2 * Copyright 2001-2006 Internet2
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 * @file saml/saml2/core/Assertions.h
20 * XMLObjects representing the SAML 2.0 Assertions schema
23 #ifndef __saml2_assertions_h__
24 #define __saml2_assertions_h__
26 #include <saml/RootObject.h>
27 #include <saml/util/SAMLConstants.h>
29 #include <xmltooling/XMLObjectBuilder.h>
30 #include <xmltooling/encryption/Encryption.h>
31 #include <xmltooling/signature/KeyResolver.h>
32 #include <xmltooling/signature/Signature.h>
33 #include <xmltooling/util/DateTime.h>
35 #define DECL_SAML2OBJECTBUILDER(cname) \
36 DECL_XMLOBJECTBUILDER(SAML_API,cname,samlconstants::SAML20_NS,samlconstants::SAML20_PREFIX)
41 * @namespace opensaml::saml2
42 * SAML 2.0 assertion namespace
47 class SAML_API Assertion;
48 class SAML_API EncryptedAssertion;
50 DECL_XMLOBJECT_SIMPLE(SAML_API,AssertionIDRef,AssertionID,SAML 2.0 AssertionIDRef element);
51 DECL_XMLOBJECT_SIMPLE(SAML_API,AssertionURIRef,AssertionURI,SAML 2.0 AssertionURIRef element);
52 DECL_XMLOBJECT_SIMPLE(SAML_API,Audience,AudienceURI,SAML 2.0 Audience element);
53 DECL_XMLOBJECT_SIMPLE(SAML_API,AuthnContextClassRef,Reference,SAML 2.0 AuthnContextClassRef element);
54 DECL_XMLOBJECT_SIMPLE(SAML_API,AuthnContextDeclRef,Reference,SAML 2.0 AuthnContextDeclRef element);
55 DECL_XMLOBJECT_SIMPLE(SAML_API,AuthenticatingAuthority,ID,SAML 2.0 AuthenticatingAuthority element);
57 BEGIN_XMLOBJECT(SAML_API,EncryptedElementType,xmltooling::XMLObject,SAML 2.0 EncryptedElementType type);
58 DECL_TYPED_FOREIGN_CHILD(EncryptedData,xmlencryption);
59 DECL_TYPED_FOREIGN_CHILDREN(EncryptedKey,xmlencryption);
60 /** EncryptedElementType local name */
61 static const XMLCh TYPE_NAME[];
64 * Decrypts the element using a standard approach based on a wrapped decryption key
65 * inside the message. The key decryption key should be supplied using the provided
66 * resolver. The recipient name may be used when multiple encrypted keys are found.
67 * The object returned will be unmarshalled around the decrypted DOM element, but the
68 * DOM itself will be released.
70 * @param KEKresolver resolver supplying key decryption key
71 * @param recipient identifier naming the recipient (the entity performing the decryption)
72 * @return the decrypted and unmarshalled object
74 virtual xmltooling::XMLObject* decrypt(xmlsignature::KeyResolver* KEKresolver, const XMLCh* recipient) const=0;
77 BEGIN_XMLOBJECT(SAML_API,EncryptedID,EncryptedElementType,SAML 2.0 EncryptedID element);
80 BEGIN_XMLOBJECT(SAML_API,BaseID,xmltooling::XMLObject,SAML 2.0 BaseID abstract element);
81 DECL_STRING_ATTRIB(NameQualifier,NAMEQUALIFIER);
82 DECL_STRING_ATTRIB(SPNameQualifier,SPNAMEQUALIFIER);
85 BEGIN_XMLOBJECT(SAML_API,NameIDType,xmltooling::XMLObject,SAML 2.0 NameIDType type);
