/*
- * The Shibboleth License, Version 1.
- * Copyright (c) 2002
- * University Corporation for Advanced Internet Development, Inc.
- * All rights reserved
+ * Copyright 2001-2009 Internet2
*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
+ * http://www.apache.org/licenses/LICENSE-2.0
*
- * Redistributions of source code must retain the above copyright notice, this
- * list of conditions and the following disclaimer.
- *
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution, if any, must include
- * the following acknowledgment: "This product includes software developed by
- * the University Corporation for Advanced Internet Development
- * <http://www.ucaid.edu>Internet2 Project. Alternately, this acknowledegement
- * may appear in the software itself, if and wherever such third-party
- * acknowledgments normally appear.
- *
- * Neither the name of Shibboleth nor the names of its contributors, nor
- * Internet2, nor the University Corporation for Advanced Internet Development,
- * Inc., nor UCAID may be used to endorse or promote products derived from this
- * software without specific prior written permission. For written permission,
- * please contact shibboleth@shibboleth.org
- *
- * Products derived from this software may not be called Shibboleth, Internet2,
- * UCAID, or the University Corporation for Advanced Internet Development, nor
- * may Shibboleth appear in their name, without prior written permission of the
- * University Corporation for Advanced Internet Development.
- *
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
- * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK
- * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE.
- * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY
- * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT,
- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
*/
/* nsapi_shib.cpp - Shibboleth NSAPI filter
12/13/04
*/
-#include "config_win32.h"
+#if defined (_MSC_VER) || defined(__BORLANDC__)
+# include "config_win32.h"
+#else
+# include "config.h"
+#endif
+
// SAML Runtime
#include <saml/saml.h>
#include <shib/shib-threads.h>
#include <shib-target/shib-target.h>
-#include <log4cpp/Category.hh>
-
#include <ctime>
#include <fstream>
#include <sstream>
#include <stdexcept>
#ifdef WIN32
+# include <process.h>
# define XP_WIN32
#else
# define XP_UNIX
}
using namespace std;
-using namespace log4cpp;
using namespace saml;
using namespace shibboleth;
using namespace shibtarget;
#define NET_WRITE(str) \
if (IO_ERROR==net_write(sn->csd,str,strlen(str))) return REQ_EXIT
-#if 0
-/**************************************************************************/
-/* This isn't used anywhere -- why have it? */
-#define NET_WRITE1(buf,fmstr,param) \
- do { sprintf(buf,fmstr,param); NET_WRITE(buf); } while(0)
-
-#define NET_WRITE2(buf,fmstr,param1,param2) \
- do { sprintf(buf,fmstr,param1,param2); NET_WRITE(buf); } while(0)
-
-#define NET_WRITE3(buf,fmstr,param1,param2,param3) \
- do { sprintf(buf,fmstr,param1,param2,param3); NET_WRITE(buf); } while(0)
-
-#define NET_WRITE4(buf,fmstr,param1,param2,param3,param4) \
- do { sprintf(buf,fmstr,param1,param2,param3,param4); NET_WRITE(buf); } while(0)
-/**************************************************************************/
-#endif
-
namespace {
ShibTargetConfig* g_Config=NULL;
string g_ServerName;
- string g_ServerScheme;
+ string g_unsetHeaderValue;
+ set<string> g_allowedSchemes;
+ bool g_checkSpoofing = false;
+ bool g_catchAll = true;
}
+PlugManager::Factory SunRequestMapFactory;
+
extern "C" NSAPI_PUBLIC void nsapi_shib_exit(void*)
{
if (g_Config)
}
}
}
- name=pblock_findval("server-scheme",pb);
- if (name)
- g_ServerScheme=name;
log_error(LOG_INFORM,"nsapi_shib_init",sn,rq,"nsapi_shib loaded for host (%s)",g_ServerName.c_str());
- try
- {
+ try {
const char* schemadir=pblock_findval("shib-schemas",pb);
if (!schemadir)
schemadir=getenv("SHIBSCHEMAS");
ShibTargetConfig::Metadata |
ShibTargetConfig::AAP |
ShibTargetConfig::RequestMapper |
- ShibTargetConfig::SHIREExtensions |
+ ShibTargetConfig::LocalExtensions |
ShibTargetConfig::Logging
);
- if (!g_Config->init(schemadir,config)) {
+ if (!g_Config->init(schemadir)) {
g_Config=NULL;
pblock_nvinsert("error","unable to initialize Shibboleth libraries",pb);
return REQ_ABORTED;
}
+ SAMLConfig::getConfig().getPlugMgr().regFactory(shibtarget::XML::NativeRequestMapType,&SunRequestMapFactory);
+ // We hijack the legacy type so that 1.2 config files will load this plugin
+ SAMLConfig::getConfig().getPlugMgr().regFactory(shibtarget::XML::LegacyRequestMapType,&SunRequestMapFactory);
+
+ if (!g_Config->load(config)) {
+ g_Config=NULL;
+ pblock_nvinsert("error","unable to initialize load Shibboleth configuration",pb);
+ return REQ_ABORTED;
+ }
+
daemon_atrestart(nsapi_shib_exit,NULL);
+
+ IConfig* conf=g_Config->getINI();
+ Locker locker(conf);
+ const IPropertySet* props=conf->getPropertySet("Local");
+ if (props) {
+ pair<bool,const char*> str=props->getString("unsetHeaderValue");
+ if (str.first)
+ g_unsetHeaderValue = str.second;
+
+ str=props->getString("allowedSchemes");
+ if (str.first) {
+ string schemes=str.second;
+ unsigned int j=0;
+ for (unsigned int i=0; i < schemes.length(); i++) {
+ if (schemes.at(i)==' ') {
+ g_allowedSchemes.insert(schemes.substr(j, i-j));
+ j = i+1;
+ }
+ }
+ g_allowedSchemes.insert(schemes.substr(j, schemes.length()-j));
+ }
+
+ pair<bool,bool> flag=props->getBool("checkSpoofing");
+ g_checkSpoofing = !flag.first || flag.second;
+ flag=props->getBool("catchAll");
+ g_catchAll = !flag.first || flag.second;
+ }
+ if (g_allowedSchemes.empty()) {
+ g_allowedSchemes.insert("https");
+ g_allowedSchemes.insert("http");
+ }
}
- catch (...)
- {
-#ifdef _DEBUG
- throw;
-#endif
+ catch (exception&) {
g_Config=NULL;
pblock_nvinsert("error","caught exception, unable to initialize Shibboleth libraries",pb);
return REQ_ABORTED;
class ShibTargetNSAPI : public ShibTarget
{
+ void checkString(const string& s, const char* msg) {
+ string::const_iterator e = s.end();
+ for (string::const_iterator i=s.begin(); i!=e; ++i) {
+ if (iscntrl(*i))
+ throw FatalProfileException(msg);
+ }
+ }
+
public:
- ShibTargetNSAPI(pblock* pb, Session* sn, Request* rq) {
- // Get everything but hostname...
