util/samlquery.cpp

   1 /*\r
   2  *  Copyright 2001-2007 Internet2\r
   3  * \r
   4  * Licensed under the Apache License, Version 2.0 (the "License");\r
   5  * you may not use this file except in compliance with the License.\r
   6  * You may obtain a copy of the License at\r
   7  *\r
   8  *     http://www.apache.org/licenses/LICENSE-2.0\r
   9  *\r
  10  * Unless required by applicable law or agreed to in writing, software\r
  11  * distributed under the License is distributed on an "AS IS" BASIS,\r
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  13  * See the License for the specific language governing permissions and\r
  14  * limitations under the License.\r
  15  */\r
  16 \r
  17 /**\r
  18  * samlquery.cpp\r
  19  * \r
  20  * SAML Attribute Query tool layered on SP configuration\r
  21  */\r
  22 \r
  23 #if defined (_MSC_VER) || defined(__BORLANDC__)\r
  24 # include "config_win32.h"\r
  25 #else\r
  26 # include "config.h"\r
  27 #endif\r
  28 \r
  29 #ifdef WIN32\r
  30 # define _CRT_NONSTDC_NO_DEPRECATE 1\r
  31 # define _CRT_SECURE_NO_DEPRECATE 1\r
  32 #endif\r
  33 \r
  34 #include <shibsp/Application.h>\r
  35 #include <shibsp/exceptions.h>\r
  36 #include <shibsp/SPConfig.h>\r
  37 #include <shibsp/ServiceProvider.h>\r
  38 #include <shibsp/binding/SOAPClient.h>\r
  39 #include <shibsp/util/SPConstants.h>\r
  40 \r
  41 #include <saml/binding/SecurityPolicy.h>\r
  42 #include <saml/saml1/binding/SAML1SOAPClient.h>\r
  43 #include <saml/saml1/core/Assertions.h>\r
  44 #include <saml/saml1/core/Protocols.h>\r
  45 #include <saml/saml2/binding/SAML2SOAPClient.h>\r
  46 #include <saml/saml2/core/Protocols.h>\r
  47 #include <saml/saml2/metadata/Metadata.h>\r
  48 #include <xercesc/util/XMLUniDefs.hpp>\r
  49 #include <xmltooling/XMLToolingConfig.h>\r
  50 #include <xmltooling/util/XMLHelper.h>\r
  51 \r
  52 using namespace shibsp;\r
  53 using namespace opensaml::saml1;\r
  54 using namespace opensaml::saml1p;\r
  55 using namespace opensaml::saml2;\r
  56 using namespace opensaml::saml2p;\r
  57 using namespace opensaml::saml2md;\r
  58 using namespace opensaml;\r
  59 using namespace xmltooling;\r
  60 using namespace std;\r
  61 \r
  62 enum samlversion {\r
  63     v10, v11, v20\r
  64 };\r
  65 \r
  66 int main(int argc,char* argv[])\r
  67 {\r
  68     char* n_param=NULL;\r
  69     char* q_param=NULL;\r
  70     char* f_param=NULL;\r
  71     char* a_param=NULL;\r
  72     char* path=NULL;\r
  73     char* config=NULL;\r
  74 \r
  75     for (int i=1; i<argc; i++) {\r
  76         if (!strcmp(argv[i],"-n") && i+1<argc)\r
  77             n_param=argv[++i];\r
  78         else if (!strcmp(argv[i],"-q") && i+1<argc)\r
  79             q_param=argv[++i];\r
  80         else if (!strcmp(argv[i],"-f") && i+1<argc)\r
  81             f_param=argv[++i];\r
  82         else if (!strcmp(argv[i],"-a") && i+1<argc)\r
  83             a_param=argv[++i];\r
  84     }\r
  85 \r
  86     if (!n_param || !q_param) {\r
  87         cerr << "usage: samlquery -n <name> -q <IdP> [-f <format URI> -a <application id>]" << endl;\r
  88         exit(0);\r
  89     }\r
  90     \r
  91     path=getenv("SHIBSP_SCHEMAS");\r
  92     if (!path)\r
  93         path=SHIBSP_SCHEMAS;\r
  94     config=getenv("SHIBSP_CONFIG");\r
  95     if (!config)\r
  96         config=SHIBSP_CONFIG;\r
  97     if (!a_param)\r
  98         a_param="default";\r
  99 \r
 100     SPConfig& conf=SPConfig::getConfig();\r
 101     conf.setFeatures(\r
 102         SPConfig::Metadata |\r
 103         SPConfig::Trust |\r
 104         SPConfig::Credentials |\r
 105         SPConfig::AttributeResolver |\r
 106         SPConfig::OutOfProcess |\r
 107         SPConfig::Caching\r
 108         );\r
 109     if (!conf.init(path))\r