86 DECL_STRING_ATTRIB(NameQualifier,NAMEQUALIFIER);
87 DECL_STRING_ATTRIB(SPNameQualifier,SPNAMEQUALIFIER);
88 DECL_STRING_ATTRIB(Format,FORMAT);
89 DECL_STRING_ATTRIB(SPProvidedID,SPPROVIDEDID);
90 DECL_SIMPLE_CONTENT(Name);
91 /** NameIDType local name */
92 static const XMLCh TYPE_NAME[];
93 /** Unspecified name format ID */
94 static const XMLCh UNSPECIFIED[];
95 /** Email address name format ID */
96 static const XMLCh EMAIL[];
97 /** X.509 subject name format ID */
98 static const XMLCh X509_SUBJECT[];
99 /** Windows domain qualified name format ID */
100 static const XMLCh WIN_DOMAIN_QUALIFIED[];
101 /** Kerberos principal name format ID */
102 static const XMLCh KERBEROS[];
103 /** Entity identifier name format ID */
104 static const XMLCh ENTITY[];
105 /** Persistent identifier name format ID */
106 static const XMLCh PERSISTENT[];
107 /** Transient identifier name format ID */
108 static const XMLCh TRANSIENT[];
111 BEGIN_XMLOBJECT(SAML_API,NameID,NameIDType,SAML 2.0 NameID element);
114 BEGIN_XMLOBJECT(SAML_API,Issuer,NameIDType,SAML 2.0 Issuer element);
117 BEGIN_XMLOBJECT(SAML_API,Condition,xmltooling::XMLObject,SAML 2.0 Condition element);
120 BEGIN_XMLOBJECT(SAML_API,AudienceRestriction,Condition,SAML 2.0 AudienceRestriction element);
121 DECL_TYPED_CHILDREN(Audience);
122 /** AudienceRestrictionType local name */
123 static const XMLCh TYPE_NAME[];
126 BEGIN_XMLOBJECT(SAML_API,OneTimeUse,Condition,SAML 2.0 OneTimeUse element);
127 /** OneTimeUseType local name */
128 static const XMLCh TYPE_NAME[];
131 BEGIN_XMLOBJECT(SAML_API,ProxyRestriction,Condition,SAML 2.0 ProxyRestriction element);
132 DECL_INTEGER_ATTRIB(Count,COUNT);
133 DECL_TYPED_CHILDREN(Audience);
134 /** ProxyRestrictionType local name */
135 static const XMLCh TYPE_NAME[];
138 BEGIN_XMLOBJECT(SAML_API,Conditions,xmltooling::XMLObject,SAML 2.0 Conditions element);
139 DECL_DATETIME_ATTRIB(NotBefore,NOTBEFORE);
140 DECL_DATETIME_ATTRIB(NotOnOrAfter,NOTONORAFTER);
141 DECL_TYPED_CHILDREN(AudienceRestriction);
142 DECL_TYPED_CHILDREN(OneTimeUse);
143 DECL_TYPED_CHILDREN(ProxyRestriction);
144 DECL_TYPED_CHILDREN(Condition);
145 /** ConditionsType local name */
146 static const XMLCh TYPE_NAME[];
149 BEGIN_XMLOBJECT(SAML_API,SubjectConfirmationData,xmltooling::ElementProxy,SAML 2.0 SubjectConfirmationData element);
150 DECL_DATETIME_ATTRIB(NotBefore,NOTBEFORE);
151 DECL_DATETIME_ATTRIB(NotOnOrAfter,NOTONORAFTER);
152 DECL_STRING_ATTRIB(Recipient,RECIPIENT);
153 DECL_STRING_ATTRIB(InResponseTo,INRESPONSETO);
154 DECL_STRING_ATTRIB(Address,ADDRESS);
155 DECL_SIMPLE_CONTENT(Data);
158 BEGIN_XMLOBJECT(SAML_API,KeyInfoConfirmationDataType,xmltooling::AttributeExtensibleXMLObject,SAML 2.0 KeyInfoConfirmationDataType type);
159 DECL_DATETIME_ATTRIB(NotBefore,NOTBEFORE);
