From: Scott Cantor Date: Fri, 3 Nov 2006 20:11:42 +0000 (+0000) Subject: Added MessageRoutingRule for destination checks. X-Git-Tag: 2.0-alpha1~165 X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fcpp-opensaml.git;a=commitdiff_plain;h=441141898ba4a43910f0185fee5f01de9ac78144 Added MessageRoutingRule for destination checks. --- diff --git a/saml/Makefile.am b/saml/Makefile.am index ae7c2d1..8c3e2f2 100644 --- a/saml/Makefile.am +++ b/saml/Makefile.am @@ -40,6 +40,7 @@ samlbindinclude_HEADERS = \ binding/MessageDecoder.h \ binding/MessageEncoder.h \ binding/MessageFlowRule.h \ + binding/MessageRoutingRule.h \ binding/MessageSigningRule.h \ binding/SAMLArtifact.h \ binding/SecurityPolicy.h \ @@ -105,6 +106,7 @@ libsaml_la_SOURCES = \ binding/impl/MessageDecoder.cpp \ binding/impl/MessageEncoder.cpp \ binding/impl/MessageFlowRule.cpp \ + binding/impl/MessageRoutingRule.cpp \ binding/impl/MessageSigningRule.cpp \ binding/impl/SAMLArtifact.cpp \ binding/impl/SecurityPolicy.cpp \ diff --git a/saml/binding/MessageRoutingRule.h b/saml/binding/MessageRoutingRule.h new file mode 100644 index 0000000..cc30ea4 --- /dev/null +++ b/saml/binding/MessageRoutingRule.h @@ -0,0 +1,61 @@ +/* + * Copyright 2001-2006 Internet2 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * @file saml/binding/MessageRoutingRule.h + * + * Routing rule that enforces message delivery to an intended destination + */ + +#include + + +namespace opensaml { + /** + * Routing rule that enforces message delivery to an intended destination + * + * Subclasses can provide support for additional message types + * by overriding the destination derivation method. + */ + class SAML_API MessageRoutingRule : public SecurityPolicyRule + { + public: + MessageRoutingRule(const DOMElement* e); + virtual ~MessageRoutingRule() {} + + std::pair evaluate( + const GenericRequest& request, + const xmltooling::XMLObject& message, + const saml2md::MetadataProvider* metadataProvider, + const xmltooling::QName* role, + const TrustEngine* trustEngine + ) const; + + protected: + /** + * Examines the message and/or its contents and extracts the destination + * address/URL, if specified. + * + * @param message message to examine + * @return the destination address/URL, or NULL + */ + virtual const XMLCh* getDestination(const xmltooling::XMLObject& message) const; + + private: + bool m_mandatory; + }; + +}; diff --git a/saml/binding/SecurityPolicyRule.h b/saml/binding/SecurityPolicyRule.h index f547251..749c571 100644 --- a/saml/binding/SecurityPolicyRule.h +++ b/saml/binding/SecurityPolicyRule.h @@ -33,6 +33,7 @@ namespace opensaml { class SAML_API Issuer; }; namespace saml2md { + class SAML_API MetadataProvider; class SAML_API RoleDescriptor; }; @@ -83,15 +84,24 @@ namespace opensaml { * *

A ReplayCache instance must be available from the runtime, unless * a "checkReplay" XML attribute is set to "0" or "false" when instantiating - * the policy. + * the policy rule. * *

Messages must have been issued in the past, but no more than 60 seconds ago, * or up to a number of seconds set by an "expires" XML attribute when - * instantiating the policy. + * instantiating the policy rule. */ #define MESSAGEFLOW_POLICY_RULE "org.opensaml.binding.MessageFlowRule" /** + * SecurityPolicyRule for ensuring messages are delivered to the right place. + * + *

