shibsp/attribute/resolver/impl/XMLAttributeExtractor.cpp

   1 /*
   2  *  Copyright 2001-2009 Internet2
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /**
  18  * XMLAttributeExtractor.cpp
  19  *
  20  * AttributeExtractor based on an XML mapping file.
  21  */
  22
  23 #include "internal.h"
  24 #include "Application.h"
  25 #include "ServiceProvider.h"
  26 #include "attribute/AttributeDecoder.h"
  27 #include "attribute/filtering/AttributeFilter.h"
  28 #include "attribute/filtering/BasicFilteringContext.h"
  29 #include "attribute/resolver/AttributeExtractor.h"
  30 #include "security/SecurityPolicy.h"
  31 #include "util/SPConstants.h"
  32
  33 #include <saml/SAMLConfig.h>
  34 #include <saml/saml1/core/Assertions.h>
  35 #include <saml/saml2/core/Assertions.h>
  36 #include <saml/saml2/metadata/MetadataCredentialCriteria.h>
  37 #include <saml/saml2/metadata/ObservableMetadataProvider.h>
  38 #include <xmltooling/util/NDC.h>
  39 #include <xmltooling/util/ReloadableXMLFile.h>
  40 #include <xmltooling/util/XMLHelper.h>
  41 #include <xercesc/util/XMLUniDefs.hpp>
  42
  43 using namespace shibsp;
  44 using namespace opensaml::saml2md;
  45 using namespace opensaml;
  46 using namespace xmltooling;
  47 using namespace std;
  48 using saml1::NameIdentifier;
  49 using saml2::NameID;
  50 using saml2::EncryptedAttribute;
  51
  52 namespace shibsp {
  53
  54 #if defined (_MSC_VER)
  55     #pragma warning( push )
  56     #pragma warning( disable : 4250 )
  57 #endif
  58
  59     class XMLExtractorImpl : public ObservableMetadataProvider::Observer
  60     {
  61     public:
  62         XMLExtractorImpl(const DOMElement* e, Category& log);
  63         ~XMLExtractorImpl() {
  64             for (map<const ObservableMetadataProvider*,decoded_t>::iterator i=m_decodedMap.begin(); i!=m_decodedMap.end(); ++i) {
  65                 i->first->removeObserver(this);
  66                 for (decoded_t::iterator attrs = i->second.begin(); attrs!=i->second.end(); ++attrs)
  67                     for_each(attrs->second.begin(), attrs->second.end(), mem_fun_ref<DDF&,DDF>(&DDF::destroy));
  68             }
  69             delete m_attrLock;
  70             delete m_trust;
  71             delete m_metadata;
  72             delete m_filter;
  73             for (attrmap_t::iterator j = m_attrMap.begin(); j!=m_attrMap.end(); ++j)
  74                 delete j->second.first;
  75             if (m_document)
  76                 m_document->release();
  77         }
  78
  79         void setDocument(DOMDocument* doc) {
  80             m_document = doc;
  81         }
  82
  83         void onEvent(const ObservableMetadataProvider& metadata) const {
  84             // Destroy attributes we cached from this provider.
  85             m_attrLock->wrlock();
  86             decoded_t& d = m_decodedMap[&metadata];
  87             for (decoded_t::iterator a = d.begin(); a!=d.end(); ++a)
  88                 for_each(a->second.begin(), a->second.end(), mem_fun_ref<DDF&,DDF>(&DDF::destroy));
  89             d.clear();
  90             m_attrLock->unlock();
  91         }
  92
  93         void extractAttributes(
  94             const Application& application,
  95             const char* assertingParty,
  96             const char* relyingParty,
  97             const NameIdentifier& nameid,
  98             vector<Attribute*>& attributes
  99             ) const;
 100         void extractAttributes(
 101             const Application& application,
 102             const char* assertingParty,
 103             const char* relyingParty,
 104             const NameID& nameid,
 105             vector<Attribute*>& attributes
 106             ) const;
 107         void extractAttributes(
 108             const Application& application,
 109             const char* assertingParty,
 110             const char* relyingParty,
 111             const saml1::Attribute& attr,
 112             vector<Attribute*>& attributes
 113             ) const;
 114         void extractAttributes(
 115             const Application& application,
 116             const char* assertingParty,
 117             const char* relyingParty,
 118             const saml2::Attribute& attr,
 119             vector<Attribute*>& attributes
 120             ) const;
 121         void extractAttributes(
 122             const Application& application,
 123             const ObservableMetadataProvider* observable,
 124             const XMLCh* entityID,
 125             const char* relyingParty,
 126             const Extensions& ext,
 127             vector<Attribute*>& attributes
 128             ) const;
 129
 130         void getAttributeIds(vector<string>& attributes) const {
 131             attributes.insert(attributes.end(), m_attributeIds.begin(), m_attributeIds.end());
 132         }
 133
 134     private:
 135         Category& m_log;
 136         DOMDocument* m_document;
 137 #ifdef HAVE_GOOD_STL
 138         typedef map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > > attrmap_t;
 139 #else
 140         typedef map< pair<string,string>,pair< AttributeDecoder*,vector<string> > > attrmap_t;
 141 #endif
 142         attrmap_t m_attrMap;
 143         vector<string> m_attributeIds;
 144
 145         // settings for embedded assertions in metadata
 146         auto_ptr_char m_policyId;
 147         MetadataProvider* m_metadata;
 148         TrustEngine* m_trust;
 149         AttributeFilter* m_filter;
 150         bool m_entityAssertions;
 151
 152         // manages caching of decoded Attributes
 153         mutable RWLock* m_attrLock;
 154         typedef map< const EntityAttributes*,vector<DDF> > decoded_t;
 155         mutable map<const ObservableMetadataProvider*,decoded_t> m_decodedMap;
 156     };
 157
 158     class XMLExtractor : public AttributeExtractor, public ReloadableXMLFile
 159     {
 160     public:
 161         XMLExtractor(const DOMElement* e) : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT".AttributeExtractor.XML")), m_impl(NULL) {
 162             load();
 163         }
 164         ~XMLExtractor() {
 165             delete m_impl;
 166         }
 167
 168         void extractAttributes(
 169             const Application& application, const RoleDescriptor* issuer, const XMLObject& xmlObject, vector<Attribute*>& attributes
 170             ) const;
 171
 172         void getAttributeIds(std::vector<std::string>& attributes) const {
 173             if (m_impl)
 174                 m_impl->getAttributeIds(attributes);
 175         }
 176
 177     protected:
 178         pair<bool,DOMElement*> load();
 179
 180     private:
 181         XMLExtractorImpl* m_impl;
 182     };
 183
 184 #if defined (_MSC_VER)
 185     #pragma warning( pop )
 186 #endif
 187
 188     AttributeExtractor* SHIBSP_DLLLOCAL XMLAttributeExtractorFactory(const DOMElement* const & e)
 189     {
 190         return new XMLExtractor(e);
 191     }
 192
 193     static const XMLCh _aliases[] =             UNICODE_LITERAL_7(a,l,i,a,s,e,s);
 194     static const XMLCh _AttributeDecoder[] =    UNICODE_LITERAL_16(A,t,t,r,i,b,u,t,e,D,e,c,o,d,e,r);
 195     static const XMLCh _AttributeFilter[] =     UNICODE_LITERAL_15(A,t,t,r,i,b,u,t,e,F,i,l,t,e,r);
 196     static const XMLCh Attributes[] =           UNICODE_LITERAL_10(A,t,t,r,i,b,u,t,e,s);
 197     static const XMLCh _id[] =                  UNICODE_LITERAL_2(i,d);
 198     static const XMLCh _MetadataProvider[] =    UNICODE_LITERAL_16(M,e,t,a,d,a,t,a,P,r,o,v,i,d,e,r);
 199     static const XMLCh _name[] =                UNICODE_LITERAL_4(n,a,m,e);
 200     static const XMLCh nameFormat[] =           UNICODE_LITERAL_10(n,a,m,e,F,o,r,m,a,t);
 201     static const XMLCh metadataPolicyId[] =     UNICODE_LITERAL_16(m,e,t,a,d,a,t,a,P,o,l,i,c,y,I,d);
 202     static const XMLCh _TrustEngine[] =         UNICODE_LITERAL_11(T,r,u,s,t,E,n,g,i,n,e);
 203     static const XMLCh _type[] =                UNICODE_LITERAL_4(t,y,p,e);
 204 };
 205
 206 XMLExtractorImpl::XMLExtractorImpl(const DOMElement* e, Category& log)
 207     : m_log(log),
 208         m_document(NULL),
 209         m_policyId(e ? e->getAttributeNS(NULL, metadataPolicyId) : NULL),
 210         m_metadata(NULL),
 211         m_trust(NULL),
 212         m_filter(NULL),
 213         m_entityAssertions(true),
 214         m_attrLock(NULL)
 215 {
 216 #ifdef _DEBUG
 217     xmltooling::NDC ndc("XMLExtractorImpl");
 218 #endif
 219
 220     if (!XMLHelper::isNodeNamed(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, Attributes))
 221         throw ConfigurationException("XML AttributeExtractor requires am:Attributes at root of configuration.");
 222
 223     DOMElement* child = XMLHelper::getFirstChildElement(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, _MetadataProvider);
 224     if (child) {
 225         try {
 226             auto_ptr_char type(child->getAttributeNS(NULL, _type));
 227             if (!type.get() || !*type.get())
 228                 throw ConfigurationException("MetadataProvider element missing type attribute.");
 229             m_log.info("building MetadataProvider of type %s...", type.get());
 230             auto_ptr<MetadataProvider> mp(SAMLConfig::getConfig().MetadataProviderManager.newPlugin(type.get(), child));
 231             mp->init();
 232             m_metadata = mp.release();
 233         }
 234         catch (exception& ex) {
 235             m_entityAssertions = false;
 236             m_log.crit("error building/initializing dedicated MetadataProvider: %s", ex.what());
 237             m_log.crit("disabling support for Assertions in EntityAttributes extension");
 238         }
 239     }
 240
 241     if (m_entityAssertions) {
 242         child = XMLHelper::getFirstChildElement(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, _TrustEngine);
 243         if (child) {
 244             try {
 245                 auto_ptr_char type(child->getAttributeNS(NULL, _type));
 246                 if (!type.get() || !*type.get())
 247                     throw ConfigurationException("TrustEngine element missing type attribute.");
 248                 m_log.info("building TrustEngine of type %s...", type.get());
 249                 m_trust = XMLToolingConfig::getConfig().TrustEngineManager.newPlugin(type.get(), child);
 250             }
 251             catch (exception& ex) {
 252                 m_entityAssertions = false;
 253                 m_log.crit("error building/initializing dedicated TrustEngine: %s", ex.what());
 254                 m_log.crit("disabling support for Assertions in EntityAttributes extension");
 255             }
 256         }
 257     }
 258
 259     if (m_entityAssertions) {
 260         child = XMLHelper::getFirstChildElement(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, _AttributeFilter);
 261         if (child) {
 262             try {
 263                 auto_ptr_char type(child->getAttributeNS(NULL, _type));
 264                 if (!type.get() || !*type.get())
 265                     throw ConfigurationException("AttributeFilter element missing type attribute.");
 266                 m_log.info("building AttributeFilter of type %s...", type.get());
 267                 m_filter = SPConfig::getConfig().AttributeFilterManager.newPlugin(type.get(), child);
 268             }
 269             catch (exception& ex) {
 270                 m_entityAssertions = false;
 271                 m_log.crit("error building/initializing dedicated AttributeFilter: %s", ex.what());
 272                 m_log.crit("disabling support for Assertions in EntityAttributes extension");
 273             }
 274         }
 275     }
 276
 277     child = XMLHelper::getFirstChildElement(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 278     while (child) {
 279         // Check for missing name or id.