160 DECL_DATETIME_ATTRIB(NotOnOrAfter,NOTONORAFTER);
161 DECL_STRING_ATTRIB(Recipient,RECIPIENT);
162 DECL_STRING_ATTRIB(InResponseTo,INRESPONSETO);
163 DECL_STRING_ATTRIB(Address,ADDRESS);
164 DECL_TYPED_FOREIGN_CHILDREN(KeyInfo,xmlsignature);
165 /** KeyInfoConfirmationDataType local name */
166 static const XMLCh TYPE_NAME[];
169 BEGIN_XMLOBJECT(SAML_API,SubjectConfirmation,xmltooling::XMLObject,SAML 2.0 SubjectConfirmation element);
170 DECL_STRING_ATTRIB(Method,METHOD);
171 DECL_TYPED_CHILD(BaseID);
172 DECL_TYPED_CHILD(NameID);
173 DECL_TYPED_CHILD(EncryptedID);
174 DECL_XMLOBJECT_CHILD(SubjectConfirmationData);
175 DECL_TYPED_CHILD(KeyInfoConfirmationDataType);
176 /** SubjectConfirmationType local name */
177 static const XMLCh TYPE_NAME[];
178 /** Bearer confirmation method */
179 static const XMLCh BEARER[];
180 /** Holder of key confirmation method */
181 static const XMLCh HOLDER_KEY[];
182 /** Sender vouches confirmation method */
183 static const XMLCh SENDER_VOUCHES[];
186 BEGIN_XMLOBJECT(SAML_API,Subject,xmltooling::XMLObject,SAML 2.0 Subject element);
187 DECL_TYPED_CHILD(BaseID);
188 DECL_TYPED_CHILD(NameID);
189 DECL_TYPED_CHILD(EncryptedID);
190 DECL_TYPED_CHILDREN(SubjectConfirmation);
191 /** SubjectType local name */
192 static const XMLCh TYPE_NAME[];
195 BEGIN_XMLOBJECT(SAML_API,Statement,xmltooling::XMLObject,SAML 2.0 Statement element);
198 BEGIN_XMLOBJECT(SAML_API,SubjectLocality,xmltooling::XMLObject,SAML 2.0 SubjectLocality element);
199 DECL_STRING_ATTRIB(Address,ADDRESS);
200 DECL_STRING_ATTRIB(DNSName,DNSNAME);
201 /** SubjectLocalityType local name */
202 static const XMLCh TYPE_NAME[];
205 BEGIN_XMLOBJECT(SAML_API,AuthnContextDecl,xmltooling::ElementProxy,SAML 2.0 AuthnContextDecl element);
208 BEGIN_XMLOBJECT(SAML_API,AuthnContext,xmltooling::XMLObject,SAML 2.0 AuthnContext element);
209 DECL_TYPED_CHILD(AuthnContextClassRef);
210 DECL_XMLOBJECT_CHILD(AuthnContextDecl);
211 DECL_TYPED_CHILD(AuthnContextDeclRef);
212 DECL_TYPED_CHILDREN(AuthenticatingAuthority);
213 /** AuthnContextType local name */
214 static const XMLCh TYPE_NAME[];
217 BEGIN_XMLOBJECT(SAML_API,AuthnStatement,Statement,SAML 2.0 AuthnStatement element);
218 DECL_DATETIME_ATTRIB(AuthnInstant,AUTHNINSTANT);
219 DECL_STRING_ATTRIB(SessionIndex,SESSIONINDEX);
220 DECL_DATETIME_ATTRIB(SessionNotOnOrAfter,SESSIONNOTONORAFTER);
221 DECL_TYPED_CHILD(SubjectLocality);
222 DECL_TYPED_CHILD(AuthnContext);
223 /** AuthnStatementType local name */
224 static const XMLCh TYPE_NAME[];
227 BEGIN_XMLOBJECT(SAML_API,Action,xmltooling::XMLObject,SAML 2.0 Action element);
228 DECL_STRING_ATTRIB(Namespace,NAMESPACE);
229 DECL_SIMPLE_CONTENT(Action);
230 /** ActionType local name */
231 static const XMLCh TYPE_NAME[];
232 /** Read/Write/Execute/Delete/Control Action Namespace */