+ ShibTargetNSAPI(pblock* pb, Session* sn, Request* rq) : m_pb(pb), m_sn(sn), m_rq(rq), m_firsttime(true) {
+
+ // To determine whether SSL is active or not, we're supposed to rely
+ // on the security_active macro. For iPlanet 4.x, this works.
+ // For Sun 7.x, it's useless and appears to be on or off based
+ // on whether ANY SSL support is enabled for a vhost. Sun 6.x is unknown.
+ // As a fix, there's a conf variable called $security that can be mapped
+ // into a function parameter: security_active="$security"
+ // We check for this parameter, and rely on the macro if it isn't set.
+ // This doubles as a scheme virtualizer for load balanced scenarios
+ // since you can set the parameter to 1 or 0 as needed.
+ const char* scheme;
+ const char* sa = pblock_findval("security_active", pb);
+ if (sa)
+ scheme = (*sa == '1') ? "https" : "http";
+ else if (security_active)
+ scheme = "https";
+ else
+ scheme = "http";
+
+ // A similar issue exists for the port. server_portnum is no longer
+ // working on at least Sun 7.x, and returns the first listener's port
+ // rather than whatever port is actually used for the request. Nice job, Sun.
+ sa = pblock_findval("server_portnum", pb);
+ int port = (sa && *sa) ? atoi(sa) : server_portnum;
+
+ // Get everything else but hostname...
const char* uri=pblock_findval("uri", rq->reqpb);
const char* qstr=pblock_findval("query", rq->reqpb);
- int port=server_portnum;
- const char* scheme=security_active ? "https" : "http";
const char* host=NULL;
string url;
url=uri;
if (qstr)
url=url + '?' + qstr;
-
+
#ifdef vs_is_default_vs
// This is 6.0 or later, so we can distinguish requests to name-based vhosts.
- if (!vs_is_default_vs)
+ if (!vs_is_default_vs(request_get_vs(m_rq)))
// The beauty here is, a non-default vhost can *only* be accessed if the client
// specified the exact name in the Host header. So we can trust the Host header.
host=pblock_findval("host", rq->headers);
// In other cases, we're going to rely on the initialization process...
host=g_ServerName.c_str();
- char *content_type = NULL;
- if (request_header("content-type", &content_type, sn, rq) != REQ_PROCEED)
- throw("Bad Content Type");
-
- const char *remote_ip = pblock_findval("ip", sn->client);
- const char *method = pblock_findval("method", rq->reqpb);
-
- init(
- g_Config, scheme, host, port, url.c_str(), content_type,
- remote_ip, method
- );
-
- m_pb = pb;
- m_sn = sn;
- m_rq = rq;
+ char* content_type = "";
+ request_header("content-type", &content_type, sn, rq);
+
+ const char* remote_ip = pblock_findval("ip", sn->client);
+ const char* method = pblock_findval("method", rq->reqpb);
+
+ init(scheme, host, port, url.c_str(), content_type, remote_ip, method);
+
+ // See if this is the first time we've run.
+ method = pblock_findval("auth-type", rq->vars);
+ if (method && !strcmp(method, "shibboleth"))
+ m_firsttime = false;
+ if (!m_firsttime || rq->orig_rq)
+ log(LogLevelDebug, "nsapi_shib function running more than once");
+ }
+ ~ShibTargetNSAPI() {
}
- ~ShibTargetNSAPI() { }
virtual void log(ShibLogLevel level, const string &msg) {
- log_error((level == LogLevelDebug ? LOG_INFORM :
- (level == LogLevelInfo ? LOG_INFORM :
- (level == LogLevelWarn ? LOG_FAILURE :
- LOG_FAILURE))),
- "NSAPI_SHIB", m_sn, m_rq, msg.c_str());
+ ShibTarget::log(level,msg);
+ if (level==LogLevelError)
+ log_error(LOG_FAILURE, "nsapi_shib", m_sn, m_rq, const_cast<char*>(msg.c_str()));
}
- virtual string getCookies(void) {
+ virtual string getCookies(void) const {
char *cookies = NULL;
if (request_header("cookie", &cookies, m_sn, m_rq) == REQ_ABORTED)
throw("error accessing cookie header");
string cookie = name + '=' + value;
pblock_nvinsert("Set-Cookie", cookie.c_str(), m_rq->srvhdrs);
}
- virtual string getArgs(void) {
+ virtual string getArgs(void) {
const char *q = pblock_findval("query", m_rq->reqpb);
return string(q ? q : "");
}
virtual string getPostData(void) {
char* content_length=NULL;
- if (request_header("content-length", &content_length, m_sn, m_rq)
- !=REQ_PROCEED || atoi(content_length) > 1024*1024) // 1MB?
- throw ShibTargetException(SHIBRPC_OK,
- "blocked too-large a post to Shibboleth session processor");
+ if (request_header("content-length", &content_length, m_sn, m_rq)!=REQ_PROCEED ||
+ atoi(content_length) > 1024*1024) // 1MB?
+ throw FatalProfileException("Blocked too-large a submission to profile endpoint.");
else {
char ch=IO_EOF+1;
int cl=atoi(content_length);
string cgistr;
while (cl && ch != IO_EOF) {
- ch=netbuf_getc(m_sn->inbuf);
-
- // Check for error.
- if(ch==IO_ERROR)
- break;
- cgistr += ch;
- cl--;
+ ch=netbuf_getc(m_sn->inbuf);
+
+ // Check for error.
+ if(ch==IO_ERROR)
+ break;
+ cgistr += ch;
+ cl--;
}
if (cl)
- throw ShibTargetException(SHIBRPC_OK,"error reading POST data from browser");
+ throw FatalProfileException("Error reading profile submission from browser.");
return cgistr;
}
}
virtual void clearHeader(const string &name) {
- // srvhdrs or headers?
- param_free(pblock_remove(name.c_str(), m_rq->headers));
+ if (g_checkSpoofing && m_firsttime && !m_rq->orig_rq && m_allhttp.empty()) {
+ // Populate the set of client-supplied headers for spoof checking.
+ const pb_entry* entry;
+ for (int i=0; i<m_rq->headers->hsize; ++i) {
+ entry = m_rq->headers->ht[i];
+ while (entry) {
+ string cgiversion("HTTP_");
+ const char* pch = entry->param->name;
+ while (*pch) {
+ cgiversion += (isalnum(*pch) ? toupper(*pch) : '_');
+ pch++;
+ }
+ m_allhttp.insert(cgiversion);
+ entry = entry->next;
+ }
+ }
+ }
+ if (name=="REMOTE_USER") {
+ if (g_checkSpoofing && m_firsttime && !m_rq->orig_rq && m_allhttp.count("HTTP_REMOTE_USER") > 0)
+ throw SAMLException("Attempt to spoof header ($1) was detected.", params(1, name.c_str()));
+ param_free(pblock_remove("auth-user",m_rq->vars));
+ param_free(pblock_remove("remote-user",m_rq->headers));
+ pblock_nvinsert("remote-user", g_unsetHeaderValue.c_str(), m_rq->headers);
+ }
+ else {
+ if (g_checkSpoofing && m_firsttime && !m_rq->orig_rq) {
+ // Map to the expected CGI variable name.
