDescriptor*>(issuer->getParent())->getEntityID());\r
+            TSM_ASSERT("Issuer was not expected.", !strcmp(entityID.get(),"https://idp.example.org/"));\r
+            TSM_ASSERT_EQUALS("Assertion count was not correct.", response->getAssertions().size(), 1);\r
+\r
+            // Trigger a replay.\r
+            TSM_ASSERT_THROWS("Did not catch the replay.", \r
+                decoder->decode(relayState,issuer,trusted,*this,m_metadata,&idprole,m_trust),\r
+                BindingException);\r
+        }\r
+        catch (XMLToolingException& ex) {\r
+            TS_TRACE(ex.what());\r
+            throw;\r
+        }\r
+    }\r
+\r
+    const char* getMethod() const {\r
+        return "GET";\r
+    } \r
+\r
+    const char* getRequestURL() const {\r
+        return "https://sp.example.org/SAML/Artifact";\r
+    }\r
+    \r
+    const char* getQueryString() const {\r
+        return NULL;\r
+    }\r
+    \r
+    SAMLArtifact* generateSAML1Artifact(const char* relyingParty) const {\r
+        throw BindingException("Not implemented.");\r
+    }\r
+    \r
+    saml2p::SAML2Artifact* generateSAML2Artifact(const char* relyingParty) const {\r
+        return new SAML2ArtifactType0004(SAMLConfig::getConfig().hashSHA1("https://idp.example.org/"),1);\r
+    }\r
+    \r
+    saml1p::Response* resolve(\r
+        bool& authenticated,\r
+        const vector<SAMLArtifact*>& artifacts,\r
+        const IDPSSODescriptor& idpDescriptor,\r
+        const X509TrustEngine* trustEngine=NULL\r
+        ) const {\r
+        throw BindingException("Not implemented.");\r
+    }\r
+\r
+    ArtifactResponse* resolve(\r
+        bool& authenticated,\r
+        const SAML2Artifact& artifact,\r
+        const SSODescriptorType& ssoDescriptor,\r
+        const X509TrustEngine* trustEngine=NULL\r
+        ) const {\r
+        XMLObject* xmlObject =\r
+            SAMLConfig::getConfig().getArtifactMap()->retrieveContent(&artifact, "https://sp.example.org/");\r
+        Response* payload = dynamic_cast<Response*>(xmlObject);\r
+        TSM_ASSERT("Not a response.", payload!=NULL);\r
+        auto_ptr<ArtifactResponse> response(ArtifactResponseBuilder::buildArtifactResponse());\r
+        response->setPayload(payload);\r
+        Status* status = StatusBuilder::buildStatus();\r
+        response->setStatus(status);\r
+        StatusCode* sc = StatusCodeBuilder::buildStatusCode();\r
+        status->setStatusCode(sc);\r
+        sc->setValue(StatusCode::SUCCESS);\r
+        response->marshall();\r
+        SchemaValidators.validate(response.get());\r
+        authenticated = true;\r
+        return response.release();\r
+    }\r
+};\r
index f8eea0c..8970b8d 100644 (file)
                                        Name="binding"\r
                                        >\r
                                        <File\r
+                                               RelativePath=".\saml2\binding\SAML2ArtifactTest.cpp"\r
+                                               >\r
+                                       </File>\r
+                                       <File\r
                                                RelativePath=".\saml2\binding\SAML2POSTTest.cpp"\r
                                                >\r
                                        </File>\r
                                        Name="binding"\r
                                        >\r
                                        <File\r
+                                               RelativePath=".\saml2\binding\SAML2ArtifactTest.h"\r
+                                               >\r
+                                               <FileConfiguration\r
+                                                       Name="Debug|Win32"\r
+                                                       >\r
+                                                       <Tool\r
+                                                               Name="VCCustomBuildTool"\r
+                                                               CommandLine="\perl\bin\perl.exe -w \cxxtest\cxxtestgen.pl --part --have-eh --have-std --abort-on-fail -o &quot;$(InputDir)$(InputName)&quot;.cpp &quot;$(InputPath)&quot;&#x0D;&#x0A;"\r
+                                                               Outputs="&quot;$(InputDir)$(InputName)&quot;.cpp"\r
+                                                       />\r
+                                               </FileConfiguration>\r
+                                               <FileConfiguration\r
+                                                       Name="Release|Win32"\r
+                                                       >\r
+                                                       <Tool\r
+                                                               Name="VCCustomBuildTool"\r
+                                                               CommandLine="\perl\bin\perl.exe -w \cxxtest\cxxtestgen.pl --part --have-eh --have-std --abort-on-fail -o &quot;$(InputDir)$(InputName)&quot;.cpp &quot;$(InputPath)&quot;&#x0D;&#x0A;"\r
+                                                               Outputs="&quot;$(InputDir)$(InputName)&quot;.cpp"\r
+                                                       />\r
+                                               </FileConfiguration>\r
+                                       </File>\r
+                                       <File\r
                                                RelativePath=".\saml2\binding\SAML2POSTTest.h"\r
                                                >\r
                                                <FileConfiguration\r