shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp

   1 /**
   2  * Licensed to the University Corporation for Advanced Internet
   3  * Development, Inc. (UCAID) under one or more contributor license
   4  * agreements. See the NOTICE file distributed with this work for
   5  * additional information regarding copyright ownership.
   6  *
   7  * UCAID licenses this file to you under the Apache License,
   8  * Version 2.0 (the "License"); you may not use this file except
   9  * in compliance with the License. You may obtain a copy of the
  10  * License at
  11  *
  12  * http://www.apache.org/licenses/LICENSE-2.0
  13  *
  14  * Unless required by applicable law or agreed to in writing,
  15  * software distributed under the License is distributed on an
  16  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
  17  * either express or implied. See the License for the specific
  18  * language governing permissions and limitations under the License.
  19  */
  20
  21 /**
  22  * SimpleAggregationAttributeResolver.cpp
  23  *
  24  * AttributeResolver based on SAML queries to third-party AA sources.
  25  */
  26
  27 #include "internal.h"
  28 #include "exceptions.h"
  29 #include "Application.h"
  30 #include "ServiceProvider.h"
  31 #include "SessionCache.h"
  32 #include "attribute/NameIDAttribute.h"
  33 #include "attribute/SimpleAttribute.h"
  34 #include "attribute/filtering/AttributeFilter.h"
  35 #include "attribute/filtering/BasicFilteringContext.h"
  36 #include "attribute/resolver/AttributeExtractor.h"
  37 #include "attribute/resolver/AttributeResolver.h"
  38 #include "attribute/resolver/ResolutionContext.h"
  39 #include "binding/SOAPClient.h"
  40 #include "metadata/MetadataProviderCriteria.h"
  41 #include "security/SecurityPolicy.h"
  42 #include "security/SecurityPolicyProvider.h"
  43 #include "util/SPConstants.h"
  44
  45 #include <boost/algorithm/string.hpp>
  46 #include <boost/iterator/indirect_iterator.hpp>
  47 #include <boost/ptr_container/ptr_vector.hpp>
  48 #include <saml/exceptions.h>
  49 #include <saml/SAMLConfig.h>
  50 #include <saml/saml2/binding/SAML2SOAPClient.h>
  51 #include <saml/saml2/core/Protocols.h>
  52 #include <saml/saml2/metadata/Metadata.h>
  53 #include <saml/saml2/metadata/MetadataCredentialCriteria.h>
  54 #include <saml/saml2/metadata/MetadataProvider.h>
  55 #include <xmltooling/XMLToolingConfig.h>
  56 #include <xmltooling/security/TrustEngine.h>
  57 #include <xmltooling/util/NDC.h>
  58 #include <xmltooling/util/URLEncoder.h>
  59 #include <xmltooling/util/XMLHelper.h>
  60 #include <xercesc/util/XMLUniDefs.hpp>
  61
  62 using namespace shibsp;
  63 using namespace opensaml::saml2;
  64 using namespace opensaml::saml2p;
  65 using namespace opensaml::saml2md;
  66 using namespace opensaml;
  67 using namespace xmltooling;
  68 using namespace boost;
  69 using namespace std;
  70
  71 namespace shibsp {
  72
  73     class SHIBSP_DLLLOCAL SimpleAggregationContext : public ResolutionContext
  74     {
  75     public:
  76         SimpleAggregationContext(const Application& application, const Session& session)
  77             : m_app(application),
  78               m_request(nullptr),
  79               m_session(&session),
  80               m_nameid(nullptr),
  81               m_class(session.getAuthnContextClassRef()),
  82               m_decl(session.getAuthnContextDeclRef()),
  83               m_inputTokens(nullptr),
  84               m_inputAttributes(nullptr) {
  85         }
  86
  87         SimpleAggregationContext(
  88             const Application& application,
  89             const GenericRequest* request=nullptr,
  90             const NameID* nameid=nullptr,
  91             const XMLCh* entityID=nullptr,
  92             const XMLCh* authncontext_class=nullptr,
  93             const XMLCh* authncontext_decl=nullptr,
  94             const vector<const opensaml::Assertion*>* tokens=nullptr,
  95             const vector<shibsp::Attribute*>* attributes=nullptr
  96             ) : m_app(application),
  97                 m_request(request),
  98                 m_session(nullptr),
  99                 m_nameid(nameid),
 100                 m_entityid(entityID),
 101                 m_class(authncontext_class),