Enforcement is mandatory and the message must be explicitly addressed, + * unless a "mandatory" XML attribute is set to "0" or "false" when instantiating + * the policy rule. + */ + #define MESSAGEROUTING_POLICY_RULE "org.opensaml.binding.MessageRoutingRule" + + /** * SecurityPolicyRule for protocol message signing. * * Allows the message issuer to be authenticated using an XML or binding-specific diff --git a/saml/binding/impl/MessageDecoder.cpp b/saml/binding/impl/MessageDecoder.cpp index ffcd27b..983b3a3 100644 --- a/saml/binding/impl/MessageDecoder.cpp +++ b/saml/binding/impl/MessageDecoder.cpp @@ -36,6 +36,7 @@ namespace opensaml { namespace saml2p { SAML_DLLLOCAL PluginManager::Factory SAML2ArtifactDecoderFactory; SAML_DLLLOCAL PluginManager::Factory SAML2POSTDecoderFactory; + SAML_DLLLOCAL PluginManager::Factory SAML2RedirectDecoderFactory; }; }; @@ -46,4 +47,5 @@ void SAML_API opensaml::registerMessageDecoders() conf.MessageDecoderManager.registerFactory(samlconstants::SAML1_PROFILE_BROWSER_POST, saml1p::SAML1POSTDecoderFactory); conf.MessageDecoderManager.registerFactory(samlconstants::SAML20_BINDING_HTTP_ARTIFACT, saml2p::SAML2ArtifactDecoderFactory); conf.MessageDecoderManager.registerFactory(samlconstants::SAML20_BINDING_HTTP_POST, saml2p::SAML2POSTDecoderFactory); + conf.MessageDecoderManager.registerFactory(samlconstants::SAML20_BINDING_HTTP_REDIRECT, saml2p::SAML2RedirectDecoderFactory); } diff --git a/saml/binding/impl/MessageFlowRule.cpp b/saml/binding/impl/MessageFlowRule.cpp index 0e8cea3..ef70bd0 100644 --- a/saml/binding/impl/MessageFlowRule.cpp +++ b/saml/binding/impl/MessageFlowRule.cpp @@ -70,7 +70,7 @@ pair MessageFlowRule::evaluate( check(obj.getID(), obj.getIssueInstantEpoch()); } catch (bad_cast&) { - throw BindingException("Message was not of a recognized SAML root type."); + throw BindingException("Message was not of a recognized type."); } return pair(NULL,NULL); } diff --git a/saml/binding/impl/MessageRoutingRule.cpp b/saml/binding/impl/MessageRoutingRule.cpp new file mode 100644 index 0000000..261edd1 --- /dev/null +++ b/saml/binding/impl/MessageRoutingRule.cpp @@ -0,0 +1,111 @@ +/* + * Copyright 2001-2006 Internet2 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * MessageRoutingRule.cpp + * + * XML Signature checking SecurityPolicyRule + */ + +#include "internal.h" +#include "exceptions.h" +#include "binding/HTTPRequest.h" +#include "binding/MessageRoutingRule.h" +#include "saml1/core/Protocols.h" +#include "saml2/core/Protocols.h" + +#include +#include +#include + +using namespace opensaml; +using namespace xmltooling; +using namespace log4cpp; +using namespace std; + +namespace opensaml { + SecurityPolicyRule* SAML_DLLLOCAL MessageRoutingRuleFactory(const DOMElement* const & e) + { + return new MessageRoutingRule(e); + } +}; + +static const XMLCh mandatory[] = UNICODE_LITERAL_9(m,a,n,d,a,t,o,r,y); + +MessageRoutingRule::MessageRoutingRule(const DOMElement* e) : m_mandatory(true) +{ + if (e) { + const XMLCh* attr = e->getAttributeNS(NULL, mandatory); + if (attr && (*attr==chLatin_f || *attr==chDigit_0)) + m_mandatory = false; + } +} + +pair MessageRoutingRule::evaluate( + const GenericRequest& request, + const XMLObject& message, + const saml2md::MetadataProvider* metadataProvider, + const QName* role, + const opensaml::TrustEngine* trustEngine + ) const +{ + Category& log=Category::getInstance(SAML_LOGCAT".SecurityPolicyRule.MessageRouting"); + log.debug("evaluating message routing policy"); + + try { + const char* to = dynamic_cast(request).getRequestURL(); + if (!to || !