 280         const XMLCh* name = child->getAttributeNS(NULL, _name);
 281         if (!name || !*name) {
 282             m_log.warn("skipping Attribute with no name");
 283             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 284             continue;
 285         }
 286
 287         auto_ptr_char id(child->getAttributeNS(NULL, _id));
 288         if (!id.get() || !*id.get()) {
 289             m_log.warn("skipping Attribute with no id");
 290             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 291             continue;
 292         }
 293         else if (!strcmp(id.get(), "REMOTE_USER")) {
 294             m_log.warn("skipping Attribute, id of REMOTE_USER is a reserved name");
 295             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 296             continue;
 297         }
 298
 299         AttributeDecoder* decoder=NULL;
 300         try {
 301             DOMElement* dchild = XMLHelper::getFirstChildElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, _AttributeDecoder);
 302             if (dchild) {
 303                 auto_ptr<xmltooling::QName> q(XMLHelper::getXSIType(dchild));
 304                 if (q.get())
 305                     decoder = SPConfig::getConfig().AttributeDecoderManager.newPlugin(*q.get(), dchild);
 306             }
 307             if (!decoder)
 308                 decoder = SPConfig::getConfig().AttributeDecoderManager.newPlugin(StringAttributeDecoderType, NULL);
 309         }
 310         catch (exception& ex) {
 311             m_log.error("skipping Attribute (%s), error building AttributeDecoder: %s", id.get(), ex.what());
 312         }
 313
 314         if (!decoder) {
 315             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 316             continue;
 317         }
 318
 319         // Empty NameFormat implies the usual Shib URI naming defaults.
 320         const XMLCh* format = child->getAttributeNS(NULL, nameFormat);
 321         if (!format || XMLString::equals(format, shibspconstants::SHIB1_ATTRIBUTE_NAMESPACE_URI) ||
 322                 XMLString::equals(format, saml2::Attribute::URI_REFERENCE))
 323             format = &chNull;  // ignore default Format/Namespace values
 324
 325         // Fetch/create the map entry and see if it's a duplicate rule.
 326 #ifdef HAVE_GOOD_STL
 327         pair< AttributeDecoder*,vector<string> >& decl = m_attrMap[pair<xstring,xstring>(name,format)];
 328 #else
 329         auto_ptr_char n(name);
 330         auto_ptr_char f(format);
 331         pair< AttributeDecoder*,vector<string> >& decl = m_attrMap[pair<string,string>(n.get(),f.get())];
 332 #endif
 333         if (decl.first) {
 334             m_log.warn("skipping duplicate Attribute mapping (same name and nameFormat)");
 335             delete decoder;
 336             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 337             continue;
 338         }
 339
 340         if (m_log.isInfoEnabled()) {
 341 #ifdef HAVE_GOOD_STL
 342             auto_ptr_char n(name);
 343             auto_ptr_char f(format);
 344 #endif
 345             m_log.info("creating mapping for Attribute %s%s%s", n.get(), *f.get() ? ", Format/Namespace:" : "", f.get());
 346         }
 347
 348         decl.first = decoder;
 349         decl.second.push_back(id.get());
 350         m_attributeIds.push_back(id.get());
 351
 352         name = child->getAttributeNS(NULL, _aliases);
 353         if (name && *name) {
 354             auto_ptr_char aliases(name);
 355             char* pos;
 356             char* start = const_cast<char*>(aliases.get());
 357             while (start && *start) {
 358                 while (*start && isspace(*start))
 359                     start++;
 360                 if (!*start)
 361                     break;
 362                 pos = strchr(start,' ');
 363                 if (pos)
 364                     *pos=0;
 365                 if (strcmp(start, "REMOTE_USER")) {
 366                     decl.second.push_back(start);
 367                     m_attributeIds.push_back(start);
 368                 }
 369                 else {
 370                     m_log.warn("skipping alias, REMOTE_USER is a reserved name");
 371                 }
 372                 start = pos ? pos+1 : NULL;
 373             }
 374         }
 375
 376         child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 377     }
 378
 379     m_attrLock = RWLock::create();
 380 }
 381
 382 void XMLExtractorImpl::extractAttributes(
 383     const Application& application,
 384     const char* assertingParty,
 385     const char* relyingParty,
 386     const NameIdentifier& nameid,
 387     vector<Attribute*>& attributes
 388     ) const
 389 {
 390 #ifdef HAVE_GOOD_STL
 391     map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 392 #else
 393     map< pair<string,string>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 394 #endif
 395
