shibsp/ServiceProvider.cpp

   1 /*
   2  *  Copyright 2001-2007 Internet2
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /**
  18  * ServiceProvider.cpp
  19  *
  20  * Interface to a Shibboleth ServiceProvider instance.
  21  */
  22
  23 #include "internal.h"
  24 #include "exceptions.h"
  25 #include "AccessControl.h"
  26 #include "Application.h"
  27 #include "ServiceProvider.h"
  28 #include "SessionCache.h"
  29 #include "SPRequest.h"
  30 #include "attribute/Attribute.h"
  31 #include "handler/SessionInitiator.h"
  32 #include "util/TemplateParameters.h"
  33
  34 #include <fstream>
  35 #include <sstream>
  36 #include <xmltooling/XMLToolingConfig.h>
  37 #include <xmltooling/util/NDC.h>
  38 #include <xmltooling/util/XMLHelper.h>
  39
  40 using namespace shibsp;
  41 using namespace xmltooling;
  42 using namespace std;
  43
  44 namespace shibsp {
  45     SHIBSP_DLLLOCAL PluginManager<ServiceProvider,string,const DOMElement*>::Factory XMLServiceProviderFactory;
  46
  47     long SHIBSP_DLLLOCAL sendError(SPRequest& request, const Application* app, const char* page, TemplateParameters& tp, bool mayRedirect=false)
  48     {
  49         if (mayRedirect) {
  50             // Check for redirection on errors instead of template.
  51             const PropertySet* sessions=app ? app->getPropertySet("Sessions") : NULL;
  52             pair<bool,const char*> redirectErrors = sessions ? sessions->getString("redirectErrors") : pair<bool,const char*>(false,NULL);
  53             if (redirectErrors.first) {
  54                 string loc(redirectErrors.second);
  55                 loc = loc + '?' + tp.toQueryString();
  56                 return request.sendRedirect(loc.c_str());
  57             }
  58         }
  59
  60         request.setContentType("text/html");
  61         request.setResponseHeader("Expires","01-Jan-1997 12:00:00 GMT");
  62         request.setResponseHeader("Cache-Control","private,no-store,no-cache");
  63
  64         const PropertySet* props=app ? app->getPropertySet("Errors") : NULL;
  65         if (props) {
  66             pair<bool,const char*> p=props->getString(page);
  67             if (p.first) {
  68                 ifstream infile(p.second);
  69                 if (infile) {
  70                     tp.setPropertySet(props);
  71                     stringstream str;
  72                     XMLToolingConfig::getConfig().getTemplateEngine()->run(infile, str, tp, tp.getRichException());
  73                     return request.sendResponse(str);
  74                 }
  75             }
  76             else if (!strcmp(page,"access")) {
  77                 istringstream msg("Access Denied");
  78                 return request.sendResponse(msg, HTTPResponse::XMLTOOLING_HTTP_STATUS_FORBIDDEN);
  79             }
  80         }
  81
  82         string errstr = string("sendError could not process error template (") + page + ")";
  83         request.log(SPRequest::SPError, errstr);
  84         istringstream msg("Internal Server Error. Please contact the site administrator.");
  85         return request.sendError(msg);
  86     }
  87
  88     void SHIBSP_DLLLOCAL clearHeaders(SPRequest& request) {
  89         // Clear invariant stuff.
  90         request.clearHeader("Shib-Identity-Provider");
  91         request.clearHeader("Shib-Authentication-Method");
  92         request.clearHeader("Shib-AuthnContext-Class");
  93         request.clearHeader("Shib-AuthnContext-Decl");
  94         request.clearHeader("Shib-Attributes");
  95         request.clearHeader("Shib-Application-ID");
  96
  97         // TODO: Figure out a way to clear attribute headers...
