/*
* Copyright 2001-2005 Internet2
- *
+ *
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
delete[] m_surName;
delete[] m_company;
}
-
+
ContactType getType() const { return m_type; }
const char* getCompany() const { return m_company; }
const char* getGivenName() const { return m_givenName; }
Iterator<string> getEmailAddresses() const { return m_emails; }
Iterator<string> getTelephoneNumbers() const { return m_phones; }
const DOMElement* getElement() const { return m_root; }
-
+
private:
const DOMElement* m_root;
ContactType m_type;
char* m_company;
vector<string> m_emails,m_phones;
};
-
+
class Organization : public IOrganization
{
public:
Organization(const DOMElement* e);
~Organization() {}
-
+
const char* getName(const char* lang="en") const { return forLang(m_names,lang); }
const char* getDisplayName(const char* lang="en") const { return forLang(m_displays,lang); }
const char* getURL(const char* lang="en") const { return forLang(m_urls,lang); }
const DOMElement* getElement() const { return m_root; }
-
+
private:
const char* forLang(const map<string,string>& m, const char* lang) const {
map<string,string>::const_iterator i=m.find(lang);
};
class EntityDescriptor;
-
+
class EncryptionMethod : public XENCEncryptionMethod
{
public:
EncryptionMethod(const DOMElement* e);
~EncryptionMethod() {}
-
+
const XMLCh * getAlgorithm(void) const { return m_alg; }
const XMLCh * getDigestMethod(void) const { return m_digest; }
const XMLCh * getOAEPparams(void) const { return m_params; }
void setDigestMethod(const XMLCh * method) {throw exception();}
void setOAEPparams(const XMLCh * params) {throw exception();}
void setKeySize(int size) {throw exception();}
-
+
private:
const DOMElement* m_root;
const XMLCh* m_alg;
const XMLCh* m_params;
int m_size;
};
-
+
class KeyDescriptor : public IKeyDescriptor
{
public:
KeyDescriptor(const DOMElement* e);
~KeyDescriptor();
-
+
KeyUse getUse() const { return m_use; }
DSIGKeyInfoList* getKeyInfo() const { return m_klist; }
saml::Iterator<const XENCEncryptionMethod*> getEncryptionMethods() const { return m_methods; }
const DOMElement* getElement() const { return m_root; }
-
+
private:
const DOMElement* m_root;
KeyUse m_use;
mutable DSIGKeyInfoList* m_klist;
vector<const XENCEncryptionMethod*> m_methods;
};
-
+
class KeyAuthority : public IKeyAuthority
{
public:
KeyAuthority(const DOMElement* e);
~KeyAuthority();
-
+
int getVerifyDepth() const { return m_depth; }
Iterator<DSIGKeyInfoList*> getKeyInfos() const { return m_klists; }
-
+
private:
int m_depth;
vector<DSIGKeyInfoList*> m_klists;
};
-
+
class Role : public virtual IRoleDescriptor
{
public:
Role(const EntityDescriptor* provider, time_t validUntil, const DOMElement* e);
~Role();
-
+
// External contract
const IEntityDescriptor* getEntityDescriptor() const {return m_provider;}
Iterator<const XMLCh*> getProtocolSupportEnumeration() const {return m_protocolEnum;}
Iterator<const IContactPerson*> getContactPersons() const
{return (m_contacts.empty() ? m_provider->getContactPersons() : m_contacts);}
const DOMElement* getElement() const {return m_root;}
-
+
protected:
vector<const XMLCh*> m_protocolEnum;
vector<const IKeyDescriptor*> m_keys;
vector<const IContactPerson*> m_contacts;
time_t m_validUntil;
};
-
+
class Endpoint : public virtual IEndpoint
{
public:
Endpoint(const XMLCh* binding, const XMLCh* loc)
: m_root(NULL), m_binding(binding), m_location(loc), m_resploc(NULL) {}
~Endpoint() {}
-
+
const XMLCh* getBinding() const { return m_binding; }
const XMLCh* getLocation() const { return m_location; }
