shibsp/attribute/resolver/impl/XMLAttributeExtractor.cpp

   1 /*
   2  *  Copyright 2001-2010 Internet2
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /**
  18  * XMLAttributeExtractor.cpp
  19  *
  20  * AttributeExtractor based on an XML mapping file.
  21  */
  22
  23 #include "internal.h"
  24 #include "exceptions.h"
  25 #include "Application.h"
  26 #include "ServiceProvider.h"
  27 #include "attribute/Attribute.h"
  28 #include "attribute/AttributeDecoder.h"
  29 #include "attribute/filtering/AttributeFilter.h"
  30 #include "attribute/filtering/BasicFilteringContext.h"
  31 #include "attribute/resolver/AttributeExtractor.h"
  32 #include "remoting/ddf.h"
  33 #include "security/SecurityPolicy.h"
  34 #include "util/SPConstants.h"
  35
  36 #include <saml/SAMLConfig.h>
  37 #include <saml/saml1/core/Assertions.h>
  38 #include <saml/saml2/core/Assertions.h>
  39 #include <saml/saml2/metadata/Metadata.h>
  40 #include <saml/saml2/metadata/MetadataCredentialCriteria.h>
  41 #include <saml/saml2/metadata/ObservableMetadataProvider.h>
  42 #include <xmltooling/XMLToolingConfig.h>
  43 #include <xmltooling/security/TrustEngine.h>
  44 #include <xmltooling/util/NDC.h>
  45 #include <xmltooling/util/ReloadableXMLFile.h>
  46 #include <xmltooling/util/Threads.h>
  47 #include <xmltooling/util/XMLHelper.h>
  48 #include <xercesc/util/XMLUniDefs.hpp>
  49
  50 using namespace shibsp;
  51 using namespace opensaml::saml2md;
  52 using namespace opensaml;
  53 using namespace xmltooling;
  54 using namespace std;
  55 using saml1::NameIdentifier;
  56 using saml2::NameID;
  57 using saml2::EncryptedAttribute;
  58
  59 namespace shibsp {
  60
  61 #if defined (_MSC_VER)
  62     #pragma warning( push )
  63     #pragma warning( disable : 4250 )
  64 #endif
  65
  66     class XMLExtractorImpl : public ObservableMetadataProvider::Observer
  67     {
  68     public:
  69         XMLExtractorImpl(const DOMElement* e, Category& log);
  70         ~XMLExtractorImpl() {
  71             for (map<const ObservableMetadataProvider*,decoded_t>::iterator i=m_decodedMap.begin(); i!=m_decodedMap.end(); ++i) {
  72                 i->first->removeObserver(this);
  73                 for (decoded_t::iterator attrs = i->second.begin(); attrs!=i->second.end(); ++attrs)
  74                     for_each(attrs->second.begin(), attrs->second.end(), mem_fun_ref<DDF&,DDF>(&DDF::destroy));
  75             }
  76             delete m_attrLock;
  77             delete m_trust;
  78             delete m_metadata;
  79             delete m_filter;
  80             for (attrmap_t::iterator j = m_attrMap.begin(); j!=m_attrMap.end(); ++j)
  81                 delete j->second.first;
  82             if (m_document)
  83                 m_document->release();
  84         }
  85
  86         void setDocument(DOMDocument* doc) {
  87             m_document = doc;
  88         }
  89
  90         void onEvent(const ObservableMetadataProvider& metadata) const {
  91             // Destroy attributes we cached from this provider.
  92             m_attrLock->wrlock();
  93             decoded_t& d = m_decodedMap[&metadata];
  94             for (decoded_t::iterator a = d.begin(); a!=d.end(); ++a)
  95                 for_each(a->second.begin(), a->second.end(), mem_fun_ref<DDF&,DDF>(&DDF::destroy));
  96             d.clear();
  97             m_attrLock->unlock();
  98         }
  99
 100         void extractAttributes(
 101             const Application& application,
 102             const char* assertingParty,
 103             const char* relyingParty,
 104             const NameIdentifier& nameid,
 105             vector<Attribute*>& attributes
 106             ) const;
 107         void extractAttributes(
 108             const Application& application,
 109             const char* assertingParty,
 110             const char* relyingParty,
 111             const NameID& nameid,
 112             vector<Attribute*>& attributes
 113             ) const;
 114         void extractAttributes(
 115             const Application& application,
 116             const char* assertingParty,
 117             const char* relyingParty,
 118             const saml1::Attribute& attr,
 119             vector<Attribute*>& attributes
 120             ) const;
 121         void extractAttributes(
 122             const Application& application,
 123             const char* assertingParty,
 124             const char* relyingParty,
 125             const saml2::Attribute& attr,
 126             vector<Attribute*>& attributes
 127             ) const;
 128         void extractAttributes(
 129             const Application& application,
 130             const char* assertingParty,
 131             const char* relyingParty,
 132             const saml1::AttributeStatement& statement,
 133             vector<Attribute*>& attributes
 134             ) const;
 135         void extractAttributes(
 136             const Application& application,
 137             const char* assertingParty,
 138             const char* relyingParty,
 139             const saml2::AttributeStatement& statement,
 140             vector<Attribute*>& attributes
 141             ) const;
 142         void extractAttributes(
 143             const Application& application,
 144             const ObservableMetadataProvider* observable,
 145             const XMLCh* entityID,
 146             const char* relyingParty,
 147             const Extensions& ext,
 148             vector<Attribute*>& attributes
 149             ) const;
 150
 151         void getAttributeIds(vector<string>& attributes) const {
 152             attributes.insert(attributes.end(), m_attributeIds.begin(), m_attributeIds.end());
 153         }
 154
 155         void generateMetadata(SPSSODescriptor& role) const;
 156
 157     private:
 158         Category& m_log;
 159         DOMDocument* m_document;
 160         typedef map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > > attrmap_t;
 161         attrmap_t m_attrMap;
 162         vector<string> m_attributeIds;
 163         vector< pair< pair<xstring,xstring>,bool > > m_requestedAttrs;
 164
 165         // settings for embedded assertions in metadata
 166         string m_policyId;
 167         MetadataProvider* m_metadata;
 168         TrustEngine* m_trust;
 169         AttributeFilter* m_filter;
 170         bool m_entityAssertions;
 171
 172         // manages caching of decoded Attributes
 173         mutable RWLock* m_attrLock;