  98         /*
  99         AttributeExtractor* extractor = request.getApplication().getAttributeExtractor();
 100         if (extractor) {
 101             Locker locker(extractor);
 102             extractor->clearHeaders(request);
 103         }
 104         AttributeResolver* resolver = request.getApplication().getAttributeResolver();
 105         if (resolver) {
 106             Locker locker(resolver);
 107             resolver->clearHeaders(request);
 108         }
 109         */
 110     }
 111 };
 112
 113 void SHIBSP_API shibsp::registerServiceProviders()
 114 {
 115     SPConfig::getConfig().ServiceProviderManager.registerFactory(XML_SERVICE_PROVIDER, XMLServiceProviderFactory);
 116 }
 117
 118 pair<bool,long> ServiceProvider::doAuthentication(SPRequest& request, bool handler) const
 119 {
 120 #ifdef _DEBUG
 121     xmltooling::NDC ndc("doAuthentication");
 122 #endif
 123
 124     const Application* app=NULL;
 125     string targetURL = request.getRequestURL();
 126
 127     try {
 128         RequestMapper::Settings settings = request.getRequestSettings();
 129         app = &(request.getApplication());
 130
 131         // If not SSL, check to see if we should block or redirect it.
 132         if (!request.isSecure()) {
 133             pair<bool,const char*> redirectToSSL = settings.first->getString("redirectToSSL");
 134             if (redirectToSSL.first) {
 135 #ifdef HAVE_STRCASECMP
 136                 if (!strcasecmp("GET",request.getMethod()) || !strcasecmp("HEAD",request.getMethod())) {
 137 #else
 138                 if (!stricmp("GET",request.getMethod()) || !stricmp("HEAD",request.getMethod())) {
 139 #endif
 140                     // Compute the new target URL
 141                     string redirectURL = string("https://") + request.getHostname();
 142                     if (strcmp(redirectToSSL.second,"443")) {
 143                         redirectURL = redirectURL + ':' + redirectToSSL.second;
 144                     }
 145                     redirectURL += request.getRequestURI();
 146                     return make_pair(true, request.sendRedirect(redirectURL.c_str()));
 147                 }
 148                 else {
 149                     TemplateParameters tp;
 150                     tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 151                     return make_pair(true,sendError(request, app, "ssl", tp));
 152                 }
 153             }
 154         }
 155
 156         const char* handlerURL=request.getHandlerURL(targetURL.c_str());
 157         if (!handlerURL)
 158             throw ConfigurationException("Cannot determine handler from resource URL, check configuration.");
 159
 160         // If the request URL contains the handler base URL for this application, either dispatch
 161         // directly (mainly Apache 2.0) or just pass back control.
 162         if (strstr(targetURL.c_str(),handlerURL)) {
 163             if (handler)
 164                 return doHandler(request);
 165             else
 166                 return make_pair(true, request.returnOK());
 167         }
 168
 169         // Three settings dictate how to proceed.
 170         pair<bool,const char*> authType = settings.first->getString("authType");
 171         pair<bool,bool> requireSession = settings.first->getBool("requireSession");
 172         pair<bool,const char*> requireSessionWith = settings.first->getString("requireSessionWith");
 173
 174         // If no session is required AND the AuthType (an Apache-derived concept) isn't shibboleth,
 175         // then we ignore this request and consider it unprotected. Apache might lie to us if
 176         // ShibBasicHijack is on, but that's up to it.
 177         if ((!requireSession.first || !requireSession.second) && !requireSessionWith.first &&
 178 #ifdef HAVE_STRCASECMP
 179                 (!authType.first || strcasecmp(authType.second,"shibboleth")))
 180 #else
 181                 (!authType.first || _stricmp(authType.second,"shibboleth")))
 182 #endif
 183             return make_pair(true,request.returnDecline());
 184
 185         // Fix for secadv 20050901
 186         clearHeaders(request);
 187
 188         Session* session = NULL;
 189         try {
 190             session = request.getSession();
 191         }
 192         catch (exception& e) {
 193             request.log(SPRequest::SPWarn, string("error during session lookup: ") + e.what());
 194             // If it's not a retryable session failure, we throw to the outer handler for reporting.