 102                 m_decl(authncontext_decl),
 103                 m_inputTokens(tokens),
 104                 m_inputAttributes(attributes) {
 105         }
 106
 107         ~SimpleAggregationContext() {
 108             for_each(m_attributes.begin(), m_attributes.end(), xmltooling::cleanup<shibsp::Attribute>());
 109             for_each(m_assertions.begin(), m_assertions.end(), xmltooling::cleanup<opensaml::Assertion>());
 110         }
 111
 112         const Application& getApplication() const {
 113             return m_app;
 114         }
 115         const GenericRequest* getRequest() const {
 116             return m_request;
 117         }
 118         const char* getEntityID() const {
 119             return m_session ? m_session->getEntityID() : m_entityid.get();
 120         }
 121         const NameID* getNameID() const {
 122             return m_session ? m_session->getNameID() : m_nameid;
 123         }
 124         const XMLCh* getClassRef() const {
 125             return m_class.get();
 126         }
 127         const XMLCh* getDeclRef() const {
 128             return m_decl.get();
 129         }
 130         const Session* getSession() const {
 131             return m_session;
 132         }
 133         const vector<shibsp::Attribute*>* getInputAttributes() const {
 134             return m_inputAttributes;
 135         }
 136         const vector<const opensaml::Assertion*>* getInputTokens() const {
 137             return m_inputTokens;
 138         }
 139         vector<shibsp::Attribute*>& getResolvedAttributes() {
 140             return m_attributes;
 141         }
 142         vector<opensaml::Assertion*>& getResolvedAssertions() {
 143             return m_assertions;
 144         }
 145
 146     private:
 147         const Application& m_app;
 148         const GenericRequest* m_request;
 149         const Session* m_session;
 150         const NameID* m_nameid;
 151         auto_ptr_char m_entityid;
 152         auto_ptr_XMLCh m_class;
 153         auto_ptr_XMLCh m_decl;
 154         const vector<const opensaml::Assertion*>* m_inputTokens;
 155         const vector<shibsp::Attribute*>* m_inputAttributes;
 156         vector<shibsp::Attribute*> m_attributes;
 157         vector<opensaml::Assertion*> m_assertions;
 158     };
 159
 160     class SHIBSP_DLLLOCAL SimpleAggregationResolver : public AttributeResolver
 161     {
 162     public:
 163         SimpleAggregationResolver(const DOMElement* e);
 164         ~SimpleAggregationResolver() {}
 165
 166         Lockable* lock() {return this;}
 167         void unlock() {}
 168
 169         // deprecated method
 170         ResolutionContext* createResolutionContext(
 171             const Application& application,
 172             const EntityDescriptor* issuer,
 173             const XMLCh* protocol,
 174             const NameID* nameid=nullptr,
 175             const XMLCh* authncontext_class=nullptr,
 176             const XMLCh* authncontext_decl=nullptr,
 177             const vector<const opensaml::Assertion*>* tokens=nullptr,
 178             const vector<shibsp::Attribute*>* attributes=nullptr
 179             ) const {
 180             return createResolutionContext(application, nullptr, issuer, protocol, nameid, authncontext_class, authncontext_decl, tokens, attributes);
 181         }
 182
 183         ResolutionContext* createResolutionContext(
 184             const Application& application,
 185             const GenericRequest* request,
 186             const EntityDescriptor* issuer,
 187             const XMLCh* protocol,
 188             const NameID* nameid=nullptr,
 189             const XMLCh* authncontext_class=nullptr,
 190             const XMLCh* authncontext_decl=nullptr,
 191             const vector<const opensaml::Assertion*>* tokens=nullptr,
 192             const vector<shibsp::Attribute*>* attributes=nullptr
 193             ) const {
 194             return new SimpleAggregationContext(
 195                 application, request, nameid, (issuer ? issuer->getEntityID() : nullptr), authncontext_class, authncontext_decl, tokens, attributes
 196                 );
 197         }
 198
 199         ResolutionContext* createResolutionContext(const Application& application, const Session& session) const {