+ string transformed("HTTP_");
+ const char* pch = name.c_str();
+ while (*pch) {
+ transformed += (isalnum(*pch) ? toupper(*pch) : '_');
+ pch++;
+ }
+ if (m_allhttp.count(transformed) > 0)
+ throw SAMLException("Attempt to spoof header ($1) was detected.", params(1, name.c_str()));
+ }
+ param_free(pblock_remove(name.c_str(), m_rq->headers));
+ pblock_nvinsert(name.c_str(), g_unsetHeaderValue.c_str(), m_rq->headers);
+ }
}
virtual void setHeader(const string &name, const string &value) {
- // srvhdrs or headers?
- pblock_nvinsert(name.c_str(), value.c_str() ,m_rq->srvhdrs);
+ param_free(pblock_remove(name.c_str(), m_rq->headers));
+ pblock_nvinsert(name.c_str(), value.c_str() ,m_rq->headers);
}
virtual string getHeader(const string &name) {
- const char *hdr = NULL;
- if (request_header(name.c_str(), &hdr, m_sn, m_rq) != REQ_PROCEED)
- hdr = NULL; // XXX: throw an exception here?
+ char *hdr = NULL;
+ if (request_header(const_cast<char*>(name.c_str()), &hdr, m_sn, m_rq) != REQ_PROCEED) {
+ string n;
+ const char* pch = name.c_str();
+ while (*pch)
+ n += tolower(*(pch++));
+ if (request_header(const_cast<char*>(n.c_str()), &hdr, m_sn, m_rq) != REQ_PROCEED)
+ return "";
+ }
return string(hdr ? hdr : "");
}
virtual void setRemoteUser(const string &user) {
+ param_free(pblock_remove("remote-user",m_rq->headers));
pblock_nvinsert("remote-user", user.c_str(), m_rq->headers);
pblock_nvinsert("auth-user", user.c_str(), m_rq->vars);
}
virtual string getRemoteUser(void) {
- return getHeader("remote-user");
- }
- // Override this function because we want to add the NSAPI Directory override
- virtual pair<bool,bool> getRequireSession(IRequestMapper::Settings &settings) {
- pair<bool,bool> requireSession=settings.first->getBool("requireSession");
- if (!requireSession.first || !requireSession.second) {
- const char* param=pblock_findval("require-session",pb);
- if (param && (!strcmp(param,"1") || !strcasecmp(param,"true")))
- requireSession.second=true;
- }
- return requireSession;
+ const char* ru = pblock_findval("auth-user", m_rq->vars);
+ return ru ? ru : "";
}
virtual void* sendPage(
const string& msg,
- const string& content_type,
- const saml::Iterator<header_t>& headers=EMPTY(header_t),
- int code=200
+ int code=200,
+ const string& content_type="text/html",
+ const saml::Iterator<header_t>& headers=EMPTY(header_t)
) {
- pblock_nvinsert("Content-Type", content_type.c_str(), m_rq->srvhdrs);
- // XXX: Do we need content-length: or connection: close headers?
+ checkString(content_type, "Detected control character in a response header.");
+ param_free(pblock_remove("content-type", m_rq->srvhdrs));
+ pblock_nvinsert("content-type", content_type.c_str(), m_rq->srvhdrs);
+ pblock_nninsert("content-length", msg.length(), m_rq->srvhdrs);
+ pblock_nvinsert("connection","close",m_rq->srvhdrs);
while (headers.hasNext()) {
const header_t& h=headers.next();
- pblock_nvinsert(h.first.c_str(), h.second.c_str(), m_rq->srvhdrs);
+ checkString(h.first, "Detected control character in a response header.");
+ checkString(h.second, "Detected control character in a response header.");
+ pblock_nvinsert(h.first.c_str(), h.second.c_str(), m_rq->srvhdrs);
}
- protocol_status(m_sn, m_rq, PROTOCOL_OK, NULL);
- NET_WRITE(const_cast<char*>(msg.c_str()));
- return (VOID*)REQ_EXIT;
+ protocol_status(m_sn, m_rq, code, NULL);
+ protocol_start_response(m_sn, m_rq);
+ net_write(m_sn->csd,const_cast<char*>(msg.c_str()),msg.length());
+ return (void*)REQ_EXIT;
}
virtual void* sendRedirect(const string& url) {
- pblock_nvinsert("Content-Type", "text/html", m_rq->srvhdrs);
- pblock_nvinsert("Content-Length", "40", m_rq->srvhdrs);
- pblock_nvinsert("Expires", "01-Jan-1997 12:00:00 GMT", m_rq->srvhdrs);
- pblock_nvinsert("Cache-Control", "private,no-store,no-cache", m_rq->srvhdrs);
- pblock_nvinsert("Location", url.c_str(), m_rq->srvhdrs);
- protocol_status(m_sn, m_rq, PROTOCOL_REDIRECT, "302 Please wait");
+ checkString(url, "Detected control character in an attempted redirect.");
+ if (g_allowedSchemes.find(url.substr(0, url.find(':'))) == g_allowedSchemes.end())
+ throw FatalProfileException("Invalid scheme in attempted redirect.");
+ param_free(pblock_remove("content-type", m_rq->srvhdrs));
+ pblock_nninsert("content-length", 0, m_rq->srvhdrs);
+ pblock_nvinsert("expires", "01-Jan-1997 12:00:00 GMT", m_rq->srvhdrs);
+ pblock_nvinsert("cache-control", "private,no-store,no-cache", m_rq->srvhdrs);
+ pblock_nvinsert("location", url.c_str(), m_rq->srvhdrs);
+ pblock_nvinsert("connection","close",m_rq->srvhdrs);
+ protocol_status(m_sn, m_rq, PROTOCOL_REDIRECT, NULL);
protocol_start_response(m_sn, m_rq);
- NET_WRITE("<HTML><BODY>Redirecting...</BODY></HTML>");
- return (void*)REQ_EXIT;
+ return (void*)REQ_ABORTED;
}
- virtual void* returnDecline(void) { return (void*)REQ_PROCEED; } // XXX?
