/*
- * Copyright 2001-2009 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
pair<bool,long> ADFSSessionInitiator::run(SPRequest& request, string& entityID, bool isHandler) const
{
// We have to know the IdP to function.
- if (entityID.empty())
+ if (entityID.empty() || !checkCompatibility(request, isHandler))
return make_pair(false,0L);
string target;
<attribute name="entityID" type="anyURI"/>
<attribute name="discoveryURL" type="anyURI"/>
<attribute name="isPassive" type="boolean"/>
+ <attribute name="returnOnError" type="boolean"/>
<attribute name="forceAuthn" type="boolean"/>
<attribute name="authnContextClassRef" type="anyURI"/>
<attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
<attribute name="acsIndex" type="unsignedShort"/>
<attribute name="defaultACSIndex" type="unsignedShort"/> <!-- deprecated -->
<attribute name="isPassive" type="boolean"/>
+ <attribute name="returnOnError" type="boolean"/>
<attribute name="forceAuthn" type="boolean"/>
<attribute name="authnContextClassRef" type="anyURI"/>
<attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
#endif
namespace xmltooling {
- class XMLTOOL_API HTTPRequest;
- class XMLTOOL_API HTTPResponse;
class XMLTOOL_API XMLObject;
};
namespace shibsp {
class SHIBSP_API Application;
- class SHIBSP_API SPRequest;
#if defined (_MSC_VER)
#pragma warning( push )
const std::map<std::string,std::string>* remapper=NULL
);
+ void log(SPRequest::SPLogLevel level, const std::string& msg) const;
+
#ifndef SHIBSP_LITE
/**
* Examines a protocol response message for errors and raises an annotated exception
#endif
/**
- * Implements various mechanisms to preserve RelayState,
- * such as cookies or StorageService-backed keys.
- *
- * <p>If a supported mechanism can be identified, the input parameter will be
- * replaced with a suitable state key.
- *
- * @param application the associated Application
- * @param response outgoing HTTP response
- * @param relayState RelayState token to supply with message
- */
- virtual void preserveRelayState(
- const Application& application, xmltooling::HTTPResponse& response, std::string& relayState
- ) const;
-
- /**
- * Implements various mechanisms to recover RelayState,
- * such as cookies or StorageService-backed keys.
- *
- * <p>If a supported mechanism can be identified, the input parameter will be
- * replaced with the recovered state information.
- *
- * @param application the associated Application
- * @param request incoming HTTP request
- * @param response outgoing HTTP response
- * @param relayState RelayState token supplied with message
- * @param clear true iff the token state should be cleared
- */
- virtual void recoverRelayState(
- const Application& application,
- const xmltooling::HTTPRequest& request,
- xmltooling::HTTPResponse& response,
- std::string& relayState,
- bool clear=true
- ) const;
-
- /**
* Implements a mechanism to preserve form post data.
*
* @param application the associated Application
/**
* Post a redirect response with post data.
- *
+ *
* @param application the associated Application
* @param response outgoing HTTP response
* @param request incoming HTTP request
#ifndef __shibsp_handler_h__
#define __shibsp_handler_h__
+#include <shibsp/SPRequest.h>
#include <shibsp/util/PropertySet.h>
#ifndef SHIBSP_LITE
};
#endif
-namespace shibsp {
+namespace xmltooling {
+ class XMLTOOL_API HTTPRequest;
+ class XMLTOOL_API HTTPResponse;
+};
- class SHIBSP_API SPRequest;
+namespace shibsp {
/**
* Pluggable runtime functionality that implement protocols and services
MAKE_NONCOPYABLE(Handler);
protected:
Handler();
+
+ /**
+ * Log using handler's specific logging object.
+ *
+ * @param level logging level
+ * @param msg message to log
+ */
+ virtual void log(SPRequest::SPLogLevel level, const std::string& msg) const;
+
+ /**
+ * Implements various mechanisms to preserve RelayState,
+ * such as cookies or StorageService-backed keys.
+ *
+ * <p>If a supported mechanism can be identified, the input parameter will be
+ * replaced with a suitable state key.
+ *
+ * @param application the associated Application
+ * @param response outgoing HTTP response
+ * @param relayState RelayState token to supply with message
+ */
+ virtual void preserveRelayState(
+ const Application& application, xmltooling::HTTPResponse& response, std::string& relayState
+ ) const;
+
+ /**
+ * Implements various mechanisms to recover RelayState,
+ * such as cookies or StorageService-backed keys.