233 static const XMLCh RWEDC_NEG_ACTION_NAMESPACE[];
234 /** Read/Write/Execute/Delete/Control with Negation Action Namespace */
235 static const XMLCh RWEDC_ACTION_NAMESPACE[];
236 /** Get/Head/Put/Post Action Namespace */
237 static const XMLCh GHPP_ACTION_NAMESPACE[];
238 /** UNIX File Permissions Action Namespace */
239 static const XMLCh UNIX_ACTION_NAMESPACE[];
242 BEGIN_XMLOBJECT(SAML_API,Evidence,xmltooling::XMLObject,SAML 2.0 Evidence element);
243 DECL_TYPED_CHILDREN(AssertionIDRef);
244 DECL_TYPED_CHILDREN(AssertionURIRef);
245 DECL_TYPED_CHILDREN(Assertion);
246 DECL_TYPED_CHILDREN(EncryptedAssertion);
247 /** EvidenceType local name */
248 static const XMLCh TYPE_NAME[];
251 BEGIN_XMLOBJECT(SAML_API,AuthzDecisionStatement,Statement,SAML 2.0 AuthzDecisionStatement element);
252 DECL_STRING_ATTRIB(Resource,RESOURCE);
253 DECL_STRING_ATTRIB(Decision,DECISION);
254 DECL_TYPED_CHILDREN(Action);
255 DECL_TYPED_CHILD(Evidence);
256 /** AuthzDecisionStatementType local name */
257 static const XMLCh TYPE_NAME[];
258 /** Permit Decision */
259 static const XMLCh DECISION_PERMIT[];
261 static const XMLCh DECISION_DENY[];
262 /** Indeterminate Decision */
263 static const XMLCh DECISION_INDETERMINATE[];
266 BEGIN_XMLOBJECT(SAML_API,AttributeValue,xmltooling::ElementProxy,SAML 2.0 AttributeValue element);
269 BEGIN_XMLOBJECT(SAML_API,Attribute,xmltooling::AttributeExtensibleXMLObject,SAML 2.0 Attribute element);
270 DECL_STRING_ATTRIB(Name,NAME);
271 DECL_STRING_ATTRIB(NameFormat,NAMEFORMAT);
272 DECL_STRING_ATTRIB(FriendlyName,FRIENDLYNAME);
273 DECL_XMLOBJECT_CHILDREN(AttributeValue);
274 /** AttributeType local name */
275 static const XMLCh TYPE_NAME[];
276 /** Unspecified attribute name format ID */
277 static const XMLCh UNSPECIFIED[];
278 /** URI reference attribute name format ID */
279 static const XMLCh URI_REFERENCE[];
280 /** Basic attribute name format ID */
281 static const XMLCh BASIC[];
284 BEGIN_XMLOBJECT(SAML_API,EncryptedAttribute,EncryptedElementType,SAML 2.0 EncryptedAttribute element);
287 BEGIN_XMLOBJECT(SAML_API,AttributeStatement,Statement,SAML 2.0 AttributeStatement element);
288 DECL_TYPED_CHILDREN(Attribute);
289 DECL_TYPED_CHILDREN(EncryptedAttribute);
290 /** AttributeStatementType local name */
291 static const XMLCh TYPE_NAME[];
294 BEGIN_XMLOBJECT(SAML_API,EncryptedAssertion,EncryptedElementType,SAML 2.0 EncryptedAssertion element);
297 BEGIN_XMLOBJECT(SAML_API,Advice,xmltooling::ElementExtensibleXMLObject,SAML 2.0 Advice element);
298 DECL_TYPED_CHILDREN(AssertionIDRef);
299 DECL_TYPED_CHILDREN(AssertionURIRef);
300 DECL_TYPED_CHILDREN(Assertion);
301 DECL_TYPED_CHILDREN(EncryptedAssertion);
302 /** AdviceType local name */
303 static const XMLCh TYPE_NAME[];
307 * SAML 2.0 assertion or protocol message.