 110         return -10;\r
 111 \r
 112     try {\r
 113         static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h);\r
 114         static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e);\r
 115         DOMDocument* dummydoc=XMLToolingConfig::getConfig().getParser().newDocument();\r
 116         XercesJanitor<DOMDocument> docjanitor(dummydoc);\r
 117         DOMElement* dummy = dummydoc->createElementNS(NULL,path);\r
 118         auto_ptr_XMLCh src(config);\r
 119         dummy->setAttributeNS(NULL,path,src.get());\r
 120         dummy->setAttributeNS(NULL,validate,xmlconstants::XML_ONE);\r
 121 \r
 122         conf.setServiceProvider(conf.ServiceProviderManager.newPlugin(XML_SERVICE_PROVIDER,dummy));\r
 123         conf.getServiceProvider()->init();\r
 124     }\r
 125     catch (exception&) {\r
 126         conf.term();\r
 127         return -20;\r
 128     }\r
 129 \r
 130     ServiceProvider* sp=conf.getServiceProvider();\r
 131     sp->lock();\r
 132 \r
 133     try {\r
 134         const Application* app=sp->getApplication(a_param);\r
 135         if (!app)\r
 136             throw ConfigurationException("Application ($1) not found in configuration.", params(1,a_param));\r
 137 \r
 138         auto_ptr_XMLCh domain(q_param);\r
 139         auto_ptr_XMLCh name(n_param);\r
 140         auto_ptr_XMLCh format(f_param);\r
 141         auto_ptr_XMLCh issuer(app->getString("providerId").second);\r
 142 \r
 143         MetadataProvider* m=app->getMetadataProvider();\r
 144         xmltooling::Locker mlocker(m);\r
 145         const EntityDescriptor* site=m->getEntityDescriptor(domain.get());\r
 146         if (!site)\r
 147             throw MetadataException("Unable to locate metadata for IdP ($1).", params(1,q_param));\r
 148 \r
 149         // Try to locate an AA role.\r
 150         samlversion ver;\r
 151         const AttributeAuthorityDescriptor* AA=NULL;\r
 152         if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML20P_NS))\r
 153             ver = v20;\r
 154         else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML11_PROTOCOL_ENUM))\r
 155             ver = v11;\r
 156         else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML10_PROTOCOL_ENUM))\r
 157             ver = v10;\r
 158         else\r
 159             throw MetadataException("No AttributeAuthority role found in metadata.");\r
 160 \r
 161         SecurityPolicy policy;\r
 162         shibsp::SOAPClient soaper(*app,policy);\r
 163 \r
 164         if (ver == v20) {\r
 165             auto_ptr_XMLCh binding(samlconstants::SAML20_BINDING_SOAP);\r
 166             opensaml::saml2p::StatusResponseType* srt=NULL;\r
 167             const vector<AttributeService*>& endpoints=AA->getAttributeServices();\r
 168             for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !srt && ep!=endpoints.end(); ++ep) {\r
 169                 try {\r
 170                     if (!XMLString::equals((*ep)->getBinding(),binding.get()))\r
 171                         continue;\r
 172                     auto_ptr_char loc((*ep)->getLocation());\r
 173                     NameID* nameid = NameIDBuilder::buildNameID();\r
 174                     Issuer* iss = IssuerBuilder::buildIssuer();\r
 175                     opensaml::saml2::Subject* subject = opensaml::saml2::SubjectBuilder::buildSubject();\r
 176                     opensaml::saml2p::AttributeQuery* query = opensaml::saml2p::AttributeQueryBuilder::buildAttributeQuery();\r
 177                     nameid->setName(name.get());\r
 178                     nameid->setFormat(format.get() ? format.get() : NameID::TRANSIENT);\r
 179                     nameid->setNameQualifier(domain.get());\r
 180                     iss->setName(issuer.get());\r