 200             return new SimpleAggregationContext(application,session);
 201         }
 202
 203         void resolveAttributes(ResolutionContext& ctx) const;
 204
 205         void getAttributeIds(vector<string>& attributes) const {
 206             if (m_extractor)
 207                 m_extractor->getAttributeIds(attributes);
 208         }
 209
 210     private:
 211         void doQuery(SimpleAggregationContext& ctx, const char* entityID, const NameID* name) const;
 212
 213         Category& m_log;
 214         string m_policyId;
 215         bool m_subjectMatch;
 216         vector<string> m_attributeIds;
 217         xstring m_format;
 218         scoped_ptr<MetadataProvider> m_metadata;
 219         scoped_ptr<TrustEngine> m_trust;
 220         scoped_ptr<AttributeExtractor> m_extractor;
 221         scoped_ptr<AttributeFilter> m_filter;
 222         ptr_vector<saml2::Attribute> m_designators;
 223         vector< pair<string,bool> > m_sources;
 224         vector<string> m_exceptionId;
 225     };
 226
 227     AttributeResolver* SHIBSP_DLLLOCAL SimpleAggregationResolverFactory(const DOMElement* const & e)
 228     {
 229         return new SimpleAggregationResolver(e);
 230     }
 231
 232     static const XMLCh _AttributeExtractor[] =  UNICODE_LITERAL_18(A,t,t,r,i,b,u,t,e,E,x,t,r,a,c,t,o,r);
 233     static const XMLCh _AttributeFilter[] =     UNICODE_LITERAL_15(A,t,t,r,i,b,u,t,e,F,i,l,t,e,r);
 234     static const XMLCh attributeId[] =          UNICODE_LITERAL_11(a,t,t,r,i,b,u,t,e,I,d);
 235     static const XMLCh Entity[] =               UNICODE_LITERAL_6(E,n,t,i,t,y);
 236     static const XMLCh EntityReference[] =      UNICODE_LITERAL_15(E,n,t,i,t,y,R,e,f,e,r,e,n,c,e);
 237     static const XMLCh exceptionId[] =          UNICODE_LITERAL_11(e,x,c,e,p,t,i,o,n,I,d);
 238     static const XMLCh format[] =               UNICODE_LITERAL_6(f,o,r,m,a,t);
 239     static const XMLCh _MetadataProvider[] =    UNICODE_LITERAL_16(M,e,t,a,d,a,t,a,P,r,o,v,i,d,e,r);
 240     static const XMLCh policyId[] =             UNICODE_LITERAL_8(p,o,l,i,c,y,I,d);
 241     static const XMLCh subjectMatch[] =         UNICODE_LITERAL_12(s,u,b,j,e,c,t,M,a,t,c,h);
 242     static const XMLCh _TrustEngine[] =         UNICODE_LITERAL_11(T,r,u,s,t,E,n,g,i,n,e);
 243     static const XMLCh _type[] =                UNICODE_LITERAL_4(t,y,p,e);
 244 };
 245
 246 SimpleAggregationResolver::SimpleAggregationResolver(const DOMElement* e)
 247     : m_log(Category::getInstance(SHIBSP_LOGCAT".AttributeResolver.SimpleAggregation")),
 248         m_policyId(XMLHelper::getAttrString(e, nullptr, policyId)),
 249         m_subjectMatch(XMLHelper::getAttrBool(e, false, subjectMatch))
 250 {
 251 #ifdef _DEBUG
 252     xmltooling::NDC ndc("SimpleAggregationResolver");
 253 #endif
 254
 255     const XMLCh* aid = e ? e->getAttributeNS(nullptr, attributeId) : nullptr;
 256     if (aid && *aid) {
 257         auto_ptr_char dup(aid);
 258         string sdup(dup.get());
 259         trim(sdup);
 260         split(m_attributeIds, sdup, is_space(), algorithm::token_compress_on);
 261
 262         aid = e->getAttributeNS(nullptr, format);
 263         if (aid && *aid)
 264             m_format = aid;
 265     }
 266
 267     string exid(XMLHelper::getAttrString(e, nullptr, exceptionId));
 268     if (!exid.empty())
 269         m_exceptionId.push_back(exid);
 270
 271     DOMElement* child = XMLHelper::getFirstChildElement(e, _MetadataProvider);
 272     if (child) {
 273         string t(XMLHelper::getAttrString(child, nullptr, _type));
 274         if (t.empty())
 275             throw ConfigurationException("MetadataProvider element missing type attribute.");
 276         m_log.info("building MetadataProvider of type %s...", t.c_str());
 277         m_metadata.reset(SAMLConfig::getConfig().MetadataProviderManager.newPlugin(t.c_str(), child));
 278         m_metadata->init();
 279     }
 280
 281     child = XMLHelper::getFirstChildElement(e,  _TrustEngine);
 282     if (child) {
 283         string t(XMLHelper::getAttrString(child, nullptr, _type));
 284         if (t.empty())
 285             throw ConfigurationException("TrustEngine element missing type attribute.");