const XMLCh* getResponseLocation() const { return m_resploc; }
const DOMElement* getElement() const { return m_root; }
-
+
private:
const DOMElement* m_root;
const XMLCh* m_binding;
const XMLCh* m_location;
const XMLCh* m_resploc;
};
-
+
class IndexedEndpoint : public Endpoint, public virtual IIndexedEndpoint
{
public:
IndexedEndpoint(const DOMElement* e) : Endpoint(e), m_index(XMLString::parseInt(e->getAttributeNS(NULL,SHIB_L(index)))) {}
unsigned short getIndex() const {return m_index;}
-
+
private:
unsigned short m_index;
};
-
+
class EndpointManager : public IEndpointManager
{
public:
m_soft=e;
}
}
-
+
private:
vector<const IEndpoint*> m_endpoints;
const IEndpoint* m_soft; // Soft default (not explicit)
const IEndpoint* m_hard; // Hard default (explicit)
};
-
+
class SSORole : public Role, public virtual ISSODescriptor
{
public:
const IEndpointManager* getSingleLogoutServiceManager() const {return &m_logout;}
const IEndpointManager* getManageNameIDServiceManager() const {return &m_nameid;}
saml::Iterator<const XMLCh*> getNameIDFormats() const {return m_formats;}
-
+
private:
EndpointManager m_artifact,m_logout,m_nameid;
vector<const XMLCh*> m_formats;
private:
vector<pair<const XMLCh*,bool> > m_scopes;
};
-
+
class IDPRole : public SSORole, public ScopedRole, public virtual IIDPSSODescriptor
{
public:
const IEndpointManager* getAssertionIDRequestServiceManager() const {return &m_idreq;}
saml::Iterator<const XMLCh*> getAttributeProfiles() const {return m_attrprofs;}
saml::Iterator<const saml::SAMLAttribute*> getAttributes() const {return m_attrs;}
-
+
private:
EndpointManager m_sso,m_mapping,m_idreq;
vector<const XMLCh*> m_attrprofs;
saml::Iterator<const XMLCh*> getNameIDFormats() const {return m_formats;}
saml::Iterator<const XMLCh*> getAttributeProfiles() const {return m_attrprofs;}
saml::Iterator<const saml::SAMLAttribute*> getAttributes() const {return m_attrs;}
-
+
private:
EndpointManager m_query,m_idreq;
vector<const XMLCh*> m_formats,m_attrprofs;
vector<const SAMLAttribute*> m_attrs;
};
-
+
class EntityDescriptor : public IExtendedEntityDescriptor
{
public:
const IEntitiesDescriptor* parent=NULL
);
~EntityDescriptor();
-
+
// External contract
const XMLCh* getId() const {return m_id;}
bool isValid() const {return time(NULL) < m_validUntil;}
const IEntitiesDescriptor* parent=NULL
);
~EntitiesDescriptor();
-
+
const XMLCh* getName() const {return m_name;}
bool isValid() const {return time(NULL) < m_validUntil;}
const IEntitiesDescriptor* getEntitiesDescriptor() const {return m_parent;}
Iterator<const IEntityDescriptor*> getEntityDescriptors() const {return m_providers;}
Iterator<const IKeyAuthority*> getKeyAuthorities() const {return m_keyauths;}
const DOMElement* getElement() const {return m_root;}
-
+
// Used internally
time_t getValidUntil() const {return m_validUntil;}
private:
const IEntitiesDescriptor* lookupGroup(const char* name, bool strict=true) const;
const IEntitiesDescriptor* lookupGroup(const XMLCh* name, bool strict=true) const;
pair<const IEntitiesDescriptor*,const IEntityDescriptor*> getRoot() const;
-
+
bool verifySignature(DOMDocument* doc, const DOMElement* parent, bool failUnsigned) const;
-
+
protected:
virtual ReloadableXMLFileImpl* newImplementation(const char* pathname, bool first=true) const;
virtual ReloadableXMLFileImpl* newImplementation(const DOMElement* e, bool first=true) const;
-
+
private:
bool m_exclusions,m_verify;
set<string> m_set;
: m_root(e), m_type(IContactPerson::other), m_givenName(NULL), m_surName(NULL), m_company(NULL)
{
const XMLCh* type=NULL;
-
+
// Old metadata or new?
