X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fcpp-sp.git;a=blobdiff_plain;f=shibsp%2Fimpl%2FXMLServiceProvider.cpp;h=59c86eb7085392356c616aaf760b59b3047ab7f7;hp=eb01515f6acfe182b2ed806b6bfb37b12bb4550a;hb=f0cab28136e0758f7bf7c60581d714f5f5dbbf08;hpb=15293635df4f1a825af8a7d4a9fc0ed7ec8e2945 diff --git a/shibsp/impl/XMLServiceProvider.cpp b/shibsp/impl/XMLServiceProvider.cpp index eb01515..59c86eb 100644 --- a/shibsp/impl/XMLServiceProvider.cpp +++ b/shibsp/impl/XMLServiceProvider.cpp @@ -1,27 +1,32 @@ -/* - * Copyright 2001-2007 Internet2 - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at +/** + * Licensed to the University Corporation for Advanced Internet + * Development, Inc. (UCAID) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for + * additional information regarding copyright ownership. + * + * UCAID licenses this file to you under the Apache License, + * Version 2.0 (the "License"); you may not use this file except + * in compliance with the License. You may obtain a copy of the + * License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * http://www.apache.org/licenses/LICENSE-2.0 * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific + * language governing permissions and limitations under the License. */ /** * XMLServiceProvider.cpp * - * XML-based SP configuration and mgmt + * XML-based SP configuration and mgmt. */ #include "internal.h" #include "exceptions.h" +#include "version.h" #include "AccessControl.h" #include "Application.h" #include "RequestMapper.h" @@ -29,6 +34,8 @@ #include "SessionCache.h" #include "SPConfig.h" #include "SPRequest.h" +#include "binding/ProtocolProvider.h" +#include "handler/LogoutInitiator.h" #include "handler/SessionInitiator.h" #include "remoting/ListenerService.h" #include "util/DOMPropertySet.h" @@ -41,36 +48,63 @@ #else # error "Supported logging library not available." #endif +#include +#include +#include +#include +#include +#include #include +#include #include +#include #include #include +#include +#include #include #ifndef SHIBSP_LITE -# include "TransactionLog.h" # include "attribute/filtering/AttributeFilter.h" # include "attribute/resolver/AttributeExtractor.h" # include "attribute/resolver/AttributeResolver.h" # include "security/PKIXTrustEngine.h" +# include "security/SecurityPolicyProvider.h" +# include +# include # include # include # include # include +# include # include -# include +# include +# include +# include +# include # include +# include +# include # include +# include +# include using namespace opensaml::saml2; using namespace opensaml::saml2p; using namespace opensaml::saml2md; using namespace opensaml; +#else +# include "lite/SAMLConstants.h" #endif using namespace shibsp; using namespace xmltooling; +using namespace boost; using namespace std; +#ifndef min +# define min(a,b) (((a) < (b)) ? (a) : (b)) +#endif + namespace { #if defined (_MSC_VER) @@ -84,12 +118,9 @@ namespace { class SHIBSP_DLLLOCAL XMLApplication : public Application, public Remoted, public DOMPropertySet, public DOMNodeFilter { public: - XMLApplication(const ServiceProvider*, const DOMElement* e, const XMLApplication* base=NULL); - ~XMLApplication() { cleanup(); } - - // Application - const ServiceProvider& getServiceProvider() const {return *m_sp;} - const char* getId() const {return getString("id").second;} + XMLApplication(const ServiceProvider*, const ProtocolProvider*, DOMElement*, const XMLApplication* base=nullptr); + ~XMLApplication(); + const char* getHash() const {return m_hash.c_str();} #ifndef SHIBSP_LITE @@ -99,58 +130,69 @@ namespace { SAML2Artifact* generateSAML2Artifact(const EntityDescriptor* relyingParty) const { pair index = make_pair(false,0); const PropertySet* props = getRelyingParty(relyingParty); - if (props) - index = getInt("artifactEndpointIndex"); + index = props->getInt("artifactEndpointIndex"); if (!index.first) index = getArtifactEndpointIndex(); - return new SAML2ArtifactType0004(SAMLConfig::getConfig().hashSHA1(getString("entityID").second),index.first ? index.second : 1); + pair entityID = props->getString("entityID"); + return new SAML2ArtifactType0004( + SecurityHelper::doHash("SHA1", entityID.second, strlen(entityID.second), false), + index.first ? index.second : 1 + ); } MetadataProvider* getMetadataProvider(bool required=true) const { if (required && !m_base && !m_metadata) throw ConfigurationException("No MetadataProvider available."); - return (!m_metadata && m_base) ? m_base->getMetadataProvider() : m_metadata; + return (!m_metadata && m_base) ? m_base->getMetadataProvider(required) : m_metadata.get(); } TrustEngine* getTrustEngine(bool required=true) const { if (required && !m_base && !m_trust) throw ConfigurationException("No TrustEngine available."); - return (!m_trust && m_base) ? m_base->getTrustEngine() : m_trust; + return (!m_trust && m_base) ? m_base->getTrustEngine(required) : m_trust.get(); } AttributeExtractor* getAttributeExtractor() const { - return (!m_attrExtractor && m_base) ? m_base->getAttributeExtractor() : m_attrExtractor; + return (!m_attrExtractor && m_base) ? m_base->getAttributeExtractor() : m_attrExtractor.get(); } AttributeFilter* getAttributeFilter() const { - return (!m_attrFilter && m_base) ? m_base->getAttributeFilter() : m_attrFilter; + return (!m_attrFilter && m_base) ? m_base->getAttributeFilter() : m_attrFilter.get(); } AttributeResolver* getAttributeResolver() const { - return (!m_attrResolver && m_base) ? m_base->getAttributeResolver() : m_attrResolver; + return (!m_attrResolver && m_base) ? m_base->getAttributeResolver() : m_attrResolver.get(); } CredentialResolver* getCredentialResolver() const { - return (!m_credResolver && m_base) ? m_base->getCredentialResolver() : m_credResolver; + return (!m_credResolver && m_base) ? m_base->getCredentialResolver() : m_credResolver.get(); } const PropertySet* getRelyingParty(const EntityDescriptor* provider) const; - const vector& getAudiences() const { - return (m_audiences.empty() && m_base) ? m_base->getAudiences() : m_audiences; + const PropertySet* getRelyingParty(const XMLCh* entityID) const; + + const vector* getAudiences() const { + return (m_audiences.empty() && m_base) ? m_base->getAudiences() : &m_audiences; } #endif string getNotificationURL(const char* resource, bool front, unsigned int index) const; - const set& getRemoteUserAttributeIds() const { + const vector& getRemoteUserAttributeIds() const { return (m_remoteUsers.empty() && m_base) ? m_base->getRemoteUserAttributeIds() : m_remoteUsers; } - void clearAttributeHeaders(SPRequest& request) const; + void clearHeader(SPRequest& request, const char* rawname, const char* cginame) const; + void setHeader(SPRequest& request, const char* name, const char* value) const; + string getSecureHeader(const SPRequest& request, const char* name) const; + const SessionInitiator* getDefaultSessionInitiator() const; const SessionInitiator* getSessionInitiatorById(const char* id) const; const Handler* getDefaultAssertionConsumerService() const; const Handler* getAssertionConsumerServiceByIndex(unsigned short index) const; + const Handler* getAssertionConsumerServiceByProtocol(const XMLCh* protocol, const char* binding=nullptr) const; const vector& getAssertionConsumerServicesByBinding(const XMLCh* binding) const; const Handler* getHandler(const char* path) const; + void getHandlers(vector& handlers) const; + void limitRedirect(const GenericRequest& request, const char* url) const; void receive(DDF& in, ostream& out) { // Only current function is to return the headers to clear. DDF header; - DDF ret=DDF(NULL).list(); + DDF ret=DDF(nullptr).list(); DDFJanitor jret(ret); for (vector< pair >::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i) { header = DDF(i->first.c_str()).string(i->second.c_str()); @@ -160,55 +202,68 @@ namespace { } // Provides filter to exclude special config elements. - short acceptNode(const DOMNode* node) const; - +#ifdef SHIBSP_XERCESC_SHORT_ACCEPTNODE + short +#else + FilterAction +#endif + acceptNode(const DOMNode* node) const; + private: - void cleanup(); - const ServiceProvider* m_sp; // this is ok because its locking scope includes us + template T* doChainedPlugins( + PluginManager& pluginMgr, + const char* pluginType, + const char* chainingType, + const XMLCh* localName, + DOMElement* e, + Category& log, + const char* dummyType=nullptr + ); + void doAttributeInfo(); + void doHandlers(const ProtocolProvider*, const DOMElement*, Category&); + void doSSO(const ProtocolProvider&, set&, DOMElement*, Category&); + void doLogout(const ProtocolProvider&, set&, DOMElement*, Category&); + void doNameIDMgmt(const ProtocolProvider&, set&, DOMElement*, Category&); + void doArtifactResolution(const ProtocolProvider&, const char*, DOMElement*, Category&); const XMLApplication* m_base; string m_hash; + std::pair m_attributePrefix; #ifndef SHIBSP_LITE - MetadataProvider* m_metadata; - TrustEngine* m_trust; - AttributeExtractor* m_attrExtractor; - AttributeFilter* m_attrFilter; - AttributeResolver* m_attrResolver; - CredentialResolver* m_credResolver; + void doAttributePlugins(DOMElement*, Category&); + scoped_ptr m_metadata; + scoped_ptr m_trust; + scoped_ptr m_attrExtractor; + scoped_ptr m_attrFilter; + scoped_ptr m_attrResolver; + scoped_ptr m_credResolver; vector m_audiences; // RelyingParty properties - DOMPropertySet* m_partyDefault; -#ifdef HAVE_GOOD_STL - map m_partyMap; -#else - map m_partyMap; + map< xstring,boost::shared_ptr > m_partyMap; // name-based matching + vector< pair< boost::shared_ptr,boost::shared_ptr > > m_partyVec; // plugin-based matching #endif -#endif - vector m_frontLogout,m_backLogout; - set m_remoteUsers; - mutable vector< pair > m_unsetHeaders; - RWLock* m_unsetLock; + vector m_remoteUsers,m_frontLogout,m_backLogout; // manage handler objects - vector m_handlers; + vector< boost::shared_ptr > m_handlers; // maps location (path info) to applicable handlers map m_handlerMap; // maps unique indexes to consumer services map m_acsIndexMap; - + // pointer to default consumer service const Handler* m_acsDefault; // maps binding strings to supporting consumer service(s) -#ifdef HAVE_GOOD_STL - typedef map > ACSBindingMap; -#else - typedef map > ACSBindingMap; -#endif + typedef map< xstring,vector > ACSBindingMap; ACSBindingMap m_acsBindingMap; + // maps protocol strings to supporting consumer service(s) + typedef map< xstring,vector > ACSProtocolMap; + ACSProtocolMap m_acsProtocolMap; + // pointer to default session initiator const SessionInitiator* m_sessionInitDefault; @@ -222,6 +277,17 @@ namespace { if (m_artifactResolutionDefault) return m_artifactResolutionDefault->getInt("index"); return m_base ? m_base->getArtifactEndpointIndex() : make_pair(false,0); } + + enum { + REDIRECT_LIMIT_INHERIT, + REDIRECT_LIMIT_NONE, + REDIRECT_LIMIT_EXACT, + REDIRECT_LIMIT_HOST, + REDIRECT_LIMIT_WHITELIST, + REDIRECT_LIMIT_EXACT_WHITELIST, + REDIRECT_LIMIT_HOST_WHITELIST + } m_redirectLimit; + vector m_redirectWhitelist; }; // Top-level configuration implementation @@ -229,138 +295,154 @@ namespace { class SHIBSP_DLLLOCAL XMLConfigImpl : public DOMPropertySet, public DOMNodeFilter { public: - XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* outer, Category& log); - ~XMLConfigImpl(); - - RequestMapper* m_requestMapper; - map m_appmap; + XMLConfigImpl(const DOMElement* e, bool first, XMLConfig* outer, Category& log); + ~XMLConfigImpl() { + if (m_document) + m_document->release(); + } + #ifndef SHIBSP_LITE - map< string,pair< PropertySet*,vector > > m_policyMap; - map< string, vector< pair< string, pair > > > m_transportOptionMap; + scoped_ptr m_tranLog; + scoped_ptr m_policy; + vector< boost::tuple > m_transportOptions; #endif - + scoped_ptr m_requestMapper; + map< string,boost::shared_ptr > m_appmap; + // Provides filter to exclude special config elements. - short acceptNode(const DOMNode* node) const; +#ifdef SHIBSP_XERCESC_SHORT_ACCEPTNODE + short +#else + FilterAction +#endif + acceptNode(const DOMNode* node) const; void setDocument(DOMDocument* doc) { m_document = doc; } private: - void doExtensions(const DOMElement* e, const char* label, Category& log); - void cleanup(); + void doExtensions(const DOMElement*, const char*, Category&); + void doListener(const DOMElement*, XMLConfig*, Category&); + void doCaching(const DOMElement*, XMLConfig*, Category&); - const XMLConfig* m_outer; DOMDocument* m_document; }; - class SHIBSP_DLLLOCAL XMLConfig : public ServiceProvider, public ReloadableXMLFile, public Remoted - { - public: - XMLConfig(const DOMElement* e) : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT".Config")), - m_impl(NULL), m_listener(NULL), m_sessionCache(NULL) + class SHIBSP_DLLLOCAL XMLConfig : public ServiceProvider, public ReloadableXMLFile #ifndef SHIBSP_LITE - , m_tranLog(NULL) + ,public Remoted #endif - { - } - + { + public: + XMLConfig(const DOMElement* e) : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT ".Config")) {} + void init() { - load(); + background_load(); } ~XMLConfig() { - delete m_impl; - delete m_sessionCache; - delete m_listener; + shutdown(); #ifndef SHIBSP_LITE - delete m_tranLog; - SAMLConfig::getConfig().setArtifactMap(NULL); - XMLToolingConfig::getConfig().setReplayCache(NULL); - for_each(m_storage.begin(), m_storage.end(), cleanup_pair()); + SAMLConfig::getConfig().setArtifactMap(nullptr); + XMLToolingConfig::getConfig().setReplayCache(nullptr); #endif } +#ifndef SHIBSP_LITE + // Lockable + Lockable* lock() { + ReloadableXMLFile::lock(); + if (m_impl->m_policy) + m_impl->m_policy->lock(); + return this; + } + void unlock() { + if (m_impl->m_policy) + m_impl->m_policy->unlock(); + ReloadableXMLFile::unlock(); + } +#endif + // PropertySet const PropertySet* getParent() const { return m_impl->getParent(); } void setParent(const PropertySet* parent) {return m_impl->setParent(parent);} - pair getBool(const char* name, const char* ns=NULL) const {return m_impl->getBool(name,ns);} - pair getString(const char* name, const char* ns=NULL) const {return m_impl->getString(name,ns);} - pair getXMLString(const char* name, const char* ns=NULL) const {return m_impl->getXMLString(name,ns);} - pair getUnsignedInt(const char* name, const char* ns=NULL) const {return m_impl->getUnsignedInt(name,ns);} - pair getInt(const char* name, const char* ns=NULL) const {return m_impl->getInt(name,ns);} + pair getBool(const char* name, const char* ns=nullptr) const {return m_impl->getBool(name,ns);} + pair getString(const char* name, const char* ns=nullptr) const {return m_impl->getString(name,ns);} + pair getXMLString(const char* name, const char* ns=nullptr) const {return m_impl->getXMLString(name,ns);} + pair getUnsignedInt(const char* name, const char* ns=nullptr) const {return m_impl->getUnsignedInt(name,ns);} + pair getInt(const char* name, const char* ns=nullptr) const {return m_impl->getInt(name,ns);} + void getAll(map& properties) const {return m_impl->getAll(properties);} const PropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:2.0:native:sp:config") const {return m_impl->getPropertySet(name,ns);} const DOMElement* getElement() const {return m_impl->getElement();} + // ServiceProvider +#ifndef SHIBSP_LITE // Remoted void receive(DDF& in, ostream& out); - // ServiceProvider -#ifndef SHIBSP_LITE TransactionLog* getTransactionLog() const { - if (m_tranLog) - return m_tranLog; + if (m_impl->m_tranLog) + return m_impl->m_tranLog.get(); throw ConfigurationException("No TransactionLog available."); } StorageService* getStorageService(const char* id) const { if (id) { - map::const_iterator i=m_storage.find(id); - if (i!