*to) { + if (m_mandatory) + throw BindingException("Unable to determine delivery location."); + log.debug("unable to determine delivery location, ignoring message"); + return pair(NULL,NULL); + } + auto_ptr_char dest(getDestination(message)); + if (dest.get() && *dest.get()) { + if (!XMLString::equals(to, dest.get())) { + log.error("Message intended for (%s), but delivered to (%s)", dest.get(), to); + throw BindingException("Message delivered to incorrect address."); + } + } + else if (m_mandatory) + throw BindingException("Message did not contain intended address."); + } + catch (bad_cast&) { + throw BindingException("Message was not of a recognized type."); + } + return pair(NULL,NULL); +} + +const XMLCh* MessageRoutingRule::getDestination(const XMLObject& message) const +{ + // We just let any bad casts throw here. + + // Shortcuts some of the casting. + const XMLCh* ns = message.getElementQName().getNamespaceURI(); + if (ns) { + if (XMLString::equals(ns, samlconstants::SAML20P_NS)) { + const saml2p::StatusResponseType* response = dynamic_cast(&message); + if (response) + return response->getDestination(); + return dynamic_cast(message).getDestination(); + } + else if (XMLString::equals(ns, samlconstants::SAML1P_NS)) { + // Should be a samlp:Response, at least in OpenSAML. + return dynamic_cast(message).getRecipient(); + } + } + return NULL; +} diff --git a/saml/binding/impl/SecurityPolicy.cpp b/saml/binding/impl/SecurityPolicy.cpp index 0b30af3..6e9b6ae 100644 --- a/saml/binding/impl/SecurityPolicy.cpp +++ b/saml/binding/impl/SecurityPolicy.cpp @@ -33,6 +33,7 @@ using namespace std; namespace opensaml { SAML_DLLLOCAL PluginManager::Factory MessageFlowRuleFactory; + SAML_DLLLOCAL PluginManager::Factory MessageRoutingRuleFactory; SAML_DLLLOCAL PluginManager::Factory MessageSigningRuleFactory; }; @@ -40,6 +41,7 @@ void SAML_API opensaml::registerSecurityPolicyRules() { SAMLConfig& conf=SAMLConfig::getConfig(); conf.SecurityPolicyRuleManager.registerFactory(MESSAGEFLOW_POLICY_RULE, MessageFlowRuleFactory); + conf.SecurityPolicyRuleManager.registerFactory(MESSAGEROUTING_POLICY_RULE, MessageRoutingRuleFactory); conf.SecurityPolicyRuleManager.registerFactory(MESSAGESIGNING_POLICY_RULE, MessageSigningRuleFactory); } @@ -85,7 +87,7 @@ void SecurityPolicy::setIssuer(saml2::Issuer* issuer) m_issuer=issuer; } -void SecurityPolicy::setIssuerMetadata(const saml2md::RoleDescriptor* issuerRole) +void SecurityPolicy::setIssuerMetadata(const RoleDescriptor* issuerRole) { if (issuerRole && m_issuerRole && issuerRole!=m_issuerRole) throw BindingException("Externally provided RoleDescriptor conflicts with policy results."); diff --git a/saml/saml.vcproj b/saml/saml.vcproj index 6a44790..ed0106b 100644 --- a/saml/saml.vcproj +++ b/saml/saml.vcproj @@ -418,6 +418,10 @@ RelativePath=".\saml2\binding\impl\SAML2Redirect.cpp" > + + @@ -476,6 +480,10 @@ > + + @@ -771,6 +779,10 @@ > + + diff --git a/saml/saml1/binding/impl/SAML1POSTDecoder.cpp b/saml/saml1/binding/impl/SAML1POSTDecoder.cpp index 33ac05f..bff2e55 100644 --- a/saml/saml1/binding/impl/SAML1POSTDecoder.cpp +++ b/saml/saml1/binding/impl/SAML1POSTDecoder.cpp @@ -103,18 +103,6 @@ Response* SAML1POSTDecoder::decode( if (!m_validate) SchemaValidators.validate(xmlObject.get()); - // Check recipient URL. - auto_ptr_char recipient(response->getRecipient()); - const char* recipient2 = httpRequest->getRequestURL(); - if (!recipient.get() || !*(recipient.get())) { - log.error("response missing Recipient attribute"); - throw BindingException("SAML response did not contain Recipient attribute identifying intended destination."); - } - else if (!recipient2 || !