+ *
+ * <p>If a supported mechanism can be identified, the input parameter will be
+ * replaced with the recovered state information.
+ *
+ * @param application the associated Application
+ * @param request incoming HTTP request
+ * @param response outgoing HTTP response
+ * @param relayState RelayState token supplied with message
+ * @param clear true iff the token state should be cleared
+ */
+ virtual void recoverRelayState(
+ const Application& application,
+ const xmltooling::HTTPRequest& request,
+ xmltooling::HTTPResponse& response,
+ std::string& relayState,
+ bool clear=true
+ ) const;
+
public:
virtual ~Handler();
/*
- * Copyright 2001-2009 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
#include <shibsp/handler/Handler.h>
+#include <set>
+#include <string>
+
namespace shibsp {
/**
/** Property remapper for configuration compatibility. */
static std::map<std::string,std::string> m_remapper;
+ /** Set of optional settings supported by handler. */
+ std::set<std::string> m_supportedOptions;
+
SessionInitiator();
+ /**
+ * Examines the request and applicable settings to determine whether
+ * the handler is able to support the request.
+ * <p>If the handler is within a chain, the method will return false,
+ * otherwise an exception will be raised.
+ *
+ * @param request SP request context
+ * @param isHandler true iff executing in the context of a direct handler invocation
+ * @return true iff the request appears to be compatible
+ */
+ bool checkCompatibility(SPRequest& request, bool isHandler) const;
+
public:
virtual ~SessionInitiator();
/**
+ * Indicates the set of optional settings supported by the handler.
+ *
+ * @return an array of the optional settings supported
+ */
+ virtual const std::set<std::string>& getSupportedOptions() const;
+
+ /**
* Executes an incoming request.
*
* <p>SessionInitiators can be run either directly by incoming web requests
{
}
-AbstractHandler::AbstractHandler(
- const DOMElement* e, Category& log, DOMNodeFilter* filter, const map<string,string>* remapper
- ) : m_log(log), m_configNS(shibspconstants::SHIB2SPCONFIG_NS) {
- load(e,NULL,filter,remapper);
-}
-
-AbstractHandler::~AbstractHandler()
+void Handler::log(SPRequest::SPLogLevel level, const string& msg) const
{
+ Category::getInstance(SHIBSP_LOGCAT".Handler").log(
+ (level == SPRequest::SPDebug ? Priority::DEBUG :
+ (level == SPRequest::SPInfo ? Priority::INFO :
+ (level == SPRequest::SPWarn ? Priority::WARN :
+ (level == SPRequest::SPError ? Priority::ERROR : Priority::CRIT)))),
+ msg
+ );
}
-#ifndef SHIBSP_LITE
-
-const char* Handler::getType() const
-{
- return getString("type").second;
-}
-
-void AbstractHandler::checkError(const XMLObject* response, const saml2md::RoleDescriptor* role) const
-{
- const saml2p::StatusResponseType* r2 = dynamic_cast<const saml2p::StatusResponseType*>(response);
- if (r2) {
- const saml2p::Status* status = r2->getStatus();
- if (status) {
- const saml2p::StatusCode* sc = status->getStatusCode();
- const XMLCh* code = sc ? sc->getValue() : NULL;
- if (code && !XMLString::equals(code,saml2p::StatusCode::SUCCESS)) {
- FatalProfileException ex("SAML response contained an error.");
- annotateException(&ex, role, status); // throws it
- }
- }
- }
-
- const saml1p::Response* r1 = dynamic_cast<const saml1p::Response*>(response);
- if (r1) {
- const saml1p::Status* status = r1->getStatus();
- if (status) {
- const saml1p::StatusCode* sc = status->getStatusCode();