=m_storage.end()) - return i->second; + map< string,boost::shared_ptr >::const_iterator i = m_storage.find(id); + if (i != m_storage.end()) + return i->second.get(); } - return NULL; + else if (!m_storage.empty()) + return m_storage.begin()->second.get(); + return nullptr; } #endif ListenerService* getListenerService(bool required=true) const { if (required && !m_listener) throw ConfigurationException("No ListenerService available."); - return m_listener; + return m_listener.get(); } SessionCache* getSessionCache(bool required=true) const { if (required && !m_sessionCache) throw ConfigurationException("No SessionCache available."); - return m_sessionCache; + return m_sessionCache.get(); } RequestMapper* getRequestMapper(bool required=true) const { if (required && !m_impl->m_requestMapper) throw ConfigurationException("No RequestMapper available."); - return m_impl->m_requestMapper; + return m_impl->m_requestMapper.get(); } const Application* getApplication(const char* applicationId) const { - map::const_iterator i=m_impl->m_appmap.find(applicationId); - return (i!=m_impl->m_appmap.end()) ? i->second : NULL; + map< string,boost::shared_ptr >::const_iterator i = m_impl->m_appmap.find(applicationId ? applicationId : "default"); + return (i != m_impl->m_appmap.end()) ? i->second.get() : nullptr; } #ifndef SHIBSP_LITE + SecurityPolicyProvider* getSecurityPolicyProvider(bool required=true) const { + if (required && !m_impl->m_policy) + throw ConfigurationException("No SecurityPolicyProvider available."); + return m_impl->m_policy.get(); + } + const PropertySet* getPolicySettings(const char* id) const { - map > >::const_iterator i = m_impl->m_policyMap.find(id); - if (i!=m_impl->m_policyMap.end()) - return i->second.first; - throw ConfigurationException("Security Policy ($1) not found, check element.", params(1,id)); + return getSecurityPolicyProvider()->getPolicySettings(id); } const vector& getPolicyRules(const char* id) const { - map > >::const_iterator i = m_impl->m_policyMap.find(id); - if (i!=m_impl->m_policyMap.end()) - return i->second.second; - throw ConfigurationException("Security Policy ($1) not found, check element.", params(1,id)); + return getSecurityPolicyProvider()->getPolicyRules(id); } - bool setTransportOptions(const char* id, SOAPTransport& transport) const { + bool setTransportOptions(SOAPTransport& transport) const { bool ret = true; - map< string, vector< pair< string, pair > > >::const_iterator p = - m_impl->m_transportOptionMap.find(id); - if (p == m_impl->m_transportOptionMap.end()) - return ret; - vector< pair< string, pair > >::const_iterator opt; - for (opt = p->second.begin(); opt != p->second.end(); ++opt) { - if (!transport.setProviderOption(opt->first.c_str(), opt->second.first.c_str(), opt->second.second.c_str())) { - m_log.error("failed to set SOAPTransport option (%s)", opt->second.first.c_str()); + for (vector< boost::tuple >::const_iterator opt = m_impl->m_transportOptions.begin(); + opt != m_impl->m_transportOptions.end(); ++opt) { + if (!transport.setProviderOption(opt->get<0>().c_str(), opt->get<1>().c_str(), opt->get<2>().c_str())) { + m_log.error("failed to set SOAPTransport option (%s)", opt->get<1>().c_str()); ret = false; } } @@ -369,25 +451,28 @@ namespace { #endif protected: - pair load(); + pair background_load(); private: friend class XMLConfigImpl; - XMLConfigImpl* m_impl; - mutable ListenerService* m_listener; - mutable SessionCache* m_sessionCache; + // The order of these members actually matters. If we want to rely on auto-destruction, then + // anything dependent on anything else has to come later in the object so it will pop first. + // Storage is the lowest, then remoting, then the cache, and finally the rest. #ifndef SHIBSP_LITE - mutable TransactionLog* m_tranLog; - mutable map m_storage; + map< string,boost::shared_ptr > m_storage; #endif + scoped_ptr m_listener; + scoped_ptr m_sessionCache; + scoped_ptr m_impl; }; #if defined (_MSC_VER) #pragma warning( pop ) #endif - static const XMLCh _Application[] = UNICODE_LITERAL_11(A,p,p,l,i,c,a,t,i,o,n); - static const XMLCh Applications[] = UNICODE_LITERAL_12(A,p,p,l,i,c,a,t,i,o,n,s); + static const XMLCh applicationId[] = UNICODE_LITERAL_13(a,p,p,l,i,c,a,t,i,o,n,I,d); + static const XMLCh ApplicationOverride[] = UNICODE_LITERAL_19(A,p,p,l,i,c,a,t,i,o,n,O,v,e,r,r,i,d,e); + static const XMLCh ApplicationDefaults[] = UNICODE_LITERAL_19(A,p,p,l,i,c,a,t,i,o,n,D,e,f,a,u,l,t,s); static const XMLCh _ArtifactMap[] = UNICODE_LITERAL_11(A,r,t,i,f,a,c,t,M,a,p); static const XMLCh _AttributeExtractor[] = UNICODE_LITERAL_18(A,t,t,r,i,b,u,t,e,E,x,t,r,a,c,t,o,r); static const XMLCh _AttributeFilter[] = UNICODE_LITERAL_15(A,t,t,r,i,b,u,t,e,F,i,l,t,e,r); @@ -398,51 +483,48 @@ namespace { static const XMLCh Binding[] = UNICODE_LITERAL_7(B,i,n,d,i,n,g); static const XMLCh Channel[]= UNICODE_LITERAL_7(C,h,a,n,n,e,l); static const XMLCh _CredentialResolver[] = UNICODE_LITERAL_18(C,r,e,d,e,n,t,i,a,l,R,e,s,o,l,v,e,r); - static const XMLCh DefaultRelyingParty[] = UNICODE_LITERAL_19(D,e,f,a,u,l,t,R,e,l,y,i,n,g,P,a,r,t,y); + static const XMLCh _default[] = UNICODE_LITERAL_7(d,e,f,a,u,l,t); static const XMLCh _Extensions[] = UNICODE_LITERAL_10(E,x,t,e,n,s,i,o,n,s); static const XMLCh _fatal[] = UNICODE_LITERAL_5(f,a,t,a,l); static const XMLCh _Handler[] = UNICODE_LITERAL_7(H,a,n,d,l,e,r); static const XMLCh _id[] = UNICODE_LITERAL_2(i,d); - static const XMLCh Implementation[] = UNICODE_LITERAL_14(I,m,p,l,e,m,e,n,t,a,t,i,o,n); + static const XMLCh _index[] = UNICODE_LITERAL_5(i,n,d,e,x); static const XMLCh InProcess[] = UNICODE_LITERAL_9(I,n,P,r,o,c,e,s,s); static const XMLCh Library[] = UNICODE_LITERAL_7(L,i,b,r,a,r,y); static const XMLCh Listener[] = UNICODE_LITERAL_8(L,i,s,t,e,n,e,r); static const XMLCh Location[] = UNICODE_LITERAL_8(L,o,c,a,t,i,o,n); static const XMLCh logger[] = UNICODE_LITERAL_6(l,o,g,g,e,r); + static const XMLCh Logout[] = UNICODE_LITERAL_6(L,o,g,o,u,t); static const XMLCh _LogoutInitiator[] = UNICODE_LITERAL_15(L,o,g,o,u,t,I,n,i,t,i,a,t,o,r); static const XMLCh _ManageNameIDService[] = UNICODE_LITERAL_19(M,a,n,a,g,e,N,a,m,e,I,D,S,e,r,v,i,c,e); - static const XMLCh MemoryListener[] = UNICODE_LITERAL_14(M,e,m,o,r,y,L,i,s,t,e,n,e,r); static const XMLCh _MetadataProvider[] = UNICODE_LITERAL_16(M,e,t,a,d,a,t,a,P,r,o,v,i,d,e,r); + static const XMLCh NameIDMgmt[] = UNICODE_LITERAL_10(N,a,m,e,I,D,M,g,m,t); static const XMLCh Notify[] = UNICODE_LITERAL_6(N,o,t,i,f,y); static const XMLCh _option[] = UNICODE_LITERAL_6(o,p,t,i,o,n); static const XMLCh OutOfProcess[] = UNICODE_LITERAL_12(O,u,t,O,f,P,r,o,c,e,s,s); static const XMLCh _path[] = UNICODE_LITERAL_4(p,a,t,h); - static const XMLCh Policy[] = UNICODE_LITERAL_6(P,o,l,i,c,y); + static const XMLCh _policyId[] = UNICODE_LITERAL_8(p,o,l,i,c,y,I,d); + static const XMLCh _ProtocolProvider[] = UNICODE_LITERAL_16(P,r,o,t,o,c,o,l,P,r,o,v,i,d,e,r); static const XMLCh _provider[] = UNICODE_LITERAL_8(p,r,o,v,i,d,e,r); static const XMLCh RelyingParty[] = UNICODE_LITERAL_12(R,e,l,y,i,n,g,P,a,r,t,y); static const XMLCh _ReplayCache[] = UNICODE_LITERAL_11(R,e,p,l,a,y,C,a,c,h,e); static const XMLCh _RequestMapper[] = UNICODE_LITERAL_13(R,e,q,u,e,s,t,M,a,p,p,e,r); - static const XMLCh Rule[] = UNICODE_LITERAL_4(R,u,l,e); + static const XMLCh RequestMap[] = UNICODE_LITERAL_10(R,e,q,u,e,s,t,M,a,p); static const XMLCh SecurityPolicies[] = UNICODE_LITERAL_16(S,e,c,u,r,i,t,y,P,o,l,i,c,i,e,s); + static const XMLCh _SecurityPolicyProvider[] = UNICODE_LITERAL_22(S,e,c,u,r,i,t,y,P,o,l,i,c,y,P,r,o,v,i,d,e,r); static const XMLCh _SessionCache[] = UNICODE_LITERAL_12(S,e,s,s,i,o,n,C,a,c,h,e); static const XMLCh _SessionInitiator[] = UNICODE_LITERAL_16(S,e,s,s,i,o,n,I,n,i,t,i,a,t,o,r); static const XMLCh _SingleLogoutService[] = UNICODE_LITERAL_19(S,i,n,g,l,e,L,o,g,o,u,t,S,e,r,v,i,c,e); + static const XMLCh Site[] = UNICODE_LITERAL_4(S,i,t,e); + static const XMLCh SSO[] = UNICODE_LITERAL_3(S,S,O); static const XMLCh _StorageService[] = UNICODE_LITERAL_14(S,t,o,r,a,g,e,S,e,r,v,i,c,e); static const XMLCh TCPListener[] = UNICODE_LITERAL_11(T,C,P,L,i,s,t,e,n,e,r); + static const XMLCh tranLogFiller[] = UNICODE_LITERAL_13(t,r,a,n,L,o,g,F,i,l,l,e,r); + static const XMLCh tranLogFormat[] = UNICODE_LITERAL_13(t,r,a,n,L,o,g,F,o,r,m,a,t); static const XMLCh TransportOption[] = UNICODE_LITERAL_15(T,r,a,n,s,p,o,r,t,O,p,t,i,o,n); static const XMLCh _TrustEngine[] = UNICODE_LITERAL_11(T,r,u,s,t,E,n,g,i,n,e); static const XMLCh _type[] = UNICODE_LITERAL_4(t,y,p,e); static const XMLCh UnixListener[] = UNICODE_LITERAL_12(U,n,i,x,L,i,s,t,e,n,e,r); - -#ifndef SHIBSP_LITE - class SHIBSP_DLLLOCAL PolicyNodeFilter : public DOMNodeFilter - { - public: - short acceptNode(const DOMNode* node) const { - return FILTER_REJECT; - } - }; -#endif }; namespace shibsp { @@ -454,475 +536,995 @@ namespace shibsp { XMLApplication::XMLApplication( const ServiceProvider* sp, - const DOMElement* e, + const ProtocolProvider* pp, + DOMElement* e, const XMLApplication* base - ) : m_sp(sp), m_base(base), -#ifndef SHIBSP_LITE - m_metadata(NULL), m_trust(NULL), - m_attrExtractor(NULL), m_attrFilter(NULL), m_attrResolver(NULL), - m_credResolver(NULL), m_partyDefault(NULL), -#endif - m_unsetLock(NULL), m_acsDefault(NULL), m_sessionInitDefault(NULL), m_artifactResolutionDefault(NULL) + ) : Application(sp), m_base(base), m_acsDefault(nullptr), m_sessionInitDefault(nullptr), m_artifactResolutionDefault(nullptr) { #ifdef _DEBUG xmltooling::NDC ndc("XMLApplication"); #endif - Category& log=Category::getInstance(SHIBSP_LOGCAT".Application"); + Category& log = Category::getInstance(SHIBSP_LOGCAT ".Application"); + + // First load any property sets. + map remapper; + remapper["relayStateLimit"] = "redirectLimit"; + remapper["relayStateWhitelist"] = "redirectWhitelist"; + load(e, nullptr, this, &remapper); + + // Process redirect limit policy. Do this before assigning the parent pointer + // to ensure we get only our Sessions element. + const PropertySet* sessionProps = getPropertySet("Sessions"); + if (sessionProps) { + pair prop = sessionProps->getString("redirectLimit"); + if (prop.first) { + if (!strcmp(prop.second, "none")) + m_redirectLimit = REDIRECT_LIMIT_NONE; + else if (!strcmp(prop.second, "exact")) + m_redirectLimit = REDIRECT_LIMIT_EXACT; + else if (!strcmp(prop.second, "host")) + m_redirectLimit = REDIRECT_LIMIT_HOST; + else { + if (!strcmp(prop.second, "exact+whitelist")) + m_redirectLimit = REDIRECT_LIMIT_EXACT_WHITELIST; + else if (!strcmp(prop.second, "host+whitelist")) + m_redirectLimit = REDIRECT_LIMIT_HOST_WHITELIST; + else if (!strcmp(prop.second, "whitelist")) + m_redirectLimit = REDIRECT_LIMIT_WHITELIST; + else + throw ConfigurationException("Unrecognized redirectLimit setting ($1)", params(1, prop.second)); + prop = sessionProps->getString("redirectWhitelist"); + if (prop.first) { + string dup(prop.second); + trim(dup); + split(m_redirectWhitelist, dup, is_space(), algorithm::token_compress_on); + } + } + } + else { + m_redirectLimit = base ? REDIRECT_LIMIT_INHERIT : REDIRECT_LIMIT_NONE; + } + + // Audit some additional settings for logging purposes. + prop = sessionProps->getString("cookieProps"); + if (!prop.first) { + log.warn("empty/missing cookieProps setting, set to \"https\" for SSL/TLS-only usage"); + } + else if (!strcmp(prop.second, "http")) { + log.warn("insecure cookieProps setting, set to \"https\" for SSL/TLS-only usage"); + } + else if (strcmp(prop.second, "https")) { + if (!strstr(prop.second, ";secure") && !strstr(prop.second, "; secure")) + log.warn("custom cookieProps setting should include \"; secure\" for SSL/TLS-only usage"); + else if (!strstr(prop.second, ";HttpOnly") && !strstr(prop.second, "; HttpOnly")) + log.warn("custom cookieProps setting should include \"; HttpOnly\", site is vulnerable to client-side cookie theft"); + } + + pair handlerSSL = sessionProps->getBool("handlerSSL"); + if (handlerSSL.first && !handlerSSL.second) + log.warn("handlerSSL should be enabled for SSL/TLS-enabled web sites"); + } + else { + m_redirectLimit = base ? REDIRECT_LIMIT_INHERIT : REDIRECT_LIMIT_NONE; + } - try { - // First load any property sets. - load(e,log,this); - if (base) - setParent(base); + // Assign parent. + if (base) + setParent(base); - SPConfig& conf=SPConfig::getConfig(); + SPConfig& conf=SPConfig::getConfig(); #ifndef SHIBSP_LITE - SAMLConfig& samlConf=SAMLConfig::getConfig(); - XMLToolingConfig& xmlConf=XMLToolingConfig::getConfig(); + XMLToolingConfig& xmlConf=XMLToolingConfig::getConfig(); #endif - // This used to be an actual hash, but now it's just a hex-encode to avoid xmlsec. - static char DIGITS[] = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'}; - string tohash=getId(); - tohash+=getString("entityID").second; - for (const char* ch = tohash.c_str(); *ch; ++ch) { - m_hash += (DIGITS[((unsigned char)(0xF0 & *ch)) >> 4 ]); - m_hash += (DIGITS[0x0F & *ch]); - } - - // Load attribute ID lists for REMOTE_USER and header clearing. - if (conf.isEnabled(SPConfig::InProcess)) { - pair attributes = getString("REMOTE_USER"); - if (attributes.first) { - char* dup = strdup(attributes.second); - char* pos; - char* start = dup; - while (start && *start) { - while (*start && isspace(*start)) - start++; - if (!*start) - break; - pos = strchr(start,' '); - if (pos) - *pos=0; - m_remoteUsers.insert(start); - start = pos ? pos+1 : NULL; - } - free(dup); - } + // This used to be an actual hash, but now it's just a hex-encode to avoid xmlsec dependency. + static char DIGITS[] = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'}; + string tohash=getId(); + tohash+=getString("entityID").second; + for (const char* ch = tohash.c_str(); *ch; ++ch) { + m_hash += (DIGITS[((unsigned char)(0xF0 & *ch)) >> 4 ]); + m_hash += (DIGITS[0x0F & *ch]); + } - attributes = getString("unsetHeaders"); - if (attributes.first) { - char* dup = strdup(attributes.second); - char* pos; - char* start = dup; - while (start && *start) { - while (*start && isspace(*start)) - start++; - if (!