util/samlquery.cpp

   1 /*\r
   2  *  Copyright 2001-2007 Internet2\r
   3  * \r
   4  * Licensed under the Apache License, Version 2.0 (the "License");\r
   5  * you may not use this file except in compliance with the License.\r
   6  * You may obtain a copy of the License at\r
   7  *\r
   8  *     http://www.apache.org/licenses/LICENSE-2.0\r
   9  *\r
  10  * Unless required by applicable law or agreed to in writing, software\r
  11  * distributed under the License is distributed on an "AS IS" BASIS,\r
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  13  * See the License for the specific language governing permissions and\r
  14  * limitations under the License.\r
  15  */\r
  16 \r
  17 /**\r
  18  * samlquery.cpp\r
  19  * \r
  20  * SAML Attribute Query tool layered on SP configuration\r
  21  */\r
  22 \r
  23 #if defined (_MSC_VER) || defined(__BORLANDC__)\r
  24 # include "config_win32.h"\r
  25 #else\r
  26 # include "config.h"\r
  27 #endif\r
  28 \r
  29 #ifdef WIN32\r
  30 # define _CRT_NONSTDC_NO_DEPRECATE 1\r
  31 # define _CRT_SECURE_NO_DEPRECATE 1\r
  32 #endif\r
  33 \r
  34 #include <shibsp/Application.h>\r
  35 #include <shibsp/exceptions.h>\r
  36 #include <shibsp/SPConfig.h>\r
  37 #include <shibsp/ServiceProvider.h>\r
  38 #include <shibsp/binding/SOAPClient.h>\r
  39 #include <shibsp/util/SPConstants.h>\r
  40 \r
  41 #include <saml/binding/SecurityPolicy.h>\r
  42 #include <saml/saml1/binding/SAML1SOAPClient.h>\r
  43 #include <saml/saml1/core/Assertions.h>\r
  44 #include <saml/saml1/core/Protocols.h>\r
  45 #include <saml/saml2/binding/SAML2SOAPClient.h>\r
  46 #include <saml/saml2/core/Protocols.h>\r
  47 #include <saml/saml2/metadata/Metadata.h>\r
  48 #include <xercesc/util/XMLUniDefs.hpp>\r
  49 #include <xmltooling/XMLToolingConfig.h>\r
  50 #include <xmltooling/util/XMLHelper.h>\r
  51 \r
  52 using namespace shibsp;\r
  53 using namespace opensaml::saml1;\r
  54 using namespace opensaml::saml1p;\r
  55 using namespace opensaml::saml2;\r
  56 using namespace opensaml::saml2p;\r
  57 using namespace opensaml::saml2md;\r
  58 using namespace opensaml;\r
  59 using namespace xmltooling;\r
  60 using namespace std;\r
  61 \r
  62 enum samlversion {\r
  63     v10, v11, v20\r
  64 };\r
  65 \r
  66 int main(int argc,char* argv[])\r
  67 {\r
  68     char* n_param=NULL;\r
  69     char* q_param=NULL;\r
  70     char* f_param=NULL;\r
  71     char* a_param=NULL;\r
  72     char* path=NULL;\r
  73     char* config=NULL;\r
  74 \r
  75     for (int i=1; i<argc; i++) {\r
  76         if (!strcmp(argv[i],"-n") && i+1<argc)\r
  77             n_param=argv[++i];\r
  78         else if (!strcmp(argv[i],"-q") && i+1<argc)\r
  79             q_param=argv[++i];\r
  80         else if (!strcmp(argv[i],"-f") && i+1<argc)\r
  81             f_param=argv[++i];\r
  82         else if (!strcmp(argv[i],"-a") && i+1<argc)\r
  83             a_param=argv[++i];\r
  84     }\r
  85 \r
  86     if (!n_param || !q_param) {\r
  87         cerr << "usage: samlquery -n <name> -q <IdP> [-f <format URI> -a <application id>]" << endl;\r
  88         exit(0);\r
  89     }\r
  90     \r
  91     path=getenv("SHIBSP_SCHEMAS");\r
  92     if (!path)\r
  93         path=SHIBSP_SCHEMAS;\r
  94     config=getenv("SHIBSP_CONFIG");\r
  95     if (!config)\r
  96         config=SHIBSP_CONFIG;\r
  97     if (!a_param)\r
  98         a_param="default";\r
  99 \r
 100     XMLToolingConfig::getConfig().log_config(getenv("SHIBSP_LOGGING") ? getenv("SHIBSP_LOGGING") : SHIBSP_LOGGING);\r
 101 \r
 102     SPConfig& conf=SPConfig::getConfig();\r
 103     conf.setFeatures(\r
 104         SPConfig::Metadata |\r
 105         SPConfig::Trust |\r
 106         SPConfig::Credentials |\r
 107         SPConfig::AttributeResolver |\r
 108         SPConfig::OutOfProcess\r
 109         );\r