- const xmltooling::QName* code = sc ? sc->getValue() : NULL;
- if (code && *code != saml1p::StatusCode::SUCCESS) {
- FatalProfileException ex("SAML response contained an error.");
- ex.addProperty("statusCode", code->toString().c_str());
- if (sc->getStatusCode()) {
- code = sc->getStatusCode()->getValue();
- if (code)
- ex.addProperty("statusCode2", code->toString().c_str());
- }
- if (status->getStatusMessage()) {
- auto_ptr_char msg(status->getStatusMessage()->getMessage());
- if (msg.get() && *msg.get())
- ex.addProperty("statusMessage", msg.get());
- }
- ex.raise();
- }
- }
- }
-}
-
-void AbstractHandler::fillStatus(saml2p::StatusResponseType& response, const XMLCh* code, const XMLCh* subcode, const char* msg) const
-{
- saml2p::Status* status = saml2p::StatusBuilder::buildStatus();
- saml2p::StatusCode* scode = saml2p::StatusCodeBuilder::buildStatusCode();
- status->setStatusCode(scode);
- scode->setValue(code);
- if (subcode) {
- saml2p::StatusCode* ssubcode = saml2p::StatusCodeBuilder::buildStatusCode();
- scode->setStatusCode(ssubcode);
- ssubcode->setValue(subcode);
- }
- if (msg) {
- pair<bool,bool> flag = getBool("detailedErrors", m_configNS.get());
- auto_ptr_XMLCh widemsg((flag.first && flag.second) ? msg : "Error processing request.");
- saml2p::StatusMessage* sm = saml2p::StatusMessageBuilder::buildStatusMessage();
- status->setStatusMessage(sm);
- sm->setMessage(widemsg.get());
- }
- response.setStatus(status);
-}
-
-long AbstractHandler::sendMessage(
- const MessageEncoder& encoder,
- XMLObject* msg,
- const char* relayState,
- const char* destination,
- const saml2md::RoleDescriptor* role,
- const Application& application,
- HTTPResponse& httpResponse,
- bool signIfPossible
- ) const
-{
- const EntityDescriptor* entity = role ? dynamic_cast<const EntityDescriptor*>(role->getParent()) : NULL;
- const PropertySet* relyingParty = application.getRelyingParty(entity);
- pair<bool,const char*> flag = signIfPossible ? make_pair(true,(const char*)"true") : relyingParty->getString("signing");
- if (role && flag.first &&
- (!strcmp(flag.second, "true") ||
- (encoder.isUserAgentPresent() && !strcmp(flag.second, "front")) ||
- (!encoder.isUserAgentPresent() && !strcmp(flag.second, "back")))) {
- CredentialResolver* credResolver=application.getCredentialResolver();
- if (credResolver) {
- Locker credLocker(credResolver);
- const Credential* cred = NULL;
- pair<bool,const char*> keyName = relyingParty->getString("keyName");
- pair<bool,const XMLCh*> sigalg = relyingParty->getXMLString("signingAlg");
- if (role) {
- MetadataCredentialCriteria mcc(*role);
- mcc.setUsage(Credential::SIGNING_CREDENTIAL);
- if (keyName.first)
- mcc.getKeyNames().insert(keyName.second);
- if (sigalg.first)
- mcc.setXMLAlgorithm(sigalg.second);
- cred = credResolver->resolve(&mcc);
- }
- else {
- CredentialCriteria cc;
- cc.setUsage(Credential::SIGNING_CREDENTIAL);
- if (keyName.first)
- cc.getKeyNames().insert(keyName.second);
- if (sigalg.first)
- cc.setXMLAlgorithm(sigalg.second);
- cred = credResolver->resolve(&cc);
- }
- if (cred) {
- // Signed request.
- return encoder.encode(
- httpResponse,
- msg,
- destination,
- entity,
- relayState,
- &application,
- cred,
- sigalg.second,
- relyingParty->getXMLString("digestAlg").second
- );
- }
- else {
- m_log.warn("no signing credential resolved, leaving message unsigned");
- }
- }
- else {
- m_log.warn("no credential resolver installed, leaving message unsigned");
- }
- }
-
- // Unsigned request.