*start) - break; - pos = strchr(start,' '); - if (pos) - *pos=0; - - string transformed("HTTP_"); - const char* pch = start; - while (*pch) { - transformed += (isalnum(*pch) ? toupper(*pch) : '_'); - pch++; - } - m_unsetHeaders.push_back(pair(start,transformed)); - start = pos ? pos+1 : NULL; - } - free(dup); - m_unsetHeaders.push_back(pair("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID")); + doAttributeInfo(); + + if (conf.isEnabled(SPConfig::Handlers)) + doHandlers(pp, e, log); + + // Notification. + DOMNodeList* nlist = e->getElementsByTagNameNS(shibspconstants::SHIB2SPCONFIG_NS, Notify); + for (XMLSize_t i = 0; nlist && i < nlist->getLength(); ++i) { + if (nlist->item(i)->getParentNode()->isSameNode(e)) { + const XMLCh* channel = static_cast(nlist->item(i))->getAttributeNS(nullptr, Channel); + string loc(XMLHelper::getAttrString(static_cast(nlist->item(i)), nullptr, Location)); + if (!loc.empty()) { + if (channel && *channel == chLatin_f) + m_frontLogout.push_back(loc); + else + m_backLogout.push_back(loc); } } + } - Handler* handler=NULL; - const PropertySet* sessions = getPropertySet("Sessions"); +#ifndef SHIBSP_LITE + nlist = e->getElementsByTagNameNS(samlconstants::SAML20_NS, Audience::LOCAL_NAME); + if (nlist && nlist->getLength()) { + log.warn("use of elements outside of a Security Policy Rule is deprecated"); + for (XMLSize_t i = 0; i < nlist->getLength(); ++i) + if (nlist->item(i)->getParentNode()->isSameNode(e) && nlist->item(i)->hasChildNodes()) + m_audiences.push_back(nlist->item(i)->getFirstChild()->getNodeValue()); + } - // Process assertion export handler. - pair location = sessions ? sessions->getString("exportLocation") : pair(false,NULL); - if (location.first) { - try { - handler = conf.HandlerManager.newPlugin(samlconstants::SAML20_BINDING_URI, make_pair(sessions->getElement(), getId())); - m_handlers.push_back(handler); + if (conf.isEnabled(SPConfig::Metadata)) { + m_metadata.reset( + doChainedPlugins( + SAMLConfig::getConfig().MetadataProviderManager, "MetadataProvider", CHAINING_METADATA_PROVIDER, _MetadataProvider, e, log + ) + ); + try { + if (m_metadata) + m_metadata->init(); + else if (!m_base) + log.warn("no MetadataProvider available, configure at least one for standard SSO usage"); + } + catch (std::exception& ex) { + log.crit("error initializing MetadataProvider: %s", ex.what()); + } + } - // Insert into location map. If it contains the handlerURL, we skip past that part. - const char* pch = strstr(location.second, sessions->getString("handlerURL").second); - if (pch) - location.second = pch + strlen(sessions->getString("handlerURL").second); - if (*location.second == '/') - m_handlerMap[location.second]=handler; - else - m_handlerMap[string("/") + location.second]=handler; - } - catch (exception& ex) { - log.error("caught exception installing assertion lookup handler: %s", ex.what()); + if (conf.isEnabled(SPConfig::Trust)) { + m_trust.reset(doChainedPlugins(xmlConf.TrustEngineManager, "TrustEngine", CHAINING_TRUSTENGINE, _TrustEngine, e, log)); + if (!m_trust && !m_base) { + log.info( + "no TrustEngine specified or installed, using default chain {%s, %s}", + EXPLICIT_KEY_TRUSTENGINE, SHIBBOLETH_PKIX_TRUSTENGINE + ); + m_trust.reset(xmlConf.TrustEngineManager.newPlugin(CHAINING_TRUSTENGINE, nullptr)); + ChainingTrustEngine* trustchain = dynamic_cast(m_trust.get()); + if (trustchain) { + trustchain->addTrustEngine(xmlConf.TrustEngineManager.newPlugin(EXPLICIT_KEY_TRUSTENGINE, nullptr)); + trustchain->addTrustEngine(xmlConf.TrustEngineManager.newPlugin(SHIBBOLETH_PKIX_TRUSTENGINE, nullptr)); } } + } - // Process other handlers. - bool hardACS=false, hardSessionInit=false, hardArt=false; - const DOMElement* child = sessions ? XMLHelper::getFirstChildElement(sessions->getElement()) : NULL; + if (conf.isEnabled(SPConfig::AttributeResolution)) { + doAttributePlugins(e, log); + } + + if (conf.isEnabled(SPConfig::Credentials)) { + m_credResolver.reset( + doChainedPlugins(xmlConf.CredentialResolverManager, "CredentialResolver", CHAINING_CREDENTIAL_RESOLVER, _CredentialResolver, e, log) + ); + } + + // Finally, load relying parties. + const DOMElement* child = XMLHelper::getFirstChildElement(e, RelyingParty); + while (child) { + if (child->hasAttributeNS(nullptr, saml2::Attribute::NAME_ATTRIB_NAME)) { + boost::shared_ptr rp(new DOMPropertySet()); + rp->load(child, nullptr, this); + rp->setParent(this); + m_partyMap[child->getAttributeNS(nullptr, saml2::Attribute::NAME_ATTRIB_NAME)] = rp; + } + else if (child->hasAttributeNS(nullptr, _type)) { + string emtype(XMLHelper::getAttrString(child, nullptr, _type)); + boost::shared_ptr em(SAMLConfig::getConfig().EntityMatcherManager.newPlugin(emtype, child)); + boost::shared_ptr rp(new DOMPropertySet()); + rp->load(child, nullptr, this); + rp->setParent(this); + m_partyVec.push_back(make_pair(em, rp)); + } + child = XMLHelper::getNextSiblingElement(child, RelyingParty); + } + if (base && m_partyMap.empty() && m_partyVec.empty() && (!base->m_partyMap.empty() || !base->m_partyVec.empty())) { + // For inheritance of RPs to work, we have to pull them in to the override by cloning the DOM. + child = XMLHelper::getFirstChildElement(base->getElement(), RelyingParty); while (child) { - try { - // A handler is based on the Binding property in conjunction with the element name. - // If it's an ACS or SI, also handle index/id mappings and defaulting. - if (XMLString::equals(child->getLocalName(),_AssertionConsumerService)) { - auto_ptr_char bindprop(child->getAttributeNS(NULL,Binding)); - if (!bindprop.get() || !*(bindprop.get())) { - log.warn("md:AssertionConsumerService element has no Binding attribute, skipping it..."); - child = XMLHelper::getNextSiblingElement(child); - continue; - } - handler=conf.AssertionConsumerServiceManager.newPlugin(bindprop.get(),make_pair(child, getId())); - // Map by binding (may be > 1 per binding, e.g. SAML 1.0 vs 1.1) -#ifdef HAVE_GOOD_STL - m_acsBindingMap[handler->getXMLString("Binding").second].push_back(handler); -#else - m_acsBindingMap[handler->getString("Binding").second].push_back(handler); + if (child->hasAttributeNS(nullptr, saml2::Attribute::NAME_ATTRIB_NAME)) { + DOMElement* rpclone = static_cast(child->cloneNode(true)); + boost::shared_ptr rp(new DOMPropertySet()); + rp->load(rpclone, nullptr, this); + rp->setParent(this); + m_partyMap[rpclone->getAttributeNS(nullptr, saml2::Attribute::NAME_ATTRIB_NAME)] = rp; + } + else if (child->hasAttributeNS(nullptr, _type)) { + DOMElement* rpclone = static_cast(child->cloneNode(true)); + string emtype(XMLHelper::getAttrString(rpclone, nullptr, _type)); + boost::shared_ptr em(SAMLConfig::getConfig().EntityMatcherManager.newPlugin(emtype, rpclone)); + boost::shared_ptr rp(new DOMPropertySet()); + rp->load(rpclone, nullptr, this); + rp->setParent(this); + m_partyVec.push_back(make_pair(em, rp)); + } + child = XMLHelper::getNextSiblingElement(child, RelyingParty); + } + } #endif - m_acsIndexMap[handler->getUnsignedInt("index").second]=handler; - - if (!hardACS) { - pair defprop=handler->getBool("isDefault"); - if (defprop.first) { - if (defprop.second) { - hardACS=true; - m_acsDefault=handler; - } - } - else if (!m_acsDefault) - m_acsDefault=handler; - } - } - else if (XMLString::equals(child->getLocalName(),_SessionInitiator)) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - if (!type.get() || !*(type.get())) { - log.warn("SessionInitiator element has no type attribute, skipping it..."); - child = XMLHelper::getNextSiblingElement(child); - continue; - } - SessionInitiator* sihandler=conf.SessionInitiatorManager.newPlugin(type.get(),make_pair(child, getId())); - handler=sihandler; - pair si_id=handler->getString("id"); - if (si_id.first && si_id.second) - m_sessionInitMap[si_id.second]=sihandler; - if (!hardSessionInit) { - pair defprop=handler->getBool("isDefault"); - if (defprop.first) { - if (defprop.second) { - hardSessionInit=true; - m_sessionInitDefault=sihandler; - } - } - else if (!m_sessionInitDefault) - m_sessionInitDefault=sihandler; - } - } - else if (XMLString::equals(child->getLocalName(),_LogoutInitiator)) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - if (!type.get() || !*(type.get())) { - log.warn("LogoutInitiator element has no type attribute, skipping it..."); - child = XMLHelper::getNextSiblingElement(child); - continue; - } - handler=conf.LogoutInitiatorManager.newPlugin(type.get(),make_pair(child, getId())); - } - else if (XMLString::equals(child->getLocalName(),_ArtifactResolutionService)) { - auto_ptr_char bindprop(child->getAttributeNS(NULL,Binding)); - if (!bindprop.get() || !*(bindprop.get())) { - log.warn("md:ArtifactResolutionService element has no Binding attribute, skipping it..."); - child = XMLHelper::getNextSiblingElement(child); - continue; - } - handler=conf.ArtifactResolutionServiceManager.newPlugin(bindprop.get(),make_pair(child, getId())); - - if (!hardArt) { - pair defprop=handler->getBool("isDefault"); - if (defprop.first) { - if (defprop.second) { - hardArt=true; - m_artifactResolutionDefault=handler; - } - } - else if (!m_artifactResolutionDefault) - m_artifactResolutionDefault=handler; - } - } - else if (XMLString::equals(child->getLocalName(),_SingleLogoutService)) { - auto_ptr_char bindprop(child->getAttributeNS(NULL,Binding)); - if (!bindprop.get() || !*(bindprop.get())) { - log.warn("md:SingleLogoutService element has no Binding attribute, skipping it..."); - child = XMLHelper::getNextSiblingElement(child); - continue; - } - handler=conf.SingleLogoutServiceManager.newPlugin(bindprop.get(),make_pair(child, getId())); - } - else if (XMLString::equals(child->getLocalName(),_ManageNameIDService)) { - auto_ptr_char bindprop(child->getAttributeNS(NULL,Binding)); - if (!bindprop.get() || !*(bindprop.get())) { - log.warn("md:ManageNameIDService element has no Binding attribute, skipping it..."); - child = XMLHelper::getNextSiblingElement(child); - continue; - } - handler=conf.ManageNameIDServiceManager.newPlugin(bindprop.get(),make_pair(child, getId())); - } - else { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - if (!type.get() || !*(type.get())) { - log.warn("Handler element has no type attribute, skipping it..."); - child = XMLHelper::getNextSiblingElement(child); - continue; - } - handler=conf.HandlerManager.newPlugin(type.get(),make_pair(child, getId())); - } - m_handlers.push_back(handler); + // Out of process only, we register a listener endpoint. + if (!conf.isEnabled(SPConfig::InProcess)) { + ListenerService* listener = sp->getListenerService(false); + if (listener) { + string addr=string(getId()) + "::getHeaders::Application"; + listener->regListener(addr.c_str(), this); + } + else { + log.info("no ListenerService available, Application remoting disabled"); + } + } +} - // Insert into location map. - location=handler->getString("Location"); - if (location.first && *location.second == '/') - m_handlerMap[location.second]=handler; - else if (location.first) - m_handlerMap[string("/") + location.second]=handler; +XMLApplication::~XMLApplication() +{ + ListenerService* listener=getServiceProvider().getListenerService(false); + if (listener && SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess) && !SPConfig::getConfig().isEnabled(SPConfig::InProcess)) { + string addr=string(getId()) + "::getHeaders::Application"; + listener->unregListener(addr.c_str(), this); + } +} +template T* XMLApplication::doChainedPlugins( + PluginManager& pluginMgr, + const char* pluginType, + const char* chainingType, + const XMLCh* localName, + DOMElement* e, + Category& log, + const char* dummyType + ) +{ + string t; + DOMElement* child = XMLHelper::getFirstChildElement(e, localName); + if (child) { + // Check for multiple. + if (XMLHelper::getNextSiblingElement(child, localName)) { + log.info("multiple %s plugins, wrapping in a chain", pluginType); + DOMElement* chain = child->getOwnerDocument()->createElementNS(nullptr, localName); + while (child) { + chain->appendChild(child); + child = XMLHelper::getFirstChildElement(e, localName); } - catch (exception& ex) { - log.error("caught exception processing handler element: %s", ex.what()); - } - - child = XMLHelper::getNextSiblingElement(child); + t = chainingType; + child = chain; + e->appendChild(chain); + } + else { + // Only a single one. + t = XMLHelper::getAttrString(child, nullptr, _type); } - // Notification. - DOMNodeList* nlist=e->getElementsByTagNameNS(shibspconstants::SHIB2SPCONFIG_NS,Notify); - for (XMLSize_t i=0; nlist && igetLength(); i++) { - if (nlist->item(i)->getParentNode()->isSameNode(e)) { - const XMLCh* channel = static_cast(nlist->item(i))->getAttributeNS(NULL,Channel); - auto_ptr_char loc(static_cast(nlist->item(i))->getAttributeNS(NULL,Location)); - if (loc.get() && *loc.get()) { - if (channel && *channel == chLatin_f) - m_frontLogout.push_back(loc.get()); - else - m_backLogout.push_back(loc.get()); - } + try { + if (!t.empty()) { + log.info("building %s of type %s...", pluginType, t.c_str()); + return pluginMgr.newPlugin(t.c_str(), child); + } + else { + throw ConfigurationException("$1 element had no type attribute.", params(1, pluginType)); + } + } + catch (std::exception& ex) { + log.crit("error building %s: %s", pluginType, ex.what()); + if (dummyType) { + // Install a dummy version as a safety valve. + log.crit("installing safe %s in place of failed version", pluginType); + return pluginMgr.newPlugin(dummyType, nullptr); } } + } -#ifndef SHIBSP_LITE - nlist=e->getElementsByTagNameNS(samlconstants::SAML20_NS,Audience::LOCAL_NAME); - for (XMLSize_t i=0; nlist && igetLength(); i++) - if (nlist->item(i)->getParentNode()->isSameNode(e) && nlist->item(i)->hasChildNodes()) - m_audiences.push_back(nlist->item(i)->getFirstChild()->getNodeValue()); + return nullptr; +} - // Always include our own entityID as an audience. - m_audiences.push_back(getXMLString("entityID").second); +void XMLApplication::doAttributeInfo() +{ + // Populate prefix pair. + m_attributePrefix.second = "HTTP_"; + pair prefix = getString("attributePrefix"); + if (prefix.first) { + m_attributePrefix.first = prefix.second; + const char* pch = prefix.second; + while (*pch) { + m_attributePrefix.second += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; + } + } - if (conf.isEnabled(SPConfig::Metadata)) { - child = XMLHelper::getFirstChildElement(e,_MetadataProvider); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building MetadataProvider of type %s...",type.get()); - try { - auto_ptr mp(samlConf.MetadataProviderManager.newPlugin(type.get(),child)); - mp->init(); - m_metadata = mp.release(); - } - catch (exception& ex) { - log.crit("error building/initializing MetadataProvider: %s", ex.what()); + pair attributes = getString("REMOTE_USER"); + if (attributes.first) { + string dup(attributes.second); + trim(dup); + split(m_remoteUsers, dup, is_space(), algorithm::token_compress_on); + } + + // Load