 396     const XMLCh* format = nameid.getFormat();
 397     if (!format || !*format)
 398         format = NameIdentifier::UNSPECIFIED;
 399 #ifdef HAVE_GOOD_STL
 400     if ((rule=m_attrMap.find(pair<xstring,xstring>(format,xstring()))) != m_attrMap.end()) {
 401 #else
 402     auto_ptr_char temp(format);
 403     if ((rule=m_attrMap.find(pair<string,string>(temp.get(),string()))) != m_attrMap.end()) {
 404 #endif
 405         Attribute* a = rule->second.first->decode(rule->second.second, &nameid, assertingParty, relyingParty);
 406         if (a)
 407             attributes.push_back(a);
 408     }
 409     else if (m_log.isDebugEnabled()) {
 410 #ifdef HAVE_GOOD_STL
 411         auto_ptr_char temp(format);
 412 #endif
 413         m_log.debug("skipping unmapped NameIdentifier with format (%s)", temp.get());
 414     }
 415 }
 416
 417 void XMLExtractorImpl::extractAttributes(
 418     const Application& application,
 419     const char* assertingParty,
 420     const char* relyingParty,
 421     const NameID& nameid,
 422     vector<Attribute*>& attributes
 423     ) const
 424 {
 425 #ifdef HAVE_GOOD_STL
 426     map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 427 #else
 428     map< pair<string,string>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 429 #endif
 430
 431     const XMLCh* format = nameid.getFormat();
 432     if (!format || !*format)
 433         format = NameID::UNSPECIFIED;
 434 #ifdef HAVE_GOOD_STL
 435     if ((rule=m_attrMap.find(pair<xstring,xstring>(format,xstring()))) != m_attrMap.end()) {
 436 #else
 437     auto_ptr_char temp(format);
 438     if ((rule=m_attrMap.find(pair<string,string>(temp.get(),string()))) != m_attrMap.end()) {
 439 #endif
 440         Attribute* a = rule->second.first->decode(rule->second.second, &nameid, assertingParty, relyingParty);
 441         if (a)
 442             attributes.push_back(a);
 443     }
 444     else if (m_log.isDebugEnabled()) {
 445 #ifdef HAVE_GOOD_STL
 446         auto_ptr_char temp(format);
 447 #endif
 448         m_log.debug("skipping unmapped NameID with format (%s)", temp.get());
 449     }
 450 }
 451
 452 void XMLExtractorImpl::extractAttributes(
 453     const Application& application,
 454     const char* assertingParty,
 455     const char* relyingParty,
 456     const saml1::Attribute& attr,
 457     vector<Attribute*>& attributes
 458     ) const
 459 {
 460 #ifdef HAVE_GOOD_STL
 461     map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 462 #else
 463     map< pair<string,string>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 464 #endif
 465
 466     const XMLCh* name = attr.getAttributeName();
 467     const XMLCh* format = attr.getAttributeNamespace();
 468     if (!name || !*name)
 469         return;
 470     if (!format || XMLString::equals(format, shibspconstants::SHIB1_ATTRIBUTE_NAMESPACE_URI))
 471         format = &chNull;
 472 #ifdef HAVE_GOOD_STL
 473     if ((rule=m_attrMap.find(pair<xstring,xstring>(name,format))) != m_attrMap.end()) {
 474 #else
 475     auto_ptr_char temp1(name);
 476     auto_ptr_char temp2(format);
 477     if ((rule=m_attrMap.find(pair<string,string>(temp1.get(),temp2.get()))) != m_attrMap.end()) {
 478 #endif
 479         Attribute* a = rule->second.first->decode(rule->second.second, &attr, assertingParty, relyingParty);
 480         if (a)
 481             attributes.push_back(a);
 482     }
 483     else if (m_log.isInfoEnabled()) {
 484 #ifdef HAVE_GOOD_STL
 485         auto_ptr_char temp1(name);
 486         auto_ptr_char temp2(format);
 487 #endif
 488         m_log.info("skipping unmapped SAML 1.x Attribute with Name: %s%s%s", temp1.get(), *temp2.get() ? ", Namespace:" : "", temp2.get());
 489     }
 490 }
 491
 492 void XMLExtractorImpl::extractAttributes(
 493     const Application& application,
 494     const char* assertingParty,
 495     const char* relyingParty,
 496     const saml2::Attribute& attr,
 497     vector<Attribute*>& attributes
 498     ) const
 499 {
 500 #ifdef HAVE_GOOD_STL
 501     map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 502 #else
 503     map< pair<string,string>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 504 #endif
 505
 506     const XMLCh* name = attr.getName();
 507     const XMLCh* format = attr.getNameFormat();
 508     if (!name || !*name)
 509         return;
 510     if (!format || !*format)
 511         format = saml2::Attribute::UNSPECIFIED;
 512     else if (XMLString::equals(format, saml2::Attribute::URI_REFERENCE))
 513         format = &chNull;
 514 #ifdef HAVE_GOOD_STL
 515     if ((rule=m_attrMap.find(pair<xstring,xstring>(name,format))) != m_attrMap.end()) {
 516 #else
 517     auto_ptr_char temp1(name);
 518     auto_ptr_char temp2(format);
 519     if ((rule=m_attrMap.find(pair<string,string>(temp1.get(),temp2.get()))) != m_attrMap.end()) {
 520 #endif
 521         Attribute* a = rule->second.first->decode(rule->second.second, &attr, assertingParty, relyingParty);
