From 7fac2e62afd540b4c762bb39d53778a9de2ed309 Mon Sep 17 00:00:00 2001 From: Scott Cantor Date: Thu, 5 May 2016 15:45:17 -0400 Subject: [PATCH] SSPCPP-677 - Filter schacHomeOrganization values against shibmd:Scope https://issues.shibboleth.net/jira/browse/SSPCPP-677 AttributeValueMatchesShibMDScope function type added to code and schema. schacHomeOrganization added to policy and (commented out) to map. --- Projects/vc10/shibsp/shibsp.vcxproj | 2 +- Projects/vc10/shibsp/shibsp.vcxproj.filters | 6 +- configs/attribute-map.xml | 109 +++++++++++---------- configs/attribute-policy.xml | 5 + schemas/shibboleth-2.0-afp-mf-saml.xsd | 11 +++ shibsp/Makefile.am | 2 +- shibsp/attribute/filtering/MatchFunctor.h | 5 +- ....cpp => AttributeMatchesShibMDScopeFunctor.cpp} | 40 ++++++-- shibsp/attribute/filtering/impl/MatchFunctor.cpp | 4 + 9 files changed, 117 insertions(+), 67 deletions(-) rename shibsp/attribute/filtering/impl/{AttributeScopeMatchesShibMDScopeFunctor.cpp => AttributeMatchesShibMDScopeFunctor.cpp} (73%) diff --git a/Projects/vc10/shibsp/shibsp.vcxproj b/Projects/vc10/shibsp/shibsp.vcxproj index daf761a..16ac9cd 100644 --- a/Projects/vc10/shibsp/shibsp.vcxproj +++ b/Projects/vc10/shibsp/shibsp.vcxproj @@ -251,7 +251,7 @@ - + diff --git a/Projects/vc10/shibsp/shibsp.vcxproj.filters b/Projects/vc10/shibsp/shibsp.vcxproj.filters index 929c38e..0552dce 100644 --- a/Projects/vc10/shibsp/shibsp.vcxproj.filters +++ b/Projects/vc10/shibsp/shibsp.vcxproj.filters @@ -141,9 +141,6 @@ Source Files\attribute\filtering\impl - - Source Files\attribute\filtering\impl - Source Files\attribute\filtering\impl @@ -429,6 +426,9 @@ Source Files\attribute\filtering\impl + + Source Files\attribute\filtering\impl + diff --git a/configs/attribute-map.xml b/configs/attribute-map.xml index c163754..febaf90 100644 --- a/configs/attribute-map.xml +++ b/configs/attribute-map.xml @@ -8,30 +8,30 @@ --> - - + + - + - - + + - + - - + + - + - - + + @@ -60,13 +60,12 @@ + + + diff --git a/configs/attribute-policy.xml b/configs/attribute-policy.xml index a2d1742..ba0449f 100644 --- a/configs/attribute-policy.xml +++ b/configs/attribute-policy.xml @@ -58,6 +58,11 @@ + + + + + diff --git a/schemas/shibboleth-2.0-afp-mf-saml.xsd b/schemas/shibboleth-2.0-afp-mf-saml.xsd index 86380b1..4161f58 100644 --- a/schemas/shibboleth-2.0-afp-mf-saml.xsd +++ b/schemas/shibboleth-2.0-afp-mf-saml.xsd @@ -247,6 +247,17 @@ + + + + A match function that ensures that an attribute's value matches a scope given in metadata for the entity or role. + + + + + + + diff --git a/shibsp/Makefile.am b/shibsp/Makefile.am index 6e75bc7..b5dbbb4 100644 --- a/shibsp/Makefile.am +++ b/shibsp/Makefile.am @@ -211,7 +211,7 @@ libshibsp_la_SOURCES = \ attribute/filtering/impl/AttributeRequesterEntityAttributeFunctor.cpp \ attribute/filtering/impl/AttributeIssuerEntityMatcherFunctor.cpp \ attribute/filtering/impl/AttributeRequesterEntityMatcherFunctor.cpp \ - attribute/filtering/impl/AttributeScopeMatchesShibMDScopeFunctor.cpp \ + attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp \ attribute/filtering/impl/RegistrationAuthorityFunctor.cpp \ attribute/resolver/impl/ChainingAttributeResolver.cpp \ attribute/resolver/impl/QueryAttributeResolver.cpp \ diff --git a/shibsp/attribute/filtering/MatchFunctor.h