attribute ID lists for REMOTE_USER and header clearing. + if (SPConfig::getConfig().isEnabled(SPConfig::InProcess)) { + attributes = getString("unsetHeaders"); + if (attributes.first) { + string transformedprefix(m_attributePrefix.second); + const char* pch; + prefix = getString("metadataAttributePrefix"); + if (prefix.first) { + pch = prefix.second; + while (*pch) { + transformedprefix += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; } } - } - if (conf.isEnabled(SPConfig::Trust)) { - child = XMLHelper::getFirstChildElement(e,_TrustEngine); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building TrustEngine of type %s...",type.get()); - try { - m_trust = xmlConf.TrustEngineManager.newPlugin(type.get(),child); - } - catch (exception& ex) { - log.crit("error building TrustEngine: %s", ex.what()); + string dup(attributes.second); + trim(dup); + vector headerNames; + split(headerNames, dup, is_space(), algorithm::token_compress_on); + for (vector::const_iterator h = headerNames.begin(); h != headerNames.end(); ++h) { + string transformed; + const char* pch = h->c_str(); + while (*pch) { + transformed += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; } + m_unsetHeaders.push_back(pair(m_attributePrefix.first + *h, m_attributePrefix.second + transformed)); + if (prefix.first) + m_unsetHeaders.push_back(pair(m_attributePrefix.first + prefix.second + *h, transformedprefix + transformed)); } + m_unsetHeaders.push_back(pair(m_attributePrefix.first + "Shib-Application-ID", m_attributePrefix.second + "SHIB_APPLICATION_ID")); } + } +} - if (conf.isEnabled(SPConfig::AttributeResolution)) { - child = XMLHelper::getFirstChildElement(e,_AttributeExtractor); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building AttributeExtractor of type %s...",type.get()); - try { - m_attrExtractor = conf.AttributeExtractorManager.newPlugin(type.get(),child); - } - catch (exception& ex) { - log.crit("error building AttributeExtractor: %s", ex.what()); - } +void XMLApplication::doHandlers(const ProtocolProvider* pp, const DOMElement* e, Category& log) +{ + SPConfig& conf = SPConfig::getConfig(); + + const PropertySet* sessions = getPropertySet("Sessions"); + + // Process assertion export handler. + pair location = sessions ? sessions->getString("exportLocation") : pair(false,nullptr); + if (location.first) { + try { + DOMElement* exportElement = e->getOwnerDocument()->createElementNS(shibspconstants::SHIB2SPCONFIG_NS, _Handler); + exportElement->setAttributeNS(nullptr,Location,sessions->getXMLString("exportLocation").second); + pair exportACL = sessions->getXMLString("exportACL"); + if (exportACL.first) { + static const XMLCh _acl[] = UNICODE_LITERAL_9(e,x,p,o,r,t,A,C,L); + exportElement->setAttributeNS(nullptr,_acl,exportACL.second); } + boost::shared_ptr exportHandler( + conf.HandlerManager.newPlugin(samlconstants::SAML20_BINDING_URI, pair(exportElement, getId())) + ); + m_handlers.push_back(exportHandler); + + // Insert into location map. If it contains the handlerURL, we skip past that part. + const char* hurl = sessions->getString("handlerURL").second; + if (!hurl) + hurl = "/Shibboleth.sso"; + const char* pch = strstr(location.second, hurl); + if (pch) + location.second = pch + strlen(hurl); + if (*location.second == '/') + m_handlerMap[location.second] = exportHandler.get(); + else + m_handlerMap[string("/") + location.second] = exportHandler.get(); + } + catch (std::exception& ex) { + log.error("caught exception installing assertion lookup handler: %s", ex.what()); + } + } - child = XMLHelper::getFirstChildElement(e,_AttributeFilter); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building AttributeFilter of type %s...",type.get()); - try { - m_attrFilter = conf.AttributeFilterManager.newPlugin(type.get(),child); + // Look for "shorthand" elements first. + set protocols; + DOMElement* child = sessions ? XMLHelper::getFirstChildElement(sessions->getElement()) : nullptr; + while (child) { + if (XMLHelper::isNodeNamed(child, shibspconstants::SHIB2SPCONFIG_NS, SSO)) { + if (pp) + doSSO(*pp, protocols, child, log); + else + log.error("no ProtocolProvider, SSO auto-configure unsupported"); + } + else if (XMLHelper::isNodeNamed(child, shibspconstants::SHIB2SPCONFIG_NS, Logout)) { + if (pp) + doLogout(*pp, protocols, child, log); + else + log.error("no ProtocolProvider, Logout auto-configure unsupported"); + } + else if (XMLHelper::isNodeNamed(child, shibspconstants::SHIB2SPCONFIG_NS, NameIDMgmt)) { + if (pp) + doNameIDMgmt(*pp, protocols, child, log); + else + log.error("no ProtocolProvider, NameIDMgmt auto-configure unsupported"); + } + else { + break; // drop into next while loop + } + child = XMLHelper::getNextSiblingElement(child); + } + + // Process other handlers. + bool hardACS=false, hardSessionInit=false, hardArt=false; + while (child) { + if (!child->hasAttributeNS(nullptr, Location)) { + auto_ptr_char hclass(child->getLocalName()); + log.error("%s handler with no Location property cannot be processed", hclass.get()); + child = XMLHelper::getNextSiblingElement(child); + continue; + } + try { + boost::shared_ptr handler; + if (XMLString::equals(child->getLocalName(), _AssertionConsumerService)) { + string bindprop(XMLHelper::getAttrString(child, nullptr, Binding)); + if (bindprop.empty()) { + log.error("AssertionConsumerService element has no Binding attribute, skipping it..."); + child = XMLHelper::getNextSiblingElement(child); + continue; } - catch (exception& ex) { - log.crit("error building AttributeFilter: %s", ex.what()); + handler.reset(conf.AssertionConsumerServiceManager.newPlugin(bindprop.c_str(), pair(child, getId()))); + // Map by binding and protocol (may be > 1 per protocol and binding) + m_acsBindingMap[handler->getXMLString("Binding").second].push_back(handler.get()); + const XMLCh* protfamily = handler->getProtocolFamily(); + if (protfamily) + m_acsProtocolMap[protfamily].push_back(handler.get()); + m_acsIndexMap[handler->getUnsignedInt("index").second] = handler.get(); + + if (!hardACS) { + pair defprop = handler->getBool("isDefault"); + if (defprop.first) { + if (defprop.second) { + hardACS = true; + m_acsDefault = handler.get(); + } + } + else if (!m_acsDefault) + m_acsDefault = handler.get(); } } - - child = XMLHelper::getFirstChildElement(e,_AttributeResolver); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building AttributeResolver of type %s...",type.get()); - try { - m_attrResolver = conf.AttributeResolverManager.newPlugin(type.get(),child); + else if (XMLString::equals(child->getLocalName(), _SessionInitiator)) { + string t(XMLHelper::getAttrString(child, nullptr, _type)); + if (t.empty()) { + log.error("SessionInitiator element has no type attribute, skipping it..."); + child = XMLHelper::getNextSiblingElement(child); + continue; } - catch (exception& ex) { - log.crit("error building AttributeResolver: %s", ex.what()); + boost::shared_ptr sihandler( + conf.SessionInitiatorManager.newPlugin(t.c_str(), pair(child, getId())) + ); + handler = sihandler; + pair si_id = handler->getString("id"); + if (si_id.first && si_id.second) + m_sessionInitMap[si_id.second] = sihandler.get(); + if (!hardSessionInit) { + pair defprop = handler->getBool("isDefault"); + if (defprop.first) { + if (defprop.second) { + hardSessionInit = true; + m_sessionInitDefault = sihandler.get(); + } + } + else if (!m_sessionInitDefault) { + m_sessionInitDefault = sihandler.get(); + } } } - - if (m_unsetHeaders.empty()) { - vector unsetHeaders; - if (m_attrExtractor) { - Locker extlock(m_attrExtractor); - m_attrExtractor->getAttributeIds(unsetHeaders); - } - if (m_attrResolver) { - Locker reslock(m_attrResolver); - m_attrResolver->getAttributeIds(unsetHeaders); + else if (XMLString::equals(child->getLocalName(), _LogoutInitiator)) { + string t(XMLHelper::getAttrString(child, nullptr, _type)); + if (t.empty()) { + log.error("LogoutInitiator element has no type attribute, skipping it..."); + child = XMLHelper::getNextSiblingElement(child); + continue; } - if (unsetHeaders.empty()) { - if (m_base) - m_unsetHeaders.insert(m_unsetHeaders.end(), m_base->m_unsetHeaders.begin(), m_base->m_unsetHeaders.end()); - else - m_unsetHeaders.push_back(pair("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID")); + handler.reset(conf.LogoutInitiatorManager.newPlugin(t.c_str(), pair(child, getId()))); + } + else if (XMLString::equals(child->getLocalName(), _ArtifactResolutionService)) { + string bindprop(XMLHelper::getAttrString(child, nullptr, Binding)); + if (bindprop.empty()) { + log.error("ArtifactResolutionService element has no Binding attribute, skipping it..."); + child = XMLHelper::getNextSiblingElement(child); + continue; } - else { - for (vector::const_iterator hdr = unsetHeaders.begin(); hdr!=unsetHeaders.end(); ++hdr) { - string transformed("HTTP_"); - const char* pch = hdr->c_str(); - while (*pch) { - transformed += (isalnum(*pch) ? toupper(*pch) : '_'); - pch++; + handler.reset(conf.ArtifactResolutionServiceManager.newPlugin(bindprop.c_str(), pair(child, getId()))); + + if (!hardArt) { + pair defprop = handler->getBool("isDefault"); + if (defprop.first) { + if (defprop.second) { + hardArt = true; + m_artifactResolutionDefault = handler.get(); } - m_unsetHeaders.push_back(pair(*hdr,transformed)); } - m_unsetHeaders.push_back(pair("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID")); + else if (!m_artifactResolutionDefault) + m_artifactResolutionDefault = handler.get(); } } - } - - if (conf.isEnabled(SPConfig::Credentials)) { - child = XMLHelper::getFirstChildElement(e,_CredentialResolver); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building CredentialResolver of type %s...",type.get()); - try { - m_credResolver = xmlConf.CredentialResolverManager.newPlugin(type.get(),child); + else if (XMLString::equals(child->getLocalName(), _SingleLogoutService)) { + string bindprop(XMLHelper::getAttrString(child, nullptr, Binding)); + if (bindprop.empty()) { + log.error("SingleLogoutService element has no Binding attribute, skipping it..."); + child = XMLHelper::getNextSiblingElement(child); + continue; } - catch (exception& ex) { - log.crit("error building CredentialResolver: %s", ex.what()); + handler.reset(conf.SingleLogoutServiceManager.newPlugin(bindprop.c_str(), pair(child, getId()))); + } + else if (XMLString::equals(child->getLocalName(), _ManageNameIDService)) { + string bindprop(XMLHelper::getAttrString(child, nullptr, Binding)); + if (bindprop.empty()) { + log.error("ManageNameIDService element has no Binding attribute, skipping it..."); + child = XMLHelper::getNextSiblingElement(child); + continue; + } + handler.reset(conf.ManageNameIDServiceManager.newPlugin(bindprop.c_str(), pair(child, getId()))); + } + else { + string t(XMLHelper::getAttrString(child, nullptr, _type)); + if (t.empty()) { + log.error("Handler element has no type attribute, skipping it..."); + child = XMLHelper::getNextSiblingElement(child); + continue; } + handler.reset(conf.HandlerManager.newPlugin(t.c_str(), pair(child, getId()))); } + + m_handlers.push_back(handler); + + // Insert into location map. + location = handler->getString("Location"); + if (location.first && *location.second == '/') + m_handlerMap[location.second] = handler.get(); + else if (location.first) + m_handlerMap[string("/") + location.second] = handler.get(); + } + catch (std::exception& ex) { + log.error("caught exception processing handler element: %s", ex.what()); } - // Finally, load relying parties. - child = XMLHelper::getFirstChildElement(e,DefaultRelyingParty); - if (child) { - m_partyDefault=new DOMPropertySet(); - m_partyDefault->load(child,log,this); - child = XMLHelper::getFirstChildElement(child,RelyingParty); - while (child) { - auto_ptr rp(new DOMPropertySet()); - rp->load(child,log,this); - rp->setParent(m_partyDefault); - m_partyMap[child->getAttributeNS(NULL,saml2::Attribute::NAME_ATTRIB_NAME)]=rp.release(); - child = XMLHelper::getNextSiblingElement(child,RelyingParty); + child = XMLHelper::getNextSiblingElement(child); + } +} + +void XMLApplication::doSSO(const ProtocolProvider& pp, set& protocols, DOMElement* e, Category& log) +{ + if (!e->hasChildNodes()) + return; + DOMNamedNodeMap* ssoprops = e->getAttributes(); + XMLSize_t ssopropslen = ssoprops ? ssoprops->getLength() : 0; + + SPConfig& conf = SPConfig::getConfig(); + + int index = 0; // track ACS indexes globally across all protocols + + // Tokenize the protocol list inside the element. + XMLStringTokenizer prottokens(e->getTextContent()); + while (prottokens.hasMoreTokens()) { + auto_ptr_char prot(prottokens.nextToken()); + + // Look for initiator. + const PropertySet* initiator = pp.getInitiator(prot.get(), "SSO"); + if (initiator) { + log.info("auto-configuring SSO initiation for protocol (%s)", prot.get()); + pair inittype = initiator->getXMLString("id"); + if (inittype.first) { + // Append a session initiator element of the designated type to the root element. + DOMElement* sidom = e->getOwnerDocument()->createElementNS(shibspconstants::SHIB2SPCONFIG_NS, _SessionInitiator); + sidom->setAttributeNS(nullptr, _type, inittype.second); + e->appendChild(sidom); + log.info("adding SessionInitiator of type (%s) to chain (/Login)", initiator->getString("id").second); + + doArtifactResolution(pp, prot.get(), e, log); + protocols.insert(prot.get()); + } + else { + log.error("missing id property on Initiator element, check config for protocol (%s)", prot.get()); } } -#endif - // In process only, we need a shared lock around accessing the header clearing list. - if (!conf.isEnabled(SPConfig::OutOfProcess)) { - m_unsetLock = RWLock::create(); - } - else if (!conf.isEnabled(SPConfig::InProcess)) { - ListenerService* listener = sp->getListenerService(false); - if (listener) { - string addr=string(getId()) + "::getHeaders::Application"; - listener->regListener(addr.c_str(),this); + // Look for incoming bindings. + const vector& bindings = pp.getBindings(prot.get(), "SSO"); + if (!bindings.empty()) { + log.info("auto-configuring SSO endpoints for protocol (%s)", prot.get()); + pair idprop,pathprop; + for (vector::const_iterator b = bindings.begin(); b != bindings.end(); ++b, ++index) { + idprop = (*b)->getXMLString("id"); + pathprop = (*b)->getXMLString("path"); + if (idprop.first && pathprop.first) { + DOMElement* acsdom = e->getOwnerDocument()->createElementNS(samlconstants::SAML20MD_NS, _AssertionConsumerService); + + // Copy in any attributes from the element so they can be accessed as properties in the ACS handler. + for (XMLSize_t p = 0; p < ssopropslen; ++p) { + DOMNode* ssoprop = ssoprops->item(p); + if (ssoprop->getNodeType() == DOMNode::ATTRIBUTE_NODE) { + acsdom->setAttributeNS( + ((DOMAttr*)ssoprop)->getNamespaceURI(), + ((DOMAttr*)ssoprop)->getLocalName(), + ((DOMAttr*)ssoprop)->getValue() + ); + } + } + + // Set