 174         typedef map< const EntityAttributes*,vector<DDF> > decoded_t;
 175         mutable map<const ObservableMetadataProvider*,decoded_t> m_decodedMap;
 176     };
 177
 178     class XMLExtractor : public AttributeExtractor, public ReloadableXMLFile
 179     {
 180     public:
 181         XMLExtractor(const DOMElement* e) : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT".AttributeExtractor.XML")), m_impl(nullptr) {
 182             background_load();
 183         }
 184         ~XMLExtractor() {
 185             shutdown();
 186             delete m_impl;
 187         }
 188
 189         void extractAttributes(
 190             const Application& application, const RoleDescriptor* issuer, const XMLObject& xmlObject, vector<Attribute*>& attributes
 191             ) const;
 192
 193         void getAttributeIds(std::vector<std::string>& attributes) const {
 194             if (m_impl)
 195                 m_impl->getAttributeIds(attributes);
 196         }
 197
 198         void generateMetadata(SPSSODescriptor& role) const {
 199             if (m_impl)
 200                 m_impl->generateMetadata(role);
 201         }
 202
 203     protected:
 204         pair<bool,DOMElement*> background_load();
 205
 206     private:
 207         XMLExtractorImpl* m_impl;
 208     };
 209
 210 #if defined (_MSC_VER)
 211     #pragma warning( pop )
 212 #endif
 213
 214     AttributeExtractor* SHIBSP_DLLLOCAL XMLAttributeExtractorFactory(const DOMElement* const & e)
 215     {
 216         return new XMLExtractor(e);
 217     }
 218
 219     static const XMLCh _aliases[] =             UNICODE_LITERAL_7(a,l,i,a,s,e,s);
 220     static const XMLCh _AttributeDecoder[] =    UNICODE_LITERAL_16(A,t,t,r,i,b,u,t,e,D,e,c,o,d,e,r);
 221     static const XMLCh _AttributeFilter[] =     UNICODE_LITERAL_15(A,t,t,r,i,b,u,t,e,F,i,l,t,e,r);
 222     static const XMLCh Attributes[] =           UNICODE_LITERAL_10(A,t,t,r,i,b,u,t,e,s);
 223     static const XMLCh _id[] =                  UNICODE_LITERAL_2(i,d);
 224     static const XMLCh isRequested[] =          UNICODE_LITERAL_11(i,s,R,e,q,u,e,s,t,e,d);
 225     static const XMLCh _MetadataProvider[] =    UNICODE_LITERAL_16(M,e,t,a,d,a,t,a,P,r,o,v,i,d,e,r);
 226     static const XMLCh _name[] =                UNICODE_LITERAL_4(n,a,m,e);
 227     static const XMLCh nameFormat[] =           UNICODE_LITERAL_10(n,a,m,e,F,o,r,m,a,t);
 228     static const XMLCh metadataPolicyId[] =     UNICODE_LITERAL_16(m,e,t,a,d,a,t,a,P,o,l,i,c,y,I,d);
 229     static const XMLCh _TrustEngine[] =         UNICODE_LITERAL_11(T,r,u,s,t,E,n,g,i,n,e);
 230     static const XMLCh _type[] =                UNICODE_LITERAL_4(t,y,p,e);
 231 };
 232
 233 XMLExtractorImpl::XMLExtractorImpl(const DOMElement* e, Category& log)
 234     : m_log(log),
 235         m_document(nullptr),
 236         m_policyId(XMLHelper::getAttrString(e, nullptr, metadataPolicyId)),
 237         m_metadata(nullptr),
 238         m_trust(nullptr),
 239         m_filter(nullptr),
 240         m_entityAssertions(true),
 241         m_attrLock(nullptr)
 242 {
 243 #ifdef _DEBUG
 244     xmltooling::NDC ndc("XMLExtractorImpl");
 245 #endif
 246
 247     if (!XMLHelper::isNodeNamed(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, Attributes))
 248         throw ConfigurationException("XML AttributeExtractor requires am:Attributes at root of configuration.");
 249
 250     DOMElement* child = XMLHelper::getFirstChildElement(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, _MetadataProvider);
 251     if (child) {
 252         try {
 253             string t(XMLHelper::getAttrString(child, nullptr, _type));
 254             if (t.empty())
 255                 throw ConfigurationException("MetadataProvider element missing type attribute.");
 256             m_log.info("building MetadataProvider of type %s...", t.c_str());
 257             auto_ptr<MetadataProvider> mp(SAMLConfig::getConfig().MetadataProviderManager.newPlugin(t.c_str(), child));
 258             mp->init();
 259             m_metadata = mp.release();
 260         }
 261         catch (exception& ex) {
 262             m_entityAssertions = false;
 263             m_log.crit("error building/initializing dedicated MetadataProvider: %s", ex.what());
 264             m_log.crit("disabling support for Assertions in EntityAttributes extension");
 265         }
 266     }
 267
 268     if (m_entityAssertions) {
 269         child = XMLHelper::getFirstChildElement(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, _TrustEngine);
 270         if (child) {
 271             try {
 272                 string t(XMLHelper::getAttrString(child, nullptr, _type));
 273                 if (t.empty())
 274                     throw ConfigurationException("TrustEngine element missing type attribute.");
 275                 m_log.info("building TrustEngine of type %s...", t.c_str());
 276                 m_trust = XMLToolingConfig::getConfig().TrustEngineManager.newPlugin(t.c_str(), child);
 277             }
 278             catch (exception& ex) {
 279                 m_entityAssertions = false;
 280                 m_log.crit("error building/initializing dedicated TrustEngine: %s", ex.what());
 281                 m_log.crit("disabling support for Assertions in EntityAttributes extension");
 282             }
 283         }
 284     }
 285
 286     if (m_entityAssertions) {
 287         child = XMLHelper::getFirstChildElement(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, _AttributeFilter);
 288         if (child) {
 289             try {
 290                 string t(XMLHelper::getAttrString(child, nullptr, _type));
 291                 if (t.empty())
 292                     throw ConfigurationException("AttributeFilter element missing type attribute.");
 293                 m_log.info("building AttributeFilter of type %s...", t.c_str());
 294                 m_filter = SPConfig::getConfig().AttributeFilterManager.newPlugin(t.c_str(), child);
 295             }
 296             catch (exception& ex) {
 297                 m_entityAssertions = false;
 298                 m_log.crit("error building/initializing dedicated AttributeFilter: %s", ex.what());
 299                 m_log.crit("disabling support for Assertions in EntityAttributes extension");
 300             }
 301         }
 302     }
 303
 304     child = XMLHelper::getFirstChildElement(e, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 305     while (child) {
 306         // Check for missing name or id.
