util/samlquery.cpp

   1 /*\r
   2  *  Copyright 2001-2007 Internet2\r
   3  * \r
   4  * Licensed under the Apache License, Version 2.0 (the "License");\r
   5  * you may not use this file except in compliance with the License.\r
   6  * You may obtain a copy of the License at\r
   7  *\r
   8  *     http://www.apache.org/licenses/LICENSE-2.0\r
   9  *\r
  10  * Unless required by applicable law or agreed to in writing, software\r
  11  * distributed under the License is distributed on an "AS IS" BASIS,\r
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  13  * See the License for the specific language governing permissions and\r
  14  * limitations under the License.\r
  15  */\r
  16 \r
  17 /**\r
  18  * samlquery.cpp\r
  19  * \r
  20  * SAML Attribute Query tool layered on SP configuration\r
  21  */\r
  22 \r
  23 #if defined (_MSC_VER) || defined(__BORLANDC__)\r
  24 # include "config_win32.h"\r
  25 #else\r
  26 # include "config.h"\r
  27 #endif\r
  28 \r
  29 #ifdef WIN32\r
  30 # define _CRT_NONSTDC_NO_DEPRECATE 1\r
  31 # define _CRT_SECURE_NO_DEPRECATE 1\r
  32 #endif\r
  33 \r
  34 #include <shibsp/Application.h>\r
  35 #include <shibsp/exceptions.h>\r
  36 #include <shibsp/SPConfig.h>\r
  37 #include <shibsp/ServiceProvider.h>\r
  38 #include <shibsp/util/SPConstants.h>\r
  39 \r
  40 #include <saml/binding/SecurityPolicy.h>\r
  41 #include <saml/saml1/binding/SAML1SOAPClient.h>\r
  42 #include <saml/saml1/core/Assertions.h>\r
  43 #include <saml/saml1/core/Protocols.h>\r
  44 #include <saml/saml2/binding/SAML2SOAPClient.h>\r
  45 #include <saml/saml2/core/Protocols.h>\r
  46 #include <saml/saml2/metadata/Metadata.h>\r
  47 #include <xercesc/util/XMLUniDefs.hpp>\r
  48 #include <xmltooling/XMLToolingConfig.h>\r
  49 #include <xmltooling/util/XMLHelper.h>\r
  50 \r
  51 using namespace shibsp;\r
  52 using namespace opensaml::saml1;\r
  53 using namespace opensaml::saml1p;\r
  54 using namespace opensaml::saml2;\r
  55 using namespace opensaml::saml2p;\r
  56 using namespace opensaml::saml2md;\r
  57 using namespace opensaml;\r
  58 using namespace xmltooling;\r
  59 using namespace std;\r
  60 \r
  61 enum samlversion {\r
  62     v10, v11, v20\r
  63 };\r
  64 \r
  65 int main(int argc,char* argv[])\r
  66 {\r
  67     char* n_param=NULL;\r
  68     char* q_param=NULL;\r
  69     char* f_param=NULL;\r
  70     char* a_param=NULL;\r
  71     char* path=NULL;\r
  72     char* config=NULL;\r
  73 \r
  74     for (int i=1; i<argc; i++) {\r
  75         if (!strcmp(argv[i],"-n") && i+1<argc)\r
  76             n_param=argv[++i];\r
  77         else if (!strcmp(argv[i],"-q") && i+1<argc)\r
  78             q_param=argv[++i];\r
  79         else if (!strcmp(argv[i],"-f") && i+1<argc)\r
  80             f_param=argv[++i];\r
  81         else if (!strcmp(argv[i],"-a") && i+1<argc)\r
  82             a_param=argv[++i];\r
  83     }\r
  84 \r
  85     if (!n_param || !q_param) {\r
  86         cerr << "usage: samlquery -n <name> -q <IdP> [-f <format URI> -a <application id>]" << endl;\r
  87         exit(0);\r
  88     }\r
  89     \r
  90     path=getenv("SHIBSP_SCHEMAS");\r
  91     if (!path)\r
  92         path=SHIBSP_SCHEMAS;\r
  93     config=getenv("SHIBSP_CONFIG");\r
  94     if (!config)\r
  95         config=SHIBSP_CONFIG;\r
  96     if (!a_param)\r
  97         a_param="default";\r
  98 \r
  99     SPConfig& conf=SPConfig::getConfig();\r
 100     conf.setFeatures(\r
 101         SPConfig::Metadata |\r
 102         SPConfig::Trust |\r
 103         SPConfig::Credentials |\r
 104         SPConfig::AttributeResolver |\r
 105         SPConfig::OutOfProcess |\r
 106         SPConfig::Caching\r
 107         );\r
 108     if (!conf.init(path))\r
 109         return -10;\r
 110 \r
 111     try {\r
 112         static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h);\r