b/shibsp/attribute/filtering/MatchFunctor.h index 8b9ac58..9622665 100644 --- a/shibsp/attribute/filtering/MatchFunctor.h +++ b/shibsp/attribute/filtering/MatchFunctor.h @@ -146,9 +146,12 @@ namespace shibsp { /** Matches based on requester and pluggable criteria. */ extern SHIBSP_API xmltooling::QName AttributeRequesterEntityMatcherType; - /** Matches based on metadata Scope extensions. */ + /** Matches scope based on metadata Scope extensions. */ extern SHIBSP_API xmltooling::QName AttributeScopeMatchesShibMDScopeType; + /** Matches value based on metadata Scope extensions. */ + extern SHIBSP_API xmltooling::QName AttributeValueMatchesShibMDScopeType; + /** Matches based on NameID NameQualifiers. */ extern SHIBSP_API xmltooling::QName NameIDQualifierStringType; diff --git a/shibsp/attribute/filtering/impl/AttributeScopeMatchesShibMDScopeFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp similarity index 73% rename from shibsp/attribute/filtering/impl/AttributeScopeMatchesShibMDScopeFunctor.cpp rename to shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp index c78f0b6..2d64126 100644 --- a/shibsp/attribute/filtering/impl/AttributeScopeMatchesShibMDScopeFunctor.cpp +++ b/shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp @@ -42,12 +42,10 @@ using namespace std; namespace shibsp { - static const XMLCh groupID[] = UNICODE_LITERAL_7(g,r,o,u,p,I,D); - /** - * A match function that ensures that an attributes value's scope matches a scope given in metadata for the entity or role. + * A match function that ensures that a string matches a scope given in metadata for the entity or role. */ - class SHIBSP_DLLLOCAL AttributeScopeMatchesShibMDScopeFunctor : public MatchFunctor + class SHIBSP_DLLLOCAL AbstractAttributeMatchesShibMDScopeFunctor : public MatchFunctor { public: bool evaluatePolicyRequirement(const FilteringContext& filterContext) const { @@ -59,10 +57,10 @@ namespace shibsp { if (!issuer) return false; - const char* scope = attribute.getScope(index); - if (!scope || !*scope) + const char* s = getStringToMatch(attribute, index); + if (!s || !*s) return false; - auto_arrayptr widescope(fromUTF8(scope)); + auto_arrayptr widestr(fromUTF8(s)); const Scope* rule; const Extensions* ext = issuer->getExtensions(); @@ -70,7 +68,7 @@ namespace shibsp { const vector& exts = ext->getUnknownXMLObjects(); for (vector::const_iterator e = exts.begin(); e != exts.end(); ++e) { rule = dynamic_cast(*e); - if (rule && matches(*rule, widescope)) { + if (rule && matches(*rule, widestr)) { return true; } } @@ -81,7 +79,7 @@ namespace shibsp { const vector& exts = ext->getUnknownXMLObjects(); for (vector::const_iterator e = exts.begin(); e != exts.end(); ++e) { rule = dynamic_cast(*e); - if (rule && matches(*rule, widescope)) { + if (rule && matches(*rule, widestr)) { return true; } } @@ -90,6 +88,9 @@ namespace shibsp { return false; } + protected: + virtual const char* getStringToMatch(const Attribute& attribute, size_t index) const = 0; + private: bool matches(const Scope& rule, auto_arrayptr& scope) const { const XMLCh* val = rule.getValue(); @@ -106,9 +107,30 @@ namespace shibsp { } }; + class AttributeScopeMatchesShibMDScopeFunctor : public AbstractAttributeMatchesShibMDScopeFunctor + { + protected: + const char* getStringToMatch(const