+ virtual void* returnDecline(void) { return (void*)REQ_NOACTION; }
virtual void* returnOK(void) { return (void*)REQ_PROCEED; }
pblock* m_pb;
Session* m_sn;
Request* m_rq;
+ set<string> m_allhttp;
+ bool m_firsttime;
};
/********************************************************************************/
#define FUNC "shibboleth"
extern "C" NSAPI_PUBLIC int nsapi_shib(pblock* pb, Session* sn, Request* rq)
{
- ostringstream threadid;
- threadid << "[" << getpid() << "] nsapi_shib" << '\0';
- saml::NDC ndc(threadid.str().c_str());
+ ostringstream threadid;
+ threadid << "[" << getpid() << "] nsapi_shib" << '\0';
+ saml::NDC ndc(threadid.str().c_str());
-#ifndef _DEBUG
- try {
-#endif
- ShibTargetNSAPI stn(pb, sn, rq);
+ try {
+ ShibTargetNSAPI stn(pb, sn, rq);
- // Check user authentication
- pair<bool,void*> res = stn.doCheckAuthN();
- if (res.first) return (int)res.second;
+ // Check user authentication
+ pair<bool,void*> res = stn.doCheckAuthN();
+ if (res.first) return (int)res.second;
- // user authN was okay -- export the assertions now
- const char* param=pblock_findval("export-assertion", pb);
- bool doExportAssn = false;
- if (param && (!strcmp(param,"1") || !strcasecmp(param,"true")))
- doExportAssn = true;
- res = stn.doExportAssertions(doExportAssn);
- if (res.first) return (int)res.second;
-
- // Check the Authorization
- res = stf.doCheckAuthZ();
- if (res.first) return (int)res.second;
+ // user authN was okay -- export the assertions now
+ param_free(pblock_remove("auth-user",rq->vars));
+ // This seems to be required in order to eventually set
+ // the auth-user var.
+ pblock_nvinsert("auth-type","shibboleth",rq->vars);
+ res = stn.doExportAssertions();
+ if (res.first) return (int)res.second;
- // this user is ok.
- return REQ_PROCEED;
+ // Check the Authorization
+ res = stn.doCheckAuthZ();
+ if (res.first) return (int)res.second;
-#ifndef _DEBUG
- } catch (...) {
- return WriteClientError(sn, rq, FUNC, "threw an uncaught exception.");
- }
-#endif
+ // this user is ok.
+ return REQ_PROCEED;
+ }
+ catch (exception& e) {
+ log_error(LOG_FAILURE,FUNC,sn,rq,const_cast<char*>(e.what()));
+ return WriteClientError(sn, rq, FUNC, "Shibboleth filter threw an exception, see web server log for error.");
+ }
+ catch (...) {
+ if (g_catchAll)
+ return WriteClientError(sn, rq, FUNC, "Shibboleth filter threw an uncaught exception.");
+ throw;
+ }
}
#define FUNC "shib_handler"
extern "C" NSAPI_PUBLIC int shib_handler(pblock* pb, Session* sn, Request* rq)
{
- ostringstream threadid;
- threadid << "[" << getpid() << "] shib_handler" << '\0';
- saml::NDC ndc(threadid.str().c_str());
+ ostringstream threadid;
+ threadid << "[" << getpid() << "] shib_handler" << '\0';
+ saml::NDC ndc(threadid.str().c_str());
-#ifndef _DEBUG
- try {
-#endif
- ShibTargetNSAPI stn(pb, sn, rq);
-
- pair<bool,void*> res = stn.doHandleProfile();
- if (res.first) return (int)res.second;
+ try {
+ ShibTargetNSAPI stn(pb, sn, rq);
- return WriteClientError(sn, rq, FUNC, "doHandleProfile() did not do anything.")
+ pair<bool,void*> res = stn.doHandler();
+ if (res.first) return (int)res.second;
-#ifndef _DEBUG
- } catch (...) {
- return WriteClientError(sn, rq, FUNC, "threw an uncaught exception.");
- }
-#endif
+ return WriteClientError(sn, rq, FUNC, "Shibboleth handler did not do anything.");
+ }
+ catch (exception& e) {
+ log_error(LOG_FAILURE,FUNC,sn,rq,const_cast<char*>(e.what()));
+ return WriteClientError(sn, rq, FUNC, "Shibboleth handler threw an exception, see web server log for error.");
+ }
+ catch (...) {
+ if (g_catchAll)
+ return WriteClientError(sn, rq, FUNC, "Shibboleth handler threw an unknown exception.");
+ throw;
+ }
}
-#if 0
-
+class SunRequestMapper : public virtual IRequestMapper, public virtual IPropertySet
+{
+public:
+ SunRequestMapper(const DOMElement* e);
+ ~SunRequestMapper() { delete m_mapper; delete m_stKey; delete m_propsKey; }
+ void lock() { m_mapper->lock(); }
+ void unlock() { m_stKey->setData(NULL); m_propsKey->setData(NULL); m_mapper->unlock(); }
+ Settings getSettings(ShibTarget* st) const;
+
+ pair<bool,bool> getBool(const char* name, const char* ns=NULL) const;
+ pair<bool,const char*> getString(const char* name, const char* ns=NULL) const;
+ pair<bool,const XMLCh*> getXMLString(const char* name, const char* ns=NULL) const;
+ pair<bool,unsigned int> getUnsignedInt(const char* name, const char* ns=NULL) const;
+ pair<bool,int> getInt(const char* name, const char* ns=NULL) const;
+ const IPropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:target:config:1.0") const;
+ const DOMElement* getElement() const;
+
+private:
+ IRequestMapper* m_mapper;
+ ThreadKey* m_stKey;
+ ThreadKey* m_propsKey;
+};
-IRequestMapper::Settings map_request(pblock* pb, Session* sn, Request* rq, IRequestMapper* mapper, string& target)
+IPlugIn* SunRequestMapFactory(const DOMElement* e)
{
- // Get everything but hostname...
- const char* uri=pblock_findval("uri",rq->reqpb);
- const char* qstr=pblock_findval("query",rq->reqpb);
- int port=server_portnum;
- const char* scheme=security_active ? "https" : "http";
- const char* host=NULL;
+ return new SunRequestMapper(e);
+}
- string url;
- if (uri)
- url=uri;
- if (qstr)
- url=url + '?' + qstr;
-
-#ifdef vs_is_default_vs
- // This is 6.0 or later, so we can distinguish requests to name-based vhosts.
- if (!vs_is_default_vs)
- // The beauty here is, a non-default vhost can *only* be accessed if the client
- // specified the exact name in the Host header. So we can trust the Host header.
- host=pblock_findval("host", rq->headers);
- else
-#endif
- // In other cases, we're going to rely on the initialization process...
- host=g_ServerName.c_str();
-
- target=(g_ServerScheme.empty() ? string(scheme) : g_ServerScheme) + "://" + host;
-
- // If port is non-default, append it.