 110     if (!conf.init(path))\r
 111         return -10;\r
 112 \r
 113     try {\r
 114         static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h);\r
 115         static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e);\r
 116         DOMDocument* dummydoc=XMLToolingConfig::getConfig().getParser().newDocument();\r
 117         XercesJanitor<DOMDocument> docjanitor(dummydoc);\r
 118         DOMElement* dummy = dummydoc->createElementNS(NULL,path);\r
 119         auto_ptr_XMLCh src(config);\r
 120         dummy->setAttributeNS(NULL,path,src.get());\r
 121         dummy->setAttributeNS(NULL,validate,xmlconstants::XML_ONE);\r
 122 \r
 123         conf.setServiceProvider(conf.ServiceProviderManager.newPlugin(XML_SERVICE_PROVIDER,dummy));\r
 124         conf.getServiceProvider()->init();\r
 125     }\r
 126     catch (exception&) {\r
 127         conf.term();\r
 128         return -20;\r
 129     }\r
 130 \r
 131     ServiceProvider* sp=conf.getServiceProvider();\r
 132     sp->lock();\r
 133 \r
 134     try {\r
 135         const Application* app=sp->getApplication(a_param);\r
 136         if (!app)\r
 137             throw ConfigurationException("Application ($1) not found in configuration.", params(1,a_param));\r
 138 \r
 139         auto_ptr_XMLCh domain(q_param);\r
 140         auto_ptr_XMLCh name(n_param);\r
 141         auto_ptr_XMLCh format(f_param);\r
 142         auto_ptr_XMLCh issuer(app->getString("providerId").second);\r
 143 \r
 144         MetadataProvider* m=app->getMetadataProvider();\r
 145         xmltooling::Locker mlocker(m);\r
 146         const EntityDescriptor* site=m->getEntityDescriptor(domain.get());\r
 147         if (!site)\r
 148             throw MetadataException("Unable to locate metadata for IdP ($1).", params(1,q_param));\r
 149 \r
 150         // Try to locate an AA role.\r
 151         samlversion ver;\r
 152         const AttributeAuthorityDescriptor* AA=NULL;\r
 153         if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML20P_NS))\r
 154             ver = v20;\r
 155         else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML11_PROTOCOL_ENUM))\r
 156             ver = v11;\r
 157         else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML10_PROTOCOL_ENUM))\r
 158             ver = v10;\r
 159         else\r
 160             throw MetadataException("No AttributeAuthority role found in metadata.");\r
 161 \r
 162         SecurityPolicy policy;\r
 163         shibsp::SOAPClient soaper(*app,policy);\r
 164 \r
 165         if (ver == v20) {\r
 166             auto_ptr_XMLCh binding(samlconstants::SAML20_BINDING_SOAP);\r
 167             opensaml::saml2p::StatusResponseType* srt=NULL;\r
 168             const vector<AttributeService*>& endpoints=AA->getAttributeServices();\r
 169             for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !srt && ep!=endpoints.end(); ++ep) {\r
 170                 try {\r
 171                     if (!XMLString::equals((*ep)->getBinding(),binding.get()))\r
 172                         continue;\r
 173                     auto_ptr_char loc((*ep)->getLocation());\r
 174                     NameID* nameid = NameIDBuilder::buildNameID();\r
 175                     opensaml::saml2::Subject* subject = opensaml::saml2::SubjectBuilder::buildSubject();\r
 176                     subject->setNameID(nameid);\r
 177                     opensaml::saml2p::AttributeQuery* query = opensaml::saml2p::AttributeQueryBuilder::buildAttributeQuery();\r
 178                     query->setSubject(subject);\r
 179                     Issuer* iss = IssuerBuilder::buildIssuer();\r
 180                     query->setIssuer(iss);\r
 181                     nameid->setName(name.get());\r
 182                     nameid->setFormat(format.get() ? format.get() : NameID::TRANSIENT);\r