- return encoder.encode(httpResponse, msg, destination, entity, relayState, &application);
-}
-
-#endif
-
-void AbstractHandler::preserveRelayState(const Application& application, HTTPResponse& response, string& relayState) const
+void Handler::preserveRelayState(const Application& application, HTTPResponse& response, string& relayState) const
{
if (relayState.empty())
return;
relayState = string(mech.second-3) + ':' + rsKey;
}
else {
- m_log.error("Storage-backed RelayState with invalid StorageService ID (%s)", mech.second);
+ string msg("Storage-backed RelayState with invalid StorageService ID (");
+ msg = msg + mech.second+ ')';
+ log(SPRequest::SPError, msg);
relayState.erase();
}
#endif
throw ConfigurationException("Unsupported relayState mechanism ($1).", params(1,mech.second));
}
-void AbstractHandler::recoverRelayState(
+void Handler::recoverRelayState(
const Application& application, const HTTPRequest& request, HTTPResponse& response, string& relayState, bool clear
) const
{
relayState.erase();
}
else {
- m_log.error("Storage-backed RelayState with invalid StorageService ID (%s)", ssid.c_str());
+ string msg("Storage-backed RelayState with invalid StorageService ID (");
+ msg += ssid + ')';
+ log(SPRequest::SPError, msg);
relayState.erase();
}
#endif
DDFJanitor jin(in),jout(out);
out = application.getServiceProvider().getListenerService()->send(in);
if (!out.isstring()) {
- m_log.error("StorageService-backed RelayState mechanism did not return a state value.");
+ log(SPRequest::SPError, "StorageService-backed RelayState mechanism did not return a state value.");
relayState.erase();
}
else {
}
}
+AbstractHandler::AbstractHandler(
+ const DOMElement* e, Category& log, DOMNodeFilter* filter, const map<string,string>* remapper
+ ) : m_log(log), m_configNS(shibspconstants::SHIB2SPCONFIG_NS) {
+ load(e,NULL,filter,remapper);
+}
+
+AbstractHandler::~AbstractHandler()
+{
+}
+
+void AbstractHandler::log(SPRequest::SPLogLevel level, const string& msg) const
+{
+ m_log.log(
+ (level == SPRequest::SPDebug ? Priority::DEBUG :
+ (level == SPRequest::SPInfo ? Priority::INFO :
+ (level == SPRequest::SPWarn ? Priority::WARN :
+ (level == SPRequest::SPError ? Priority::ERROR : Priority::CRIT)))),
+ msg
+ );
+}
+
+#ifndef SHIBSP_LITE
+
+const char* Handler::getType() const
+{
+ return getString("type").second;
+}
+
+void AbstractHandler::checkError(const XMLObject* response, const saml2md::RoleDescriptor* role) const
+{
+ const saml2p::StatusResponseType* r2 = dynamic_cast<const saml2p::StatusResponseType*>(response);
+ if (r2) {
+ const saml2p::Status* status = r2->getStatus();
+ if (status) {
+ const saml2p::StatusCode* sc = status->getStatusCode();
+ const XMLCh* code = sc ? sc->getValue() : NULL;
+ if (code && !XMLString::equals(code,saml2p::StatusCode::SUCCESS)) {
+ FatalProfileException ex("SAML response contained an error.");
+ annotateException(&ex, role, status); // throws it
+ }
+ }
+ }
+
+ const saml1p::Response* r1 = dynamic_cast<const saml1p::Response*>(response);
+ if (r1) {
+ const saml1p::Status* status = r1->getStatus();
+ if (status) {
+ const saml1p::StatusCode* sc = status->getStatusCode();
+ const xmltooling::QName* code = sc ? sc->getValue() : NULL;
+ if (code && *code != saml1p::StatusCode::SUCCESS) {
+ FatalProfileException ex("SAML response contained an error.");
+ ex.addProperty("statusCode", code->toString().c_str());
+ if (sc->getStatusCode()) {
+ code = sc->getStatusCode()->getValue();
+ if (code)
+ ex.addProperty("statusCode2", code->toString().c_str());
+ }
+ if (status->getStatusMessage()) {
+ auto_ptr_char msg(status->getStatusMessage()->getMessage());
+ if (msg.get() && *msg.get())
+ ex.addProperty("statusMessage", msg.get());
+ }
+ ex.raise();
+ }
+ }
+ }
+}
+
+void AbstractHandler::fillStatus(saml2p::StatusResponseType& response, const XMLCh* code, const XMLCh* subcode, const char* msg) const
+{
+ saml2p::Status* status = saml2p::StatusBuilder::buildStatus();
+ saml2p::StatusCode* scode = saml2p::StatusCodeBuilder::buildStatusCode();
+ status->setStatusCode(scode);
+ scode->setValue(code);
+ if (subcode) {