 286         m_log.info("building TrustEngine of type %s...", t.c_str());
 287         m_trust.reset(XMLToolingConfig::getConfig().TrustEngineManager.newPlugin(t.c_str(), child));
 288     }
 289
 290     child = XMLHelper::getFirstChildElement(e,  _AttributeExtractor);
 291     if (child) {
 292         string t(XMLHelper::getAttrString(child, nullptr, _type));
 293         if (t.empty())
 294             throw ConfigurationException("AttributeExtractor element missing type attribute.");
 295         m_log.info("building AttributeExtractor of type %s...", t.c_str());
 296         m_extractor.reset(SPConfig::getConfig().AttributeExtractorManager.newPlugin(t.c_str(), child));
 297     }
 298
 299     child = XMLHelper::getFirstChildElement(e,  _AttributeFilter);
 300     if (child) {
 301         string t(XMLHelper::getAttrString(child, nullptr, _type));
 302         if (t.empty())
 303             throw ConfigurationException("AttributeFilter element missing type attribute.");
 304         m_log.info("building AttributeFilter of type %s...", t.c_str());
 305         m_filter.reset(SPConfig::getConfig().AttributeFilterManager.newPlugin(t.c_str(), child));
 306     }
 307
 308     child = XMLHelper::getFirstChildElement(e);
 309     while (child) {
 310         if (child->hasChildNodes() && XMLString::equals(child->getLocalName(), Entity)) {
 311             aid = child->getFirstChild()->getNodeValue();
 312             if (aid && *aid) {
 313                 auto_ptr_char taid(aid);
 314                 m_sources.push_back(pair<string,bool>(taid.get(),true));
 315             }
 316         }
 317         else if (child->hasChildNodes() && XMLString::equals(child->getLocalName(), EntityReference)) {
 318             aid = child->getFirstChild()->getNodeValue();
 319             if (aid && *aid) {
 320                 auto_ptr_char taid(aid);
 321                 m_sources.push_back(pair<string,bool>(taid.get(),false));
 322             }
 323         }
 324         else if (XMLHelper::isNodeNamed(child, samlconstants::SAML20_NS, saml2::Attribute::LOCAL_NAME)) {
 325             try {
 326                 auto_ptr<XMLObject> obj(saml2::AttributeBuilder::buildOneFromElement(child));
 327                 saml2::Attribute* down = dynamic_cast<saml2::Attribute*>(obj.get());
 328                 if (down) {
 329                     m_designators.push_back(down);
 330                     obj.release();
 331                 }
 332             }
 333             catch (std::exception& ex) {
 334                 m_log.error("exception loading attribute designator: %s", ex.what());
 335             }
 336         }
 337         child = XMLHelper::getNextSiblingElement(child);
 338     }
 339 }
 340
 341 void SimpleAggregationResolver::doQuery(SimpleAggregationContext& ctx, const char* entityID, const NameID* name) const
 342 {
 343 #ifdef _DEBUG
 344     xmltooling::NDC ndc("doQuery");
 345 #endif
 346     const Application& application = ctx.getApplication();
 347     MetadataProviderCriteria mc(application, entityID, &AttributeAuthorityDescriptor::ELEMENT_QNAME, samlconstants::SAML20P_NS);
 348     Locker mlocker(m_metadata.get());
 349     const AttributeAuthorityDescriptor* AA=nullptr;
 350     pair<const EntityDescriptor*,const RoleDescriptor*> mdresult =
 351         (m_metadata ? m_metadata.get() : application.getMetadataProvider())->getEntityDescriptor(mc);
 352     if (!mdresult.first) {
 353         m_log.warn("unable to locate metadata for provider (%s)", entityID);
 354         return;
 355     }
 356     else if (!(AA=dynamic_cast<const AttributeAuthorityDescriptor*>(mdresult.second))) {
 357         m_log.warn("no SAML 2 AttributeAuthority role found in metadata for (%s)", entityID);
 358         return;
 359     }
 360
 361     const PropertySet* relyingParty = application.getRelyingParty(mdresult.first);
 362     pair<bool,bool> signedAssertions = relyingParty->getBool("requireSignedAssertions");
 363     pair<bool,const char*> encryption = relyingParty->getString("encryption");
 364
 365     // Locate policy key.
 366     const char* policyId = m_policyId.empty() ? application.getString("policyId").second : m_policyId.c_str();
 367
 368     // Set up policy and SOAP client.