necessary properties based on context. + acsdom->setAttributeNS(nullptr, Binding, idprop.second); + acsdom->setAttributeNS(nullptr, Location, pathprop.second); + xstring indexbuf(1, chDigit_1 + (index % 10)); + if (index / 10) + indexbuf = (XMLCh)(chDigit_1 + (index / 10)) + indexbuf; + acsdom->setAttributeNS(nullptr, _index, indexbuf.c_str()); + + log.info("adding AssertionConsumerService for Binding (%s) at (%s)", (*b)->getString("id").second, (*b)->getString("path").second); + boost::shared_ptr handler( + conf.AssertionConsumerServiceManager.newPlugin( + (*b)->getString("id").second, pair(acsdom, getId()) + ) + ); + m_handlers.push_back(handler); + + // Setup maps and defaults. + m_acsBindingMap[handler->getXMLString("Binding").second].push_back(handler.get()); + const XMLCh* protfamily = handler->getProtocolFamily(); + if (protfamily) + m_acsProtocolMap[protfamily].push_back(handler.get()); + m_acsIndexMap[handler->getUnsignedInt("index").second] = handler.get(); + if (!m_acsDefault) + m_acsDefault = handler.get(); + + // Insert into location map. + pair location = handler->getString("Location"); + if (location.first && *location.second == '/') + m_handlerMap[location.second] = handler.get(); + else if (location.first) + m_handlerMap[string("/") + location.second] = handler.get(); + } + else { + log.error("missing id or path property on Binding element, check config for protocol (%s)", prot.get()); + } } - else - log.info("no ListenerService available, Application remoting disabled"); + } + + if (!initiator && bindings.empty()) { + log.error("no SSO Initiator or Binding config for protocol (%s)", prot.get()); } } - catch (exception&) { - cleanup(); - throw; - } -#ifndef _DEBUG - catch (...) { - cleanup(); - throw; - } -#endif -} -void XMLApplication::cleanup() -{ - ListenerService* listener=getServiceProvider().getListenerService(false); - if (listener && SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess) && !SPConfig::getConfig().isEnabled(SPConfig::InProcess)) { - string addr=string(getId()) + "::getHeaders::Application"; - listener->unregListener(addr.c_str(),this); + // Handle discovery. + static const XMLCh discoveryProtocol[] = UNICODE_LITERAL_17(d,i,s,c,o,v,e,r,y,P,r,o,t,o,c,o,l); + static const XMLCh discoveryURL[] = UNICODE_LITERAL_12(d,i,s,c,o,v,e,r,y,U,R,L); + static const XMLCh _URL[] = UNICODE_LITERAL_3(U,R,L); + const XMLCh* discop = e->getAttributeNS(nullptr, discoveryProtocol); + if (discop && *discop) { + const XMLCh* discou = e->getAttributeNS(nullptr, discoveryURL); + if (discou && *discou) { + // Append a session initiator element of the designated type to the root element. + DOMElement* sidom = e->getOwnerDocument()->createElementNS(shibspconstants::SHIB2SPCONFIG_NS, _SessionInitiator); + sidom->setAttributeNS(nullptr, _type, discop); + sidom->setAttributeNS(nullptr, _URL, discou); + e->appendChild(sidom); + if (log.isInfoEnabled()) { + auto_ptr_char dp(discop); + log.info("adding SessionInitiator of type (%s) to chain (/Login)", dp.get()); + } + } + else { + log.error("SSO discoveryProtocol specified without discoveryURL"); + } } - delete m_unsetLock; - m_unsetLock = NULL; - for_each(m_handlers.begin(),m_handlers.end(),xmltooling::cleanup()); - m_handlers.clear(); -#ifndef SHIBSP_LITE - delete m_partyDefault; - m_partyDefault = NULL; -#ifdef HAVE_GOOD_STL - for_each(m_partyMap.begin(),m_partyMap.end(),cleanup_pair()); -#else - for_each(m_partyMap.begin(),m_partyMap.end(),cleanup_pair()); -#endif - m_partyMap.clear(); - delete m_credResolver; - m_credResolver = NULL; - delete m_attrResolver; - m_attrResolver = NULL; - delete m_attrFilter; - m_attrFilter = NULL; - delete m_attrExtractor; - m_attrExtractor = NULL; - delete m_trust; - m_trust = NULL; - delete m_metadata; - m_metadata = NULL; -#endif + + // Attach default Location to SSO element. + static const XMLCh _loc[] = { chForwardSlash, chLatin_L, chLatin_o, chLatin_g, chLatin_i, chLatin_n, chNull }; + e->setAttributeNS(nullptr, Location, _loc); + + // Instantiate Chaining initiator around the SSO element. + boost::shared_ptr chain( + conf.SessionInitiatorManager.newPlugin(CHAINING_SESSION_INITIATOR, pair(e, getId())) + ); + m_handlers.push_back(chain); + m_sessionInitDefault = chain.get(); + m_handlerMap["/Login"] = chain.get(); } -short XMLApplication::acceptNode(const DOMNode* node) const +void XMLApplication::doLogout(const ProtocolProvider& pp, set& protocols, DOMElement* e, Category& log) { - const XMLCh* name=node->getLocalName(); - if (XMLString::equals(name,_Application) || - XMLString::equals(name,_Audience) || - XMLString::equals(name,Notify) || - XMLString::equals(name,_AssertionConsumerService) || - XMLString::equals(name,_ArtifactResolutionService) || + if (!e->hasChildNodes()) + return; + DOMNamedNodeMap* sloprops = e->getAttributes(); + XMLSize_t slopropslen = sloprops ? sloprops->getLength() : 0; + + SPConfig& conf = SPConfig::getConfig(); + + // Tokenize the protocol list inside the element. + XMLStringTokenizer prottokens(e->getTextContent()); + while (prottokens.hasMoreTokens()) { + auto_ptr_char prot(prottokens.nextToken()); + + // Look for initiator. + const PropertySet* initiator = pp.getInitiator(prot.get(), "Logout"); + if (initiator) { + log.info("auto-configuring Logout initiation for protocol (%s)", prot.get()); + pair inittype = initiator->getXMLString("id"); + if (inittype.first) { + // Append a logout initiator element of the designated type to the root element. + DOMElement* lidom = e->getOwnerDocument()->createElementNS(shibspconstants::SHIB2SPCONFIG_NS, _LogoutInitiator); + lidom->setAttributeNS(nullptr, _type, inittype.second); + e->appendChild(lidom); + log.info("adding LogoutInitiator of type (%s) to chain (/Logout)", initiator->getString("id").second); + + if (protocols.count(prot.get()) == 0) { + doArtifactResolution(pp, prot.get(), e, log); + protocols.insert(prot.get()); + } + } + else { + log.error("missing id property on Initiator element, check config for protocol (%s)", prot.get()); + } + } + + // Look for incoming bindings. + const vector& bindings = pp.getBindings(prot.get(), "Logout"); + if (!bindings.empty()) { + log.info("auto-configuring Logout endpoints for protocol (%s)", prot.get()); + pair idprop,pathprop; + for (vector::const_iterator b = bindings.begin(); b != bindings.end(); ++b) { + idprop = (*b)->getXMLString("id"); + pathprop = (*b)->getXMLString("path"); + if (idprop.first && pathprop.first) { + DOMElement* slodom = e->getOwnerDocument()->createElementNS(samlconstants::SAML20MD_NS, _SingleLogoutService); + + // Copy in any attributes from the element so they can be accessed as properties in the SLO handler. + for (XMLSize_t p = 0; p < slopropslen; ++p) { + DOMNode* sloprop = sloprops->item(p); + if (sloprop->getNodeType() == DOMNode::ATTRIBUTE_NODE) { + slodom->setAttributeNS( + ((DOMAttr*)sloprop)->getNamespaceURI(), + ((DOMAttr*)sloprop)->getLocalName(), + ((DOMAttr*)sloprop)->getValue() + ); + } + } + + // Set necessary properties based on context. + slodom->setAttributeNS(nullptr, Binding, idprop.second); + slodom->setAttributeNS(nullptr, Location, pathprop.second); + if (e->hasAttributeNS(nullptr, _policyId)) + slodom->setAttributeNS(shibspconstants::SHIB2SPCONFIG_NS, _policyId, e->getAttributeNS(nullptr, _policyId)); + + log.info("adding SingleLogoutService for Binding (%s) at (%s)", (*b)->getString("id").second, (*b)->getString("path").second); + boost::shared_ptr handler( + conf.SingleLogoutServiceManager.newPlugin((*b)->getString("id").second, pair(slodom, getId())) + ); + m_handlers.push_back(handler); + + // Insert into location map. + pair location = handler->getString("Location"); + if (location.first && *location.second == '/') + m_handlerMap[location.second] = handler.get(); + else if (location.first) + m_handlerMap[string("/") + location.second] = handler.get(); + } + else { + log.error("missing id or path property on Binding element, check config for protocol (%s)", prot.get()); + } + } + + if (protocols.count(prot.get()) == 0) { + doArtifactResolution(pp, prot.get(), e, log); + protocols.insert(prot.get()); + } + } + + if (!initiator && bindings.empty()) { + log.error("no Logout Initiator or Binding config for protocol (%s)", prot.get()); + } + } + + // Attach default Location to Logout element. + static const XMLCh _loc[] = { chForwardSlash, chLatin_L, chLatin_o, chLatin_g, chLatin_o, chLatin_u, chLatin_t, chNull }; + e->setAttributeNS(nullptr, Location, _loc); + + // Instantiate Chaining initiator around the SSO element. + boost::shared_ptr chain( + conf.LogoutInitiatorManager.newPlugin(CHAINING_LOGOUT_INITIATOR, pair(e, getId())) + ); + m_handlers.push_back(chain); + m_handlerMap["/Logout"] = chain.get(); +} + +void XMLApplication::doNameIDMgmt(const ProtocolProvider& pp, set& protocols, DOMElement* e, Category& log) +{ + if (!e->hasChildNodes()) + return; + DOMNamedNodeMap* nimprops = e->getAttributes(); + XMLSize_t nimpropslen = nimprops ? nimprops->getLength() : 0; + + SPConfig& conf = SPConfig::getConfig(); + + // Tokenize the protocol list inside the element. + XMLStringTokenizer prottokens(e->getTextContent()); + while (prottokens.hasMoreTokens()) { + auto_ptr_char prot(prottokens.nextToken()); + + // Look for incoming bindings. + const vector& bindings = pp.getBindings(prot.get(), "NameIDMgmt"); + if (!bindings.empty()) { + log.info("auto-configuring NameIDMgmt endpoints for protocol (%s)", prot.get()); + pair idprop,pathprop; + for (vector::const_iterator b = bindings.begin(); b != bindings.end(); ++b) { + idprop = (*b)->getXMLString("id"); + pathprop = (*b)->getXMLString("path"); + if (idprop.first && pathprop.first) { + DOMElement* nimdom = e->getOwnerDocument()->createElementNS(samlconstants::SAML20MD_NS, _ManageNameIDService); + + // Copy in any attributes from the element so they can be accessed as properties in the NIM handler. + for (XMLSize_t p = 0; p < nimpropslen; ++p) { + DOMNode* nimprop = nimprops->item(p); + if (nimprop->getNodeType() == DOMNode::ATTRIBUTE_NODE) { + nimdom->setAttributeNS( + ((DOMAttr*)nimprop)->getNamespaceURI(), + ((DOMAttr*)nimprop)->getLocalName(), + ((DOMAttr*)nimprop)->getValue() + ); + } + } + + // Set necessary properties based on context. + nimdom->setAttributeNS(nullptr, Binding, idprop.second); + nimdom->setAttributeNS(nullptr, Location, pathprop.second); + if (e->hasAttributeNS(nullptr, _policyId)) + nimdom->setAttributeNS(shibspconstants::SHIB2SPCONFIG_NS, _policyId, e->getAttributeNS(nullptr, _policyId)); + + log.info("adding ManageNameIDService for Binding (%s) at (%s)", (*b)->getString("id").second, (*b)->getString("path").second); + boost::shared_ptr handler( + conf.ManageNameIDServiceManager.newPlugin((*b)->getString("id").second, pair(nimdom, getId())) + ); + m_handlers.push_back(handler); + + // Insert into location map. + pair location = handler->getString("Location"); + if (location.first && *location.second == '/') + m_handlerMap[location.second] = handler.get(); + else if (location.first) + m_handlerMap[string("/") + location.second] = handler.get(); + } + else { + log.error("missing id or path property on Binding element, check config for protocol (%s)", prot.get()); + } + } + + if (protocols.count(prot.get()) == 0) { + doArtifactResolution(pp, prot.get(), e, log); + protocols.insert(prot.get()); + } + } + else { + log.error("no NameIDMgmt Binding config for protocol (%s)", prot.get()); + } + } +} + +void XMLApplication::doArtifactResolution(const ProtocolProvider& pp, const char* protocol, DOMElement* e, Category& log) +{ + SPConfig& conf = SPConfig::getConfig(); + + int index = 0; // track indexes globally across all protocols + + // Look for incoming bindings. + const vector& bindings = pp.getBindings(protocol, "ArtifactResolution"); + if (!bindings.empty()) { + log.info("auto-configuring ArtifactResolution endpoints for protocol (%s)", protocol); + pair idprop,pathprop; + for (vector::const_iterator b = bindings.begin(); b != bindings.end(); ++b, ++index) { + idprop = (*b)->getXMLString("id"); + pathprop = (*b)->getXMLString("path"); + if (idprop.first && pathprop.first) { + DOMElement* artdom = e->getOwnerDocument()->createElementNS(samlconstants::SAML20MD_NS, _ArtifactResolutionService); + artdom->setAttributeNS(nullptr, Binding, idprop.second); + artdom->setAttributeNS(nullptr, Location, pathprop.second); + xstring indexbuf(1, chDigit_1 + (index % 10)); + if (index / 10) + indexbuf = (XMLCh)(chDigit_1 + (index / 10)) + indexbuf; + artdom->setAttributeNS(nullptr, _index, indexbuf.c_str()); + + log.info("adding ArtifactResolutionService for Binding (%s) at (%s)", (*b)->getString("id").second, (*b)->getString("path").second); + boost::shared_ptr handler( + conf.ArtifactResolutionServiceManager.newPlugin((*b)->getString("id").second, pair(artdom, getId())) + ); + m_handlers.push_back(handler); + + if (!m_artifactResolutionDefault) + m_artifactResolutionDefault = handler.get(); + + // Insert into location map. + pair location = handler->getString("Location"); + if (location.first && *location.second == '/') + m_handlerMap[location.second] = handler.get(); + else if (location.first) + m_handlerMap[string("/") + location.second] = handler.get(); + } + else { + log.error("missing id or path property on Binding element, check config for protocol (%s)", protocol); + } + } + } +} + +#ifndef SHIBSP_LITE +void XMLApplication::doAttributePlugins(DOMElement* e, Category& log) +{ + SPConfig& conf = SPConfig::getConfig(); + + m_attrExtractor.reset( + doChainedPlugins(conf.AttributeExtractorManager, "AttributeExtractor", CHAINING_ATTRIBUTE_EXTRACTOR, _AttributeExtractor, e, log) + ); + + m_attrFilter.reset( + doChainedPlugins(conf.AttributeFilterManager, "AttributeFilter", CHAINING_ATTRIBUTE_FILTER, _AttributeFilter, e, log, DUMMY_ATTRIBUTE_FILTER) + ); + + m_attrResolver.reset( + doChainedPlugins(conf.AttributeResolverManager, "AttributeResolver", CHAINING_ATTRIBUTE_RESOLVER, _AttributeResolver, e, log) + ); + + if (m_unsetHeaders.empty()) { + vector unsetHeaders; + if (m_attrExtractor) { + Locker extlock(m_attrExtractor.get()); + m_attrExtractor->getAttributeIds(unsetHeaders); + } + else if (m_base && m_base->m_attrExtractor) { + Locker extlock(m_base->m_attrExtractor.get()); + m_base->m_attrExtractor->getAttributeIds(unsetHeaders); + } + if (m_attrResolver) { + Locker reslock(m_attrResolver.get()); + m_attrResolver->getAttributeIds(unsetHeaders); + } + else if (m_base && m_base->m_attrResolver) { + Locker extlock(m_base->m_attrResolver.get()); + m_base->m_attrResolver->getAttributeIds(unsetHeaders); + } + if (!unsetHeaders.empty()) { + string transformedprefix(m_attributePrefix.second); + const char* pch; + pair prefix = getString("metadataAttributePrefix"); + if (prefix.first) { + pch = prefix.second; + while (*pch) { + transformedprefix += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; + } + } + for (vector::const_iterator hdr = unsetHeaders.begin(); hdr!