if (saml::XML::isElementNamed(e,::XML::SHIB_NS,SHIB_L(Contact))) {
type=e->getAttributeNS(NULL,SHIB_L(Type));
e=saml::XML::getNextSiblingElement(e);
}
}
-
+
if (!XMLString::compareString(type,SHIB_L(technical)))
m_type=IContactPerson::technical;
else if (!XMLString::compareString(type,SHIB_L(support)))
m_use=encryption;
else if (!XMLString::compareString(e->getAttributeNS(NULL,SHIB_L(use)),SHIB_L(signing)))
m_use=signing;
-
+
m_klist = new DSIGKeyInfoList(NULL);
// Process ds:KeyInfo
"skipping ds:KeyInfo element containing unsupported children"
);
}
+ catch (XSECException& xe) {
+ auto_ptr_char msg(xe.getMsg());
+ Category::getInstance(XMLPROVIDERS_LOGCAT".Metadata").error("unable to process ds:KeyInfo element: %s",msg.get());
+ }
catch (XSECCryptoException& xe) {
Category::getInstance(XMLPROVIDERS_LOGCAT".Metadata").error("unable to process ds:KeyInfo element: %s",xe.getMsg());
}
-
+
// Check for encryption methods.
e=saml::XML::getNextSiblingElement(e,::XML::SAML2META_NS,SHIB_L(EncryptionMethod));
while (e) {
#endif
if (e->hasAttributeNS(NULL,SHIB_L(VerifyDepth)))
m_depth=XMLString::parseInt(e->getAttributeNS(NULL,SHIB_L(VerifyDepth)));
-
+
// Process ds:KeyInfo children
e=saml::XML::getFirstChildElement(e,saml::XML::XMLSIG_NS,L(KeyInfo));
while (e) {
}
child=saml::XML::getNextSiblingElement(child);
}
-
+
if (klist->getSize()>0)
m_klists.push_back(klist.release());
else
{
// Check the root element namespace. If SAML2, assume it's the std schema.
if (e && !XMLString::compareString(e->getNamespaceURI(),::XML::SAML2META_NS)) {
-
+
if (e->hasAttributeNS(NULL,SHIB_L(validUntil))) {
SAMLDateTime exp(e->getAttributeNS(NULL,SHIB_L(validUntil)));
exp.parseDateTime();
m_validUntil=min(m_validUntil,exp.getEpoch());
}
-
+
if (e->hasAttributeNS(NULL,SHIB_L(errorURL)))
m_errorURL=toUTF8(e->getAttributeNS(NULL,SHIB_L(errorURL)));
-
+
// Chop the protocol list into pieces...assume any whitespace can appear in between.
m_protocolEnumCopy=XMLString::replicate(e->getAttributeNS(NULL,SHIB_L(protocolSupportEnumeration)));
XMLCh* temp=m_protocolEnumCopy;
m_protocolEnum.push_back(start);
while (*temp && XMLChar1_1::isWhitespace(*temp)) temp++;
}
-
+
e=saml::XML::getFirstChildElement(m_root,::XML::SAML2META_NS,SHIB_L(KeyDescriptor));
while (e) {
m_keys.push_back(new KeyDescriptor(e));
else {
nlist=e->getElementsByTagNameNS(::XML::SHIB_NS,SHIB_L(Domain));
}
-
+
for (XMLSize_t i=0; nlist && i < nlist->getLength(); i++) {
const XMLCh* dom=(nlist->item(i)->hasChildNodes()) ? nlist->item(i)->getFirstChild()->getNodeValue() : NULL;
if (dom && *dom) {
if (!XMLString::compareString(e->getNamespaceURI(),::XML::SAML2META_NS)) {
const XMLCh* flag=e->getAttributeNS(NULL,SHIB_L(WantAuthnRequestsSigned));
m_wantAuthnRequestsSigned=(flag && (*flag==chDigit_1 || *flag==chLatin_t));
-
+
// Check for SourceID extension.
DOMElement* ext=saml::XML::getFirstChildElement(e,::XML::SAML2META_NS,SHIB_L(Extensions));
if (ext) {
if (ext && ext->hasChildNodes())
m_sourceId=ext->getFirstChild()->getNodeValue();
}
-
+
XMLSize_t i;
DOMNodeList* nlist=e->getElementsByTagNameNS(::XML::SAML2META_NS,SHIB_L(SingleSignOnService));
for (i=0; nlist && i<nlist->getLength(); i++)
else {
m_id=e->getAttributeNS(NULL,SHIB_L(Name));
m_errorURL=toUTF8(e->getAttributeNS(NULL,SHIB_L(ErrorURL)));
-
+
bool idp=false,aa=false; // only want to build a role once
DOMElement* child=saml::XML::getFirstChildElement(e);
while (child) {
if (m_id && *m_id) {
auto_ptr_char id(m_id);
wrapper->m_sites.insert(pair<const string,const EntityDescriptor*>(id.get(),this));
-
+
// Look for an IdP role, and register the artifact source ID and endpoints.