 369     scoped_ptr<SecurityPolicy> policy(
 370         application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(application, nullptr, policyId)
 371         );
 372     if (m_metadata)
 373         policy->setMetadataProvider(m_metadata.get());
 374     if (m_trust)
 375         policy->setTrustEngine(m_trust.get());
 376     policy->getAudiences().push_back(relyingParty->getXMLString("entityID").second);
 377
 378     MetadataCredentialCriteria mcc(*AA);
 379     shibsp::SOAPClient soaper(*policy.get());
 380
 381     auto_ptr_XMLCh binding(samlconstants::SAML20_BINDING_SOAP);
 382     auto_ptr<saml2p::StatusResponseType> srt;
 383     const vector<AttributeService*>& endpoints=AA->getAttributeServices();
 384     for (indirect_iterator<vector<AttributeService*>::const_iterator> ep = make_indirect_iterator(endpoints.begin());
 385             !srt.get() && ep != make_indirect_iterator(endpoints.end()); ++ep) {
 386         if (!XMLString::equals(ep->getBinding(), binding.get())  || !ep->getLocation())
 387             continue;
 388         auto_ptr_char loc(ep->getLocation());
 389         try {
 390             auto_ptr<saml2::Subject> subject(saml2::SubjectBuilder::buildSubject());
 391
 392             // Encrypt the NameID?
 393             if (encryption.first && (!strcmp(encryption.second, "true") || !strcmp(encryption.second, "back"))) {
 394                 auto_ptr<EncryptedID> encrypted(EncryptedIDBuilder::buildEncryptedID());
 395                 encrypted->encrypt(
 396                     *name,
 397                     *(policy->getMetadataProvider()),
 398                     mcc,
 399                     false,
 400                     relyingParty->getXMLString("encryptionAlg").second
 401                     );
 402                 subject->setEncryptedID(encrypted.get());
 403                 encrypted.release();
 404             }
 405             else {
 406                 subject->setNameID(name->cloneNameID());
 407             }
 408
 409             saml2p::AttributeQuery* query = saml2p::AttributeQueryBuilder::buildAttributeQuery();
 410             query->setSubject(subject.release());
 411             Issuer* iss = IssuerBuilder::buildIssuer();
 412             iss->setName(relyingParty->getXMLString("entityID").second);
 413             query->setIssuer(iss);
 414             for (ptr_vector<saml2::Attribute>::const_iterator ad = m_designators.begin(); ad != m_designators.end(); ++ad) {
 415                 auto_ptr<saml2::Attribute> adwrapper(ad->cloneAttribute());
 416                 query->getAttributes().push_back(adwrapper.get());
 417                 adwrapper.release();
 418             }
 419
 420             SAML2SOAPClient client(soaper, false);
 421             client.sendSAML(query, application.getId(), mcc, loc.get());
 422             srt.reset(client.receiveSAML());
 423         }
 424         catch (std::exception& ex) {
 425             m_log.error("exception during SAML query to %s: %s", loc.get(), ex.what());
 426             soaper.reset();
 427         }
 428     }
 429
 430     if (!srt.get()) {
 431         m_log.error("unable to obtain a SAML response from attribute authority (%s)", entityID);
 432         throw BindingException("Unable to obtain a SAML response from attribute authority.");
 433     }
 434
 435     saml2p::Response* response = dynamic_cast<saml2p::Response*>(srt.get());
 436     if (!response) {
 437         m_log.error("message was not a samlp:Response");
 438         throw FatalProfileException("Attribute authority returned an unrecognized message.");
 439     }
 440     else if (!response->getStatus() || !response->getStatus()->getStatusCode() ||
 441             !XMLString::equals(response->getStatus()->getStatusCode()->getValue(), saml2p::StatusCode::SUCCESS)) {
 442         m_log.error("attribute authority (%s) returned a SAML error", entityID);
 443         throw FatalProfileException("Attribute authority returned a SAML error.");
 444     }
 445
 446     saml2::Assertion* newtoken = nullptr;
 447     auto_ptr<saml2::Assertion> newtokenwrapper;
 448     const vector<saml2::Assertion*>& assertions = const_cast<const saml2p::Response*>(response)->getAssertions();
 449     if (assertions.empty()) {
 450         // Check for encryption.
 451         const vector<saml2::EncryptedAssertion*>& encassertions =
 452             const_cast<const saml2p::Response*>(response)->getEncryptedAssertions();
 453         if (encassertions.empty()) {
 454             m_log.warn("response from attribute authority was empty");
 455             return;
 456         }
 457         else if (encassertions.size() > 1) {
 458             m_log.warn("simple resolver only supports one assertion in the query response");
 459         }
 460
 461         CredentialResolver* cr=application.getCredentialResolver();
 462         if (!cr) {
 463             m_log.warn("found encrypted assertion, but no CredentialResolver was available");
 464             throw FatalProfileException("Assertion was encrypted, but no decryption credentials are available.");
 465         }
 466
 467         // With this flag on, we block unauthenticated ciphertext when decrypting,
 468         // unless the protocol was authenticated.