 195             if (dynamic_cast<opensaml::RetryableProfileException*>(&e)==NULL)
 196                 throw;
 197         }
 198
 199         if (!session) {
 200             // No session.  Maybe that's acceptable?
 201             if ((!requireSession.first || !requireSession.second) && !requireSessionWith.first)
 202                 return make_pair(true,request.returnOK());
 203
 204             // No session, but we require one. Initiate a new session using the indicated method.
 205             const Handler* initiator=NULL;
 206             if (requireSessionWith.first) {
 207                 initiator=app->getSessionInitiatorById(requireSessionWith.second);
 208                 if (!initiator)
 209                     throw ConfigurationException(
 210                         "No session initiator found with id ($1), check requireSessionWith command.",
 211                         params(1,requireSessionWith.second)
 212                         );
 213             }
 214             else {
 215                 initiator=app->getDefaultSessionInitiator();
 216                 if (!initiator)
 217                     throw ConfigurationException("No default session initiator found, check configuration.");
 218             }
 219
 220             return initiator->run(request,false);
 221         }
 222
 223         // We're done.  Everything is okay.  Nothing to report.  Nothing to do..
 224         // Let the caller decide how to proceed.
 225         request.log(SPRequest::SPDebug, "doAuthentication succeeded");
 226         return make_pair(false,0);
 227     }
 228     catch (exception& e) {
 229         TemplateParameters tp(&e);
 230         tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 231         return make_pair(true,sendError(request, app, "session", tp));
 232     }
 233 #ifndef _DEBUG
 234     catch (...) {
 235         TemplateParameters tp;
 236         tp.m_map["errorType"] = "Unexpected Error";
 237         tp.m_map["errorText"] = "Caught an unknown exception.";
 238         tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 239         return make_pair(true,sendError(request, app, "session", tp));
 240     }
 241 #endif
 242 }
 243
 244 pair<bool,long> ServiceProvider::doAuthorization(SPRequest& request) const
 245 {
 246 #ifdef _DEBUG
 247     xmltooling::NDC ndc("doAuthorization");
 248 #endif
 249
 250     const Application* app=NULL;
 251     string targetURL = request.getRequestURL();
 252
 253     try {
 254         RequestMapper::Settings settings = request.getRequestSettings();
 255         app = &(request.getApplication());
 256
 257         // Three settings dictate how to proceed.
 258         pair<bool,const char*> authType = settings.first->getString("authType");
 259         pair<bool,bool> requireSession = settings.first->getBool("requireSession");
 260         pair<bool,const char*> requireSessionWith = settings.first->getString("requireSessionWith");
 261
 262         // If no session is required AND the AuthType (an Apache-derived concept) isn't shibboleth,
 263         // then we ignore this request and consider it unprotected. Apache might lie to us if
 264         // ShibBasicHijack is on, but that's up to it.
 265         if ((!requireSession.first || !requireSession.second) && !requireSessionWith.first &&
 266 #ifdef HAVE_STRCASECMP
 267                 (!authType.first || strcasecmp(authType.second,"shibboleth")))
 268 #else
 269                 (!authType.first || _stricmp(authType.second,"shibboleth")))
 270 #endif
 271             return make_pair(true,request.returnDecline());
 272
 273         // Do we have an access control plugin?
 274         if (settings.second) {
 275             const Session* session = NULL;
 276             try {
 277                 session = request.getSession();
 278             }
 279             catch (exception& e) {
 280                 request.log(SPRequest::SPWarn, string("unable to obtain session to pass to access control provider: ") + e.what());
 281             }
 282
 283             Locker acllock(settings.second);
 284             if (settings.second->authorized(request,session)) {
 285                 // Let the caller decide how to proceed.