309 class SAML_API RootObject : virtual public opensaml::RootObject
314 virtual ~RootObject() {}
316 /** Gets the Version attribute. */
317 virtual const XMLCh* getVersion() const=0;
319 /** Gets the Issuer. */
320 virtual Issuer* getIssuer() const=0;
323 BEGIN_XMLOBJECT(SAML_API,Assertion,saml2::RootObject,SAML 2.0 Assertion element);
324 bool isAssertion() const {
327 DECL_INHERITED_STRING_ATTRIB(Version,VER);
328 DECL_INHERITED_STRING_ATTRIB(ID,ID);
329 DECL_INHERITED_DATETIME_ATTRIB(IssueInstant,ISSUEINSTANT);
330 DECL_INHERITED_TYPED_CHILD(Issuer);
331 DECL_INHERITED_TYPED_FOREIGN_CHILD(Signature,xmlsignature);
332 DECL_TYPED_CHILD(Subject);
333 DECL_TYPED_CHILD(Conditions);
334 DECL_TYPED_CHILD(Advice);
335 DECL_TYPED_CHILDREN(Statement);
336 DECL_TYPED_CHILDREN(AuthnStatement);
337 DECL_TYPED_CHILDREN(AttributeStatement);
338 DECL_TYPED_CHILDREN(AuthzDecisionStatement);
339 /** AssertionType local name */
340 static const XMLCh TYPE_NAME[];
343 DECL_SAML2OBJECTBUILDER(Action);
344 DECL_SAML2OBJECTBUILDER(Advice);
345 DECL_SAML2OBJECTBUILDER(Assertion);
346 DECL_SAML2OBJECTBUILDER(AssertionIDRef);
347 DECL_SAML2OBJECTBUILDER(AssertionURIRef);
348 DECL_SAML2OBJECTBUILDER(Attribute);
349 DECL_SAML2OBJECTBUILDER(AttributeStatement);
350 DECL_SAML2OBJECTBUILDER(AttributeValue);
351 DECL_SAML2OBJECTBUILDER(Audience);
352 DECL_SAML2OBJECTBUILDER(AudienceRestriction);
353 DECL_SAML2OBJECTBUILDER(AuthenticatingAuthority);
354 DECL_SAML2OBJECTBUILDER(AuthnContext);
355 DECL_SAML2OBJECTBUILDER(AuthnContextClassRef);
356 DECL_SAML2OBJECTBUILDER(AuthnContextDecl);
357 DECL_SAML2OBJECTBUILDER(AuthnContextDeclRef);
358 DECL_SAML2OBJECTBUILDER(AuthnStatement);
359 DECL_SAML2OBJECTBUILDER(AuthzDecisionStatement);
360 DECL_SAML2OBJECTBUILDER(Conditions);
361 DECL_SAML2OBJECTBUILDER(EncryptedAssertion);
362 DECL_SAML2OBJECTBUILDER(EncryptedAttribute);
363 DECL_SAML2OBJECTBUILDER(EncryptedID);
364 DECL_SAML2OBJECTBUILDER(Evidence);
365 DECL_SAML2OBJECTBUILDER(Issuer);
366 DECL_SAML2OBJECTBUILDER(NameID);
367 DECL_SAML2OBJECTBUILDER(OneTimeUse);
368 DECL_SAML2OBJECTBUILDER(ProxyRestriction);
369 DECL_SAML2OBJECTBUILDER(Subject);
370 DECL_SAML2OBJECTBUILDER(SubjectConfirmation);
371 DECL_SAML2OBJECTBUILDER(SubjectConfirmationData);
372 DECL_SAML2OBJECTBUILDER(SubjectLocality);
375 * Builder for NameIDType objects.