 307         const XMLCh* name = child->getAttributeNS(nullptr, _name);
 308         if (!name || !*name) {
 309             m_log.warn("skipping Attribute with no name");
 310             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 311             continue;
 312         }
 313
 314         auto_ptr_char id(child->getAttributeNS(nullptr, _id));
 315         if (!id.get() || !*id.get()) {
 316             m_log.warn("skipping Attribute with no id");
 317             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 318             continue;
 319         }
 320         else if (!strcmp(id.get(), "REMOTE_USER")) {
 321             m_log.warn("skipping Attribute, id of REMOTE_USER is a reserved name");
 322             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 323             continue;
 324         }
 325
 326         AttributeDecoder* decoder=nullptr;
 327         try {
 328             DOMElement* dchild = XMLHelper::getFirstChildElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, _AttributeDecoder);
 329             if (dchild) {
 330                 auto_ptr<xmltooling::QName> q(XMLHelper::getXSIType(dchild));
 331                 if (q.get())
 332                     decoder = SPConfig::getConfig().AttributeDecoderManager.newPlugin(*q.get(), dchild);
 333             }
 334             if (!decoder)
 335                 decoder = SPConfig::getConfig().AttributeDecoderManager.newPlugin(StringAttributeDecoderType, nullptr);
 336         }
 337         catch (exception& ex) {
 338             m_log.error("skipping Attribute (%s), error building AttributeDecoder: %s", id.get(), ex.what());
 339         }
 340
 341         if (!decoder) {
 342             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 343             continue;
 344         }
 345
 346         // Empty NameFormat implies the usual Shib URI naming defaults.
 347         const XMLCh* format = child->getAttributeNS(nullptr, nameFormat);
 348         if (!format || XMLString::equals(format, shibspconstants::SHIB1_ATTRIBUTE_NAMESPACE_URI) ||
 349                 XMLString::equals(format, saml2::Attribute::URI_REFERENCE))
 350             format = &chNull;  // ignore default Format/Namespace values
 351
 352         // Fetch/create the map entry and see if it's a duplicate rule.
 353         pair< AttributeDecoder*,vector<string> >& decl = m_attrMap[pair<xstring,xstring>(name,format)];
 354         if (decl.first) {
 355             m_log.warn("skipping duplicate Attribute mapping (same name and nameFormat)");
 356             delete decoder;
 357             child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 358             continue;
 359         }
 360
 361         if (m_log.isInfoEnabled()) {
 362             auto_ptr_char n(name);
 363             auto_ptr_char f(format);
 364             m_log.info("creating mapping for Attribute %s%s%s", n.get(), *f.get() ? ", Format/Namespace:" : "", f.get());
 365         }
 366
 367         decl.first = decoder;
 368         decl.second.push_back(id.get());
 369         m_attributeIds.push_back(id.get());
 370
 371         // Check for isRequired/isRequested.