 469         pair<bool,bool> authenticatedCipher = application.getBool("requireAuthenticatedEncryption");
 470         if (policy->isAuthenticated())
 471             authenticatedCipher.second = false;
 472
 473         // Attempt to decrypt it.
 474         try {
 475             Locker credlocker(cr);
 476             auto_ptr<XMLObject> tokenwrapper(
 477                 encassertions.front()->decrypt(
 478                     *cr, relyingParty->getXMLString("entityID").second, &mcc, authenticatedCipher.first && authenticatedCipher.second
 479                     )
 480                 );
 481             newtoken = dynamic_cast<saml2::Assertion*>(tokenwrapper.get());
 482             if (newtoken) {
 483                 tokenwrapper.release();
 484                 newtokenwrapper.reset(newtoken);
 485                 if (m_log.isDebugEnabled())
 486                     m_log.debugStream() << "decrypted assertion: " << *newtoken << logging::eol;
 487             }
 488         }
 489         catch (std::exception& ex) {
 490             m_log.error("failed to decrypt assertion: %s", ex.what());
 491             throw;
 492         }
 493     }
 494     else {
 495         if (assertions.size() > 1)
 496             m_log.warn("simple resolver only supports one assertion in the query response");
 497         newtoken = assertions.front();
 498     }
 499
 500     if (!newtoken->getSignature() && signedAssertions.first && signedAssertions.second) {
 501         m_log.error("assertion unsigned, rejecting it based on signedAssertions policy");
 502         throw SecurityPolicyException("Rejected unsigned assertion based on local policy.");
 503     }
 504
 505     try {
 506         // We're going to insist that the assertion issuer is the same as the peer.
 507         // Reset the policy's message bits and extract them from the assertion.
 508         policy->reset(true);
 509         policy->setMessageID(newtoken->getID());
 510         policy->setIssueInstant(newtoken->getIssueInstantEpoch());
 511         policy->setIssuer(newtoken->getIssuer());
 512         policy->evaluate(*newtoken);
 513
 514         // Now we can check the security status of the policy.
 515         if (!policy->isAuthenticated())
 516             throw SecurityPolicyException("Security of SAML 2.0 query result not established.");
 517
 518         if (m_subjectMatch) {
 519             // Check for subject match.
 520             auto_ptr<NameID> nameIDwrapper;
 521             NameID* respName = newtoken->getSubject() ? newtoken->getSubject()->getNameID() : nullptr;
 522             if (!respName) {
 523                 // Check for encryption.
 524                 EncryptedID* encname = newtoken->getSubject() ? newtoken->getSubject()->getEncryptedID() : nullptr;
 525                 if (encname) {
 526                     CredentialResolver* cr=application.getCredentialResolver();
 527                     if (!cr)
 528                         m_log.warn("found EncryptedID, but no CredentialResolver was available");
 529                     else {
 530                         Locker credlocker(cr);
 531                         auto_ptr<XMLObject> decryptedID(encname->decrypt(*cr, relyingParty->getXMLString("entityID").second, &mcc));
 532                         respName = dynamic_cast<NameID*>(decryptedID.get());
 533                         if (respName) {
 534                             decryptedID.release();
 535                             nameIDwrapper.reset(respName);
 536                             if (m_log.isDebugEnabled())
 537                                 m_log.debugStream() << "decrypted NameID: " << *respName << logging::eol;
 538                         }
 539                     }
 540                 }
 541             }
 542
 543             if (!respName || !XMLString::equals(respName->getName(), name->getName()) ||
 544                 !XMLString::equals(respName->getFormat(), name->getFormat()) ||
 545                 !XMLString::equals(respName->getNameQualifier(), name->getNameQualifier()) ||
 546                 !XMLString::equals(respName->getSPNameQualifier(), name->getSPNameQualifier())) {
 547                 if (respName)
 548                     m_log.warnStream() << "ignoring Assertion without strongly matching NameID in Subject: " <<
 549                         *respName << logging::eol;
 550                 else
 551                     m_log.warn("ignoring Assertion without NameID in Subject");
 552                 return;
 553             }
 554         }
 555     }
 556     catch (std::exception& ex) {
 557         m_log.error("assertion failed policy validation: %s", ex.what());
 558         throw;
 559     }
 560
 561     // If the token's embedded, detach it.
 562     if (!newtokenwrapper.get()) {
 563         newtoken->detach();
 564         srt.release();  // detach blows away the Response, so avoid a double free
 565         newtokenwrapper.reset(newtoken);
 566     }
 567     ctx.getResolvedAssertions().push_back(newtoken);
 568     newtokenwrapper.release();
 569
 570     // Finally, extract and filter the result.