const IDPRole* idp=NULL;
for (vector<const IRoleDescriptor*>::const_iterator r=m_roles.begin(); r!=m_roles.end(); r++) {
}
}
}
-
+
const XMLCh* v=e->getAttributeNS(NULL,SHIB_L(verify));
m_verify=(v && (*v==chLatin_t || *v==chDigit_1));
string cr_type;
DOMElement* r=saml::XML::getFirstChildElement(e,::XML::CREDS_NS,SHIB_L(FileResolver));
if (r)
- cr_type="edu.internet2.middleware.shibboleth.common.Credentials.FileCredentialResolver";
+ cr_type="edu.internet2.middleware.shibboleth.common.Credentials.FileCredentialResolver";
else {
r=saml::XML::getFirstChildElement(e,::XML::CREDS_NS,SHIB_L(CustomResolver));
if (r) {
cr_type=c.get();
}
}
-
+
if (!cr_type.empty()) {
try {
IPlugIn* plugin=SAMLConfig::getConfig().getPlugMgr().newPlugin(cr_type.c_str(),r);
throw;
}
}
-
+
if (m_verify && !m_credResolver) {
delete m_credResolver;
throw MalformedException("Metadata provider told to verify signatures, but a verification key is not available.");
saml::NDC ndc("verifySignature");
#endif
Category& log=Category::getInstance(XMLPROVIDERS_LOGCAT".Metadata");
-
+
DOMElement* sigNode=saml::XML::getFirstChildElement(parent,saml::XML::XMLSIG_NS,L(Signature));
if (!sigNode) {
if (failUnsigned) {
}
return true;
}
-
+
XSECCryptoX509* cert=NULL;
Iterator<XSECCryptoX509*> certs=m_credResolver->getCertificates();
if (certs.hasNext())
}
}
}
-
+
if (!valid) {
auto_ptr_char temp((URI && *URI) ? URI : null);
log.error("detected an invalid signature profile (Reference URI was %s)",temp.get());
return false;
}
-
+
sig->setSigningKey(cert->clonePublicKey());
if (!sig->verify()) {
auto_ptr_char temp((URI && *URI) ? URI : null);
log.error("detected an invalid signature value (Reference URI was %s)",temp.get());
return false;
}
-
+
prov.releaseSignature(sig);
}
catch(XSECException& e) {
return NULL;
else if (strict && !m_exclusions && m_set.find(providerId)==m_set.end())
return NULL;
-
+
XMLMetadataImpl* impl=dynamic_cast<XMLMetadataImpl*>(getImplementation());
pair<XMLMetadataImpl::sitemap_t::iterator,XMLMetadataImpl::sitemap_t::iterator> range=
impl->m_sites.equal_range(providerId);
for (XMLMetadataImpl::sitemap_t::const_iterator i=range.first; i!=range.second; i++)
if (now < i->second->getValidUntil())
return i->second;
-
+
if (!strict && range.first!=range.second)
return range.first->second;
-
+
return NULL;
}
time_t now=time(NULL);
XMLMetadataImpl* impl=dynamic_cast<XMLMetadataImpl*>(getImplementation());
pair<XMLMetadataImpl::sitemap_t::iterator,XMLMetadataImpl::sitemap_t::iterator> range;
-
+
// Depends on type of artifact.
const SAMLArtifactType0001* type1=dynamic_cast<const SAMLArtifactType0001*>(artifact);
if (type1) {
if (now < i->second->getValidUntil())
return i->second;
}
-
+
return NULL;
}
return NULL;
else if (strict && !m_exclusions && m_set.find(name)==m_set.end())
return NULL;
-
+
XMLMetadataImpl* impl=dynamic_cast<XMLMetadataImpl*>(getImplementation());
pair<XMLMetadataImpl::groupmap_t::iterator,XMLMetadataImpl::groupmap_t::iterator> range=
impl->m_groups.equal_range(name);
for (XMLMetadataImpl::groupmap_t::iterator i=range.first; i!=range.second; i++)
if (now < i->second->getValidUntil())
return i->second;
-
+
if (!strict && range.first!=range.second)
return range.first->second;
-
+
return NULL;
}
projects / shibboleth / cpp-sp.git / commitdiff