 286                 request.log(SPRequest::SPDebug, "access control provider granted access");
 287                 return make_pair(false,0);
 288             }
 289             else {
 290                 request.log(SPRequest::SPWarn, "access control provider denied access");
 291                 TemplateParameters tp;
 292                 tp.m_map["requestURL"] = targetURL;
 293                 return make_pair(true,sendError(request, app, "access", tp));
 294             }
 295             return make_pair(false,0);
 296         }
 297         else
 298             return make_pair(true,request.returnDecline());
 299     }
 300     catch (exception& e) {
 301         TemplateParameters tp(&e);
 302         tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 303         return make_pair(true,sendError(request, app, "access", tp));
 304     }
 305 #ifndef _DEBUG
 306     catch (...) {
 307         TemplateParameters tp;
 308         tp.m_map["errorType"] = "Unexpected Error";
 309         tp.m_map["errorText"] = "Caught an unknown exception.";
 310         tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 311         return make_pair(true,sendError(request, app, "access", tp));
 312     }
 313 #endif
 314 }
 315
 316 pair<bool,long> ServiceProvider::doExport(SPRequest& request, bool requireSession) const
 317 {
 318 #ifdef _DEBUG
 319     xmltooling::NDC ndc("doExport");
 320 #endif
 321
 322     const Application* app=NULL;
 323     string targetURL = request.getRequestURL();
 324
 325     try {
 326         RequestMapper::Settings settings = request.getRequestSettings();
 327         app = &(request.getApplication());
 328
 329         const Session* session = NULL;
 330         try {
 331             session = request.getSession();
 332         }
 333         catch (exception& e) {
 334             request.log(SPRequest::SPWarn, string("unable to obtain session to export to request: ") +  e.what());
 335                 // If we have to have a session, then this is a fatal error.
 336                 if (requireSession)
 337                         throw;
 338         }
 339
 340                 // Still no data?
 341         if (!session) {
 342                 if (requireSession)
 343                 throw opensaml::RetryableProfileException("Unable to obtain session to export to request.");
 344                 else
 345                         return make_pair(false,0);      // just bail silently
 346         }
 347
 348         request.setHeader("Shib-Application-ID", app->getId());
 349
 350         // Export the IdP name and Authn method/context info.
 351         const char* hval = session->getEntityID();
 352         if (hval)
 353             request.setHeader("Shib-Identity-Provider", hval);
 354         hval = session->getAuthnContextClassRef();
 355         if (hval) {
 356             request.setHeader("Shib-Authentication-Method", hval);
 357             request.setHeader("Shib-AuthnContext-Class", hval);
 358         }
 359         hval = session->getAuthnContextDeclRef();
 360         if (hval)
 361             request.setHeader("Shib-AuthnContext-Decl", hval);
 362
 363         // Maybe export the assertion keys.
 364         pair<bool,bool> exp=settings.first->getBool("exportAssertion");
 365         if (exp.first && exp.second) {
 366             //setHeader("Shib-Attributes", reinterpret_cast<char*>(serialized));
 367             // TODO: export lookup URLs to access assertions by ID
 368             const vector<const char*>& tokens = session->getAssertionIDs();
 369         }
 370
 371         // Export the attributes.
 372         bool remoteUserSet = false;
 373         const multimap<string,Attribute*>& attributes = session->getAttributes();
 374         for (multimap<string,Attribute*>::const_iterator a = attributes.begin(); a!=attributes.end(); ++a) {
 375             const vector<string>& vals = a->second->getSerializedValues();
 376
 377             // See if this needs to be set as the REMOTE_USER value.
 378             if (!remoteUserSet && !vals.empty() && app->getRemoteUserAttributeIds().count(a->first)) {
 379                 request.setRemoteUser(vals.front().c_str());
 380                 remoteUserSet = true;
 381             }
 382
 383             // Handle the normal export case.