 522         if (a)
 523             attributes.push_back(a);
 524     }
 525     else if (m_log.isInfoEnabled()) {
 526 #ifdef HAVE_GOOD_STL
 527         auto_ptr_char temp1(name);
 528         auto_ptr_char temp2(format);
 529 #endif
 530         m_log.info("skipping unmapped SAML 2.0 Attribute with Name: %s%s%s", temp1.get(), *temp2.get() ? ", Format:" : "", temp2.get());
 531     }
 532 }
 533
 534 void XMLExtractorImpl::extractAttributes(
 535     const Application& application,
 536     const ObservableMetadataProvider* observable,
 537     const XMLCh* entityID,
 538     const char* relyingParty,
 539     const Extensions& ext,
 540     vector<Attribute*>& attributes
 541     ) const
 542 {
 543     const vector<XMLObject*>& exts = ext.getUnknownXMLObjects();
 544     for (vector<XMLObject*>::const_iterator i = exts.begin(); i!=exts.end(); ++i) {
 545         const EntityAttributes* container = dynamic_cast<const EntityAttributes*>(*i);
 546         if (!container)
 547             continue;
 548
 549         bool useCache = false;
 550         map<const ObservableMetadataProvider*,decoded_t>::iterator cacheEntry;
 551
 552         // Check for cached result.
 553         if (observable) {
 554             m_attrLock->rdlock();
 555             cacheEntry = m_decodedMap.find(observable);
 556             if (cacheEntry == m_decodedMap.end()) {
 557                 // We need to elevate the lock and retry.
 558                 m_attrLock->unlock();
 559                 m_attrLock->wrlock();
 560                 cacheEntry = m_decodedMap.find(observable);
 561                 if (cacheEntry==m_decodedMap.end()) {
 562
 563                     // It's still brand new, so hook it for cache activation.
 564                     observable->addObserver(this);
 565
 566                     // Prime the map reference with an empty decoded map.
 567                     cacheEntry = m_decodedMap.insert(make_pair(observable,decoded_t())).first;
 568
 569                     // Downgrade the lock.
 570                     // We don't have to recheck because we never erase the master map entry entirely, even on changes.
 571                     m_attrLock->unlock();
 572                     m_attrLock->rdlock();
 573                 }
 574             }
 575             useCache = true;
 576         }
 577
 578         if (useCache) {
 579             // We're holding a read lock, so check the cache.
 580             decoded_t::iterator d = cacheEntry->second.find(container);
 581             if (d != cacheEntry->second.end()) {
 582                 SharedLock locker(m_attrLock, false);   // pop the lock when we're done
 583                 for (vector<DDF>::iterator obj = d->second.begin(); obj != d->second.end(); ++obj) {
 584                     auto_ptr<Attribute> wrapper(Attribute::unmarshall(*obj));
 585                     m_log.debug("recovered cached metadata attribute (%s)", wrapper->getId());
 586                     attributes.push_back(wrapper.release());
 587                 }
 588                 break;
 589             }
 590         }
 591
 592         // Use a holding area to support caching.
 593         vector<Attribute*> holding;
 594
 595         const vector<saml2::Attribute*>& attrs = container->getAttributes();
 596         for (vector<saml2::Attribute*>::const_iterator attr = attrs.begin(); attr != attrs.end(); ++attr) {
 597             try {
 598                 extractAttributes(application, NULL, relyingParty, *(*attr), holding);
 599             }
 600             catch (...) {
 601                 if (useCache)
 602                     m_attrLock->unlock();
 603                 for_each(holding.begin(), holding.end(), xmltooling::cleanup<Attribute>());
 604                 throw;
 605             }
 606         }
 607
 608         if (entityID && m_entityAssertions) {
 609             const vector<saml2::Assertion*>& asserts = container->getAssertions();
 610             for (vector<saml2::Assertion*>::const_iterator assert = asserts.begin(); assert != asserts.end(); ++assert) {
 611                 if (!(*assert)->getSignature()) {
 612                     if (m_log.isDebugEnabled()) {
 613                         auto_ptr_char eid(entityID);
 614                         m_log.debug("skipping unsigned assertion in metadata extension for entity (%s)", eid.get());
 615                     }
 616                     continue;
 617                 }
 618                 else if ((*assert)->getAttributeStatements().empty()) {
 619                     if (m_log.isDebugEnabled()) {
 620                         auto_ptr_char eid(entityID);
 621                         m_log.debug("skipping assertion with no AttributeStatement in metadata extension for entity (%s)", eid.get());
 622                     }
 623                     continue;
 624                 }
 625                 else {
 626                     // Check subject.