 571     try {
 572         AttributeExtractor* extractor = m_extractor ? m_extractor.get() : application.getAttributeExtractor();
 573         if (extractor) {
 574             Locker extlocker(extractor);
 575             extractor->extractAttributes(application, ctx.getRequest(), AA, *newtoken, ctx.getResolvedAttributes());
 576         }
 577
 578         AttributeFilter* filter = m_filter ? m_filter.get() : application.getAttributeFilter();
 579         if (filter) {
 580             BasicFilteringContext fc(application, ctx.getResolvedAttributes(), AA, ctx.getClassRef(), ctx.getDeclRef());
 581             Locker filtlocker(filter);
 582             filter->filterAttributes(fc, ctx.getResolvedAttributes());
 583         }
 584     }
 585     catch (std::exception& ex) {
 586         m_log.error("caught exception extracting/filtering attributes from query result: %s", ex.what());
 587         for_each(ctx.getResolvedAttributes().begin(), ctx.getResolvedAttributes().end(), xmltooling::cleanup<shibsp::Attribute>());
 588         ctx.getResolvedAttributes().clear();
 589         throw;
 590     }
 591 }
 592
 593 void SimpleAggregationResolver::resolveAttributes(ResolutionContext& ctx) const
 594 {
 595 #ifdef _DEBUG
 596     xmltooling::NDC ndc("resolveAttributes");
 597 #endif
 598
 599     SimpleAggregationContext& qctx = dynamic_cast<SimpleAggregationContext&>(ctx);
 600
 601     // First we manufacture the appropriate NameID to use.
 602     scoped_ptr<NameID> n;
 603     for (vector<string>::const_iterator a = m_attributeIds.begin(); !n.get() && a != m_attributeIds.end(); ++a) {
 604         const Attribute* attr=nullptr;
 605         if (qctx.getSession()) {
 606             // Input attributes should be available via multimap.
 607             pair<multimap<string,const Attribute*>::const_iterator, multimap<string,const Attribute*>::const_iterator> range =
 608                 qctx.getSession()->getIndexedAttributes().equal_range(*a);
 609             for (; !attr && range.first != range.second; ++range.first) {
 610                 if (range.first->second->valueCount() > 0)
 611                     attr = range.first->second;
 612             }
 613         }
 614         else if (qctx.getInputAttributes()) {
 615             // Have to loop over unindexed set.
 616             const vector<Attribute*>* matches = qctx.getInputAttributes();
 617             for (indirect_iterator<vector<Attribute*>::const_iterator> match = make_indirect_iterator(matches->begin());
 618                     !attr && match != make_indirect_iterator(matches->end()); ++match) {
 619                 if (*a == match->getId() && match->valueCount() > 0)
 620                     attr = &(*match);
 621             }
 622         }
 623
 624         if (attr) {
 625             m_log.debug("using input attribute (%s) as identifier for queries", attr->getId());
 626             n.reset(NameIDBuilder::buildNameID());
 627             const NameIDAttribute* down = dynamic_cast<const NameIDAttribute*>(attr);
 628             if (down) {
 629                 // We can create a NameID directly from the source material.
 630                 const NameIDAttribute::Value& v = down->getValues().front();
 631                 auto_arrayptr<XMLCh> val(fromUTF8(v.m_Name.c_str()));
 632                 n->setName(val.get());
 633
 634                 if (!v.m_Format.empty()) {
 635                     auto_arrayptr<XMLCh> format(fromUTF8(v.m_Format.c_str()));
 636                     n->setFormat(format.get());
 637                 }
 638                 if (!v.m_NameQualifier.empty()) {
 639                     auto_arrayptr<XMLCh> nq(fromUTF8(v.m_NameQualifier.c_str()));
 640                     n->setNameQualifier(nq.get());
 641                 }
 642                 if (!v.m_SPNameQualifier.empty()) {
 643                     auto_arrayptr<XMLCh> spnq(fromUTF8(v.m_SPNameQualifier.c_str()));
 644                     n->setSPNameQualifier(spnq.get());
 645                 }
 646                 if (!v.m_SPProvidedID.empty()) {
 647                     auto_arrayptr<XMLCh> sppid(fromUTF8(v.m_SPProvidedID.c_str()));
 648                     n->setSPProvidedID(sppid.get());
 649                 }
 650             }
 651             else {
 652                 // We have to mock up the NameID.