 183                     nameid->setNameQualifier(domain.get());\r
 184                     iss->setName(issuer.get());\r
 185                     SAML2SOAPClient client(soaper);\r
 186                     client.sendSAML(query, *AA, loc.get());\r
 187                     srt = client.receiveSAML();\r
 188                 }\r
 189                 catch (exception& ex) {\r
 190                     cerr << "Caught exception: " << ex.what() << endl << endl;\r
 191                     soaper.reset();\r
 192                 }\r
 193             }\r
 194 \r
 195             if (!srt)\r
 196                 throw BindingException("Unable to successfully query for attributes.");\r
 197             const opensaml::saml2p::Response* response = dynamic_cast<opensaml::saml2p::Response*>(srt);\r
 198 \r
 199             const vector<opensaml::saml2::Assertion*>& assertions = response->getAssertions();\r
 200             if (assertions.size())\r
 201                 cout << *assertions.front();\r
 202             else\r
 203                 cout << "No assertions found.";\r
 204 \r
 205             delete response;\r
 206         }\r
 207         else {\r
 208             auto_ptr_XMLCh binding(samlconstants::SAML1_BINDING_SOAP);\r
 209             const opensaml::saml1p::Response* response=NULL;\r
 210             const vector<AttributeService*>& endpoints=AA->getAttributeServices();\r
 211             for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !response && ep!=endpoints.end(); ++ep) {\r
 212                 try {\r
 213                     if (!XMLString::equals((*ep)->getBinding(),binding.get()))\r
 214                         continue;\r
 215                     auto_ptr_char loc((*ep)->getLocation());\r
 216                     NameIdentifier* nameid = NameIdentifierBuilder::buildNameIdentifier();\r
 217                     opensaml::saml1::Subject* subject = opensaml::saml1::SubjectBuilder::buildSubject();\r
 218                     subject->setNameIdentifier(nameid);\r
 219                     opensaml::saml1p::AttributeQuery* query = opensaml::saml1p::AttributeQueryBuilder::buildAttributeQuery();\r
 220                     query->setSubject(subject);\r
 221                     Request* request = RequestBuilder::buildRequest();\r
 222                     request->setAttributeQuery(query);\r
 223                     nameid->setName(name.get());\r
 224                     nameid->setFormat(format.get() ? format.get() : shibspconstants::SHIB1_NAMEID_FORMAT_URI);\r
 225                     nameid->setNameQualifier(domain.get());\r
 226                     query->setResource(issuer.get());\r
 227                     request->setMinorVersion(ver==v11 ? 1 : 0);\r
 228                     SAML1SOAPClient client(soaper);\r
 229                     client.sendSAML(request, *AA, loc.get());\r
 230                     response = client.receiveSAML();\r
 231                 }\r
 232                 catch (exception& ex) {\r
 233                     cerr << "Caught exception: " << ex.what() << endl << endl;\r
 234                     soaper.reset();\r
 235                 }\r
 236             }\r
 237 \r
 238             if (!response)\r
 239                 throw BindingException("Unable to successfully query for attributes.");\r
 240 \r
 241             const vector<opensaml::saml1::Assertion*>& assertions = response->getAssertions();\r
 242             if (assertions.size())\r
 243                 cout << *assertions.front();\r
 244             else\r
 245                 cout << "No assertions found.";\r
 246 \r
 247             delete const_cast<opensaml::saml1p::Response*>(response);\r
 248         }\r
 249     }\r
 250     catch(exception& ex) {\r
 251         cerr << ex.what() << endl;\r
 252     }\r
 253 \r
 254     sp->unlock();\r
 255     conf.term();\r
 256     return 0;\r
 257 }\r