 627                     const NameID* subject = (*assert)->getSubject() ? (*assert)->getSubject()->getNameID() : NULL;
 628                     if (!subject ||
 629                             !XMLString::equals(subject->getFormat(), NameID::ENTITY) ||
 630                             !XMLString::equals(subject->getName(), entityID)) {
 631                         if (m_log.isDebugEnabled()) {
 632                             auto_ptr_char eid(entityID);
 633                             m_log.debug("skipping assertion with improper Subject in metadata extension for entity (%s)", eid.get());
 634                         }
 635                         continue;
 636                     }
 637                 }
 638
 639                 // Use a private holding area for filtering purposes.
 640                 vector<Attribute*> holding2;
 641
 642                 try {
 643                     // Set up and evaluate a policy for an AA asserting attributes to us.
 644                     shibsp::SecurityPolicy policy(application, &AttributeAuthorityDescriptor::ELEMENT_QNAME, false, m_policyId.get());
 645                     Locker locker(m_metadata);
 646                     if (m_metadata)
 647                         policy.setMetadataProvider(m_metadata);
 648                     if (m_trust)
 649                         policy.setTrustEngine(m_trust);
 650                     // Populate recipient as audience.
 651                     const XMLCh* issuer = (*assert)->getIssuer() ? (*assert)->getIssuer()->getName() : NULL;
 652                     policy.getAudiences().push_back(application.getRelyingParty(issuer)->getXMLString("entityID").second);
 653
 654                     // Extract assertion information for policy.
 655                     policy.setMessageID((*assert)->getID());
 656                     policy.setIssueInstant((*assert)->getIssueInstantEpoch());
 657                     policy.setIssuer((*assert)->getIssuer());
 658
 659                     // Look up metadata for issuer.
 660                     if (policy.getIssuer() && policy.getMetadataProvider()) {
 661                         if (policy.getIssuer()->getFormat() && !XMLString::equals(policy.getIssuer()->getFormat(), saml2::NameIDType::ENTITY)) {
 662                             m_log.debug("non-system entity issuer, skipping metadata lookup");
 663                         }
 664                         else {
 665                             m_log.debug("searching metadata for entity assertion issuer...");
 666                             pair<const EntityDescriptor*,const RoleDescriptor*> lookup;
 667                             MetadataProvider::Criteria& mc = policy.getMetadataProviderCriteria();
 668                             mc.entityID_unicode = policy.getIssuer()->getName();
 669                             mc.role = &AttributeAuthorityDescriptor::ELEMENT_QNAME;
 670                             mc.protocol = samlconstants::SAML20P_NS;
 671                             lookup = policy.getMetadataProvider()->getEntityDescriptor(mc);
 672                             if (!lookup.first) {
 673                                 auto_ptr_char iname(policy.getIssuer()->getName());
 674                                 m_log.debug("no metadata found, can't establish identity of issuer (%s)", iname.get());
 675                             }
 676                             else if (!lookup.second) {
 677                                 m_log.debug("unable to find compatible AA role in metadata");
 678                             }
 679                             else {
 680                                 policy.setIssuerMetadata(lookup.second);
 681                             }
 682                         }
 683                     }
 684
 685                     // Authenticate the assertion. We have to clone and marshall it to establish the signature for verification.
 686                     auto_ptr<saml2::Assertion> tokencopy((*assert)->cloneAssertion());
 687                     tokencopy->marshall();
 688                     policy.evaluate(*tokencopy);
 689                     if (!policy.isAuthenticated()) {
 690                         if (m_log.isDebugEnabled()) {
 691                             auto_ptr_char tempid(tokencopy->getID());
 692                             auto_ptr_char eid(entityID);
 693                             m_log.debug(
 694                                 "failed to authenticate assertion (%s) in metadata extension for entity (%s)", tempid.get(), eid.get()
 695                                 );
 696                         }
 697                         continue;
 698                     }
 699
 700                     // Override the asserting/relying party names based on this new issuer.
 701                     const EntityDescriptor* inlineEntity =
 702                         policy.getIssuerMetadata() ? dynamic_cast<const EntityDescriptor*>(policy.getIssuerMetadata()->getParent()) : NULL;
 703                     auto_ptr_char inlineAssertingParty(inlineEntity ? inlineEntity->getEntityID() : NULL);
 704                     relyingParty = application.getRelyingParty(inlineEntity)->getString("entityID").second;
 705                     const vector<saml2::Attribute*>& attrs2 =
 706                         const_cast<const saml2::AttributeStatement*>(tokencopy->getAttributeStatements().front())->getAttributes();
 707                     for (vector<saml2::Attribute*>::const_iterator a = attrs2.begin(); a!=attrs2.end(); ++a)
 708                         extractAttributes(application, inlineAssertingParty.get(), relyingParty, *(*a), holding2);
 709
 710                     // Now we locally filter the attributes so that the actual issuer can be properly set.
 711                     // If we relied on outside filtering, the attributes couldn't be distinguished from the
 712                     // ones that come from the user's IdP.