 653                 auto_arrayptr<XMLCh> val(fromUTF8(attr->getSerializedValues().front().c_str()));
 654                 n->setName(val.get());
 655                 if (!m_format.empty())
 656                     n->setFormat(m_format.c_str());
 657             }
 658         }
 659     }
 660
 661     if (!n) {
 662         if (qctx.getNameID() && m_attributeIds.empty()) {
 663             m_log.debug("using authenticated NameID as identifier for queries");
 664         }
 665         else {
 666             m_log.warn("unable to resolve attributes, no suitable query identifier found");
 667             return;
 668         }
 669     }
 670
 671     set<string> history;
 672
 673     // Put initial IdP into history to prevent extra query.
 674     if (qctx.getEntityID())
 675         history.insert(qctx.getEntityID());
 676
 677     // Prepare to track exceptions.
 678     auto_ptr<SimpleAttribute> exceptAttr;
 679     if (!m_exceptionId.empty())
 680         exceptAttr.reset(new SimpleAttribute(m_exceptionId));
 681
 682     // We have a master loop over all the possible sources of material.
 683     for (vector< pair<string,bool> >::const_iterator source = m_sources.begin(); source != m_sources.end(); ++source) {
 684         if (source->second) {
 685             // A literal entityID to query.
 686             if (history.count(source->first) == 0) {
 687                 m_log.debug("issuing SAML query to (%s)", source->first.c_str());
 688                 try {
 689                     doQuery(qctx, source->first.c_str(), n ? n.get() : qctx.getNameID());
 690                 }
 691                 catch (std::exception& ex) {
 692                     if (exceptAttr.get())
 693                         exceptAttr->getValues().push_back(XMLToolingConfig::getConfig().getURLEncoder()->encode(ex.what()));
 694                 }
 695                 history.insert(source->first);
 696             }
 697             else {
 698                 m_log.debug("skipping previously queried attribute source (%s)", source->first.c_str());
 699             }
 700         }
 701         else {
 702             m_log.debug("using attribute sources referenced in attribute (%s)", source->first.c_str());
 703             if (qctx.getSession()) {
 704                 // Input attributes should be available via multimap.
 705                 pair<multimap<string,const Attribute*>::const_iterator, multimap<string,const Attribute*>::const_iterator> range =
 706                     qctx.getSession()->getIndexedAttributes().equal_range(source->first);
 707                 for (; range.first != range.second; ++range.first) {
 708                     const vector<string>& links = range.first->second->getSerializedValues();
 709                     for (vector<string>::const_iterator link = links.begin(); link != links.end(); ++link) {
 710                         if (history.count(*link) == 0) {
 711                             m_log.debug("issuing SAML query to (%s)", link->c_str());
 712                             try {
 713                                 doQuery(qctx, link->c_str(), n ? n.get() : qctx.getNameID());
 714                             }
 715                             catch (std::exception& ex) {
 716                                 if (exceptAttr.get())
 717                                     exceptAttr->getValues().push_back(XMLToolingConfig::getConfig().getURLEncoder()->encode(ex.what()));
 718                             }
 719                             history.insert(*link);
 720                         }
 721                         else {
 722                             m_log.debug("skipping previously queried attribute source (%s)", link->c_str());
 723                         }
 724                     }
 725                 }
 726             }
 727             else if (qctx.getInputAttributes()) {
 728                 // Have to loop over unindexed set.
 729                 const vector<Attribute*>* matches = qctx.getInputAttributes();
 730                 for (indirect_iterator<vector<Attribute*>::const_iterator> match = make_indirect_iterator(matches->begin());
 731                         match != make_indirect_iterator(matches->end()); ++match) {
 732                     if (source->first == match->getId()) {
 733                         const vector<string>& links = match->getSerializedValues();
 734                         for (vector<string>::const_iterator link = links.begin(); link != links.end(); ++link) {
 735                             if (history.count(*link) == 0) {
 736                                 m_log.debug("issuing SAML query to (%s)", link->c_str());
 737                                 try {
 738                                     doQuery(qctx, link->c_str(), n ? n.get() : qctx.getNameID());
 739                                 }
 740                                 catch (std::exception& ex) {
 741                                     if (exceptAttr.get())
 742                                         exceptAttr->getValues().push_back(XMLToolingConfig::getConfig().getURLEncoder()->encode(ex.what()));
 743                                 }
 744                                 history.insert(*link);
 745                             }
 746                             else {
 747                                 m_log.debug("skipping previously queried attribute source (%s)", link->c_str());
 748                             }
 749                         }
 750                     }
 751                 }
 752             }
 753         }
 754     }
 755
 756     if (exceptAttr.get()) {
 757         qctx.getResolvedAttributes().push_back(exceptAttr.get());
 758         exceptAttr.release();
 759     }
 760 }