 372         bool requested = XMLHelper::getAttrBool(child, false, isRequested);
 373         bool required = XMLHelper::getAttrBool(child, false, RequestedAttribute::ISREQUIRED_ATTRIB_NAME);
 374         if (required || requested)
 375             m_requestedAttrs.push_back(make_pair(make_pair(name,format), required));
 376
 377         name = child->getAttributeNS(nullptr, _aliases);
 378         if (name && *name) {
 379             auto_ptr_char aliases(name);
 380             char* pos;
 381             char* start = const_cast<char*>(aliases.get());
 382             while (start && *start) {
 383                 while (*start && isspace(*start))
 384                     start++;
 385                 if (!*start)
 386                     break;
 387                 pos = strchr(start,' ');
 388                 if (pos)
 389                     *pos=0;
 390                 if (strcmp(start, "REMOTE_USER")) {
 391                     decl.second.push_back(start);
 392                     m_attributeIds.push_back(start);
 393                 }
 394                 else {
 395                     m_log.warn("skipping alias, REMOTE_USER is a reserved name");
 396                 }
 397                 start = pos ? pos+1 : nullptr;
 398             }
 399         }
 400
 401         child = XMLHelper::getNextSiblingElement(child, shibspconstants::SHIB2ATTRIBUTEMAP_NS, saml1::Attribute::LOCAL_NAME);
 402     }
 403
 404     m_attrLock = RWLock::create();
 405 }
 406
 407 void XMLExtractorImpl::generateMetadata(SPSSODescriptor& role) const
 408 {
 409     if (m_requestedAttrs.empty())
 410         return;
 411     int index = 1;
 412     const vector<AttributeConsumingService*>& svcs = const_cast<const SPSSODescriptor*>(&role)->getAttributeConsumingServices();
 413     for (vector<AttributeConsumingService*>::const_iterator s =svcs.begin(); s != svcs.end(); ++s) {
 414         pair<bool,int> i = (*s)->getIndex();
 415         if (i.first && index == i.second)
 416             index = i.second + 1;
 417     }
 418     AttributeConsumingService* svc = AttributeConsumingServiceBuilder::buildAttributeConsumingService();
 419     role.getAttributeConsumingServices().push_back(svc);
 420     svc->setIndex(index);
 421     ServiceName* sn = ServiceNameBuilder::buildServiceName();
 422     svc->getServiceNames().push_back(sn);
 423     sn->setName(dynamic_cast<EntityDescriptor*>(role.getParent())->getEntityID());
 424     static const XMLCh english[] = UNICODE_LITERAL_2(e,n);
 425     sn->setLang(english);
 426
 427     for (vector< pair< pair<xstring,xstring>,bool > >::const_iterator i = m_requestedAttrs.begin(); i != m_requestedAttrs.end(); ++i) {
 428         RequestedAttribute* req = RequestedAttributeBuilder::buildRequestedAttribute();
 429         svc->getRequestedAttributes().push_back(req);
 430         req->setName(i->first.first.c_str());
 431         if (i->first.second.empty())
 432             req->setNameFormat(saml2::Attribute::URI_REFERENCE);
 433         else
 434             req->setNameFormat(i->first.second.c_str());
 435         if (i->second)
 436             req->isRequired(true);
 437     }
 438 }
 439
 440 void XMLExtractorImpl::extractAttributes(
 441     const Application& application,
 442     const char* assertingParty,
 443     const char* relyingParty,
 444     const NameIdentifier& nameid,
 445     vector<Attribute*>& attributes
 446     ) const
 447 {
 448     map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 449
 450     const XMLCh* format = nameid.getFormat();
 451     if (!format || !*format)
 452         format = NameIdentifier::UNSPECIFIED;
 453     if ((rule=m_attrMap.find(pair<xstring,xstring>(format,xstring()))) != m_attrMap.end()) {
 454         Attribute* a = rule->second.first->decode(rule->second.second, &nameid, assertingParty, relyingParty);
 455         if (a)
 456             attributes.push_back(a);
 457     }
 458     else if (m_log.isDebugEnabled()) {
 459         auto_ptr_char temp(format);
 460         m_log.debug("skipping unmapped NameIdentifier with format (%s)", temp.get());
 461     }
 462 }
 463
 464 void XMLExtractorImpl::extractAttributes(
 465     const Application& application,
 466     const char* assertingParty,
 467     const char* relyingParty,
 468     const NameID& nameid,
 469     vector<Attribute*>& attributes
 470     ) const
 471 {
 472     map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 473
 474     const XMLCh* format = nameid.getFormat();
 475     if (!format || !*format)
 476         format = NameID::UNSPECIFIED;
 477     if ((rule=m_attrMap.find(pair<xstring,xstring>(format,xstring()))) != m_attrMap.end()) {
 478         Attribute* a = rule->second.first->decode(rule->second.second, &nameid, assertingParty, relyingParty);
 479         if (a)
 480             attributes.push_back(a);
 481     }
 482     else if (m_log.isDebugEnabled()) {
 483         auto_ptr_char temp(format);
 484         m_log.debug("skipping unmapped NameID with format (%s)", temp.get());
 485     }
 486 }
 487
 488 void XMLExtractorImpl::extractAttributes(
 489     const Application& application,
 490     const char* assertingParty,
 491     const char* relyingParty,
 492     const saml1::Attribute& attr,
 493     vector<Attribute*>& attributes
 494     ) const
 495 {
 496     map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 497
 498     const XMLCh* name = attr.getAttributeName();
 499     const XMLCh* format = attr.getAttributeNamespace();
 500     if (!name || !*name)
 501         return;
 502     if (!format || XMLString::equals(format, shibspconstants::SHIB1_ATTRIBUTE_NAMESPACE_URI))
 503         format = &chNull;
 504     if ((rule=m_attrMap.find(pair<xstring,xstring>(name,format))) != m_attrMap.end()) {
 505         Attribute* a = rule->second.first->decode(rule->second.second, &attr, assertingParty, relyingParty);
 506         if (a)
 507             attributes.push_back(a);
 508     }
 509     else if (m_log.isInfoEnabled()) {
 510         auto_ptr_char temp1(name);
 511         auto_ptr_char temp2(format);
 512         m_log.info("skipping unmapped SAML 1.x Attribute with Name: %s%s%s", temp1.get(), *temp2.get() ? ", Namespace:" : "", temp2.get());
 513     }
 514 }
 515
 516 void XMLExtractorImpl::extractAttributes(
 517     const Application& application,
 518     const char* assertingParty,
 519     const char* relyingParty,
 520     const saml2::Attribute& attr,
 521     vector<Attribute*>& attributes
 522     ) const
 523 {
 524     map< pair<xstring,xstring>,pair< AttributeDecoder*,vector<string> > >::const_iterator rule;
 525
 526     const XMLCh* name = attr.getName();
 527     const XMLCh* format = attr.getNameFormat();
 528     if (!name || !*name)
 529         return;
 530     if (!format || !*format)
 531         format = saml2::Attribute::UNSPECIFIED;
 532     else if (XMLString::equals(format, saml2::Attribute::URI_REFERENCE))
 533         format = &chNull;
 534
 535     if ((rule=m_attrMap.find(pair<xstring,xstring>(name,format))) != m_attrMap.end()) {
 536         Attribute* a = rule->second.first->decode(rule->second.second, &attr, assertingParty, relyingParty);
 537         if (a) {
 538             attributes.push_back(a);
 539             return;
 540         }
 541     }
 542     else if (XMLString::equals(format, saml2::Attribute::UNSPECIFIED)) {
 543         // As a fallback, if the format is "unspecified", null out the value and re-map.