=unsetHeaders.end(); ++hdr) { + string transformed; + pch = hdr->c_str(); + while (*pch) { + transformed += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; + } + m_unsetHeaders.push_back(make_pair(m_attributePrefix.first + *hdr, m_attributePrefix.second + transformed)); + if (prefix.first) + m_unsetHeaders.push_back(make_pair(m_attributePrefix.first + prefix.second + *hdr, transformedprefix + transformed)); + } + } + m_unsetHeaders.push_back(make_pair(m_attributePrefix.first + "Shib-Application-ID", m_attributePrefix.second + "SHIB_APPLICATION_ID")); + } +} +#endif + +#ifdef SHIBSP_XERCESC_SHORT_ACCEPTNODE +short +#else +DOMNodeFilter::FilterAction +#endif +XMLApplication::acceptNode(const DOMNode* node) const +{ + const XMLCh* name=node->getLocalName(); + if (XMLString::equals(name,ApplicationOverride) || + XMLString::equals(name,_Audience) || + XMLString::equals(name,Notify) || + XMLString::equals(name,_Handler) || + XMLString::equals(name,_AssertionConsumerService) || + XMLString::equals(name,_ArtifactResolutionService) || + XMLString::equals(name,Logout) || XMLString::equals(name,_LogoutInitiator) || XMLString::equals(name,_ManageNameIDService) || + XMLString::equals(name,NameIDMgmt) || XMLString::equals(name,_SessionInitiator) || XMLString::equals(name,_SingleLogoutService) || - XMLString::equals(name,DefaultRelyingParty) || + XMLString::equals(name,SSO) || XMLString::equals(name,RelyingParty) || XMLString::equals(name,_MetadataProvider) || XMLString::equals(name,_TrustEngine) || @@ -939,38 +1541,40 @@ short XMLApplication::acceptNode(const DOMNode* node) const const PropertySet* XMLApplication::getRelyingParty(const EntityDescriptor* provider) const { - if (!m_partyDefault && m_base) - return m_base->getRelyingParty(provider); - else if (!provider) - return m_partyDefault; - -#ifdef HAVE_GOOD_STL - map::const_iterator i=m_partyMap.find(provider->getEntityID()); - if (i!=m_partyMap.end()) - return i->second; - const EntitiesDescriptor* group=dynamic_cast(provider->getParent()); + if (!provider) + return this; + + // Check for exact match on name. + map< xstring,boost::shared_ptr >::const_iterator i = m_partyMap.find(provider->getEntityID()); + if (i != m_partyMap.end()) + return i->second.get(); + + // Check for extensible matching. + vector < pair< boost::shared_ptr,boost::shared_ptr > >::const_iterator j; + for (j = m_partyVec.begin(); j != m_partyVec.end(); ++j) { + if (j->first->matches(*provider)) + return j->second.get(); + } + + // Check for group match. + const EntitiesDescriptor* group = dynamic_cast(provider->getParent()); while (group) { if (group->getName()) { - i=m_partyMap.find(group->getName()); - if (i!=m_partyMap.end()) - return i->second; - } - group=dynamic_cast(group->getParent()); - } -#else - map::const_iterator i=m_partyMap.begin(); - for (; i!=m_partyMap.end(); i++) { - if (XMLString::equals(i->first,provider->getEntityID())) - return i->second; - const EntitiesDescriptor* group=dynamic_cast(provider->getParent()); - while (group) { - if (XMLString::equals(i->first,group->getName())) - return i->second; - group=dynamic_cast(group->getParent()); + i = m_partyMap.find(group->getName()); + if (i != m_partyMap.end()) + return i->second.get(); } + group = dynamic_cast(group->getParent()); } -#endif - return m_partyDefault; + return this; +} + +const PropertySet* XMLApplication::getRelyingParty(const XMLCh* entityID) const +{ + if (!entityID) + return this; + map< xstring,boost::shared_ptr >::const_iterator i = m_partyMap.find(entityID); + return (i != m_partyMap.end()) ? i->second.get() : this; } #endif @@ -990,8 +1594,8 @@ string XMLApplication::getNotificationURL(const char* resource, bool front, unsi #endif throw ConfigurationException("Request URL was not absolute."); - const char* handler=locs[index].c_str(); - + const char* handler = locs[index].c_str(); + // Should never happen... if (!handler || (*handler!='/' && strncmp(handler,"http:",5) && strncmp(handler,"https:",6))) throw ConfigurationException( @@ -1010,7 +1614,7 @@ string XMLApplication::getNotificationURL(const char* resource, bool front, unsi // 2 handler resource handler // 3 resource resource handler - const char* path = NULL; + const char* path = nullptr; // Decide whether to use the handler or the resource for the "protocol" const char* prot; @@ -1047,41 +1651,93 @@ string XMLApplication::getNotificationURL(const char* resource, bool front, unsi return notifyURL; } +void XMLApplication::clearHeader(SPRequest& request, const char* rawname, const char* cginame) const +{ + if (!m_attributePrefix.first.empty()) { + string temp = m_attributePrefix.first + rawname; + string temp2 = m_attributePrefix.second + (cginame + 5); + request.clearHeader(temp.c_str(), temp2.c_str()); + } + else if (m_base) { + m_base->clearHeader(request, rawname, cginame); + } + else { + request.clearHeader(rawname, cginame); + } +} + +void XMLApplication::setHeader(SPRequest& request, const char* name, const char* value) const +{ + if (!m_attributePrefix.first.empty()) { + string temp = m_attributePrefix.first + name; + request.setHeader(temp.c_str(), value); + } + else if (m_base) { + m_base->setHeader(request, name, value); + } + else { + request.setHeader(name, value); + } +} + +string XMLApplication::getSecureHeader(const SPRequest& request, const char* name) const +{ + if (!m_attributePrefix.first.empty()) { + string temp = m_attributePrefix.first + name; + return request.getSecureHeader(temp.c_str()); + } + else if (m_base) { + return m_base->getSecureHeader(request,name); + } + else { + return request.getSecureHeader(name); + } +} + const SessionInitiator* XMLApplication::getDefaultSessionInitiator() const { if (m_sessionInitDefault) return m_sessionInitDefault; - return m_base ? m_base->getDefaultSessionInitiator() : NULL; + return m_base ? m_base->getDefaultSessionInitiator() : nullptr; } const SessionInitiator* XMLApplication::getSessionInitiatorById(const char* id) const { - map::const_iterator i=m_sessionInitMap.find(id); - if (i!=m_sessionInitMap.end()) return i->second; - return m_base ? m_base->getSessionInitiatorById(id) : NULL; + map::const_iterator i = m_sessionInitMap.find(id); + if (i != m_sessionInitMap.end()) return i->second; + return m_base ? m_base->getSessionInitiatorById(id) : nullptr; } const Handler* XMLApplication::getDefaultAssertionConsumerService() const { if (m_acsDefault) return m_acsDefault; - return m_base ? m_base->getDefaultAssertionConsumerService() : NULL; + return m_base ? m_base->getDefaultAssertionConsumerService() : nullptr; } const Handler* XMLApplication::getAssertionConsumerServiceByIndex(unsigned short index) const { - map::const_iterator i=m_acsIndexMap.find(index); - if (i!=m_acsIndexMap.end()) return i->second; - return m_base ? m_base->getAssertionConsumerServiceByIndex(index) : NULL; + map::const_iterator i = m_acsIndexMap.find(index); + if (i != m_acsIndexMap.end()) return i->second; + return m_base ? m_base->getAssertionConsumerServiceByIndex(index) : nullptr; +} + +const Handler* XMLApplication::getAssertionConsumerServiceByProtocol(const XMLCh* protocol, const char* binding) const +{ + ACSProtocolMap::const_iterator i = m_acsProtocolMap.find(protocol); + if (i != m_acsProtocolMap.end() && !i->second.empty()) { + if (!binding || !*binding) + return i->second.front(); + for (ACSProtocolMap::value_type::second_type::const_iterator j = i->second.begin(); j != i->second.end(); ++j) { + if (!strcmp(binding, (*j)->getString("Binding").second)) + return *j; + } + } + return m_base ? m_base->getAssertionConsumerServiceByProtocol(protocol, binding) : nullptr; } const vector& XMLApplication::getAssertionConsumerServicesByBinding(const XMLCh* binding) const { -#ifdef HAVE_GOOD_STL - ACSBindingMap::const_iterator i=m_acsBindingMap.find(binding); -#else - auto_ptr_char temp(binding); - ACSBindingMap::const_iterator i=m_acsBindingMap.find(temp.get()); -#endif - if (i!=m_acsBindingMap.end()) + ACSBindingMap::const_iterator i = m_acsBindingMap.find(binding); + if (i != m_acsBindingMap.end()) return i->second; return m_base ? m_base->getAssertionConsumerServicesByBinding(binding) : g_noHandlers; } @@ -1089,68 +1745,86 @@ const vector& XMLApplication::getAssertionConsumerServicesByBind const Handler* XMLApplication::getHandler(const char* path) const { string wrap(path); - map::const_iterator i=m_handlerMap.find(wrap.substr(0,wrap.find('?'))); - if (i!=m_handlerMap.end()) + wrap = wrap.substr(0, wrap.find(';')); + map::const_iterator i = m_handlerMap.find(wrap.substr(0, wrap.find('?'))); + if (i != m_handlerMap.end()) return i->second; - return m_base ? m_base->getHandler(path) : NULL; + return m_base ? m_base->getHandler(path) : nullptr; } -void XMLApplication::clearAttributeHeaders(SPRequest& request) const +void XMLApplication::getHandlers(vector& handlers) const { - if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) { - for (vector< pair >::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i) - request.clearHeader(i->first.c_str(), i->second.c_str()); - return; + static void (vector::* pb)(const Handler* const&) = &vector::push_back; + for_each(m_handlers.begin(), m_handlers.end(), boost::bind(pb, boost::ref(handlers), boost::bind(&boost::shared_ptr::get, _1))); + if (m_base) { + for (map::const_iterator h = m_base->m_handlerMap.begin(); h != m_base->m_handlerMap.end(); ++h) { + if (m_handlerMap.count(h->first) == 0) + handlers.push_back(h->second); + } } +} - m_unsetLock->rdlock(); - if (m_unsetHeaders.empty()) { - // No headers yet, so we have to request them from the remote half. - m_unsetLock->unlock(); - m_unsetLock->wrlock(); - if (m_unsetHeaders.empty()) { - SharedLock wrlock(m_unsetLock, false); - string addr=string(getId()) + "::getHeaders::Application"; - DDF out,in = DDF(addr.c_str()); - DDFJanitor jin(in),jout(out); - out = getServiceProvider().getListenerService()->send(in); - if (out.islist()) { - DDF header = out.first(); - while (header.isstring()) { - m_unsetHeaders.push_back(pair(header.name(),header.string())); - header = out.next(); - } +void XMLApplication::limitRedirect(const GenericRequest& request, const char* url) const +{ + if (!url || *url == '/') + return; + if (m_redirectLimit == REDIRECT_LIMIT_INHERIT) + return m_base->limitRedirect(request, url); + if (m_redirectLimit != REDIRECT_LIMIT_NONE) { + vector whitelist; + if (m_redirectLimit == REDIRECT_LIMIT_EXACT || m_redirectLimit == REDIRECT_LIMIT_EXACT_WHITELIST) { + // Scheme and hostname have to match. + if (request.isDefaultPort()) { + whitelist.push_back(string(request.getScheme()) + "://" + request.getHostname() + '/'); } + whitelist.push_back(string(request.getScheme()) + "://" + request.getHostname() + ':' + lexical_cast(request.getPort()) + '/'); } - else { - m_unsetLock->unlock(); + else if (m_redirectLimit == REDIRECT_LIMIT_HOST || m_redirectLimit == REDIRECT_LIMIT_HOST_WHITELIST) { + // Allow any scheme or port. + whitelist.push_back(string("https://") + request.getHostname() + '/'); + whitelist.push_back(string("http://") + request.getHostname() + '/'); + whitelist.push_back(string("https://") + request.getHostname() + ':'); + whitelist.push_back(string("http://") + request.getHostname() + ':'); } - m_unsetLock->rdlock(); - } - // Now holding read lock. - SharedLock unsetLock(m_unsetLock, false); - for (vector< pair >::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i) - request.clearHeader(i->first.c_str(), i->second.c_str()); + static bool (*startsWithI)(const char*,const char*) = XMLString::startsWithI; + if (!whitelist.empty() && find_if(whitelist.begin(), whitelist.end(), + boost::bind(startsWithI, url, boost::bind(&string::c_str, _1))) != whitelist.end()) { + return; + } + else if (!m_redirectWhitelist.empty() && find_if(m_redirectWhitelist.begin(), m_redirectWhitelist.end(), + boost::bind(startsWithI, url, boost::bind(&string::c_str, _1))) != m_redirectWhitelist.end()) { + return; + } + Category::getInstance(SHIBSP_LOGCAT ".Application").warn("redirectLimit policy enforced, blocked redirect to (%s)", url); + throw opensaml::SecurityPolicyException("Blocked unacceptable redirect location."); + } } -short XMLConfigImpl::acceptNode(const DOMNode* node) const +#ifdef SHIBSP_XERCESC_SHORT_ACCEPTNODE +short +#else +DOMNodeFilter::FilterAction +#endif +XMLConfigImpl::acceptNode(const DOMNode* node) const { if (!XMLString::equals(node->getNamespaceURI(),shibspconstants::SHIB2SPCONFIG_NS)) return FILTER_ACCEPT; const XMLCh* name=node->getLocalName(); - if (XMLString::equals(name,Applications) || + if (XMLString::equals(name,ApplicationDefaults) || XMLString::equals(name,_ArtifactMap) || XMLString::equals(name,_Extensions) || - XMLString::equals(name,Implementation) || XMLString::equals(name,Listener) || - XMLString::equals(name,MemoryListener) || - XMLString::equals(name,Policy) || + XMLString::equals(name,_ProtocolProvider) || XMLString::equals(name,_RequestMapper) || XMLString::equals(name,_ReplayCache) || + XMLString::equals(name,SecurityPolicies) || + XMLString::equals(name,_SecurityPolicyProvider) || XMLString::equals(name,_SessionCache) || + XMLString::equals(name,Site) || XMLString::equals(name,_StorageService) || XMLString::equals(name,TCPListener) || + XMLString::equals(name,TransportOption) || XMLString::equals(name,UnixListener)) return FILTER_REJECT; @@ -1159,340 +1833,425 @@ short XMLConfigImpl::acceptNode(const DOMNode* node) const void XMLConfigImpl::doExtensions(const DOMElement* e, const char* label, Category& log) { - const DOMElement* exts=XMLHelper::getFirstChildElement(e,_Extensions); + const DOMElement* exts = XMLHelper::getFirstChildElement(e, _Extensions); if (exts) { - exts=XMLHelper::getFirstChildElement(exts,Library); + exts = XMLHelper::getFirstChildElement(exts, Library); while (exts) { - auto_ptr_char path(exts->getAttributeNS(NULL,_path)); + string path(XMLHelper::getAttrString(exts, nullptr, _path)); try { - if (path.get()) { - XMLToolingConfig::getConfig().load_library(path.get(),(void*)exts); - log.debug("loaded %s extension library (%s)", label, path.get()); + if (!path.empty()) { + if (!XMLToolingConfig::getConfig().load_library(path.c_str(), (void*)exts)) + throw ConfigurationException("XMLToolingConfig::load_library failed."); + log.debug("loaded %s extension library (%s)", label, path.c_str()); } } - catch (exception& e) { - const XMLCh* fatal=exts->getAttributeNS(NULL,_fatal); - if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) { - log.fatal("unable to load mandatory %s extension library %s: %s", label, path.get(), e.what()); + catch (std::exception& e) { + if (XMLHelper::getAttrBool(exts, false, _fatal)) { + log.fatal("unable