util/samlquery.cpp

   1 /*\r
   2  *  Copyright 2001-2007 Internet2\r
   3  * \r
   4  * Licensed under the Apache License, Version 2.0 (the "License");\r
   5  * you may not use this file except in compliance with the License.\r
   6  * You may obtain a copy of the License at\r
   7  *\r
   8  *     http://www.apache.org/licenses/LICENSE-2.0\r
   9  *\r
  10  * Unless required by applicable law or agreed to in writing, software\r
  11  * distributed under the License is distributed on an "AS IS" BASIS,\r
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  13  * See the License for the specific language governing permissions and\r
  14  * limitations under the License.\r
  15  */\r
  16 \r
  17 /**\r
  18  * samlquery.cpp\r
  19  * \r
  20  * SAML Attribute Query tool layered on SP configuration\r
  21  */\r
  22 \r
  23 #if defined (_MSC_VER) || defined(__BORLANDC__)\r
  24 # include "config_win32.h"\r
  25 #else\r
  26 # include "config.h"\r
  27 #endif\r
  28 \r
  29 #ifdef WIN32\r
  30 # define _CRT_NONSTDC_NO_DEPRECATE 1\r
  31 # define _CRT_SECURE_NO_DEPRECATE 1\r
  32 #endif\r
  33 \r
  34 #include <shibsp/Application.h>\r
  35 #include <shibsp/exceptions.h>\r
  36 #include <shibsp/SPConfig.h>\r
  37 #include <shibsp/ServiceProvider.h>\r
  38 #include <shibsp/attribute/resolver/AttributeResolver.h>\r
  39 #include <shibsp/binding/SOAPClient.h>\r
  40 #include <shibsp/util/SPConstants.h>\r
  41 \r
  42 #include <saml/binding/SecurityPolicy.h>\r
  43 #include <saml/saml1/binding/SAML1SOAPClient.h>\r
  44 #include <saml/saml1/core/Assertions.h>\r
  45 #include <saml/saml1/core/Protocols.h>\r
  46 #include <saml/saml2/binding/SAML2SOAPClient.h>\r
  47 #include <saml/saml2/core/Protocols.h>\r
  48 #include <saml/saml2/metadata/Metadata.h>\r
  49 #include <xercesc/util/XMLUniDefs.hpp>\r
  50 #include <xmltooling/XMLToolingConfig.h>\r
  51 #include <xmltooling/util/XMLHelper.h>\r
  52 \r
  53 using namespace shibsp;\r
  54 using namespace opensaml::saml1;\r
  55 using namespace opensaml::saml1p;\r
  56 using namespace opensaml::saml2;\r
  57 using namespace opensaml::saml2p;\r
  58 using namespace opensaml::saml2md;\r
  59 using namespace opensaml;\r
  60 using namespace xmltooling;\r
  61 using namespace std;\r
  62 \r
  63 enum samlversion {\r
  64     v10, v11, v20\r
  65 };\r
  66 \r
  67 int main(int argc,char* argv[])\r
  68 {\r
  69     char* n_param=NULL;\r
  70     char* q_param=NULL;\r
  71     char* f_param=NULL;\r
  72     char* a_param=NULL;\r
  73     char* path=NULL;\r
  74     char* config=NULL;\r
  75 \r
  76     for (int i=1; i<argc; i++) {\r
  77         if (!strcmp(argv[i],"-n") && i+1<argc)\r
  78             n_param=argv[++i];\r
  79         else if (!strcmp(argv[i],"-q") && i+1<argc)\r
  80             q_param=argv[++i];\r
  81         else if (!strcmp(argv[i],"-f") && i+1<argc)\r
  82             f_param=argv[++i];\r
  83         else if (!strcmp(argv[i],"-a") && i+1<argc)\r
  84             a_param=argv[++i];\r
  85     }\r
  86 \r
  87     if (!n_param || !q_param) {\r
  88         cerr << "usage: samlquery -n <name> -q <IdP> [-f <format URI> -a <application id>]" << endl;\r
  89         exit(0);\r
  90     }\r
  91     \r
  92     path=getenv("SHIBSP_SCHEMAS");\r
  93     if (!path)\r
  94         path=SHIBSP_SCHEMAS;\r
  95     config=getenv("SHIBSP_CONFIG");\r
  96     if (!config)\r
  97         config=SHIBSP_CONFIG;\r
  98     if (!a_param)\r
  99         a_param="default";\r
 100 \r
 101     XMLToolingConfig::getConfig().log_config(getenv("SHIBSP_LOGGING") ? getenv("SHIBSP_LOGGING") : SHIBSP_LOGGING);\r
 102 \r
 103     SPConfig& conf=SPConfig::getConfig();\r
 104     conf.setFeatures(\r
 105         SPConfig::Metadata |\r
 106         SPConfig::Trust |\r
 107         SPConfig::Credentials |\r
 108         SPConfig::OutOfProcess\r
 109         );\r