 113         static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e);\r
 114         DOMDocument* dummydoc=XMLToolingConfig::getConfig().getParser().newDocument();\r
 115         XercesJanitor<DOMDocument> docjanitor(dummydoc);\r
 116         DOMElement* dummy = dummydoc->createElementNS(NULL,path);\r
 117         auto_ptr_XMLCh src(config);\r
 118         dummy->setAttributeNS(NULL,path,src.get());\r
 119         dummy->setAttributeNS(NULL,validate,xmlconstants::XML_ONE);\r
 120 \r
 121         conf.setServiceProvider(conf.ServiceProviderManager.newPlugin(XML_SERVICE_PROVIDER,dummy));\r
 122         conf.getServiceProvider()->init();\r
 123     }\r
 124     catch (exception&) {\r
 125         conf.term();\r
 126         return -20;\r
 127     }\r
 128 \r
 129     ServiceProvider* sp=conf.getServiceProvider();\r
 130     xmltooling::Locker locker(sp);\r
 131 \r
 132     try {\r
 133         const Application* app=sp->getApplication(a_param);\r
 134         if (!app)\r
 135             throw ConfigurationException("Application ($1) not found in configuration.", params(1,a_param));\r
 136 \r
 137         auto_ptr_XMLCh domain(q_param);\r
 138         auto_ptr_XMLCh name(n_param);\r
 139         auto_ptr_XMLCh format(f_param);\r
 140         auto_ptr_XMLCh issuer(app->getString("providerId").second);\r
 141 \r
 142         MetadataProvider* m=app->getMetadataProvider();\r
 143         xmltooling::Locker mlocker(m);\r
 144         const EntityDescriptor* site=m->getEntityDescriptor(domain.get());\r
 145         if (!site)\r
 146             throw MetadataException("Unable to locate metadata for IdP ($1).", params(1,q_param));\r
 147 \r
 148         // Try to locate an AA role.\r
 149         samlversion ver;\r
 150         const AttributeAuthorityDescriptor* AA=NULL;\r
 151         if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML20P_NS))\r
 152             ver = v20;\r
 153         else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML11_PROTOCOL_ENUM))\r
 154             ver = v11;\r
 155         else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML10_PROTOCOL_ENUM))\r
 156             ver = v10;\r
 157         else\r
 158             throw MetadataException("No AttributeAuthority role found in metadata.");\r
 159 \r
 160         QName role(samlconstants::SAML20P_NS, AttributeAuthorityDescriptor::LOCAL_NAME);\r
 161         SecurityPolicy policy(sp->getPolicyRules(), m, &role, app->getTrustEngine());\r
 162 \r
 163         if (ver == v20) {\r
 164             auto_ptr_XMLCh binding(samlconstants::SAML20_BINDING_SOAP);\r
 165             SAML2SOAPClient soaper(policy,true);\r
 166             opensaml::saml2p::StatusResponseType* srt=NULL;\r
 167             const vector<AttributeService*>& endpoints=AA->getAttributeServices();\r
 168             for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !srt && ep!=endpoints.end(); ++ep) {\r
 169                 try {\r
 170                     if (!XMLString::equals((*ep)->getBinding(),binding.get()))\r
 171                         continue;\r
 172                     auto_ptr_char loc((*ep)->getLocation());\r
 173                     NameID* nameid = NameIDBuilder::buildNameID();\r
 174                     Issuer* iss = IssuerBuilder::buildIssuer();\r
 175                     opensaml::saml2::Subject* subject = opensaml::saml2::SubjectBuilder::buildSubject();\r
 176                     opensaml::saml2p::AttributeQuery* query = opensaml::saml2p::AttributeQueryBuilder::buildAttributeQuery();\r
 177                     nameid->setName(name.get());\r
 178                     nameid->setFormat(format.get() ? format.get() : NameID::TRANSIENT);\r
 179                     nameid->setNameQualifier(domain.get());\r
 180                     iss->setName(issuer.get());\r
 181                     subject->setNameID(nameid);\r
 182                     query->setSubject(subject);\r