+ saml2p::StatusCode* ssubcode = saml2p::StatusCodeBuilder::buildStatusCode();
+ scode->setStatusCode(ssubcode);
+ ssubcode->setValue(subcode);
+ }
+ if (msg) {
+ pair<bool,bool> flag = getBool("detailedErrors", m_configNS.get());
+ auto_ptr_XMLCh widemsg((flag.first && flag.second) ? msg : "Error processing request.");
+ saml2p::StatusMessage* sm = saml2p::StatusMessageBuilder::buildStatusMessage();
+ status->setStatusMessage(sm);
+ sm->setMessage(widemsg.get());
+ }
+ response.setStatus(status);
+}
+
+long AbstractHandler::sendMessage(
+ const MessageEncoder& encoder,
+ XMLObject* msg,
+ const char* relayState,
+ const char* destination,
+ const saml2md::RoleDescriptor* role,
+ const Application& application,
+ HTTPResponse& httpResponse,
+ bool signIfPossible
+ ) const
+{
+ const EntityDescriptor* entity = role ? dynamic_cast<const EntityDescriptor*>(role->getParent()) : NULL;
+ const PropertySet* relyingParty = application.getRelyingParty(entity);
+ pair<bool,const char*> flag = signIfPossible ? make_pair(true,(const char*)"true") : relyingParty->getString("signing");
+ if (role && flag.first &&
+ (!strcmp(flag.second, "true") ||
+ (encoder.isUserAgentPresent() && !strcmp(flag.second, "front")) ||
+ (!encoder.isUserAgentPresent() && !strcmp(flag.second, "back")))) {
+ CredentialResolver* credResolver=application.getCredentialResolver();
+ if (credResolver) {
+ Locker credLocker(credResolver);
+ const Credential* cred = NULL;
+ pair<bool,const char*> keyName = relyingParty->getString("keyName");
+ pair<bool,const XMLCh*> sigalg = relyingParty->getXMLString("signingAlg");
+ if (role) {
+ MetadataCredentialCriteria mcc(*role);
+ mcc.setUsage(Credential::SIGNING_CREDENTIAL);
+ if (keyName.first)
+ mcc.getKeyNames().insert(keyName.second);
+ if (sigalg.first)
+ mcc.setXMLAlgorithm(sigalg.second);
+ cred = credResolver->resolve(&mcc);
+ }
+ else {
+ CredentialCriteria cc;
+ cc.setUsage(Credential::SIGNING_CREDENTIAL);
+ if (keyName.first)
+ cc.getKeyNames().insert(keyName.second);
+ if (sigalg.first)
+ cc.setXMLAlgorithm(sigalg.second);
+ cred = credResolver->resolve(&cc);
+ }
+ if (cred) {
+ // Signed request.
+ return encoder.encode(
+ httpResponse,
+ msg,
+ destination,
+ entity,
+ relayState,
+ &application,
+ cred,
+ sigalg.second,
+ relyingParty->getXMLString("digestAlg").second
+ );
+ }
+ else {
+ m_log.warn("no signing credential resolved, leaving message unsigned");
+ }
+ }
+ else {
+ m_log.warn("no credential resolver installed, leaving message unsigned");
+ }
+ }
+
+ // Unsigned request.
+ return encoder.encode(httpResponse, msg, destination, entity, relayState, &application);
+}
+
+#endif
+
void AbstractHandler::preservePostData(
const Application& application, const HTTPRequest& request, HTTPResponse& response, const char* relayState
) const
/*
- * Copyright 2001-2007 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
}
e = XMLHelper::getNextSiblingElement(e, _SessionInitiator);
}
+
+ m_supportedOptions.insert("isPassive");
}
pair<bool,long> ChainingSessionInitiator::run(SPRequest& request, string& entityID, bool isHandler) const
{
+ if (!checkCompatibility(request, isHandler))
+ return make_pair(false,0L);
+
pair<bool,long> ret;
for (vector<SessionInitiator*>::const_iterator i = m_handlers.begin(); i!=m_handlers.end(); ++i) {
ret = (*i)->run(request, entityID, isHandler);
/*
- * Copyright 2001-2007 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
#include "internal.h"
#include "Application.h"
#include "exceptions.h"
-#include "SPRequest.h"
#include "handler/AbstractHandler.h"
#include "handler/SessionInitiator.h"
{
public:
CookieSessionInitiator(const DOMElement* e, const char* appId)
- : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT".SessionInitiator.Cookie")), m_followMultiple(getBool("followMultiple").second) {
+ : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT".SessionInitiator.Cookie")),
+ m_followMultiple(getBool("followMultiple").second) {
+ m_supportedOptions.insert("isPassive");
}
virtual ~CookieSessionInitiator() {}
pair<bool,long> CookieSessionInitiator::run(SPRequest& request, string& entityID, bool isHandler) const
{
// The IdP CANNOT be specified for us to run.