to load mandatory %s extension library %s: %s", label, path.c_str(), e.what()); throw; } else { - log.crit("unable to load optional %s extension library %s: %s", label, path.get(), e.what()); + log.crit("unable to load optional %s extension library %s: %s", label, path.c_str(), e.what()); } } - exts=XMLHelper::getNextSiblingElement(exts,Library); + exts = XMLHelper::getNextSiblingElement(exts, Library); } } } -XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* outer, Category& log) - : m_requestMapper(NULL), m_outer(outer), m_document(NULL) +void XMLConfigImpl::doListener(const DOMElement* e, XMLConfig* conf, Category& log) { -#ifdef _DEBUG - xmltooling::NDC ndc("XMLConfigImpl"); +#ifdef WIN32 + string plugtype(TCP_LISTENER_SERVICE); +#else + string plugtype(UNIX_LISTENER_SERVICE); #endif + DOMElement* child = XMLHelper::getFirstChildElement(e, UnixListener); + if (child) + plugtype = UNIX_LISTENER_SERVICE; + else { + child = XMLHelper::getFirstChildElement(e, TCPListener); + if (child) + plugtype = TCP_LISTENER_SERVICE; + else { + child = XMLHelper::getFirstChildElement(e, Listener); + if (child) { + auto_ptr_char type(child->getAttributeNS(nullptr, _type)); + if (type.get() && *type.get()) + plugtype = type.get(); + } + } + } - try { - SPConfig& conf=SPConfig::getConfig(); + log.info("building ListenerService of type %s...", plugtype.c_str()); + conf->m_listener.reset(SPConfig::getConfig().ListenerServiceManager.newPlugin(plugtype.c_str(), child)); +} + +void XMLConfigImpl::doCaching(const DOMElement* e, XMLConfig* conf, Category& log) +{ + SPConfig& spConf = SPConfig::getConfig(); #ifndef SHIBSP_LITE - SAMLConfig& samlConf=SAMLConfig::getConfig(); + SAMLConfig& samlConf = SAMLConfig::getConfig(); #endif - XMLToolingConfig& xmlConf=XMLToolingConfig::getConfig(); - const DOMElement* SHAR=XMLHelper::getFirstChildElement(e,OutOfProcess); - const DOMElement* SHIRE=XMLHelper::getFirstChildElement(e,InProcess); - - // Initialize log4cpp manually in order to redirect log messages as soon as possible. - if (conf.isEnabled(SPConfig::Logging)) { - const XMLCh* logconf=NULL; - if (conf.isEnabled(SPConfig::OutOfProcess)) - logconf=SHAR->getAttributeNS(NULL,logger); - else if (conf.isEnabled(SPConfig::InProcess)) - logconf=SHIRE->getAttributeNS(NULL,logger); - if (!logconf || !*logconf) - logconf=e->getAttributeNS(NULL,logger); - if (logconf && *logconf) { - auto_ptr_char logpath(logconf); - log.debug("loading new logging configuration from (%s), check log destination for status of configuration",logpath.get()); - XMLToolingConfig::getConfig().log_config(logpath.get()); - } - + + DOMElement* child; #ifndef SHIBSP_LITE - if (first) - m_outer->m_tranLog = new TransactionLog(); -#endif - } - - // First load any property sets. - load(e,log,this); - - const DOMElement* child; - string plugtype; - - // Much of the processing can only occur on the first instantiation. - if (first) { - // Set clock skew. - pair skew=getUnsignedInt("clockSkew"); - if (skew.first) - xmlConf.clock_skew_secs=skew.second; - - // Extensions - doExtensions(e, "global", log); - if (conf.isEnabled(SPConfig::OutOfProcess)) - doExtensions(SHAR, "out of process", log); - - if (conf.isEnabled(SPConfig::InProcess)) - doExtensions(SHIRE, "in process", log); - - // Instantiate the ListenerService and SessionCache objects. - if (conf.isEnabled(SPConfig::Listener)) { - child=XMLHelper::getFirstChildElement(SHAR,UnixListener); - if (child) - plugtype=UNIX_LISTENER_SERVICE; - else { - child=XMLHelper::getFirstChildElement(SHAR,TCPListener); - if (child) - plugtype=TCP_LISTENER_SERVICE; - else { - child=XMLHelper::getFirstChildElement(SHAR,MemoryListener); - if (child) - plugtype=MEMORY_LISTENER_SERVICE; - else { - child=XMLHelper::getFirstChildElement(SHAR,Listener); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - if (type.get()) - plugtype=type.get(); - } - } - } + if (spConf.isEnabled(SPConfig::OutOfProcess)) { + XMLToolingConfig& xmlConf = XMLToolingConfig::getConfig(); + // First build any StorageServices. + child = XMLHelper::getFirstChildElement(e, _StorageService); + while (child) { + string id(XMLHelper::getAttrString(child, nullptr, _id)); + string t(XMLHelper::getAttrString(child, nullptr, _type)); + if (!t.empty()) { + try { + log.info("building StorageService (%s) of type %s...", id.c_str(), t.c_str()); + conf->m_storage[id] = boost::shared_ptr(xmlConf.StorageServiceManager.newPlugin(t.c_str(), child)); } - if (child) { - log.info("building ListenerService of type %s...", plugtype.c_str()); - m_outer->m_listener = conf.ListenerServiceManager.newPlugin(plugtype.c_str(),child); + catch (std::exception& ex) { + log.crit("failed to instantiate StorageService (%s): %s", id.c_str(), ex.what()); } - else { - log.fatal("can't build ListenerService, missing conf:Listener element?"); - throw ConfigurationException("Can't build ListenerService, missing conf:Listener element?"); - } - } - - if (m_outer->m_listener && conf.isEnabled(SPConfig::OutOfProcess) && !conf.isEnabled(SPConfig::InProcess)) { - m_outer->m_listener->regListener("set::RelayState",m_outer->m_listener); - m_outer->m_listener->regListener("get::RelayState",m_outer->m_listener); } + child = XMLHelper::getNextSiblingElement(child, _StorageService); + } - if (conf.isEnabled(SPConfig::Caching)) { - if (conf.isEnabled(SPConfig::OutOfProcess)) { -#ifndef SHIBSP_LITE - // First build any StorageServices. - string inmemID; - child=XMLHelper::getFirstChildElement(SHAR,_StorageService); - while (child) { - auto_ptr_char id(child->getAttributeNS(NULL,_id)); - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - try { - log.info("building StorageService (%s) of type %s...", id.get(), type.get()); - m_outer->m_storage[id.get()] = xmlConf.StorageServiceManager.newPlugin(type.get(),child); - if (!strcmp(type.get(),MEMORY_STORAGE_SERVICE)) - inmemID = id.get(); - } - catch (exception& ex) { - log.crit("failed to instantiate StorageService (%s): %s", id.get(), ex.what()); - } - child=XMLHelper::getNextSiblingElement(child,_StorageService); - } - - child=XMLHelper::getFirstChildElement(SHAR,_SessionCache); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building SessionCache of type %s...",type.get()); - m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(type.get(),child); - } - else { - log.warn("SessionCache unspecified, building SessionCache of type %s...",STORAGESERVICE_SESSION_CACHE); - if (inmemID.empty()) { - inmemID = "memory"; - log.info("no StorageServices configured, providing in-memory version for session cache"); - m_outer->m_storage[inmemID] = xmlConf.StorageServiceManager.newPlugin(MEMORY_STORAGE_SERVICE,NULL); - } - child = e->getOwnerDocument()->createElementNS(NULL,_SessionCache); - auto_ptr_XMLCh ssid(inmemID.c_str()); - const_cast(child)->setAttributeNS(NULL,_StorageService,ssid.get()); - m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(STORAGESERVICE_SESSION_CACHE,child); - } + if (conf->m_storage.empty()) { + log.info("no StorageService plugin(s) installed, using (mem) in-memory instance"); + conf->m_storage["mem"] = boost::shared_ptr(xmlConf.StorageServiceManager.newPlugin(MEMORY_STORAGE_SERVICE, nullptr)); + } - // Replay cache. - StorageService* replaySS=NULL; - child=XMLHelper::getFirstChildElement(SHAR,_ReplayCache); - if (child) { - auto_ptr_char ssid(child->getAttributeNS(NULL,_StorageService)); - if (ssid.get() && *ssid.get()) { - if (m_outer->m_storage.count(ssid.get())) - replaySS = m_outer->m_storage[ssid.get()]; - if (replaySS) - log.info("building ReplayCache on top of StorageService (%s)...", ssid.get()); - else - log.crit("unable to locate StorageService (%s) in configuration", ssid.get()); - } - } - if (!replaySS) { - log.info("building ReplayCache using in-memory StorageService..."); - if (inmemID.empty()) { - inmemID = "memory"; - log.info("no StorageServices configured, providing in-memory version for legacy config"); - m_outer->m_storage[inmemID] = xmlConf.StorageServiceManager.newPlugin(MEMORY_STORAGE_SERVICE,NULL); - } - replaySS = m_outer->m_storage[inmemID]; - } - xmlConf.setReplayCache(new ReplayCache(replaySS)); - - // ArtifactMap - child=XMLHelper::getFirstChildElement(SHAR,_ArtifactMap); - if (child) { - auto_ptr_char ssid(child->getAttributeNS(NULL,_StorageService)); - if (ssid.get() && *ssid.get() && m_outer->m_storage.count(ssid.get())) { - log.info("building ArtifactMap on top of StorageService (%s)...", ssid.get()); - samlConf.setArtifactMap(new ArtifactMap(child, m_outer->m_storage[ssid.get()])); - } - } - if (samlConf.getArtifactMap()==NULL) { - log.info("building in-memory ArtifactMap..."); - samlConf.setArtifactMap(new ArtifactMap(child)); - } -#endif + // Replay cache. + StorageService* replaySS = nullptr; + child = XMLHelper::getFirstChildElement(e, _ReplayCache); + if (child) { + string ssid(XMLHelper::getAttrString(child, nullptr, _StorageService)); + if (!ssid.empty()) { + if (conf->m_storage.count(ssid)) { + log.info("building ReplayCache on top of StorageService (%s)...", ssid.c_str()); + replaySS = conf->m_storage[ssid].get(); } else { - child=XMLHelper::getFirstChildElement(SHIRE,_SessionCache); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building SessionCache of type %s...",type.get()); - m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(type.get(),child); - } - else { - log.warn("SessionCache unspecified, building SessionCache of type %s...",REMOTED_SESSION_CACHE); - m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(REMOTED_SESSION_CACHE,child); - } + log.error("unable to locate StorageService (%s), using arbitrary instance for ReplayCache", ssid.c_str()); + replaySS = conf->m_storage.begin()->second.get(); } } - } // end of first-time-only stuff - - // Back to the fully dynamic stuff...next up is the RequestMapper. - if (conf.isEnabled(SPConfig::RequestMapping)) { - child=XMLHelper::getFirstChildElement(SHIRE,_RequestMapper); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building RequestMapper of type %s...",type.get()); - m_requestMapper=conf.RequestMapperManager.newPlugin(type.get(),child); + else { + log.info("no StorageService specified for ReplayCache, using arbitrary instance"); + replaySS = conf->m_storage.begin()->second.get(); } } - -#ifndef SHIBSP_LITE - // Load security policies. - child = XMLHelper::getLastChildElement(e,SecurityPolicies); + else { + log.info("no ReplayCache specified, using arbitrary StorageService instance"); + replaySS = conf->m_storage.begin()->second.get(); + } + xmlConf.setReplayCache(new ReplayCache(replaySS)); + + // ArtifactMap + child = XMLHelper::getFirstChildElement(e, _ArtifactMap); if (child) { - PolicyNodeFilter filter; - child = XMLHelper::getFirstChildElement(child,Policy); - while (child) { - auto_ptr_char id(child->getAttributeNS(NULL,_id)); - pair< PropertySet*,vector >& rules = m_policyMap[id.get()]; - rules.first = NULL; - auto_ptr settings(new DOMPropertySet()); - settings->load(child, log, &filter); - rules.first = settings.release(); - - // Process Rule elements. - const DOMElement* rule = XMLHelper::getFirstChildElement(child,Rule); - while (rule) { - auto_ptr_char type(rule->getAttributeNS(NULL,_type)); - try { - rules.second.push_back(samlConf.SecurityPolicyRuleManager.newPlugin(type.get(),rule)); - } - catch (exception& ex) { - log.crit("error instantiating policy rule (%s) in policy (%s): %s", type.get(), id.get(), ex.what()); - } - rule = XMLHelper::getNextSiblingElement(rule,Rule); + string ssid(XMLHelper::getAttrString(child, nullptr, _StorageService)); + if (!ssid.empty()) { + if (conf->m_storage.count(ssid)) { + log.info("building ArtifactMap on top of StorageService (%s)...", ssid.c_str()); + samlConf.setArtifactMap(new ArtifactMap(child, conf->m_storage[ssid].get())); } - - // Process TransportOption elements. - rule = XMLHelper::getFirstChildElement(child,TransportOption); - while (rule) { - if (rule->hasChildNodes()) { - auto_ptr_char provider(rule->getAttributeNS(NULL,_provider)); - auto_ptr_char option(rule->getAttributeNS(NULL,_option)); - auto_ptr_char value(rule->getFirstChild()->getNodeValue()); - if (provider.get() && *provider.get() && option.get() && *option.get() && value.get() && *value.get()) { - m_transportOptionMap[id.get()].push_back( - make_pair(provider.get(), make_pair(option.get(), value.get())) - ); - } - } - rule = XMLHelper::getNextSiblingElement(rule,TransportOption); + else { + log.error("unable to locate StorageService (%s), using in-memory ArtifactMap", ssid.c_str()); + samlConf.setArtifactMap(new ArtifactMap(child)); } - - child = XMLHelper::getNextSiblingElement(child,Policy); + } + else { + log.info("no StorageService specified, using in-memory ArtifactMap"); + samlConf.setArtifactMap(new ArtifactMap(child)); } } + else { + log.info("no ArtifactMap specified, building in-memory ArtifactMap..."); + samlConf.setArtifactMap(new ArtifactMap(child)); + } + } // end of out of process caching components #endif - // Load the default application. This actually has a fixed ID of "default". ;-) - child=XMLHelper::getLastChildElement(e,Applications); - if (!child) { - log.fatal("can't build default Application object, missing conf:Applications element?"); - throw ConfigurationException("can't build default Application object, missing conf:Applications element?"); - } - XMLApplication* defapp=new XMLApplication(m_outer,child); - m_appmap[defapp->getId()]=defapp; - - // Load any overrides. - child = XMLHelper::getFirstChildElement(child,_Application); - while (child) { - auto_ptr iapp(new XMLApplication(m_outer,child,defapp)); - if (m_appmap.count(iapp->getId())) - log.crit("found conf:Application element with duplicate id attribute (%s), skipping it", iapp->getId()); - else - m_appmap[iapp->getId()]=iapp.release(); - - child = XMLHelper::getNextSiblingElement(child,_Application); + child = XMLHelper::getFirstChildElement(e, _SessionCache); + if (child) { + string t(XMLHelper::getAttrString(child, nullptr, _type)); + if (!t.empty()) { + log.info("building SessionCache of type %s...", t.c_str()); + conf->m_sessionCache.reset(spConf.SessionCacheManager.newPlugin(t.c_str(), child)); } } - catch (exception&) { - cleanup(); - throw; + if (!conf->m_sessionCache) { + log.info("no SessionCache specified, using StorageService-backed instance"); + conf->m_sessionCache.reset(spConf.SessionCacheManager.newPlugin(STORAGESERVICE_SESSION_CACHE, nullptr)); } -#ifndef _DEBUG - catch (...) { - cleanup(); - throw; - } -#endif } -XMLConfigImpl::~XMLConfigImpl() +XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, XMLConfig* outer, Category& log) : m_document(nullptr) { - cleanup(); -} +#ifdef _DEBUG + xmltooling::NDC ndc("XMLConfigImpl"); +#endif + SPConfig& conf=SPConfig::getConfig(); + XMLToolingConfig& xmlConf=XMLToolingConfig::getConfig(); + const DOMElement* SHAR=XMLHelper::getFirstChildElement(e, OutOfProcess); + const DOMElement* SHIRE=XMLHelper::getFirstChildElement(e, InProcess); + + // Initialize logging manually in order to redirect log messages as soon as possible. + // If no explicit config is supplied, we now assume the caller has done this, so that + // setuid processes can potentially do this as root. + if (conf.isEnabled(SPConfig::Logging)) { + string logconf; + if (conf.isEnabled(SPConfig::OutOfProcess)) + logconf = XMLHelper::getAttrString(SHAR, nullptr, logger); + else if (conf.isEnabled(SPConfig::InProcess)) + logconf = XMLHelper::getAttrString(SHIRE, nullptr, logger); + if (logconf.empty()) + logconf = XMLHelper::getAttrString(e, nullptr, logger); + if (!logconf.empty()) { + log.debug("loading new logging configuration from (%s), check log destination for status of configuration", logconf.c_str()); + if (!XMLToolingConfig::getConfig().log_config(logconf.c_str())) + log.crit("failed to load new logging configuration from (%s)", logconf.c_str()); + } -void XMLConfigImpl::cleanup() -{ - for_each(m_appmap.begin(),m_appmap.end(),cleanup_pair()); - m_appmap.clear(); #ifndef SHIBSP_LITE - for (map< string,pair > >::iterator i=m_policyMap.begin(); i!