- if ((!security_active && port!=80) || (security_active && port!=443)) {
- char portbuf[10];
- util_snprintf(portbuf,9,"%d",port);
- target = target + ':' + portbuf;
+SunRequestMapper::SunRequestMapper(const DOMElement* e) : m_mapper(NULL), m_stKey(NULL), m_propsKey(NULL)
+{
+ IPlugIn* p=SAMLConfig::getConfig().getPlugMgr().newPlugin(shibtarget::XML::XMLRequestMapType,e);
+ m_mapper=dynamic_cast<IRequestMapper*>(p);
+ if (!m_mapper) {
+ delete p;
+ throw UnsupportedExtensionException("Embedded request mapper plugin was not of correct type.");
}
+ m_stKey=ThreadKey::create(NULL);
+ m_propsKey=ThreadKey::create(NULL);
+}
- target+=url;
-
- return mapper->getSettingsFromParsedURL(scheme,host,port,url.c_str());
+IRequestMapper::Settings SunRequestMapper::getSettings(ShibTarget* st) const
+{
+ Settings s=m_mapper->getSettings(st);
+ m_stKey->setData(dynamic_cast<ShibTargetNSAPI*>(st));
+ m_propsKey->setData((void*)s.first);
+ return pair<const IPropertySet*,IAccessControl*>(this,s.second);
}
-int WriteClientError(Session* sn, Request* rq, const IApplication* app, const char* page, ShibMLP& mlp)
+pair<bool,bool> SunRequestMapper::getBool(const char* name, const char* ns) const
{
- const IPropertySet* props=app->getPropertySet("Errors");
- if (props) {
- pair<bool,const char*> p=props->getString(page);
- if (p.first) {
- ifstream infile(p.second);
- if (!infile.fail()) {
- const char* res = mlp.run(infile,props);
- if (res) {
- pblock_nvinsert("Content-Type","text/html",rq->srvhdrs);
- pblock_nninsert("Content-Length",strlen(res),rq->srvhdrs);
- pblock_nvinsert("Connection","close",rq->srvhdrs);
- protocol_status(sn,rq,PROTOCOL_OK,NULL);
- NET_WRITE(const_cast<char*>(res));
- return REQ_EXIT;
- }
- }
- }
+ ShibTargetNSAPI* stn=reinterpret_cast<ShibTargetNSAPI*>(m_stKey->getData());
+ const IPropertySet* s=reinterpret_cast<const IPropertySet*>(m_propsKey->getData());
+ if (stn && !ns && name) {
+ // Override boolean properties.
+ const char* param=pblock_findval(name,stn->m_pb);
+ if (param && (!strcmp(param,"1") || !strcasecmp(param,"true")))
+ return make_pair(true,true);
}
-
- log_error(LOG_FAILURE,"WriteClientError",sn,rq,"Unable to open error template, check settings.");
- protocol_status(sn,rq,PROTOCOL_SERVER_ERROR,"Unable to open error template, check settings.");
- return REQ_ABORTED;
+ return s ? s->getBool(name,ns) : make_pair(false,false);
}
-int WriteRedirectPage(Session* sn, Request* rq, const IApplication* app, const char* file, ShibMLP& mlp)
+pair<bool,const char*> SunRequestMapper::getString(const char* name, const char* ns) const
{
- ifstream infile(file);
- if (!infile.fail()) {
- const char* res = mlp.run(infile,app->getPropertySet("Errors"));
- if (res) {
- pblock_nvinsert("Content-Type","text/html",rq->srvhdrs);
- pblock_nninsert("Content-Length",strlen(res),rq->srvhdrs);
- protocol_status(sn,rq,PROTOCOL_OK,NULL);
- NET_WRITE(const_cast<char*>(res));
- return REQ_EXIT;
+ ShibTargetNSAPI* stn=reinterpret_cast<ShibTargetNSAPI*>(m_stKey->getData());
+ const IPropertySet* s=reinterpret_cast<const IPropertySet*>(m_propsKey->getData());
+ if (stn && !ns && name) {
+ // Override string properties.
+ if (!strcmp(name,"authType"))
+ return pair<bool,const char*>(true,"shibboleth");
+ else {
+ const char* param=pblock_findval(name,stn->m_pb);
+ if (param)
+ return make_pair(true,param);
}
}
- log_error(LOG_FAILURE,"WriteRedirectPage",sn,rq,"Unable to open redirect template, check settings.");
- protocol_status(sn,rq,PROTOCOL_SERVER_ERROR,"Unable to open redirect template, check settings.");
- return REQ_ABORTED;
+ return s ? s->getString(name,ns) : pair<bool,const char*>(false,NULL);
}
-#undef FUNC
-#define FUNC "shibboleth"
-extern "C" NSAPI_PUBLIC int nsapi_shib(pblock* pb, Session* sn, Request* rq)
+pair<bool,const XMLCh*> SunRequestMapper::getXMLString(const char* name, const char* ns) const
{
- try
- {
- ostringstream threadid;
- threadid << "[" << getpid() << "] nsapi_shib" << '\0';
- saml::NDC ndc(threadid.str().c_str());
-
- // We lock the configuration system for the duration.
- IConfig* conf=g_Config->getINI();
- Locker locker(conf);
-
- // Map request to application and content settings.
- string targeturl;
- IRequestMapper* mapper=conf->getRequestMapper();
- Locker locker2(mapper);
- IRequestMapper::Settings settings=map_request(pb,sn,rq,mapper,targeturl);
- pair<bool,const char*> application_id=settings.first->getString("applicationId");
- const IApplication* application=conf->getApplication(application_id.second);
- if (!application)
- return WriteClientError(sn,rq,FUNC,"Unable to map request to application settings, check configuration.");
-
- // Declare SHIRE object for this request.
- SHIRE shire(application);
-
- const char* shireURL=shire.getShireURL(targeturl.c_str());
- if (!shireURL)
- return WriteClientError(sn,rq,FUNC,"Unable to map request to proper shireURL setting, check configuration.");
-
- // If the user is accessing the SHIRE acceptance point, pass it on.
- if (targeturl.find(shireURL)!=string::npos)
- return REQ_PROCEED;
-
- // Now check the policy for this request.
- pair<bool,bool> requireSession=settings.first->getBool("requireSession");
- if (!requireSession.first || !requireSession.second) {
- const char* param=pblock_findval("require-session",pb);
- if (param && (!strcmp(param,"1") || !strcasecmp(param,"true")))
- requireSession.second=true;
- }
- pair<const char*,const char*> shib_cookie=shire.getCookieNameProps();
- pair<bool,bool> httpRedirects=application->getPropertySet("Sessions")->getBool("httpRedirects");
- pair<bool,const char*> redirectPage=application->getPropertySet("Sessions")->getString("redirectPage");
- if (httpRedirects.first && !httpRedirects.second && !redirectPage.first)
- return WriteClientError(sn,rq,FUNC,"HTML-based redirection requires a redirectPage property.");
-
- // Check for session cookie.
- const char* session_id=NULL;
- string cookie;
- if (request_header("cookie",(char**)&session_id,sn,rq)==REQ_ABORTED)
- return WriteClientError(sn,rq,FUNC,"error accessing cookie header");
-
- Category::getInstance("nsapi_shib."FUNC).debug("cookie header is {%s}",session_id ? session_id : "NULL");
- if (session_id && (session_id=strstr(session_id,shib_cookie.first))) {
- session_id+=strlen(shib_cookie.first) + 1; /* Skip over the '=' */
- char* cookieend=strchr(session_id,';');
- if (cookieend) {
- // Chop out just the value portion.