 110     if (!conf.init(path))\r
 111         return -10;\r
 112 \r
 113     try {\r
 114         static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h);\r
 115         static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e);\r
 116         DOMDocument* dummydoc=XMLToolingConfig::getConfig().getParser().newDocument();\r
 117         XercesJanitor<DOMDocument> docjanitor(dummydoc);\r
 118         DOMElement* dummy = dummydoc->createElementNS(NULL,path);\r
 119         auto_ptr_XMLCh src(config);\r
 120         dummy->setAttributeNS(NULL,path,src.get());\r
 121         dummy->setAttributeNS(NULL,validate,xmlconstants::XML_ONE);\r
 122 \r
 123         conf.setServiceProvider(conf.ServiceProviderManager.newPlugin(XML_SERVICE_PROVIDER,dummy));\r
 124         conf.getServiceProvider()->init();\r
 125     }\r
 126     catch (exception&) {\r
 127         conf.term();\r
 128         return -20;\r
 129     }\r
 130 \r
 131     ServiceProvider* sp=conf.getServiceProvider();\r
 132     sp->lock();\r
 133 \r
 134     try {\r
 135         const Application* app=sp->getApplication(a_param);\r
 136         if (!app)\r
 137             throw ConfigurationException("Application ($1) not found in configuration.", params(1,a_param));\r
 138 \r
 139         auto_ptr_XMLCh domain(q_param);\r
 140         auto_ptr_XMLCh name(n_param);\r
 141         auto_ptr_XMLCh format(f_param);\r
 142         auto_ptr_XMLCh issuer(app->getString("entityID").second);\r
 143 \r
 144         MetadataProvider* m=app->getMetadataProvider();\r
 145         xmltooling::Locker mlocker(m);\r
 146         const EntityDescriptor* site=m->getEntityDescriptor(domain.get());\r
 147         if (!site)\r
 148             throw MetadataException("Unable to locate metadata for IdP ($1).", params(1,q_param));\r
 149 \r
 150         // Try to locate an AA role.\r
 151         samlversion ver;\r
 152         const AttributeAuthorityDescriptor* AA=NULL;\r
 153         if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML20P_NS))\r
 154             ver = v20;\r
 155         else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML11_PROTOCOL_ENUM))\r
 156             ver = v11;\r
 157         else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML10_PROTOCOL_ENUM))\r
 158             ver = v10;\r
 159         else\r
 160             throw MetadataException("No AttributeAuthority role found in metadata.");\r
 161 \r
 162         shibsp::SecurityPolicy policy(*app);\r
 163         shibsp::SOAPClient soaper(policy);\r
 164         MetadataCredentialCriteria mcc(*AA);\r
 165 \r
 166         if (ver == v20) {\r
 167             auto_ptr_XMLCh binding(samlconstants::SAML20_BINDING_SOAP);\r
 168             opensaml::saml2p::StatusResponseType* srt=NULL;\r
 169             const vector<AttributeService*>& endpoints=AA->getAttributeServices();\r
 170             for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !srt && ep!=endpoints.end(); ++ep) {\r
 171                 try {\r
 172                     if (!XMLString::equals((*ep)->getBinding(),binding.get()))\r
 173                         continue;\r
 174                     auto_ptr_char loc((*ep)->getLocation());\r
 175                     NameID* nameid = NameIDBuilder::buildNameID();\r
 176                     opensaml::saml2::Subject* subject = opensaml::saml2::SubjectBuilder::buildSubject();\r
 177                     subject->setNameID(nameid);\r
 178                     opensaml::saml2p::AttributeQuery* query = opensaml::saml2p::AttributeQueryBuilder::buildAttributeQuery();\r
 179                     query->setSubject(subject);\r
 180                     Issuer* iss = IssuerBuilder::buildIssuer();\r
 181                     query->setIssuer(iss);\r
 182                     nameid->setName(name.get());\r
 183                     nameid->setFormat(format.get() ? format.get() : NameID::TRANSIENT);\r