Attribute& attribute, size_t index) const { + return attribute.getScope(index); + } + }; + + class AttributeValueMatchesShibMDScopeFunctor : public AbstractAttributeMatchesShibMDScopeFunctor + { + protected: + const char* getStringToMatch(const Attribute& attribute, size_t index) const { + return attribute.getString(index); + } + }; + MatchFunctor* SHIBSP_DLLLOCAL AttributeScopeMatchesShibMDScopeFactory(const pair& p) { return new AttributeScopeMatchesShibMDScopeFunctor(); } + MatchFunctor* SHIBSP_DLLLOCAL AttributeValueMatchesShibMDScopeFactory(const pair& p) + { + return new AttributeValueMatchesShibMDScopeFunctor(); + } + }; diff --git a/shibsp/attribute/filtering/impl/MatchFunctor.cpp b/shibsp/attribute/filtering/impl/MatchFunctor.cpp index 689989a..e69c337 100644 --- a/shibsp/attribute/filtering/impl/MatchFunctor.cpp +++ b/shibsp/attribute/filtering/impl/MatchFunctor.cpp @@ -72,6 +72,7 @@ namespace shibsp { DECL_FACTORY(AttributeIssuerEntityMatcher); DECL_FACTORY(AttributeRequesterEntityMatcher); DECL_FACTORY(AttributeScopeMatchesShibMDScope); + DECL_FACTORY(AttributeValueMatchesShibMDScope); DECL_FACTORY(NameIDQualifierString); DECL_FACTORY(AttributeIssuerRegistrationAuthority); DECL_FACTORY(RegistrationAuthority); @@ -104,6 +105,7 @@ namespace shibsp { static const XMLCh AttributeIssuerEntityMatcher[] = UNICODE_LITERAL_28(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,E,n,t,i,t,y,M,a,t,c,h,e,r); static const XMLCh AttributeRequesterEntityMatcher[] = UNICODE_LITERAL_31(A,t,t,r,i,b,u,t,e,R,e,q,u,e,s,t,e,r,E,n,t,i,t,y,M,a,t,c,h,e,r); static const XMLCh AttributeScopeMatchesShibMDScope[] = UNICODE_LITERAL_32(A,t,t,r,i,b,u,t,e,S,c,o,p,e,M,a,t,c,h,e,s,S,h,i,b,M,D,S,c,o,p,e); + static const XMLCh AttributeValueMatchesShibMDScope[] = UNICODE_LITERAL_32(A,t,t,r,i,b,u,t,e,V,a,l,u,e,M,a,t,c,h,e,s,S,h,i,b,M,D,S,c,o,p,e); static const XMLCh NameIDQualifierString[] = UNICODE_LITERAL_21(N,a,m,e,I,D,Q,u,a,l,i,f,i,e,r,S,t,r,i,n,g); static const XMLCh AttributeIssuerRegistrationAuthority[] = UNICODE_LITERAL_36(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,R,e,g,i,s,t,r,a,t,i,o,n,A,u,t,h,o,r,i,t,y); static const XMLCh RegistrationAuthority[] = UNICODE_LITERAL_21(R,e,g,i,s,t,r,a,t,i,o,n,A,u,t,h,o,r,i,t,y); @@ -136,6 +138,7 @@ DECL_SAML_QNAME(EntityAttributeRegexMatch, EntityAttributeRegexMatch); DECL_SAML_QNAME(AttributeIssuerEntityMatcher, AttributeIssuerEntityMatcher); DECL_SAML_QNAME(AttributeRequesterEntityMatcher, AttributeRequesterEntityMatcher); DECL_SAML_QNAME(AttributeScopeMatchesShibMDScope, AttributeScopeMatchesShibMDScope); +DECL_SAML_QNAME(AttributeValueMatchesShibMDScope, AttributeValueMatchesShibMDScope); DECL_SAML_QNAME(NameIDQualifierString, NameIDQualifierString); DECL_SAML_QNAME(AttributeIssuerRegistrationAuthority, AttributeIssuerRegistrationAuthority); DECL_SAML_QNAME(RegistrationAuthority, RegistrationAuthority); @@ -168,6 +171,7 @@ void SHIBSP_API shibsp::registerMatchFunctors() REGISTER_FACTORY(AttributeIssuerEntityMatcher); REGISTER_FACTORY(AttributeRequesterEntityMatcher); REGISTER_FACTORY(AttributeScopeMatchesShibMDScope); + REGISTER_FACTORY(AttributeValueMatchesShibMDScope); REGISTER_FACTORY(NameIDQualifierString); REGISTER_FACTORY(AttributeIssuerRegistrationAuthority); REGISTER_FACTORY(RegistrationAuthority); -- 2.1.4