 544         if ((rule=m_attrMap.find(pair<xstring,xstring>(name,xstring()))) != m_attrMap.end()) {
 545             Attribute* a = rule->second.first->decode(rule->second.second, &attr, assertingParty, relyingParty);
 546             if (a) {
 547                 attributes.push_back(a);
 548                 return;
 549             }
 550         }
 551     }
 552
 553     if (m_log.isInfoEnabled()) {
 554         auto_ptr_char temp1(name);
 555         auto_ptr_char temp2(format);
 556         m_log.info("skipping unmapped SAML 2.0 Attribute with Name: %s%s%s", temp1.get(), *temp2.get() ? ", Format:" : "", temp2.get());
 557     }
 558 }
 559
 560 void XMLExtractorImpl::extractAttributes(
 561     const Application& application,
 562     const char* assertingParty,
 563     const char* relyingParty,
 564     const saml1::AttributeStatement& statement,
 565     vector<Attribute*>& attributes
 566     ) const
 567 {
 568     const vector<saml1::Attribute*>& attrs = statement.getAttributes();
 569     for (vector<saml1::Attribute*>::const_iterator a = attrs.begin(); a!=attrs.end(); ++a)
 570         extractAttributes(application, assertingParty, relyingParty, *(*a), attributes);
 571 }
 572
 573 void XMLExtractorImpl::extractAttributes(
 574     const Application& application,
 575     const char* assertingParty,
 576     const char* relyingParty,
 577     const saml2::AttributeStatement& statement,
 578     vector<Attribute*>& attributes
 579     ) const
 580 {
 581     const vector<saml2::Attribute*>& attrs = statement.getAttributes();
 582     for (vector<saml2::Attribute*>::const_iterator a = attrs.begin(); a!=attrs.end(); ++a)
 583         extractAttributes(application, assertingParty, relyingParty, *(*a), attributes);
 584 }
 585
 586 void XMLExtractorImpl::extractAttributes(
 587     const Application& application,
 588     const ObservableMetadataProvider* observable,
 589     const XMLCh* entityID,
 590     const char* relyingParty,
 591     const Extensions& ext,
 592     vector<Attribute*>& attributes
 593     ) const
 594 {
 595     const vector<XMLObject*>& exts = ext.getUnknownXMLObjects();
 596     for (vector<XMLObject*>::const_iterator i = exts.begin(); i!=exts.end(); ++i) {
 597         const EntityAttributes* container = dynamic_cast<const EntityAttributes*>(*i);
 598         if (!container)
 599             continue;
 600
 601         bool useCache = false;
 602         map<const ObservableMetadataProvider*,decoded_t>::iterator cacheEntry;
 603
 604         // Check for cached result.
 605         if (observable) {
 606             m_attrLock->rdlock();
 607             cacheEntry = m_decodedMap.find(observable);
 608             if (cacheEntry == m_decodedMap.end()) {
 609                 // We need to elevate the lock and retry.
 610                 m_attrLock->unlock();
 611                 m_attrLock->wrlock();
 612                 cacheEntry = m_decodedMap.find(observable);
 613                 if (cacheEntry==m_decodedMap.end()) {
 614
 615                     // It's still brand new, so hook it for cache activation.
 616                     observable->addObserver(this);
 617
 618                     // Prime the map reference with an empty decoded map.
 619                     cacheEntry = m_decodedMap.insert(make_pair(observable,decoded_t())).first;
 620
 621                     // Downgrade the lock.
 622                     // We don't have to recheck because we never erase the master map entry entirely, even on changes.
 623                     m_attrLock->unlock();
 624                     m_attrLock->rdlock();
 625                 }
 626             }
 627             useCache = true;
 628         }
 629
 630         if (useCache) {
 631             // We're holding a read lock, so check the cache.
 632             decoded_t::iterator d = cacheEntry->second.find(container);
 633             if (d != cacheEntry->second.end()) {
 634                 SharedLock locker(m_attrLock, false);   // pop the lock when we're done
 635                 for (vector<DDF>::iterator obj = d->second.begin(); obj != d->second.end(); ++obj) {
 636                     auto_ptr<Attribute> wrapper(Attribute::unmarshall(*obj));
 637                     m_log.debug("recovered cached metadata attribute (%s)", wrapper->getId());
 638                     attributes.push_back(wrapper.release());
 639                 }
 640                 break;
 641             }
 642         }
 643
 644         // Use a holding area to support caching.
 645         vector<Attribute*> holding;
 646
 647         const vector<saml2::Attribute*>& attrs = container->getAttributes();
 648         for (vector<saml2::Attribute*>::const_iterator attr = attrs.begin(); attr != attrs.end(); ++attr) {
 649             try {
 650                 extractAttributes(application, nullptr, relyingParty, *(*attr), holding);
 651             }
 652             catch (...) {
 653                 if (useCache)
 654                     m_attrLock->unlock();
 655                 for_each(holding.begin(), holding.end(), xmltooling::cleanup<Attribute>());
 656                 throw;
 657             }
 658         }
 659
 660         if (entityID && m_entityAssertions) {
 661             const vector<saml2::Assertion*>& asserts = container->getAssertions();
 662             for (vector<saml2::Assertion*>::const_iterator assert = asserts.begin(); assert != asserts.end(); ++assert) {
 663                 if (!(*assert)->getSignature()) {
 664                     if (m_log.isDebugEnabled()) {
 665                         auto_ptr_char eid(entityID);
 666                         m_log.debug("skipping unsigned assertion in metadata extension for entity (%s)", eid.get());
 667                     }
 668                     continue;
 669                 }
 670                 else if ((*assert)->getAttributeStatements().empty()) {
 671                     if (m_log.isDebugEnabled()) {
 672                         auto_ptr_char eid(entityID);
 673                         m_log.debug("skipping assertion with no AttributeStatement in metadata extension for entity (%s)", eid.get());
 674                     }
 675                     continue;
 676                 }
 677                 else {
 678                     // Check subject.