 181                     subject->setNameID(nameid);\r
 182                     query->setSubject(subject);\r
 183                     query->setIssuer(iss);\r
 184                     SAML2SOAPClient client(soaper);\r
 185                     client.sendSAML(query, *AA, loc.get());\r
 186                     srt = client.receiveSAML();\r
 187                 }\r
 188                 catch (exception& ex) {\r
 189                     cerr << ex.what() << endl;\r
 190                     soaper.reset();\r
 191                 }\r
 192             }\r
 193 \r
 194             if (!srt)\r
 195                 throw BindingException("Unable to successfully query for attributes.");\r
 196             const opensaml::saml2p::Response* response = dynamic_cast<opensaml::saml2p::Response*>(srt);\r
 197 \r
 198             const vector<opensaml::saml2::Assertion*>& assertions = response->getAssertions();\r
 199             if (assertions.size())\r
 200                 cout << *assertions.front();\r
 201             else\r
 202                 cout << "No assertions found.";\r
 203 \r
 204             delete response;\r
 205         }\r
 206         else {\r
 207             auto_ptr_XMLCh binding(samlconstants::SAML1_BINDING_SOAP);\r
 208             const opensaml::saml1p::Response* response=NULL;\r
 209             const vector<AttributeService*>& endpoints=AA->getAttributeServices();\r
 210             for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !response && ep!=endpoints.end(); ++ep) {\r
 211                 try {\r
 212                     if (!XMLString::equals((*ep)->getBinding(),binding.get()))\r
 213                         continue;\r
 214                     auto_ptr_char loc((*ep)->getLocation());\r
 215                     NameIdentifier* nameid = NameIdentifierBuilder::buildNameIdentifier();\r
 216                     opensaml::saml1::Subject* subject = opensaml::saml1::SubjectBuilder::buildSubject();\r
 217                     opensaml::saml1p::AttributeQuery* query = opensaml::saml1p::AttributeQueryBuilder::buildAttributeQuery();\r
 218                     Request* request = RequestBuilder::buildRequest();\r
 219                     nameid->setName(name.get());\r
 220                     nameid->setFormat(format.get() ? format.get() : shibspconstants::SHIB1_NAMEID_FORMAT_URI);\r
 221                     nameid->setNameQualifier(domain.get());\r
 222                     subject->setNameIdentifier(nameid);\r
 223                     query->setSubject(subject);\r
 224                     query->setResource(issuer.get());\r
 225                     request->setMinorVersion(ver==v11 ? 1 : 0);\r
 226                     SAML1SOAPClient client(soaper);\r
 227                     client.sendSAML(request, *AA, loc.get());\r
 228                     response = client.receiveSAML();\r
 229                 }\r
 230                 catch (exception& ex) {\r
 231                     cerr << ex.what() << endl;\r
 232                     soaper.reset();\r
 233                 }\r
 234             }\r
 235 \r
 236             if (!response)\r
 237                 throw BindingException("Unable to successfully query for attributes.");\r
 238 \r
 239             const vector<opensaml::saml1::Assertion*>& assertions = response->getAssertions();\r
 240             if (assertions.size())\r
 241                 cout << *assertions.front();\r
 242             else\r
 243                 cout << "No assertions found.";\r
 244 \r
 245             delete const_cast<opensaml::saml1p::Response*>(response);\r
 246         }\r
 247     }\r
 248     catch(exception& ex) {\r
 249         cerr << ex.what() << endl;\r
 250     }\r
 251 \r
 252     sp->unlock();\r
 253     conf.term();\r
 254     return 0;\r
 255 }\r