- cookie.assign(session_id,cookieend-session_id-1);
- session_id=cookie.c_str();
- }
- }
-
- if (!session_id || !*session_id) {
- // If no session required, bail now.
- if (!requireSession.second)
- return REQ_PROCEED;
-
- // No acceptable cookie, and we require a session. Generate an AuthnRequest.
- const char* areq = shire.getAuthnRequest(targeturl.c_str());
- if (!httpRedirects.first || httpRedirects.second) {
- pblock_nvinsert("Content-Type","text/html",rq->srvhdrs);
- pblock_nvinsert("Content-Length","40",rq->srvhdrs);
- pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs);
- pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs);
- pblock_nvinsert("Location",areq,rq->srvhdrs);
- protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait");
- protocol_start_response(sn,rq);
- NET_WRITE("<HTML><BODY>Redirecting...</BODY></HTML>");
- return REQ_EXIT;
- }
- else {
- ShibMLP markupProcessor;
- markupProcessor.insert("requestURL",areq);
- return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor);
- }
- }
-
- // Make sure this session is still valid.
- RPCError* status = NULL;
- ShibMLP markupProcessor;
- markupProcessor.insert("requestURL", targeturl);
-
- try {
- status = shire.sessionIsValid(session_id, pblock_findval("ip",sn->client));
- }
- catch (ShibTargetException &e) {
- markupProcessor.insert("errorType", "Session Processing Error");
- markupProcessor.insert("errorText", e.what());
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "shire", markupProcessor);
- }
-#ifndef _DEBUG
- catch (...) {
- markupProcessor.insert("errorType", "Session Processing Error");
- markupProcessor.insert("errorText", "Unexpected Exception");
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "shire", markupProcessor);
- }
-#endif
-
- // Check the status
- if (status->isError()) {
- if (!requireSession.second)
- return REQ_PROCEED;
- else if (status->isRetryable()) {
- // Oops, session is invalid. Generate AuthnRequest.
- delete status;
- const char* areq = shire.getAuthnRequest(targeturl.c_str());
- if (!httpRedirects.first || httpRedirects.second) {
- pblock_nvinsert("Content-Type","text/html",rq->srvhdrs);
- pblock_nvinsert("Content-Length","40",rq->srvhdrs);
- pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs);
- pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs);
- pblock_nvinsert("Location",areq,rq->srvhdrs);
- protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait");
- protocol_start_response(sn,rq);
- NET_WRITE("<HTML><BODY>Redirecting...</BODY></HTML>");
- return REQ_EXIT;
- }
- else {
- markupProcessor.insert("requestURL",areq);
- return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor);
- }
- }
- else {
- // return the error page to the user
- markupProcessor.insert(*status);
- delete status;
- return WriteClientError(sn, rq, application, "shire", markupProcessor);
- }
- }
- delete status;
-
- // Move to RM phase.
- RM rm(application);
- vector<SAMLAssertion*> assertions;
- SAMLAuthenticationStatement* sso_statement=NULL;
-
- try {
- status = rm.getAssertions(session_id, pblock_findval("ip",sn->client), assertions, &sso_statement);
- }
- catch (ShibTargetException &e) {
- markupProcessor.insert("errorType", "Attribute Processing Error");
- markupProcessor.insert("errorText", e.what());
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "rm", markupProcessor);
- }
- #ifndef _DEBUG
- catch (...) {
- markupProcessor.insert("errorType", "Attribute Processing Error");
- markupProcessor.insert("errorText", "Unexpected Exception");
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "rm", markupProcessor);
- }
- #endif
-
- if (status->isError()) {
- markupProcessor.insert(*status);
- delete status;
- return WriteClientError(sn, rq, application, "rm", markupProcessor);
- }
- delete status;
-
- // Do we have an access control plugin?
- if (settings.second) {
- Locker acllock(settings.second);
- if (!settings.second->authorized(*sso_statement,assertions)) {
- for (int k = 0; k < assertions.size(); k++)
- delete assertions[k];
- delete sso_statement;
- return WriteClientError(sn, rq, application, "access", markupProcessor);
- }
- }
-
- // Get the AAP providers, which contain the attribute policy info.
- Iterator<IAAP*> provs=application->getAAPProviders();
-
- // Clear out the list of mapped attributes
- while (provs.hasNext()) {
- IAAP* aap=provs.next();
- aap->lock();
- try {
- Iterator<const IAttributeRule*> rules=aap->getAttributeRules();
- while (rules.hasNext()) {
- const char* header=rules.next()->getHeader();
- if (header)
- param_free(pblock_remove(header,rq->headers));
- }
- }
- catch(...) {
- aap->unlock();
- for (int k = 0; k < assertions.size(); k++)
- delete assertions[k];
- delete sso_statement;
- markupProcessor.insert("errorType", "Attribute Processing Error");
- markupProcessor.insert("errorText", "Unexpected Exception");
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "rm", markupProcessor);
- }
- aap->unlock();
- }
- provs.reset();
-
- // Maybe export the first assertion.
- param_free(pblock_remove("remote-user",rq->headers));
- param_free(pblock_remove("auth-user",rq->vars));
- param_free(pblock_remove("Shib-Attributes",rq->headers));
- pair<bool,bool> exp=settings.first->getBool("exportAssertion");
- if (!exp.first || !exp.second) {
- const char* param=pblock_findval("export-assertion",pb);
- if (param && (!strcmp(param,"1") || !strcasecmp(param,"true")))
- exp.second=true;
- }
- if (exp.second && assertions.size()) {
- string assertion;
- RM::serialize(*(assertions[0]), assertion);
- string::size_type lfeed;
- while ((lfeed=assertion.find('\n'))!=string::npos)
- assertion.erase(lfeed,1);
- pblock_nvinsert("Shib-Attributes",assertion.c_str(),rq->headers);
- }
-
- pblock_nvinsert("auth-type","shibboleth",rq->vars);
- param_free(pblock_remove("Shib-Origin-Site",rq->headers));
- param_free(pblock_remove("Shib-Authentication-Method",rq->headers));
- param_free(pblock_remove("Shib-NameIdentifier-Format",rq->headers));
-
- // Export the SAML AuthnMethod and the origin site name.
- auto_ptr_char os(sso_statement->getSubject()->getNameIdentifier()->getNameQualifier());
- auto_ptr_char am(sso_statement->getAuthMethod());
- pblock_nvinsert("Shib-Origin-Site",os.get(),rq->headers);
- pblock_nvinsert("Shib-Authentication-Method",am.get(),rq->headers);
-
- // Export NameID?