 679                     const NameID* subject = (*assert)->getSubject() ? (*assert)->getSubject()->getNameID() : nullptr;
 680                     if (!subject ||
 681                             !XMLString::equals(subject->getFormat(), NameID::ENTITY) ||
 682                             !XMLString::equals(subject->getName(), entityID)) {
 683                         if (m_log.isDebugEnabled()) {
 684                             auto_ptr_char eid(entityID);
 685                             m_log.debug("skipping assertion with improper Subject in metadata extension for entity (%s)", eid.get());
 686                         }
 687                         continue;
 688                     }
 689                 }
 690
 691                 // Use a private holding area for filtering purposes.
 692                 vector<Attribute*> holding2;
 693
 694                 try {
 695                     // Set up and evaluate a policy for an AA asserting attributes to us.
 696                     shibsp::SecurityPolicy policy(application, &AttributeAuthorityDescriptor::ELEMENT_QNAME, false, m_policyId.c_str());
 697                     Locker locker(m_metadata);
 698                     if (m_metadata)
 699                         policy.setMetadataProvider(m_metadata);
 700                     if (m_trust)
 701                         policy.setTrustEngine(m_trust);
 702                     // Populate recipient as audience.
 703                     const XMLCh* issuer = (*assert)->getIssuer() ? (*assert)->getIssuer()->getName() : nullptr;
 704                     policy.getAudiences().push_back(application.getRelyingParty(issuer)->getXMLString("entityID").second);
 705
 706                     // Extract assertion information for policy.
 707                     policy.setMessageID((*assert)->getID());
 708                     policy.setIssueInstant((*assert)->getIssueInstantEpoch());
 709                     policy.setIssuer((*assert)->getIssuer());
 710
 711                     // Look up metadata for issuer.
 712                     if (policy.getIssuer() && policy.getMetadataProvider()) {
 713                         if (policy.getIssuer()->getFormat() && !XMLString::equals(policy.getIssuer()->getFormat(), saml2::NameIDType::ENTITY)) {
 714                             m_log.debug("non-system entity issuer, skipping metadata lookup");
 715                         }
 716                         else {
 717                             m_log.debug("searching metadata for entity assertion issuer...");
 718                             pair<const EntityDescriptor*,const RoleDescriptor*> lookup;
 719                             MetadataProvider::Criteria& mc = policy.getMetadataProviderCriteria();
 720                             mc.entityID_unicode = policy.getIssuer()->getName();
 721                             mc.role = &AttributeAuthorityDescriptor::ELEMENT_QNAME;
 722                             mc.protocol = samlconstants::SAML20P_NS;
 723                             lookup = policy.getMetadataProvider()->getEntityDescriptor(mc);
 724                             if (!lookup.first) {
 725                                 auto_ptr_char iname(policy.getIssuer()->getName());
 726                                 m_log.debug("no metadata found, can't establish identity of issuer (%s)", iname.get());
 727                             }
 728                             else if (!lookup.second) {
 729                                 m_log.debug("unable to find compatible AA role in metadata");
 730                             }
 731                             else {
 732                                 policy.setIssuerMetadata(lookup.second);
 733                             }
 734                         }
 735                     }
 736
 737                     // Authenticate the assertion. We have to clone and marshall it to establish the signature for verification.
 738                     auto_ptr<saml2::Assertion> tokencopy((*assert)->cloneAssertion());
 739                     tokencopy->marshall();
 740                     policy.evaluate(*tokencopy);
 741                     if (!policy.isAuthenticated()) {
 742                         if (m_log.isDebugEnabled()) {
 743                             auto_ptr_char tempid(tokencopy->getID());
 744                             auto_ptr_char eid(entityID);
 745                             m_log.debug(
 746                                 "failed to authenticate assertion (%s) in metadata extension for entity (%s)", tempid.get(), eid.get()
 747                                 );
 748                         }
 749                         continue;
 750                     }
 751
 752                     // Override the asserting/relying party names based on this new issuer.
 753                     const EntityDescriptor* inlineEntity =
 754                         policy.getIssuerMetadata() ? dynamic_cast<const EntityDescriptor*>(policy.getIssuerMetadata()->getParent()) : nullptr;
 755                     auto_ptr_char inlineAssertingParty(inlineEntity ? inlineEntity->getEntityID() : nullptr);
 756                     relyingParty = application.getRelyingParty(inlineEntity)->getString("entityID").second;
 757                     const vector<saml2::Attribute*>& attrs2 =
 758                         const_cast<const saml2::AttributeStatement*>(tokencopy->getAttributeStatements().front())->getAttributes();
 759                     for (vector<saml2::Attribute*>::const_iterator a = attrs2.begin(); a!=attrs2.end(); ++a)
 760                         extractAttributes(application, inlineAssertingParty.get(), relyingParty, *(*a), holding2);
 761
 762                     // Now we locally filter the attributes so that the actual issuer can be properly set.
 763                     // If we relied on outside filtering, the attributes couldn't be distinguished from the
 764                     // ones that come from the user's IdP.