 713                     if (m_filter && !holding2.empty()) {
 714                         BasicFilteringContext fc(application, holding2, policy.getIssuerMetadata());
 715                         Locker filtlocker(m_filter);
 716                         try {
 717                             m_filter->filterAttributes(fc, holding2);
 718                         }
 719                         catch (exception& ex) {
 720                             m_log.error("caught exception filtering attributes: %s", ex.what());
 721                             m_log.error("dumping extracted attributes due to filtering exception");
 722                             for_each(holding2.begin(), holding2.end(), xmltooling::cleanup<Attribute>());
 723                             holding2.clear();
 724                         }
 725                     }
 726
 727                     if (!holding2.empty()) {
 728                         // Copy them over to the main holding tank.
 729                         holding.insert(holding.end(), holding2.begin(), holding2.end());
 730                     }
 731                 }
 732                 catch (exception& ex) {
 733                     // Known exceptions are handled gracefully by skipping the assertion.
 734                     if (m_log.isDebugEnabled()) {
 735                         auto_ptr_char tempid((*assert)->getID());
 736                         auto_ptr_char eid(entityID);
 737                         m_log.debug(
 738                             "exception authenticating assertion (%s) in metadata extension for entity (%s): %s",
 739                             tempid.get(),
 740                             eid.get(),
 741                             ex.what()
 742                             );
 743                     }
 744                     for_each(holding2.begin(), holding2.end(), xmltooling::cleanup<Attribute>());
 745                     continue;
 746                 }
 747                 catch (...) {
 748                     // Unknown exceptions are fatal.
 749                     if (useCache)
 750                         m_attrLock->unlock();
 751                     for_each(holding.begin(), holding.end(), xmltooling::cleanup<Attribute>());
 752                     for_each(holding2.begin(), holding2.end(), xmltooling::cleanup<Attribute>());
 753                     throw;
 754                 }
 755             }
 756         }
 757
 758         if (!holding.empty()) {
 759             if (useCache) {
 760                 m_attrLock->unlock();
 761                 m_attrLock->wrlock();
 762                 SharedLock locker(m_attrLock, false);   // pop the lock when we're done
 763                 if (cacheEntry->second.count(container) == 0) {
 764                     for (vector<Attribute*>::const_iterator held = holding.begin(); held != holding.end(); ++held)
 765                         cacheEntry->second[container].push_back((*held)->marshall());
 766                 }
 767             }
 768             attributes.insert(attributes.end(), holding.begin(), holding.end());
 769         }
 770         else if (useCache) {
 771             m_attrLock->unlock();
 772         }
 773
 774         break;  // only process a single extension element
 775     }
 776 }
 777
 778 void XMLExtractor::extractAttributes(
 779     const Application& application, const RoleDescriptor* issuer, const XMLObject& xmlObject, vector<Attribute*>& attributes
 780     ) const
 781 {
 782     if (!m_impl)
 783         return;
 784
 785     const EntityDescriptor* entity = issuer ? dynamic_cast<const EntityDescriptor*>(issuer->getParent()) : NULL;
 786     const char* relyingParty = application.getRelyingParty(entity)->getString("entityID").second;
 787
 788     // Check for assertions.
 789     if (XMLString::equals(xmlObject.getElementQName().getLocalPart(), saml1::Assertion::LOCAL_NAME)) {
 790         const saml2::Assertion* token2 = dynamic_cast<const saml2::Assertion*>(&xmlObject);
 791         if (token2) {
 792             auto_ptr_char assertingParty(entity ? entity->getEntityID() : NULL);
 793             const vector<saml2::AttributeStatement*>& statements = token2->getAttributeStatements();
 794             for (vector<saml2::AttributeStatement*>::const_iterator s = statements.begin(); s!=statements.end(); ++s) {
 795                 const vector<saml2::Attribute*>& attrs = const_cast<const saml2::AttributeStatement*>(*s)->getAttributes();
 796                 for (vector<saml2::Attribute*>::const_iterator a = attrs.begin(); a!=attrs.end(); ++a)
 797                     m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *(*a), attributes);
 798
 799                 const vector<saml2::EncryptedAttribute*>& encattrs = const_cast<const saml2::AttributeStatement*>(*s)->getEncryptedAttributes();
 800                 for (vector<saml2::EncryptedAttribute*>::const_iterator ea = encattrs.begin(); ea!=encattrs.end(); ++ea)
 801                     extractAttributes(application, issuer, *(*ea), attributes);
 802             }
 803             return;
 804         }
 805
 806         const saml1::Assertion* token1 = dynamic_cast<const saml1::Assertion*>(&xmlObject);
 807         if (token1) {
 808             auto_ptr_char assertingParty(entity ? entity->getEntityID() : NULL);
 809             const vector<saml1::AttributeStatement*>& statements = token1->getAttributeStatements();
 810             for (vector<saml1::AttributeStatement*>::const_iterator s = statements.begin(); s!=statements.end(); ++s) {
 811                 const vector<saml1::Attribute*>& attrs = const_cast<const saml1::AttributeStatement*>(*s)->getAttributes();
 812                 for (vector<saml1::Attribute*>::const_iterator a = attrs.begin(); a!=attrs.end(); ++a)
 813                     m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *(*a), attributes);
 814             }
 815             return;
 816         }
 817
 818         throw AttributeExtractionException("Unable to extract attributes, unknown object type.");
 819     }
 820
 821     // Check for metadata.
