2 * Licensed to the University Corporation for Advanced Internet
3 * Development, Inc. (UCAID) under one or more contributor license
4 * agreements. See the NOTICE file distributed with this work for
5 * additional information regarding copyright ownership.
7 * UCAID licenses this file to you under the Apache License,
8 * Version 2.0 (the "License"); you may not use this file except
9 * in compliance with the License. You may obtain a copy of the
12 * http://www.apache.org/licenses/LICENSE-2.0
14 * Unless required by applicable law or agreed to in writing,
15 * software distributed under the License is distributed on an
16 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
17 * either express or implied. See the License for the specific
18 * language governing permissions and limitations under the License.
22 * DelegationAttributeExtractor.cpp
24 * AttributeExtractor for DelegationRestriction information.
28 #include "Application.h"
29 #include "ServiceProvider.h"
30 #include "attribute/ExtensibleAttribute.h"
31 #include "attribute/resolver/AttributeExtractor.h"
32 #include "util/SPConstants.h"
34 #include <boost/shared_ptr.hpp>
35 #include <boost/iterator/indirect_iterator.hpp>
36 #include <saml/saml2/core/Assertions.h>
37 #include <saml/saml2/metadata/Metadata.h>
38 #include <saml/saml2/metadata/MetadataCredentialCriteria.h>
39 #include <xmltooling/security/CredentialResolver.h>
40 #include <xmltooling/util/DateTime.h>
41 #include <xmltooling/util/XMLHelper.h>
42 #include <xercesc/util/XMLUniDefs.hpp>
44 using namespace shibsp;
45 using namespace opensaml::saml2md;
46 using namespace opensaml;
47 using namespace xmltooling;
48 using namespace boost;
53 #if defined (_MSC_VER)
54 #pragma warning( push )
55 #pragma warning( disable : 4250 )
58 class DelegationExtractor : public AttributeExtractor
61 DelegationExtractor(const DOMElement* e);
62 ~DelegationExtractor() {}
71 void extractAttributes(
72 const Application& application, const RoleDescriptor* issuer, const XMLObject& xmlObject, vector<Attribute*>& attributes
75 void getAttributeIds(std::vector<std::string>& attributes) const {
76 attributes.push_back(m_attributeId);
80 string m_attributeId,m_formatter;
83 #if defined (_MSC_VER)
84 #pragma warning( pop )
87 AttributeExtractor* SHIBSP_DLLLOCAL DelegationAttributeExtractorFactory(const DOMElement* const & e)
89 return new DelegationExtractor(e);
92 static const XMLCh attributeId[] = UNICODE_LITERAL_11(a,t,t,r,i,b,u,t,e,I,d);
93 static const XMLCh formatter[] = UNICODE_LITERAL_9(f,o,r,m,a,t,t,e,r);
96 DelegationExtractor::DelegationExtractor(const DOMElement* e)
97 : m_attributeId(XMLHelper::getAttrString(e, "delegate", attributeId)),
98 m_formatter(XMLHelper::getAttrString(e, "$Name", formatter))
102 void DelegationExtractor::extractAttributes(
103 const Application& application, const RoleDescriptor* issuer, const XMLObject& xmlObject, vector<Attribute*>& attributes
106 const saml2::Assertion* assertion = dynamic_cast<const saml2::Assertion*>(&xmlObject);
107 if (!assertion || !assertion->getConditions())
110 Category& log = Category::getInstance(SHIBSP_LOGCAT".AttributeExtractor.Delegation");
112 const vector<saml2::Condition*>& conditions = const_cast<const saml2::Conditions*>(assertion->getConditions())->getConditions();
113 for (vector<saml2::Condition*>::const_iterator c = conditions.begin(); c != conditions.end(); ++c) {
114 const saml2::DelegationRestrictionType* drt = dynamic_cast<const saml2::DelegationRestrictionType*>(*c);
116 auto_ptr<ExtensibleAttribute> attr(new ExtensibleAttribute(vector<string>(1,m_attributeId), m_formatter.c_str()));
118 const vector<saml2::Delegate*>& dels = drt->getDelegates();
119 for (indirect_iterator<vector<saml2::Delegate*>::const_iterator> d = make_indirect_iterator(dels.begin());
120 d != make_indirect_iterator(dels.end()); ++d) {
121 if (d->getBaseID()) {
122 log.error("delegate identified by saml:BaseID cannot be processed into an attribute value");
126 saml2::NameID* n = nullptr;
127 boost::shared_ptr<saml2::NameID> namewrapper;
128 if (d->getEncryptedID()) {
129 CredentialResolver* cr = application.getCredentialResolver();
131 log.warn("found encrypted Delegate, but no CredentialResolver was available");
135 const XMLCh* recipient = application.getRelyingParty(
136 issuer ? dynamic_cast<EntityDescriptor*>(issuer->getParent()) : nullptr
137 )->getXMLString("entityID").second;
138 Locker credlocker(cr);
140 MetadataCredentialCriteria mcc(*issuer);
141 boost::shared_ptr<XMLObject> decrypted(d->getEncryptedID()->decrypt(*cr, recipient, &mcc));
142 namewrapper = dynamic_pointer_cast<saml2::NameID>(decrypted);
143 n = namewrapper.get();
146 boost::shared_ptr<XMLObject> decrypted(d->getEncryptedID()->decrypt(*cr, recipient));
147 namewrapper = dynamic_pointer_cast<saml2::NameID>(decrypted);
148 n = namewrapper.get();
150 if (n && log.isDebugEnabled())
151 log.debugStream() << "decrypted Delegate: " << *n << logging::eol;
153 catch (std::exception& ex) {
154 log.error("caught exception decrypting Delegate: %s", ex.what());
162 DDF val = DDF(nullptr).structure();
163 if (d->getConfirmationMethod()) {
164 auto_ptr_char temp(d->getConfirmationMethod());
165 val.addmember("ConfirmationMethod").string(temp.get());
167 if (d->getDelegationInstant()) {
168 auto_ptr_char temp(d->getDelegationInstant()->getRawData());
169 val.addmember("DelegationInstant").string(temp.get());
172 auto_arrayptr<char> name(toUTF8(n->getName()));
173 if (name.get() && *name.get()) {
174 val.addmember("Name").string(name.get());
175 auto_arrayptr<char> format(toUTF8(n->getFormat()));
177 val.addmember("Format").string(format.get());
179 auto_arrayptr<char> nq(toUTF8(n->getNameQualifier()));
181 val.addmember("NameQualifier").string(nq.get());
183 auto_arrayptr<char> spnq(toUTF8(n->getSPNameQualifier()));
185 val.addmember("SPNameQualifier").string(spnq.get());
187 auto_arrayptr<char> sppid(toUTF8(n->getSPProvidedID()));
189 val.addmember("SPProvidedID").string(sppid.get());
193 attr->getValues().add(val);
199 attributes.push_back(attr.get());