 765                     if (m_filter && !holding2.empty()) {
 766                         BasicFilteringContext fc(application, holding2, policy.getIssuerMetadata());
 767                         Locker filtlocker(m_filter);
 768                         try {
 769                             m_filter->filterAttributes(fc, holding2);
 770                         }
 771                         catch (exception& ex) {
 772                             m_log.error("caught exception filtering attributes: %s", ex.what());
 773                             m_log.error("dumping extracted attributes due to filtering exception");
 774                             for_each(holding2.begin(), holding2.end(), xmltooling::cleanup<Attribute>());
 775                             holding2.clear();
 776                         }
 777                     }
 778
 779                     if (!holding2.empty()) {
 780                         // Copy them over to the main holding tank.
 781                         holding.insert(holding.end(), holding2.begin(), holding2.end());
 782                     }
 783                 }
 784                 catch (exception& ex) {
 785                     // Known exceptions are handled gracefully by skipping the assertion.
 786                     if (m_log.isDebugEnabled()) {
 787                         auto_ptr_char tempid((*assert)->getID());
 788                         auto_ptr_char eid(entityID);
 789                         m_log.debug(
 790                             "exception authenticating assertion (%s) in metadata extension for entity (%s): %s",
 791                             tempid.get(),
 792                             eid.get(),
 793                             ex.what()
 794                             );
 795                     }
 796                     for_each(holding2.begin(), holding2.end(), xmltooling::cleanup<Attribute>());
 797                     continue;
 798                 }
 799                 catch (...) {
 800                     // Unknown exceptions are fatal.
 801                     if (useCache)
 802                         m_attrLock->unlock();
 803                     for_each(holding.begin(), holding.end(), xmltooling::cleanup<Attribute>());
 804                     for_each(holding2.begin(), holding2.end(), xmltooling::cleanup<Attribute>());
 805                     throw;
 806                 }
 807             }
 808         }
 809
 810         if (!holding.empty()) {
 811             if (useCache) {
 812                 m_attrLock->unlock();
 813                 m_attrLock->wrlock();
 814                 SharedLock locker(m_attrLock, false);   // pop the lock when we're done
 815                 if (cacheEntry->second.count(container) == 0) {
 816                     for (vector<Attribute*>::const_iterator held = holding.begin(); held != holding.end(); ++held)
 817                         cacheEntry->second[container].push_back((*held)->marshall());
 818                 }
 819             }
 820             attributes.insert(attributes.end(), holding.begin(), holding.end());
 821         }
 822         else if (useCache) {
 823             m_attrLock->unlock();
 824         }
 825
 826         break;  // only process a single extension element
 827     }
 828 }
 829
 830 void XMLExtractor::extractAttributes(
 831     const Application& application, const RoleDescriptor* issuer, const XMLObject& xmlObject, vector<Attribute*>& attributes
 832     ) const
 833 {
 834     if (!m_impl)
 835         return;
 836
 837     const EntityDescriptor* entity = issuer ? dynamic_cast<const EntityDescriptor*>(issuer->getParent()) : nullptr;
 838     const char* relyingParty = application.getRelyingParty(entity)->getString("entityID").second;
 839
 840     // Check for statements.
 841     if (XMLString::equals(xmlObject.getElementQName().getLocalPart(), saml1::AttributeStatement::LOCAL_NAME)) {
 842         const saml2::AttributeStatement* statement2 = dynamic_cast<const saml2::AttributeStatement*>(&xmlObject);
 843         if (statement2) {
 844             auto_ptr_char assertingParty(entity ? entity->getEntityID() : nullptr);
 845             m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *statement2, attributes);
 846             // Handle EncryptedAttributes inline so we have access to the role descriptor.
 847             const vector<saml2::EncryptedAttribute*>& encattrs = statement2->getEncryptedAttributes();
 848             for (vector<saml2::EncryptedAttribute*>::const_iterator ea = encattrs.begin(); ea!=encattrs.end(); ++ea)
 849                 extractAttributes(application, issuer, *(*ea), attributes);
 850             return;
 851         }
 852
 853         const saml1::AttributeStatement* statement1 = dynamic_cast<const saml1::AttributeStatement*>(&xmlObject);
 854         if (statement1) {
 855             auto_ptr_char assertingParty(entity ? entity->getEntityID() : nullptr);
 856             m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *statement1, attributes);
 857             return;
 858         }
 859
 860         throw AttributeExtractionException("Unable to extract attributes, unknown object type.");
 861     }
 862
 863     // Check for assertions.
 864     if (XMLString::equals(xmlObject.getElementQName().getLocalPart(), saml1::Assertion::LOCAL_NAME)) {
 865         const saml2::Assertion* token2 = dynamic_cast<const saml2::Assertion*>(&xmlObject);
 866         if (token2) {
 867             auto_ptr_char assertingParty(entity ? entity->getEntityID() : nullptr);
 868             const vector<saml2::AttributeStatement*>& statements = token2->getAttributeStatements();
 869             for (vector<saml2::AttributeStatement*>::const_iterator s = statements.begin(); s!=statements.end(); ++s) {
 870                 m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *(*s), attributes);
 871                 // Handle EncryptedAttributes inline so we have access to the role descriptor.
 872                 const vector<saml2::EncryptedAttribute*>& encattrs = const_cast<const saml2::AttributeStatement*>(*s)->getEncryptedAttributes();
 873                 for (vector<saml2::EncryptedAttribute*>::const_iterator ea = encattrs.begin(); ea!=encattrs.end(); ++ea)
 874                     extractAttributes(application, issuer, *(*ea), attributes);
 875             }
 876             return;
 877         }
 878
 879         const saml1::Assertion* token1 = dynamic_cast<const saml1::Assertion*>(&xmlObject);
 880         if (token1) {
 881             auto_ptr_char assertingParty(entity ? entity->getEntityID() : nullptr);
 882             const vector<saml1::AttributeStatement*>& statements = token1->getAttributeStatements();
 883             for (vector<saml1::AttributeStatement*>::const_iterator s = statements.begin(); s!=statements.end(); ++s)
 884                 m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *(*s), attributes);
 885             return;
 886         }
 887
 888         throw AttributeExtractionException("Unable to extract attributes, unknown object type.");
 889     }
 890
 891     // Check for metadata.