 822     if (XMLString::equals(xmlObject.getElementQName().getNamespaceURI(), samlconstants::SAML20MD_NS)) {
 823         const RoleDescriptor* roleToExtract = dynamic_cast<const RoleDescriptor*>(&xmlObject);
 824         const EntityDescriptor* entityToExtract = roleToExtract ? dynamic_cast<const EntityDescriptor*>(roleToExtract->getParent()) : NULL;
 825         if (!entityToExtract)
 826             throw AttributeExtractionException("Unable to extract attributes, unknown metadata object type.");
 827         const Extensions* ext = entityToExtract->getExtensions();
 828         if (ext) {
 829             m_impl->extractAttributes(
 830                 application,
 831                 dynamic_cast<const ObservableMetadataProvider*>(application.getMetadataProvider(false)),
 832                 entityToExtract->getEntityID(),
 833                 relyingParty,
 834                 *ext,
 835                 attributes
 836                 );
 837         }
 838         const EntitiesDescriptor* group = dynamic_cast<const EntitiesDescriptor*>(entityToExtract->getParent());
 839         while (group) {
 840             ext = group->getExtensions();
 841             if (ext) {
 842                 m_impl->extractAttributes(
 843                     application,
 844                     dynamic_cast<const ObservableMetadataProvider*>(application.getMetadataProvider(false)),
 845                     NULL,   // not an entity, so inline assertions won't be processed
 846                     relyingParty,
 847                     *ext,
 848                     attributes
 849                     );
 850             }
 851             group = dynamic_cast<const EntitiesDescriptor*>(group->getParent());
 852         }
 853         return;
 854     }
 855
 856     // Check for attributes.
 857     if (XMLString::equals(xmlObject.getElementQName().getLocalPart(), saml1::Attribute::LOCAL_NAME)) {
 858         auto_ptr_char assertingParty(entity ? entity->getEntityID() : NULL);
 859         const saml2::Attribute* attr2 = dynamic_cast<const saml2::Attribute*>(&xmlObject);
 860         if (attr2)
 861             return m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *attr2, attributes);
 862
 863         const saml1::Attribute* attr1 = dynamic_cast<const saml1::Attribute*>(&xmlObject);
 864         if (attr1)
 865             return m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *attr1, attributes);
 866
 867         throw AttributeExtractionException("Unable to extract attributes, unknown object type.");
 868     }
 869
 870     if (XMLString::equals(xmlObject.getElementQName().getLocalPart(), EncryptedAttribute::LOCAL_NAME)) {
 871         const EncryptedAttribute* encattr = dynamic_cast<const EncryptedAttribute*>(&xmlObject);
 872         if (encattr) {
 873             const XMLCh* recipient = application.getXMLString("entityID").second;
 874             CredentialResolver* cr = application.getCredentialResolver();
 875             if (!cr) {
 876                 m_log.warn("found encrypted attribute, but no CredentialResolver was available");
 877                 return;
 878             }
 879
 880             try {
 881                 Locker credlocker(cr);
 882                 if (issuer) {
 883                     MetadataCredentialCriteria mcc(*issuer);
 884                     auto_ptr<XMLObject> decrypted(encattr->decrypt(*cr, recipient, &mcc));
 885                     if (m_log.isDebugEnabled())
 886                         m_log.debugStream() << "decrypted Attribute: " << *(decrypted.get()) << logging::eol;
 887                     return extractAttributes(application, issuer, *(decrypted.get()), attributes);
 888                 }
 889                 else {
 890                     auto_ptr<XMLObject> decrypted(encattr->decrypt(*cr, recipient));
 891                     if (m_log.isDebugEnabled())
 892                         m_log.debugStream() << "decrypted Attribute: " << *(decrypted.get()) << logging::eol;
 893                     return extractAttributes(application, issuer, *(decrypted.get()), attributes);
 894                 }
 895             }
 896             catch (exception& ex) {
 897                 m_log.error("caught exception decrypting Attribute: %s", ex.what());
 898                 return;
 899             }
 900         }
 901     }
 902
 903     // Check for NameIDs.
 904     const NameID* name2 = dynamic_cast<const NameID*>(&xmlObject);
 905     if (name2) {
 906         auto_ptr_char assertingParty(entity ? entity->getEntityID() : NULL);
 907         return m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *name2, attributes);
 908     }
 909
 910     const NameIdentifier* name1 = dynamic_cast<const NameIdentifier*>(&xmlObject);
 911     if (name1) {
 912         auto_ptr_char assertingParty(entity ? entity->getEntityID() : NULL);
 913         return m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *name1, attributes);
 914     }
 915
 916     throw AttributeExtractionException("Unable to extract attributes, unknown object type.");
 917 }
 918
 919 pair<bool,DOMElement*> XMLExtractor::load()
 920 {
 921     // Load from source using base class.
 922     pair<bool,DOMElement*> raw = ReloadableXMLFile::load();
 923
 924     // If we own it, wrap it.
 925     XercesJanitor<DOMDocument> docjanitor(raw.first ? raw.second->getOwnerDocument() : NULL);
 926
 927     XMLExtractorImpl* impl = new XMLExtractorImpl(raw.second, m_log);
 928
 929     // If we held the document, transfer it to the impl. If we didn't, it's a no-op.
 930     impl->setDocument(docjanitor.release());
 931
 932     delete m_impl;
 933     m_impl = impl;
 934
 935     return make_pair(false,(DOMElement*)NULL);
 936 }