- AAP wrapper(provs,sso_statement->getSubject()->getNameIdentifier()->getFormat(),Constants::SHIB_ATTRIBUTE_NAMESPACE_URI);
- if (!wrapper.fail() && wrapper->getHeader()) {
- auto_ptr_char form(sso_statement->getSubject()->getNameIdentifier()->getFormat());
- auto_ptr_char nameid(sso_statement->getSubject()->getNameIdentifier()->getName());
- pblock_nvinsert("Shib-NameIdentifier-Format",form.get(),pb);
- if (!strcmp(wrapper->getHeader(),"REMOTE_USER")) {
- pblock_nvinsert("remote-user",nameid.get(),rq->headers);
- pblock_nvinsert("auth-user",nameid.get(),rq->vars);
- }
- else {
- pblock_nvinsert(wrapper->getHeader(),nameid.get(),rq->headers);
- }
- }
-
- param_free(pblock_remove("Shib-Application-ID",rq->headers));
- pblock_nvinsert("Shib-Application-ID",application_id.second,rq->headers);
-
- // Export the attributes.
- Iterator<SAMLAssertion*> a_iter(assertions);
- while (a_iter.hasNext()) {
- SAMLAssertion* assert=a_iter.next();
- Iterator<SAMLStatement*> statements=assert->getStatements();
- while (statements.hasNext()) {
- SAMLAttributeStatement* astate=dynamic_cast<SAMLAttributeStatement*>(statements.next());
- if (!astate)
- continue;
- Iterator<SAMLAttribute*> attrs=astate->getAttributes();
- while (attrs.hasNext()) {
- SAMLAttribute* attr=attrs.next();
-
- // Are we supposed to export it?
- AAP wrapper(provs,attr->getName(),attr->getNamespace());
- if (wrapper.fail() || !wrapper->getHeader())
- continue;
-
- Iterator<string> vals=attr->getSingleByteValues();
- if (!strcmp(wrapper->getHeader(),"REMOTE_USER") && vals.hasNext()) {
- char* principal=const_cast<char*>(vals.next().c_str());
- pblock_nvinsert("remote-user",principal,rq->headers);
- pblock_nvinsert("auth-user",principal,rq->vars);
- }
- else {
- int it=0;
- string header;
- const char* h=pblock_findval(wrapper->getHeader(),rq->headers);
- if (h) {
- header=h;
- param_free(pblock_remove(wrapper->getHeader(),rq->headers));
- it++;
- }
- for (; vals.hasNext(); it++) {
- string value = vals.next();
- for (string::size_type pos = value.find_first_of(";", string::size_type(0));
- pos != string::npos;
- pos = value.find_first_of(";", pos)) {
- value.insert(pos, "\\");
- pos += 2;
- }
- if (it == 0)
- header=value;
- else
- header=header + ';' + value;
- }
- pblock_nvinsert(wrapper->getHeader(),header.c_str(),rq->headers);
- }
- }
- }
- }
-
- // clean up memory
- for (int k = 0; k < assertions.size(); k++)
- delete assertions[k];
- delete sso_statement;
+ const IPropertySet* s=reinterpret_cast<const IPropertySet*>(m_propsKey->getData());
+ return s ? s->getXMLString(name,ns) : pair<bool,const XMLCh*>(false,NULL);
+}
- return REQ_PROCEED;
- }
- catch(bad_alloc) {
- return WriteClientError(sn, rq, FUNC,"Out of Memory");
- }
-#ifndef _DEBUG
- catch(...) {
- return WriteClientError(sn, rq, FUNC,"Server caught an unknown exception.");
+pair<bool,unsigned int> SunRequestMapper::getUnsignedInt(const char* name, const char* ns) const
+{
+ ShibTargetNSAPI* stn=reinterpret_cast<ShibTargetNSAPI*>(m_stKey->getData());
+ const IPropertySet* s=reinterpret_cast<const IPropertySet*>(m_propsKey->getData());
+ if (stn && !ns && name) {
+ // Override int properties.
+ const char* param=pblock_findval(name,stn->m_pb);
+ if (param)
+ return pair<bool,unsigned int>(true,strtol(param,NULL,10));
}
-#endif
-
- return WriteClientError(sn, rq, FUNC,"Server reached unreachable code, save my walrus!");
+ return s ? s->getUnsignedInt(name,ns) : pair<bool,unsigned int>(false,0);
}
-#undef FUNC
-#define FUNC "shib_handler"
-extern "C" NSAPI_PUBLIC int shib_handler(pblock* pb, Session* sn, Request* rq)
+pair<bool,int> SunRequestMapper::getInt(const char* name, const char* ns) const
{
- string targeturl;
- const IApplication* application=NULL;
- try
- {
- ostringstream threadid;
- threadid << "[" << getpid() << "] shib_handler" << '\0';
- saml::NDC ndc(threadid.str().c_str());
-
- // We lock the configuration system for the duration.
- IConfig* conf=g_Config->getINI();
- Locker locker(conf);
-
- // Map request to application and content settings.
- IRequestMapper* mapper=conf->getRequestMapper();
- Locker locker2(mapper);
- IRequestMapper::Settings settings=map_request(pb,sn,rq,mapper,targeturl);
- pair<bool,const char*> application_id=settings.first->getString("applicationId");
- application=conf->getApplication(application_id.second);
- const IPropertySet* sessionProps=application ? application->getPropertySet("Sessions") : NULL;
- if (!application || !sessionProps)
- return WriteClientError(sn,rq,FUNC,"Unable to map request to application settings, check configuration.");
-
- SHIRE shire(application);
-
- const char* shireURL=shire.getShireURL(targeturl.c_str());
- if (!shireURL)
- return WriteClientError(sn,rq,FUNC,"Unable to map request to proper shireURL setting, check configuration.");
-
- // Make sure we only process the SHIRE requests.
- if (!strstr(targeturl.c_str(),shireURL))
- return WriteClientError(sn,rq,FUNC,"NSAPI service function can only be invoked to process incoming sessions."
- "Make sure the mapped file extension or URL doesn't match actual content.");
-
- pair<const char*,const char*> shib_cookie=shire.getCookieNameProps();
-
- // Make sure this is SSL, if it should be
- pair<bool,bool> shireSSL=sessionProps->getBool("shireSSL");
- if (!shireSSL.first || shireSSL.second) {
- if (!security_active)
- throw ShibTargetException(SHIBRPC_OK,"blocked non-SSL access to Shibboleth session processor");
- }
-
- pair<bool,bool> httpRedirects=sessionProps->getBool("httpRedirects");
- pair<bool,const char*> redirectPage=sessionProps->getString("redirectPage");
- if (httpRedirects.first && !httpRedirects.second && !redirectPage.first)
- return WriteClientError(sn,rq,FUNC,"HTML-based redirection requires a redirectPage property.");
-
- // If this is a GET, we manufacture an AuthnRequest.