- if (!entityID.empty())
+ if (!entityID.empty() || !checkCompatibility(request, isHandler))
return make_pair(false,0L);
// If there's no entityID yet, we can check for cookie processing.
/*
- * Copyright 2001-2007 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
#include "internal.h"
#include "Application.h"
#include "exceptions.h"
-#include "SPRequest.h"
#include "handler/AbstractHandler.h"
#include "handler/SessionInitiator.h"
#include "util/TemplateParameters.h"
pair<bool,long> FormSessionInitiator::run(SPRequest& request, string& entityID, bool isHandler) const
{
+ if (!checkCompatibility(request, isHandler))
+ return make_pair(false,0L);
+
string target;
const char* option;
const Application& app=request.getApplication();
/*
- * Copyright 2001-2009 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
#include "Application.h"
#include "exceptions.h"
#include "ServiceProvider.h"
-#include "SPRequest.h"
#include "handler/AbstractHandler.h"
#include "handler/RemotedHandler.h"
#include "handler/SessionInitiator.h"
string address = m_appId + loc.second + "::run::SAML2SI";
setAddress(address.c_str());
}
+
+ m_supportedOptions.insert("isPassive");
}
void SAML2SessionInitiator::setParent(const PropertySet* parent)
}
// We have to know the IdP to function unless this is ECP.
- if (!ECP && (entityID.empty()))
+ if ((!ECP && entityID.empty()) || !checkCompatibility(request, isHandler))
return make_pair(false,0L);
string target;
/*
- * Copyright 2001-2009 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
#include "internal.h"
#include "Application.h"
#include "exceptions.h"
-#include "SPRequest.h"
#include "handler/AbstractHandler.h"
#include "handler/SessionInitiator.h"
url = getString("entityIDParam");
if (url.first)
m_returnParam = url.second;
+ m_supportedOptions.insert("isPassive");
}
virtual ~SAMLDSSessionInitiator() {}
{
// The IdP CANNOT be specified for us to run. Otherwise, we'd be redirecting to a DS
// anytime the IdP's metadata was wrong.
- if (!entityID.empty())
+ if (!entityID.empty() || !checkCompatibility(request, isHandler))
return make_pair(false,0L);
string target;
option = request.getParameter("isPassive");
if (option)
- isPassive = !strcmp(option,"true");
+ isPassive = (*option=='t' || *option=='1');
+ else {
+ pair<bool,bool> passopt = getBool("isPassive");
+ isPassive = passopt.first && passopt.second;
+ }
option = request.getParameter("discoveryURL");
if (option)
// The target resource is the current one and everything else is
// defaulted or set by content policy.
target=request.getRequestURL();
- pair<bool,bool> passopt = getBool("isPassive");
+ pair<bool,bool> passopt = request.getRequestSettings().first->getBool("isPassive");
+ if (!passopt.first)
+ passopt = getBool("isPassive");
isPassive = passopt.first && passopt.second;
discoveryURL = request.getRequestSettings().first->getString("discoveryURL");
}
/*
- * Copyright 2001-2009 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
*/
#include "internal.h"
+#include "exceptions.h"
#include "SPRequest.h"
#include "handler/SessionInitiator.h"
}
#endif
+const set<string>& SessionInitiator::getSupportedOptions() const
+{
+ return m_supportedOptions;
+}
+
+bool SessionInitiator::checkCompatibility(SPRequest& request, bool isHandler) const
+{
+ bool isPassive = false;
+ if (isHandler) {
+ const char* flag = request.getParameter("isPassive");
+ if (flag) {
+ isPassive = (*flag=='1' || *flag=='t');
+ }
+ else {
+ pair<bool,bool> flagprop = getBool("isPassive");
+ isPassive = (flagprop.first && flagprop.second);
+ }
+ }
+ else {
+ // It doesn't really make sense to use isPassive with automated sessions, but...