 892     if (XMLString::equals(xmlObject.getElementQName().getNamespaceURI(), samlconstants::SAML20MD_NS)) {
 893         const RoleDescriptor* roleToExtract = dynamic_cast<const RoleDescriptor*>(&xmlObject);
 894         const EntityDescriptor* entityToExtract = roleToExtract ? dynamic_cast<const EntityDescriptor*>(roleToExtract->getParent()) : nullptr;
 895         if (!entityToExtract)
 896             throw AttributeExtractionException("Unable to extract attributes, unknown metadata object type.");
 897         const Extensions* ext = entityToExtract->getExtensions();
 898         if (ext) {
 899             m_impl->extractAttributes(
 900                 application,
 901                 dynamic_cast<const ObservableMetadataProvider*>(application.getMetadataProvider(false)),
 902                 entityToExtract->getEntityID(),
 903                 relyingParty,
 904                 *ext,
 905                 attributes
 906                 );
 907         }
 908         const EntitiesDescriptor* group = dynamic_cast<const EntitiesDescriptor*>(entityToExtract->getParent());
 909         while (group) {
 910             ext = group->getExtensions();
 911             if (ext) {
 912                 m_impl->extractAttributes(
 913                     application,
 914                     dynamic_cast<const ObservableMetadataProvider*>(application.getMetadataProvider(false)),
 915                     nullptr,   // not an entity, so inline assertions won't be processed
 916                     relyingParty,
 917                     *ext,
 918                     attributes
 919                     );
 920             }
 921             group = dynamic_cast<const EntitiesDescriptor*>(group->getParent());
 922         }
 923         return;
 924     }
 925
 926     // Check for attributes.
 927     if (XMLString::equals(xmlObject.getElementQName().getLocalPart(), saml1::Attribute::LOCAL_NAME)) {
 928         auto_ptr_char assertingParty(entity ? entity->getEntityID() : nullptr);
 929         const saml2::Attribute* attr2 = dynamic_cast<const saml2::Attribute*>(&xmlObject);
 930         if (attr2)
 931             return m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *attr2, attributes);
 932
 933         const saml1::Attribute* attr1 = dynamic_cast<const saml1::Attribute*>(&xmlObject);
 934         if (attr1)
 935             return m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *attr1, attributes);
 936
 937         throw AttributeExtractionException("Unable to extract attributes, unknown object type.");
 938     }
 939
 940     if (XMLString::equals(xmlObject.getElementQName().getLocalPart(), EncryptedAttribute::LOCAL_NAME)) {
 941         const EncryptedAttribute* encattr = dynamic_cast<const EncryptedAttribute*>(&xmlObject);
 942         if (encattr) {
 943             const XMLCh* recipient = application.getXMLString("entityID").second;
 944             CredentialResolver* cr = application.getCredentialResolver();
 945             if (!cr) {
 946                 m_log.warn("found encrypted attribute, but no CredentialResolver was available");
 947                 return;
 948             }
 949
 950             try {
 951                 Locker credlocker(cr);
 952                 if (issuer) {
 953                     MetadataCredentialCriteria mcc(*issuer);
 954                     auto_ptr<XMLObject> decrypted(encattr->decrypt(*cr, recipient, &mcc));
 955                     if (m_log.isDebugEnabled())
 956                         m_log.debugStream() << "decrypted Attribute: " << *(decrypted.get()) << logging::eol;
 957                     return extractAttributes(application, issuer, *(decrypted.get()), attributes);
 958                 }
 959                 else {
 960                     auto_ptr<XMLObject> decrypted(encattr->decrypt(*cr, recipient));
 961                     if (m_log.isDebugEnabled())
 962                         m_log.debugStream() << "decrypted Attribute: " << *(decrypted.get()) << logging::eol;
 963                     return extractAttributes(application, issuer, *(decrypted.get()), attributes);
 964                 }
 965             }
 966             catch (exception& ex) {
 967                 m_log.error("caught exception decrypting Attribute: %s", ex.what());
 968                 return;
 969             }
 970         }
 971     }
 972
 973     // Check for NameIDs.
 974     const NameID* name2 = dynamic_cast<const NameID*>(&xmlObject);
 975     if (name2) {
 976         auto_ptr_char assertingParty(entity ? entity->getEntityID() : nullptr);
 977         return m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *name2, attributes);
 978     }
 979
 980     const NameIdentifier* name1 = dynamic_cast<const NameIdentifier*>(&xmlObject);
 981     if (name1) {
 982         auto_ptr_char assertingParty(entity ? entity->getEntityID() : nullptr);
 983         return m_impl->extractAttributes(application, assertingParty.get(), relyingParty, *name1, attributes);
 984     }
 985
 986     throw AttributeExtractionException("Unable to extract attributes, unknown object type.");
 987 }
 988
 989 pair<bool,DOMElement*> XMLExtractor::background_load()
 990 {
 991     // Load from source using base class.
 992     pair<bool,DOMElement*> raw = ReloadableXMLFile::load();
 993
 994     // If we own it, wrap it.
 995     XercesJanitor<DOMDocument> docjanitor(raw.first ? raw.second->getOwnerDocument() : nullptr);
 996
 997     XMLExtractorImpl* impl = new XMLExtractorImpl(raw.second, m_log);
 998
 999     // If we held the document, transfer it to the impl. If we didn't, it's a no-op.
1000     impl->setDocument(docjanitor.release());
1001
1002     // Perform the swap inside a lock.
1003     if (m_lock)
1004         m_lock->wrlock();
1005     SharedLock locker(m_lock, false);
1006     delete m_impl;
1007     m_impl = impl;
1008
1009     return make_pair(false,(DOMElement*)nullptr);
1010 }