- if (!strcasecmp(pblock_findval("method",rq->reqpb),"GET")) {
- const char* areq=pblock_findval("query",rq->reqpb) ? shire.getLazyAuthnRequest(pblock_findval("query",rq->reqpb)) : NULL;
- if (!areq)
- throw ShibTargetException(SHIBRPC_OK, "malformed arguments to request a new session");
- if (!httpRedirects.first || httpRedirects.second) {
- pblock_nvinsert("Content-Type","text/html",rq->srvhdrs);
- pblock_nvinsert("Content-Length","40",rq->srvhdrs);
- pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs);
- pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs);
- pblock_nvinsert("Location",areq,rq->srvhdrs);
- protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait");
- protocol_start_response(sn,rq);
- NET_WRITE("<HTML><BODY>Redirecting...</BODY></HTML>");
- return REQ_EXIT;
- }
- else {
- ShibMLP markupProcessor;
- markupProcessor.insert("requestURL",areq);
- return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor);
- }
- }
- else if (strcasecmp(pblock_findval("method",rq->reqpb),"POST"))
- throw ShibTargetException(SHIBRPC_OK,"blocked non-POST to Shibboleth session processor");
-
- // Make sure this POST is an appropriate content type
- char* content_type=NULL;
- if (request_header("content-type",&content_type,sn,rq)!=REQ_PROCEED ||
- !content_type || strcasecmp(content_type,"application/x-www-form-urlencoded"))
- throw ShibTargetException(SHIBRPC_OK,"blocked bad content-type to Shibboleth session processor");
-
- // Read the data.
- pair<const char*,const char*> elements=pair<const char*,const char*>(NULL,NULL);
- char* content_length=NULL;
- if (request_header("content-length",&content_length,sn,rq)!=REQ_PROCEED ||
- atoi(content_length) > 1024*1024) // 1MB?
- throw ShibTargetException(SHIBRPC_OK,"blocked too-large a post to Shibboleth session processor");
- else {
- char ch=IO_EOF+1;
- int cl=atoi(content_length);
- string cgistr;
- while (cl && ch!=IO_EOF) {
- ch=netbuf_getc(sn->inbuf);
-
- // Check for error.
- if(ch==IO_ERROR)
- break;
- cgistr+=ch;
- cl--;
- }
- if (cl)
- throw ShibTargetException(SHIBRPC_OK,"error reading POST data from browser");
- elements=shire.getFormSubmission(cgistr.c_str(),cgistr.length());
- }
-
- // Make sure the SAML Response parameter exists
- if (!elements.first || !*elements.first)
- throw ShibTargetException(SHIBRPC_OK, "Shibboleth POST failed to find SAMLResponse form element");
-
- // Make sure the target parameter exists
- if (!elements.second || !*elements.second)
- throw ShibTargetException(SHIBRPC_OK, "Shibboleth POST failed to find TARGET form element");
-
- // Process the post.
- string cookie;
- RPCError* status=NULL;
- ShibMLP markupProcessor;
- markupProcessor.insert("requestURL", targeturl.c_str());
- try {
- status = shire.sessionCreate(elements.first,pblock_findval("ip",sn->client),cookie);
- }
- catch (ShibTargetException &e) {
- markupProcessor.insert("errorType", "Session Creation Service Error");
- markupProcessor.insert("errorText", e.what());
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "shire", markupProcessor);
- }
-#ifndef _DEBUG
- catch (...) {
- markupProcessor.insert("errorType", "Session Creation Service Error");
- markupProcessor.insert("errorText", "Unexpected Exception");
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "shire", markupProcessor);
- }
-#endif
-
- if (status->isError()) {
- if (status->isRetryable()) {
- delete status;
- const char* loc=shire.getAuthnRequest(elements.second);
- if (!httpRedirects.first || httpRedirects.second) {
- pblock_nvinsert("Content-Type","text/html",rq->srvhdrs);
- pblock_nvinsert("Content-Length","40",rq->srvhdrs);
- pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs);
- pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs);
- pblock_nvinsert("Location",loc,rq->srvhdrs);
- protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait");
- protocol_start_response(sn,rq);
- NET_WRITE("<HTML><BODY>Redirecting...</BODY></HTML>");
- return REQ_EXIT;
- }
- else {
- markupProcessor.insert("requestURL",loc);
- return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor);
- }
- }
-
- // Return this error to the user.
- markupProcessor.insert(*status);
- delete status;
- return WriteClientError(sn,rq,application,"shire",markupProcessor);
- }
- delete status;
-
- // We've got a good session, set the cookie and redirect to target.
- cookie = string(shib_cookie.first) + '=' + cookie + shib_cookie.second;
- pblock_nvinsert("Set-Cookie",cookie.c_str(),rq->srvhdrs);
- if (!httpRedirects.first || httpRedirects.second) {
- pblock_nvinsert("Content-Type","text/html",rq->srvhdrs);
- pblock_nvinsert("Content-Length","40",rq->srvhdrs);
- pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs);
- pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs);
- pblock_nvinsert("Location",elements.second,rq->srvhdrs);
- protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait");
- protocol_start_response(sn,rq);
- NET_WRITE("<HTML><BODY>Redirecting...</BODY></HTML>");
- return REQ_EXIT;
- }
- else {
- markupProcessor.insert("requestURL",elements.second);
- return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor);
- }
- }
- catch (ShibTargetException &e) {
- if (application) {
- ShibMLP markupProcessor;
- markupProcessor.insert("requestURL", targeturl.c_str());
- markupProcessor.insert("errorType", "Session Creation Service Error");
- markupProcessor.insert("errorText", e.what());
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn,rq,application,"shire",markupProcessor);
- }
- }
-#ifndef _DEBUG
- catch (...) {
- if (application) {
- ShibMLP markupProcessor;
- markupProcessor.insert("requestURL", targeturl.c_str());
- markupProcessor.insert("errorType", "Session Creation Service Error");
- markupProcessor.insert("errorText", "Unexpected Exception");
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn,rq,application,"shire",markupProcessor);
- }
+ ShibTargetNSAPI* stn=reinterpret_cast<ShibTargetNSAPI*>(m_stKey->getData());
+ const IPropertySet* s=reinterpret_cast<const IPropertySet*>(m_propsKey->getData());
+ if (stn && !ns && name) {
+ // Override int properties.
+ const char* param=pblock_findval(name,stn->m_pb);
+ if (param)
+ return pair<bool,int>(true,atoi(param));
}
-#endif
- return REQ_EXIT;
+ return s ? s->getInt(name,ns) : pair<bool,int>(false,0);
}
-#endif
+const IPropertySet* SunRequestMapper::getPropertySet(const char* name, const char* ns) const
+{
+ const IPropertySet* s=reinterpret_cast<const IPropertySet*>(m_propsKey->getData());
+ return s ? s->getPropertySet(name,ns) : NULL;
+}
+
+const DOMElement* SunRequestMapper::getElement() const
+{
+ const IPropertySet* s=reinterpret_cast<const IPropertySet*>(m_propsKey->getData());
+ return s ? s->getElement() : NULL;
+}
projects / shibboleth / cpp-sp.git / blobdiff