*recipient2 || strcmp(recipient.get(),recipient2)) { - log.error("POST targeted at (%s), but delivered to (%s)", recipient.get(), recipient2 ? recipient2 : "none"); - throw BindingException("SAML message delivered with POST to incorrect server URL."); - } - // Run through the policy. policy.evaluate(genericRequest, *response); } diff --git a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp index a7f1cda..3d4cb42 100644 --- a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp +++ b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp @@ -100,37 +100,16 @@ saml2::RootObject* SAML2POSTDecoder::decode( auto_ptr xmlObject(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true)); janitor.release(); - saml2::RootObject* root = NULL; - StatusResponseType* response = NULL; - RequestAbstractType* request = dynamic_cast(xmlObject.get()); - if (!request) { - response = dynamic_cast(xmlObject.get()); - if (!response) - throw BindingException("XML content for SAML 2.0 HTTP-POST Decoder must be a SAML 2.0 protocol message."); - root = static_cast(response); - } - else { - root = static_cast(request); - } + saml2::RootObject* root = dynamic_cast(xmlObject.get()); + if (!root) + throw BindingException("XML content for SAML 2.0 HTTP-POST Decoder must be a SAML 2.0 protocol message."); try { if (!m_validate) SchemaValidators.validate(xmlObject.get()); - // Check destination URL. - auto_ptr_char dest(request ? request->getDestination() : response->getDestination()); - const char* dest2 = httpRequest->getRequestURL(); - if (root->getSignature() && !dest.get() || !*(dest.get())) { - log.error("signed SAML message missing Destination attribute"); - throw BindingException("Signed SAML message missing Destination attribute identifying intended destination."); - } - else if (dest.get() && (!dest2 || !*dest2 || strcmp(dest.get(),dest2))) { - log.error("POST targeted at (%s), but delivered to (%s)", dest.get(), dest2 ? dest2 : "none"); - throw BindingException("SAML message delivered with POST to incorrect server URL."); - } - // Run through the policy. - policy.evaluate(genericRequest, *response); + policy.evaluate(genericRequest, *root); } catch (XMLToolingException& ex) { // This is just to maximize the likelihood of attaching a source to the message for support purposes. @@ -140,7 +119,7 @@ saml2::RootObject* SAML2POSTDecoder::decode( const Issuer* claimedIssuer = root->getIssuer(); if (!claimedIssuer) { // Check for assertions. - const Response* assbag = dynamic_cast(response); + const Response* assbag = dynamic_cast(root); if (assbag) { const vector& assertions=assbag->getAssertions(); if (!assertions.empty()) diff --git a/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp b/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp index 6afb59a..15a1e53 100644 --- a/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp +++ b/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp @@ -22,17 +22,16 @@ #include "internal.h" #include "exceptions.h" +#include "binding/HTTPRequest.h" #include "saml2/binding/SAML2Redirect.h" #include "saml2/binding/SAML2RedirectDecoder.h" #include "saml2/core/Protocols.h" #include "saml2/metadata/Metadata.h" #include "saml2/metadata/MetadataProvider.h" -#include "security/X509TrustEngine.h" #include #include #include -#include #include using namespace opensaml::saml2md; @@ -59,12 +58,8 @@ SAML2RedirectDecoder::~SAML2RedirectDecoder() {} XMLObject* SAML2RedirectDecoder::decode( string& relayState, - const RoleDescriptor*& issuer, - const XMLCh*& securityMech, - const HTTPRequest& httpRequest, - const MetadataProvider* metadataProvider, - const QName* role, - const opensaml::TrustEngine* trustEngine + const GenericRequest& genericRequest, + SecurityPolicy& policy ) const { #ifdef _DEBUG @@ -73,19 +68,24 @@ XMLObject* SAML2RedirectDecoder::decode( Category& log = Category::getInstance(SAML_LOGCAT".MessageDecoder.SAML2Redirect"); log.debug("validating input"); - if (strcmp(httpRequest.getMethod(),"GET")) + const HTTPRequest* httpRequest=dynamic_cast(&genericRequest); + if (!httpRequest) { + log.error("unable to cast request to HTTPRequest type"); return NULL; - const char* msg = httpRequest.getParameter("SAMLResponse"); + } + if (strcmp(httpRequest->getMethod(),"GET")) + return NULL; + const char* msg = httpRequest->getParameter("SAMLResponse"); if (!msg) - msg = httpRequest.getParameter("SAMLRequest"); + msg = httpRequest->getParameter("SAMLRequest"); if (!msg) return NULL; - const char* state = httpRequest.getParameter("RelayState"); + const char* state = httpRequest->getParameter("RelayState"); if (state) relayState = state; else relayState.erase(); - state = httpRequest.getParameter("SAMLEncoding"); + state = httpRequest->getParameter("SAMLEncoding"); if (state && strcmp(state,samlconstants::SAML20_BINDING_URL_ENCODING_DEFLATE)) { log.warn("SAMLEncoding (%s) was not recognized", state); return NULL; @@ -113,130 +113,42 @@ XMLObject* SAML2RedirectDecoder::decode( auto_ptr xmlObject(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true)); janitor.release(); - StatusResponseType* response = NULL; - RequestAbstractType* request = dynamic_cast(xmlObject.get()); - if (!request) { - response = dynamic_cast(xmlObject.get()); - if (!response) - throw BindingException("XML content for SAML 2.0 HTTP-Redirect Decoder must be a SAML 2.0 protocol message."); - } + saml2::RootObject* root = dynamic_cast(xmlObject.get()); + if (!root) + throw BindingException("XML content for SAML 2.0 HTTP-POST Decoder must be a SAML 2.0 protocol message."); - /* For SAML 2, the issuer can be established either from the message, or in some profiles - * it's possible to omit it and defer to assertions in a Response. - * The Issuer is later matched against metadata, and then trust checking can be applied. - */ - const Issuer* claimedIssuer = request ? request->getIssuer() : response->getIssuer(); - if (!claimedIssuer) { - // Check assertion option. I cannot resist the variable name, for the sake of google. - const Response* assbag = dynamic_cast(response); - if (assbag) { - const vector& assertions=assbag->getAssertions(); - if (!assertions.empty()) - claimedIssuer = assertions.front()->getIssuer(); - } - } - - const EntityDescriptor* provider=NULL; try { if (!m_validate) SchemaValidators.validate(xmlObject.get()); - // Check destination URL. - auto_ptr_char dest(request ? request->getDestination() : response->getDestination()); - const char* dest2 = httpRequest.getRequestURL(); - if (!dest.get() || !*(dest.get())) { - log.error("signed SAML message missing Destination attribute"); - throw BindingException("Signed SAML message missing Destination attribute identifying intended destination."); - } - else if (dest.get() && (!dest2 || !*dest2 || strcmp(dest.get(),dest2))) { - log.error("Redirect targeted at (%s), but delivered to (%s)", dest.get(), dest2 ? dest2 : "none"); - throw BindingException("SAML message delivered with Redirect to incorrect server URL."); - } - - // Check freshness. - time_t now = time(NULL); - if ((request ? request->getIssueInstant()->getEpoch() : response->getIssueInstant()->getEpoch()) - < now-(2*XMLToolingConfig::getConfig().clock_skew_secs)) - throw BindingException("Detected expired Redirect binding message."); - - // Check replay. - ReplayCache* replayCache = XMLToolingConfig::getConfig().getReplayCache(); - if (replayCache) { - auto_ptr_char id(xmlObject->getXMLID()); - if (!replayCache->check("SAML2Redirect", id.get(), response->getIssueInstant()->getEpoch() + (2*XMLToolingConfig::getConfig().clock_skew_secs))) { - log.error("replay detected