=m_policyMap.end(); ++i) { - delete i->second.first; - for_each(i->second.second.begin(), i->second.second.end(), xmltooling::cleanup()); + m_tranLog.reset( + new TransactionLog( + XMLHelper::getAttrString(SHAR, nullptr, tranLogFormat).c_str(), + XMLHelper::getAttrString(SHAR, nullptr, tranLogFiller).c_str() + ) + ); +#endif } - m_policyMap.clear(); + + // Re-log library versions now that logging is set up. + log.info("Shibboleth SP Version %s", PACKAGE_VERSION); +#ifndef SHIBSP_LITE + log.info( + "Library versions: %s %s, Xerces-C %s, XML-Security-C %s, XMLTooling-C %s, OpenSAML-C %s, Shibboleth %s", +# if defined(LOG4SHIB_VERSION) + "log4shib", LOG4SHIB_VERSION, +# elif defined(LOG4CPP_VERSION) + "log4cpp", LOG4CPP_VERSION, +# else + "", "", +# endif + XERCES_FULLVERSIONDOT, XSEC_FULLVERSIONDOT, gXMLToolingDotVersionStr, gOpenSAMLDotVersionStr, gShibSPDotVersionStr + ); +#else + log.info( + "Library versions: %s %s, Xerces-C %s, XMLTooling-C %s, Shibboleth %s", +# if defined(LOG4SHIB_VERSION) + "log4shib", LOG4SHIB_VERSION, +# elif defined(LOG4CPP_VERSION) + "log4cpp", LOG4CPP_VERSION, +# else + "", "", +# endif + XERCES_FULLVERSIONDOT, gXMLToolingDotVersionStr, gShibSPDotVersionStr + ); #endif - delete m_requestMapper; - m_requestMapper = NULL; - if (m_document) - m_document->release(); - m_document = NULL; + + // First load any property sets. + load(e, nullptr, this); + + DOMElement* child; + + // Much of the processing can only occur on the first instantiation. + if (first) { + // Set clock skew. + pair skew=getUnsignedInt("clockSkew"); + if (skew.first) + xmlConf.clock_skew_secs=min(skew.second,(60*60*24*7*28)); + + pair unsafe = getString("unsafeChars"); + if (unsafe.first) + TemplateEngine::unsafe_chars = unsafe.second; + + unsafe = getString("allowedSchemes"); + if (unsafe.first) { + HTTPResponse::getAllowedSchemes().clear(); + string schemes(unsafe.second); + trim(schemes); + split(HTTPResponse::getAllowedSchemes(), schemes, is_space(), algorithm::token_compress_on); + } + + // Default language handling. + pair langFromClient = getBool("langFromClient"); + pair langPriority = getXMLString("langPriority"); + GenericRequest::setLangDefaults(!langFromClient.first || langFromClient.second, langPriority.second); + +#ifndef SHIBSP_LITE + langPriority = getXMLString("contactPriority"); + if (langPriority.first) + SAMLConfig::getConfig().setContactPriority(langPriority.second); +#endif + + // Extensions + doExtensions(e, "global", log); + if (conf.isEnabled(SPConfig::OutOfProcess)) + doExtensions(SHAR, "out of process", log); + + if (conf.isEnabled(SPConfig::InProcess)) + doExtensions(SHIRE, "in process", log); + + // Instantiate the ListenerService and SessionCache objects. + if (conf.isEnabled(SPConfig::Listener)) + doListener(e, outer, log); + +#ifndef SHIBSP_LITE + if (outer->m_listener && conf.isEnabled(SPConfig::OutOfProcess) && !conf.isEnabled(SPConfig::InProcess)) { + outer->m_listener->regListener("set::RelayState", outer); + outer->m_listener->regListener("get::RelayState", outer); + outer->m_listener->regListener("set::PostData", outer); + outer->m_listener->regListener("get::PostData", outer); + } +#endif + if (conf.isEnabled(SPConfig::Caching)) + doCaching(e, outer, log); + } // end of first-time-only stuff + + // Back to the fully dynamic stuff...next up is the RequestMapper. + if (conf.isEnabled(SPConfig::RequestMapping)) { + if (child = XMLHelper::getFirstChildElement(e, _RequestMapper)) { + string t(XMLHelper::getAttrString(child, nullptr, _type)); + if (!t.empty()) { + log.info("building RequestMapper of type %s...", t.c_str()); + m_requestMapper.reset(conf.RequestMapperManager.newPlugin(t.c_str(), child)); + } + } + if (!m_requestMapper) { + log.info("no RequestMapper specified, using 'Native' plugin with empty/default map"); + child = e->getOwnerDocument()->createElementNS(nullptr, _RequestMapper); + DOMElement* mapperDummy = e->getOwnerDocument()->createElementNS(shibspconstants::SHIB2SPCONFIG_NS, RequestMap); + mapperDummy->setAttributeNS(nullptr, applicationId, _default); + child->appendChild(mapperDummy); + m_requestMapper.reset(conf.RequestMapperManager.newPlugin(NATIVE_REQUEST_MAPPER, child)); + } + } + +#ifndef SHIBSP_LITE + // Load security policies. + if (child = XMLHelper::getLastChildElement(e, _SecurityPolicyProvider)) { + string t(XMLHelper::getAttrString(child, nullptr, _type)); + if (!t.empty()) { + log.info("building SecurityPolicyProvider of type %s...", t.c_str()); + m_policy.reset(conf.SecurityPolicyProviderManager.newPlugin(t.c_str(), child)); + } + else { + throw ConfigurationException("can't build SecurityPolicyProvider, no type specified"); + } + } + else if (child = XMLHelper::getLastChildElement(e, SecurityPolicies)) { + // For backward compatibility, wrap in a plugin element. + DOMElement* polwrapper = e->getOwnerDocument()->createElementNS(nullptr, _SecurityPolicyProvider); + polwrapper->appendChild(child); + log.warn("deprecated/legacy SecurityPolicy configuration, consider externalizing with "); + m_policy.reset(conf.SecurityPolicyProviderManager.newPlugin(XML_SECURITYPOLICY_PROVIDER, polwrapper)); + } + else { + log.fatal("can't build SecurityPolicyProvider, missing conf:SecurityPolicyProvider element?"); + throw ConfigurationException("Can't build SecurityPolicyProvider, missing conf:SecurityPolicyProvider element?"); + } + + if (first) { + if (!m_policy->getAlgorithmWhitelist().empty()) { +#ifdef SHIBSP_XMLSEC_WHITELISTING + for (vector::const_iterator white = m_policy->getAlgorithmWhitelist().begin(); + white != m_policy->getAlgorithmWhitelist().end(); ++white) { + XSECPlatformUtils::whitelistAlgorithm(white->c_str()); + auto_ptr_char whitelog(white->c_str()); + log.info("explicitly whitelisting security algorithm (%s)", whitelog.get()); + } +#else + log.crit("XML-Security-C library prior to 1.6.0 does not support algorithm white/blacklists"); +#endif + } + else if (!m_policy->getDefaultAlgorithmBlacklist().empty() || !m_policy->getAlgorithmBlacklist().empty()) { +#ifdef SHIBSP_XMLSEC_WHITELISTING + for (vector::const_iterator black = m_policy->getDefaultAlgorithmBlacklist().begin(); + black != m_policy->getDefaultAlgorithmBlacklist().end(); ++black) { + XSECPlatformUtils::blacklistAlgorithm(black->c_str()); + auto_ptr_char blacklog(black->c_str()); + log.info("automatically blacklisting security algorithm (%s)", blacklog.get()); + } + for (vector::const_iterator black = m_policy->getAlgorithmBlacklist().begin(); + black != m_policy->getAlgorithmBlacklist().end(); ++black) { + XSECPlatformUtils::blacklistAlgorithm(black->c_str()); + auto_ptr_char blacklog(black->c_str()); + log.info("explicitly blacklisting security algorithm (%s)", blacklog.get()); + } +#else + log.crit("XML-Security-C library prior to 1.6.0 does not support algorithm white/blacklists"); +#endif + } + } + + // Process TransportOption elements. + child = XMLHelper::getLastChildElement(e, TransportOption); + while (child) { + if (child->hasChildNodes()) { + string provider(XMLHelper::getAttrString(child, nullptr, _provider)); + string option(XMLHelper::getAttrString(child, nullptr, _option)); + auto_ptr_char value(child->getFirstChild()->getNodeValue()); + if (!provider.empty() && !option.empty() && value.get() && *value.get()) { + m_transportOptions.push_back(boost::make_tuple(provider, option, string(value.get()))); + } + } + child = XMLHelper::getPreviousSiblingElement(child, TransportOption); + } +#endif + + scoped_ptr pp; + if (conf.isEnabled(SPConfig::Handlers)) { + if (child = XMLHelper::getLastChildElement(e, _ProtocolProvider)) { + string t(XMLHelper::getAttrString(child, nullptr, _type)); + if (!t.empty()) { + log.info("building ProtocolProvider of type %s...", t.c_str()); + pp.reset(conf.ProtocolProviderManager.newPlugin(t.c_str(), child)); + } + } + } + Locker pplocker(pp.get()); + + // Load the default application. + child = XMLHelper::getLastChildElement(e, ApplicationDefaults); + if (!child) { + log.fatal("can't build default Application object, missing conf:ApplicationDefaults element?"); + throw ConfigurationException("can't build default Application object, missing conf:ApplicationDefaults element?"); + } + boost::shared_ptr defapp(new XMLApplication(outer, pp.get(), child)); + m_appmap[defapp->getId()] = defapp; + + // Load any overrides. + child = XMLHelper::getFirstChildElement(child, ApplicationOverride); + while (child) { + boost::shared_ptr iapp(new XMLApplication(outer, pp.get(), child, defapp.get())); + if (m_appmap.count(iapp->getId())) + log.crit("found conf:ApplicationOverride element with duplicate id attribute (%s), skipping it", iapp->getId()); + else + m_appmap[iapp->getId()] = iapp; + + child = XMLHelper::getNextSiblingElement(child, ApplicationOverride); + } + + // Check for extra AuthTypes to recognize. + if (conf.isEnabled(SPConfig::InProcess)) { + const PropertySet* inprocs = getPropertySet("InProcess"); + if (inprocs) { + pair extraAuthTypes = inprocs->getString("extraAuthTypes"); + if (extraAuthTypes.first) { + string types(extraAuthTypes.second); + trim(types); + split(outer->m_authTypes, types, is_space(), algorithm::token_compress_on); + outer->m_authTypes.insert("shibboleth"); + } + } + } } +#ifndef SHIBSP_LITE void XMLConfig::receive(DDF& in, ostream& out) { -#ifndef SHIBSP_LITE if (!strcmp(in.name(), "get::RelayState")) { const char* id = in["id"].string(); const char* key = in["key"].string(); @@ -1506,15 +2265,19 @@ void XMLConfig::receive(DDF& in, ostream& out) if (in["clear"].integer()) storage->deleteString("RelayState",key); } + else if (storage->readText("RelayState",key,&relayState)>0) { + if (in["clear"].integer()) + storage->deleteText("RelayState",key); + } } else { - Category::getInstance(SHIBSP_LOGCAT".ServiceProvider").error( + Category::getInstance(SHIBSP_LOGCAT ".ServiceProvider").error( "Storage-backed RelayState with invalid StorageService ID (%s)", id ); } // Repack for return to caller. - DDF ret=DDF(NULL).string(relayState.c_str()); + DDF ret=DDF(nullptr).unsafe_string(relayState.c_str()); DDFJanitor jret(ret); out << ret; } @@ -1527,39 +2290,99 @@ void XMLConfig::receive(DDF& in, ostream& out) string rsKey; StorageService* storage = getStorageService(id); if (storage) { - SAMLConfig::getConfig().generateRandomBytes(rsKey,20); + SAMLConfig::getConfig().generateRandomBytes(rsKey,32); rsKey = SAMLArtifact::toHex(rsKey); - storage->createString("RelayState", rsKey.c_str(), value, time(NULL) + 600); + if (strlen(value) <= storage->getCapabilities().getStringSize()) + storage->createString("RelayState", rsKey.c_str(), value, time(nullptr) + 600); + else + storage->createText("RelayState", rsKey.c_str(), value, time(nullptr) + 600); } else { - Category::getInstance(SHIBSP_LOGCAT".ServiceProvider").error( + Category::getInstance(SHIBSP_LOGCAT ".ServiceProvider").error( "Storage-backed RelayState with invalid StorageService ID (%s)", id ); } // Repack for return to caller. - DDF ret=DDF(NULL).string(rsKey.c_str()); + DDF ret=DDF(nullptr).string(rsKey.c_str()); + DDFJanitor jret(ret); + out << ret; + } + else if (!strcmp(in.name(), "get::PostData")) { + const char* id = in["id"].string(); + const char* key = in["key"].string(); + if (!id || !key) + throw ListenerException("Required parameters missing for PostData recovery."); + + string postData; + StorageService* storage = getStorageService(id); + if (storage) { + if (storage->readText("PostData",key,&postData) > 0) { + storage->deleteText("PostData",key); + } + } + else { + Category::getInstance(SHIBSP_LOGCAT ".ServiceProvider").error( + "Storage-backed PostData with invalid StorageService ID (%s)", id + ); + } + // If the data's empty, we'll send nothing back. + // If not, we don't need to round trip it, just send back the serialized DDF list. + if (postData.empty()) { + DDF ret(nullptr); + DDFJanitor jret(ret); + out << ret; + } + else { + out << postData; + } + } + else if (!strcmp(in.name(), "set::PostData")) { + const char* id = in["id"].string(); + if (!id || !in["parameters"].islist()) + throw ListenerException("Required parameters missing for PostData creation."); + + string rsKey; + StorageService* storage = getStorageService(id); + if (storage) { + SAMLConfig::getConfig().generateRandomBytes(rsKey,32); + rsKey = SAMLArtifact::toHex(rsKey); + ostringstream params; + params << in["parameters"]; + storage->createText("PostData", rsKey.c_str(), params.str().c_str(), time(nullptr) + 600); + } + else { + Category::getInstance(SHIBSP_LOGCAT ".ServiceProvider").error( + "Storage-backed PostData with invalid StorageService ID (%s)", id + ); + } + + // Repack for return to caller. + DDF ret=DDF(nullptr).string(rsKey.c_str()); DDFJanitor jret(ret); out << ret; } -#endif } +#endif -pair XMLConfig::load() +pair XMLConfig::background_load() { // Load from source using base class. pair raw = ReloadableXMLFile::load(); - + // If we own it, wrap it. - XercesJanitor docjanitor(raw.first ? raw.second->getOwnerDocument() : NULL); + XercesJanitor docjanitor(raw.first ? raw.second->getOwnerDocument() : nullptr); + + scoped_ptr impl(new XMLConfigImpl(raw.second, (m_impl==nullptr), this, m_log)); - XMLConfigImpl* impl = new XMLConfigImpl(raw.second,(m_impl==NULL),this,m_log); - // If we held the document, transfer it to the impl. If we didn't, it's a no-op. impl->setDocument(docjanitor.release()); - delete m_impl; - m_impl = impl; + // Perform the swap inside a lock. + if (m_lock) + m_lock->wrlock(); + SharedLock locker(m_lock, false); + m_impl.swap(impl); - return make_pair(false,(DOMElement*)NULL); + return make_pair(false,(DOMElement*)nullptr); }