377 * This is customized to force the element name to be specified.
379 class SAML_API NameIDTypeBuilder : public xmltooling::XMLObjectBuilder {
381 virtual ~NameIDTypeBuilder() {}
382 /** Builder that allows element/type override. */
383 #ifdef HAVE_COVARIANT_RETURNS
384 virtual NameIDType* buildObject(
386 virtual xmltooling::XMLObject* buildObject(
388 const XMLCh* nsURI, const XMLCh* localName, const XMLCh* prefix=NULL, const xmltooling::QName* schemaType=NULL
391 /** Singleton builder. */
392 static NameIDType* buildNameIDType(const XMLCh* nsURI, const XMLCh* localName, const XMLCh* prefix=NULL) {
393 const NameIDTypeBuilder* b = dynamic_cast<const NameIDTypeBuilder*>(
394 XMLObjectBuilder::getBuilder(xmltooling::QName(samlconstants::SAML20_NS,NameIDType::TYPE_NAME))
397 xmltooling::QName schemaType(samlconstants::SAML20_NS,NameIDType::TYPE_NAME,samlconstants::SAML20_PREFIX);
398 #ifdef HAVE_COVARIANT_RETURNS
399 return b->buildObject(nsURI, localName, prefix, &schemaType);
401 return dynamic_cast<NameIDType*>(b->buildObject(nsURI, localName, prefix, &schemaType));
404 throw xmltooling::XMLObjectException("Unable to obtain typed builder for NameIDType.");
409 * Builder for KeyInfoConfirmationDataType objects.
411 * This is customized to return a SubjectConfirmationData element with an
412 * xsi:type of KeyInfoConfirmationDataType.
414 class SAML_API KeyInfoConfirmationDataTypeBuilder : public xmltooling::XMLObjectBuilder {
416 virtual ~KeyInfoConfirmationDataTypeBuilder() {}
417 /** Default builder. */
418 #ifdef HAVE_COVARIANT_RETURNS
419 virtual KeyInfoConfirmationDataType* buildObject() const {
421 virtual xmltooling::XMLObject* buildObject() const {
423 xmltooling::QName schemaType(
424 samlconstants::SAML20_NS,KeyInfoConfirmationDataType::TYPE_NAME,samlconstants::SAML20_PREFIX
427 samlconstants::SAML20_NS,KeyInfoConfirmationDataType::LOCAL_NAME,samlconstants::SAML20_PREFIX,&schemaType
430 /** Builder that allows element/type override. */
431 #ifdef HAVE_COVARIANT_RETURNS
432 virtual KeyInfoConfirmationDataType* buildObject(
434 virtual xmltooling::XMLObject* buildObject(
436 const XMLCh* nsURI, const XMLCh* localName, const XMLCh* prefix=NULL, const xmltooling::QName* schemaType=NULL
439 /** Singleton builder. */
440 static KeyInfoConfirmationDataType* buildKeyInfoConfirmationDataType() {
441 const KeyInfoConfirmationDataTypeBuilder* b = dynamic_cast<const KeyInfoConfirmationDataTypeBuilder*>(
442 XMLObjectBuilder::getBuilder(xmltooling::QName(samlconstants::SAML20_NS,KeyInfoConfirmationDataType::TYPE_NAME))
445 #ifdef HAVE_COVARIANT_RETURNS
446 return b->buildObject();
448 return dynamic_cast<KeyInfoConfirmationDataType*>(b->buildObject());
450 throw xmltooling::XMLObjectException("Unable to obtain typed builder for KeyInfoConfirmationDataType.");
455 * Registers builders and validators for SAML 2.0 Assertion classes into the runtime.
457 void SAML_API registerAssertionClasses();
461 #endif /* __saml2_assertions_h__ */