of message ID (%s)", id.get()); - throw BindingException("Rejecting replayed message ID ($1).", params(1,id.get())); - } - } - else - log.warn("replay cache was not provided, this is a serious security risk!"); - - issuer = NULL; - securityMech = false; - log.debug("attempting to establish issuer and integrity of message..."); - - // If we can't identify the issuer, we're done, since we can't lookup or verify anything. - if (!claimedIssuer || !claimedIssuer->getName()) { - log.warn("unable to establish identity of message issuer"); - return xmlObject.release(); - } - else if (claimedIssuer->getFormat() && !XMLString::equals(claimedIssuer->getFormat(), NameIDType::ENTITY)) { - auto_ptr_char iformat(claimedIssuer->getFormat()); - log.warn("message issuer was in an unsupported format (%s)", iformat.get()); - return xmlObject.release(); - } - - log.debug("searching metadata for assertion issuer..."); - provider=metadataProvider ? metadataProvider->getEntityDescriptor(claimedIssuer->getName()) : NULL; - if (provider) { - log.debug("matched assertion issuer against metadata, searching for applicable role..."); - issuer=provider->getRoleDescriptor(*role, samlconstants::SAML20P_NS); - if (issuer) { - /* - if (trustEngine && signature) { - if (!trustEngine->validate(*signature, *issuer, metadataProvider->getKeyResolver())) { - log.error("unable to verify signature on message with supplied trust engine"); - throw BindingException("Message signature failed verification."); - } - else { - securityMech = samlconstants::SAML20P_NS; - } - } - else { - log.warn("unable to authenticate the message, leaving untrusted"); - } - */ - } - else { - log.warn("unable to find compatible SAML 2.0 role (%s) in metadata", role->toString().c_str()); - } - if (log.isDebugEnabled()) { - auto_ptr_char iname(provider->getEntityID()); - log.debug("message from (%s), integrity %sverified", iname.get(), securityMech ? "" : "NOT "); - } - } - else { - auto_ptr_char temp(claimedIssuer->getName()); - log.warn("no metadata found, can't establish identity of issuer (%s)", temp.get()); - } + // Run through the policy. + policy.evaluate(genericRequest, *root); } catch (XMLToolingException& ex) { - if (!provider) { - if (!claimedIssuer || !claimedIssuer->getName()) - throw; - if (!metadataProvider || !(provider=metadataProvider->getEntityDescriptor(claimedIssuer->getName(), false))) { - // Just record it. - auto_ptr_char iname(claimedIssuer->getName()); - if (iname.get()) - ex.addProperty("entityID", iname.get()); - throw; - } + // This is just to maximize the likelihood of attaching a source to the message for support purposes. + if (policy.getIssuerMetadata()) + annotateException(&ex,policy.getIssuerMetadata()); // throws it + + const Issuer* claimedIssuer = root->getIssuer(); + if (!claimedIssuer || !claimedIssuer->getName()) + throw; + const EntityDescriptor* provider=NULL; + if (!policy.getMetadataProvider() || + !(provider=policy.getMetadataProvider()->getEntityDescriptor(claimedIssuer->getName(), false))) { + // Just record it. + auto_ptr_char iname(claimedIssuer->getName()); + if (iname.get()) + ex.addProperty("entityID", iname.get()); + throw; + } + + if (policy.getRole()) { + const RoleDescriptor* roledesc=provider->getRoleDescriptor(*(policy.getRole()), samlconstants::SAML20P_NS); + if (roledesc) annotateException(&ex,roledesc); // throws it } - if (!issuer) - issuer=provider->getRoleDescriptor(*role, samlconstants::SAML20P_NS); - if (issuer) annotateException(&ex,issuer); // throws it annotateException(&ex,provider); // throws it } - return xmlObject.release(); + xmlObject.release(); + return root; }