 384             string header(request.getSecureHeader(a->first.c_str()));
 385             for (vector<string>::const_iterator v = vals.begin(); v!=vals.end(); ++v) {
 386                 if (!header.empty())
 387                     header += ";";
 388                 string::size_type pos = v->find_first_of(';',string::size_type(0));
 389                 if (pos!=string::npos) {
 390                     string value(*v);
 391                     for (; pos != string::npos; pos = value.find_first_of(';',pos)) {
 392                         value.insert(pos, "\\");
 393                         pos += 2;
 394                     }
 395                     header += value;
 396                 }
 397                 else {
 398                     header += (*v);
 399                 }
 400             }
 401             request.setHeader(a->first.c_str(), header.c_str());
 402         }
 403
 404         return make_pair(false,0);
 405     }
 406     catch (exception& e) {
 407         TemplateParameters tp(&e);
 408         tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 409         return make_pair(true,sendError(request, app, "rm", tp));
 410     }
 411 #ifndef _DEBUG
 412     catch (...) {
 413         TemplateParameters tp;
 414         tp.m_map["errorType"] = "Unexpected Error";
 415         tp.m_map["errorText"] = "Caught an unknown exception.";
 416         tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 417         return make_pair(true,sendError(request, app, "rm", tp));
 418     }
 419 #endif
 420 }
 421
 422 pair<bool,long> ServiceProvider::doHandler(SPRequest& request) const
 423 {
 424 #ifdef _DEBUG
 425     xmltooling::NDC ndc("doHandler");
 426 #endif
 427
 428     const Application* app=NULL;
 429     string targetURL = request.getRequestURL();
 430
 431     try {
 432         RequestMapper::Settings settings = request.getRequestSettings();
 433         app = &(request.getApplication());
 434
 435         const char* handlerURL=request.getHandlerURL(targetURL.c_str());
 436         if (!handlerURL)
 437             throw ConfigurationException("Cannot determine handler from resource URL, check configuration.");
 438
 439         // Make sure we only process handler requests.
 440         if (!strstr(targetURL.c_str(),handlerURL))
 441             return make_pair(true, request.returnDecline());
 442
 443         const PropertySet* sessionProps=app->getPropertySet("Sessions");
 444         if (!sessionProps)
 445             throw ConfigurationException("Unable to map request to application session settings, check configuration.");
 446
 447         // Process incoming request.
 448         pair<bool,bool> handlerSSL=sessionProps->getBool("handlerSSL");
 449
 450         // Make sure this is SSL, if it should be
 451         if ((!handlerSSL.first || handlerSSL.second) && !request.isSecure())
 452             throw opensaml::FatalProfileException("Blocked non-SSL access to Shibboleth handler.");
 453
 454         // We dispatch based on our path info. We know the request URL begins with or equals the handler URL,
 455         // so the path info is the next character (or null).
 456         const Handler* handler=app->getHandler(targetURL.c_str() + strlen(handlerURL));
 457         if (!handler)
 458             throw ConfigurationException("Shibboleth handler invoked at an unconfigured location.");
 459
 460         pair<bool,long> hret=handler->run(request);
 461
 462         // Did the handler run successfully?
 463         if (hret.first)
 464             return hret;
 465
 466         throw ConfigurationException("Configured Shibboleth handler failed to process the request.");
 467     }
 468     catch (opensaml::saml2md::MetadataException& e) {
 469         TemplateParameters tp(&e);
 470         tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 471         // See if a metadata error page is installed.
 472         const PropertySet* props=app ? app->getPropertySet("Errors") : NULL;
 473         if (props) {
 474             pair<bool,const char*> p=props->getString("metadata");
 475             if (p.first)
 476                 return make_pair(true,sendError(request, app, "metadata", tp, true));
 477         }
 478         return make_pair(true,sendError(request, app, "session", tp, true));
 479     }
 480     catch (exception& e) {
 481         TemplateParameters tp(&e);
 482         tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 483         return make_pair(true,sendError(request, app, "session", tp, true));
 484     }
 485 #ifndef _DEBUG
 486     catch (...) {
 487         TemplateParameters tp;
 488         tp.m_map["errorType"] = "Unexpected Error";
 489         tp.m_map["errorText"] = "Caught an unknown exception.";
 490         tp.m_map["requestURL"] = targetURL.substr(0,targetURL.find('?'));
 491         return make_pair(true,sendError(request, app, "session", tp, true));
 492     }
 493 #endif
 494 }