 184                     nameid->setNameQualifier(domain.get());\r
 185                     iss->setName(issuer.get());\r
 186                     SAML2SOAPClient client(soaper);\r
 187                     client.sendSAML(query, mcc, loc.get());\r
 188                     srt = client.receiveSAML();\r
 189                 }\r
 190                 catch (exception& ex) {\r
 191                     cerr << "Caught exception: " << ex.what() << endl << endl;\r
 192                     soaper.reset();\r
 193                 }\r
 194             }\r
 195 \r
 196             if (!srt)\r
 197                 throw BindingException("Unable to successfully query for attributes.");\r
 198             const opensaml::saml2p::Response* response = dynamic_cast<opensaml::saml2p::Response*>(srt);\r
 199 \r
 200             const vector<opensaml::saml2::Assertion*>& assertions = response->getAssertions();\r
 201             if (assertions.size())\r
 202                 cout << *assertions.front();\r
 203             else\r
 204                 cout << "No assertions found.";\r
 205 \r
 206             delete response;\r
 207         }\r
 208         else {\r
 209             auto_ptr_XMLCh binding(samlconstants::SAML1_BINDING_SOAP);\r
 210             const opensaml::saml1p::Response* response=NULL;\r
 211             const vector<AttributeService*>& endpoints=AA->getAttributeServices();\r
 212             for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !response && ep!=endpoints.end(); ++ep) {\r
 213                 try {\r
 214                     if (!XMLString::equals((*ep)->getBinding(),binding.get()))\r
 215                         continue;\r
 216                     auto_ptr_char loc((*ep)->getLocation());\r
 217                     NameIdentifier* nameid = NameIdentifierBuilder::buildNameIdentifier();\r
 218                     opensaml::saml1::Subject* subject = opensaml::saml1::SubjectBuilder::buildSubject();\r
 219                     subject->setNameIdentifier(nameid);\r
 220                     opensaml::saml1p::AttributeQuery* query = opensaml::saml1p::AttributeQueryBuilder::buildAttributeQuery();\r
 221                     query->setSubject(subject);\r
 222                     Request* request = RequestBuilder::buildRequest();\r
 223                     request->setAttributeQuery(query);\r
 224                     nameid->setName(name.get());\r
 225                     nameid->setFormat(format.get() ? format.get() : shibspconstants::SHIB1_NAMEID_FORMAT_URI);\r
 226                     nameid->setNameQualifier(domain.get());\r
 227                     query->setResource(issuer.get());\r
 228                     request->setMinorVersion(ver==v11 ? 1 : 0);\r
 229                     SAML1SOAPClient client(soaper);\r
 230                     client.sendSAML(request, mcc, loc.get());\r
 231                     response = client.receiveSAML();\r
 232                 }\r
 233                 catch (exception& ex) {\r
 234                     cerr << "Caught exception: " << ex.what() << endl << endl;\r
 235                     soaper.reset();\r
 236                 }\r
 237             }\r
 238 \r
 239             if (!response)\r
 240                 throw BindingException("Unable to successfully query for attributes.");\r
 241 \r
 242             const vector<opensaml::saml1::Assertion*>& assertions = response->getAssertions();\r
 243             if (assertions.size())\r
 244                 cout << *assertions.front();\r
 245             else\r
 246                 cout << "No assertions found.";\r
 247 \r
 248             delete const_cast<opensaml::saml1p::Response*>(response);\r
 249         }\r
 250     }\r
 251     catch(exception& ex) {\r
 252         cerr << ex.what() << endl;\r
 253     }\r
 254 \r
 255     sp->unlock();\r
 256     conf.term();\r
 257     return 0;\r
 258 }\r