 183                     query->setIssuer(iss);\r
 184                     auto_ptr<opensaml::saml2p::AttributeQuery> wrapper(query);\r
 185                     soaper.sendSAML(query, *AA, loc.get());\r
 186                     wrapper.release();  // freed by SOAP client\r
 187                     srt = soaper.receiveSAML();\r
 188                 }\r
 189                 catch (exception& ex) {\r
 190                     cerr << ex.what() << endl;\r
 191                     soaper.reset();\r
 192                 }\r
 193             }\r
 194 \r
 195             if (!srt)\r
 196                 throw BindingException("Unable to successfully query for attributes.");\r
 197             const opensaml::saml2p::Response* response = dynamic_cast<opensaml::saml2p::Response*>(srt);\r
 198 \r
 199             const vector<opensaml::saml2::Assertion*>& assertions = response->getAssertions();\r
 200             if (assertions.size())\r
 201                 cout << *assertions.front();\r
 202             else\r
 203                 cout << "No assertions found.";\r
 204 \r
 205             delete response;\r
 206         }\r
 207         else {\r
 208             auto_ptr_XMLCh binding(samlconstants::SAML1_BINDING_SOAP);\r
 209             SAML1SOAPClient soaper(policy,true);\r
 210             const opensaml::saml1p::Response* response=NULL;\r
 211             const vector<AttributeService*>& endpoints=AA->getAttributeServices();\r
 212             for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !response && ep!=endpoints.end(); ++ep) {\r
 213                 try {\r
 214                     if (!XMLString::equals((*ep)->getBinding(),binding.get()))\r
 215                         continue;\r
 216                     auto_ptr_char loc((*ep)->getLocation());\r
 217                     NameIdentifier* nameid = NameIdentifierBuilder::buildNameIdentifier();\r
 218                     opensaml::saml1::Subject* subject = opensaml::saml1::SubjectBuilder::buildSubject();\r
 219                     opensaml::saml1p::AttributeQuery* query = opensaml::saml1p::AttributeQueryBuilder::buildAttributeQuery();\r
 220                     Request* request = RequestBuilder::buildRequest();\r
 221                     nameid->setName(name.get());\r
 222                     nameid->setFormat(format.get() ? format.get() : shibspconstants::SHIB1_NAMEID_FORMAT_URI);\r
 223                     nameid->setNameQualifier(domain.get());\r
 224                     subject->setNameIdentifier(nameid);\r
 225                     query->setSubject(subject);\r
 226                     query->setResource(issuer.get());\r
 227                     request->setMinorVersion(ver==v11 ? 1 : 0);\r
 228                     auto_ptr<Request> wrapper(request);\r
 229                     soaper.sendSAML(request, *AA, loc.get());\r
 230                     wrapper.release();  // freed by SOAP client\r
 231                     response = soaper.receiveSAML();\r
 232                 }\r
 233                 catch (exception& ex) {\r
 234                     cerr << ex.what() << endl;\r
 235                     soaper.reset();\r
 236                 }\r
 237             }\r
 238 \r
 239             if (!response)\r
 240                 throw BindingException("Unable to successfully query for attributes.");\r
 241 \r
 242             const vector<opensaml::saml1::Assertion*>& assertions = response->getAssertions();\r
 243             if (assertions.size())\r
 244                 cout << *assertions.front();\r
 245             else\r
 246                 cout << "No assertions found.";\r
 247 \r
 248             delete const_cast<opensaml::saml1p::Response*>(response);\r
 249         }\r
 250     }\r
 251     catch(exception& ex) {\r
 252         cerr << ex.what() << endl;\r
 253     }\r
 254 \r
 255     conf.term();\r
 256     return 0;\r
 257 }\r