+ pair<bool,bool> flagprop = request.getRequestSettings().first->getBool("isPassive");
+ if (!flagprop.first)
+ flagprop = getBool("isPassive");
+ isPassive = (flagprop.first && flagprop.second);
+ }
+
+ // Check for support of isPassive if it's used.
+ if (isPassive && getSupportedOptions().count("isPassive") == 0) {
+ if (getParent()) {
+ log(SPRequest::SPInfo, "handler does not support isPassive option");
+ return false;
+ }
+ throw ConfigurationException("Unsupported option (isPassive) supplied to SessionInitiator.");
+ }
+
+ return true;
+}
+
pair<bool,long> SessionInitiator::run(SPRequest& request, bool isHandler) const
{
- const char* entityID=NULL;
+ const char* entityID = NULL;
pair<bool,const char*> param = getString("entityIDParam");
-
if (isHandler) {
- entityID=request.getParameter(param.first ? param.second : "entityID");
+ entityID = request.getParameter(param.first ? param.second : "entityID");
if (!param.first && (!entityID || !*entityID))
entityID=request.getParameter("providerId");
}
if (!entityID || !*entityID) {
- RequestMapper::Settings settings = request.getRequestSettings();
- param = settings.first->getString("entityID");
+ param = request.getRequestSettings().first->getString("entityID");
if (param.first)
entityID = param.second;
}
if (!entityID || !*entityID)
- entityID=getString("entityID").second;
+ entityID = getString("entityID").second;
string copy(entityID ? entityID : "");
- return run(request, copy, isHandler);
+
+ try {
+ return run(request, copy, isHandler);
+ }
+ catch (exception& ex) {
+ // If it's a handler operation, and isPassive is used or returnOnError is set, we trap the error.
+ if (isHandler) {
+ bool returnOnError = false;
+ const char* flag = request.getParameter("isPassive");
+ if (flag && (*flag == 't' || *flag == '1')) {
+ returnOnError = true;
+ }
+ else {
+ pair<bool,bool> flagprop = getBool("isPassive");
+ if (flagprop.first && flagprop.second) {
+ returnOnError = true;
+ }
+ else {
+ flag = request.getParameter("returnOnError");
+ if (flag) {
+ returnOnError = (*flag=='1' || *flag=='t');
+ }
+ else {
+ flagprop = getBool("returnOnError");
+ returnOnError = (flagprop.first && flagprop.second);
+ }
+ }
+ }
+
+ if (returnOnError) {
+ // Log it and attempt to recover relay state so we can get back.
+ log(SPRequest::SPError, ex.what());
+ log(SPRequest::SPInfo, "trapping SessionInitiator error condition and returning to target location");
+ const char* flag = request.getParameter("target");
+ string target(flag ? flag : "");
+ recoverRelayState(request.getApplication(), request, request, target, false);
+ return make_pair(true, request.sendRedirect(target.c_str()));
+ }
+ }
+ throw;
+ }
}
/*
- * Copyright 2001-2009 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
#include "Application.h"
#include "exceptions.h"
#include "ServiceProvider.h"
-#include "SPRequest.h"
#include "handler/AbstractHandler.h"
#include "handler/RemotedHandler.h"
#include "handler/SessionInitiator.h"
pair<bool,long> Shib1SessionInitiator::run(SPRequest& request, string& entityID, bool isHandler) const
{
// We have to know the IdP to function.
- if (entityID.empty())
+ if (entityID.empty() || !checkCompatibility(request, isHandler))
return make_pair(false,0L);
string target;
/*
- * Copyright 2001-2007 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
string address = m_appId + loc.second + "::run::TransformSI";
setAddress(address.c_str());
}
+ m_supportedOptions.insert("isPassive");
#ifndef SHIBSP_LITE
if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
pair<bool,long> TransformSessionInitiator::run(SPRequest& request, string& entityID, bool isHandler) const
{
// We have to have a candidate name to function.
- if (entityID.empty())
+ if (entityID.empty() || !checkCompatibility(request, isHandler))
return make_pair(false,0L);
string target;
/*
- * Copyright 2001-2009 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
{
// The IdP CANNOT be specified for us to run. Otherwise, we'd be redirecting to a WAYF
// anytime the IdP's metadata was wrong.
- if (!entityID.empty())
+ if (!entityID.empty() || !checkCompatibility(request, isHandler))
return make_pair(false,0L);
string target;
projects / shibboleth / cpp-sp.git / commitdiff