Add explicit none option for transport authn.

[shibboleth/sp.git] / shibsp / binding / impl / SOAPClient.cpp

diff --git a/shibsp/binding/impl/SOAPClient.cpp b/shibsp/binding/impl/SOAPClient.cpp
index 9e1158f..3cef3d4 100644 (file)
--- a/shibsp/binding/impl/SOAPClient.cpp
+++ b/shibsp/binding/impl/SOAPClient.cpp
@@ -26,7 +26,6 @@
 #include "ServiceProvider.h"
 #include "binding/SOAPClient.h"
 
-#include <log4cpp/Category.hh>
 #include <saml/saml2/metadata/Metadata.h>
 #include <xmltooling/soap/SOAP.h>
 #include <xmltooling/soap/HTTPSOAPTransport.h>
@@ -36,7 +35,6 @@ using namespace shibsp;
 using namespace opensaml::saml2md;
 using namespace xmlsignature;
 using namespace xmltooling;
-using namespace log4cpp;
 using namespace std;
 
 SOAPClient::SOAPClient(SecurityPolicy& policy)
@@ -48,27 +46,27 @@ SOAPClient::SOAPClient(SecurityPolicy& policy)
     setValidating(validate.first && validate.second);
 }
 
-void SOAPClient::send(const soap11::Envelope& env, MetadataCredentialCriteria& peer, const char* endpoint)
+void SOAPClient::send(const soap11::Envelope& env, const char* from, MetadataCredentialCriteria& to, const char* endpoint)
 {
     // Check for message signing requirements.   
-    m_relyingParty = m_app.getRelyingParty(dynamic_cast<const EntityDescriptor*>(peer.getRole().getParent()));
-    pair<bool,bool> flag = m_relyingParty->getBool("signRequests");
-    if (flag.first && flag.second) {
+    m_relyingParty = m_app.getRelyingParty(dynamic_cast<const EntityDescriptor*>(to.getRole().getParent()));
+    pair<bool,const char*> flag = m_relyingParty->getString("signing");
+    if (flag.first && (!strcmp(flag.second, "true") || !strcmp(flag.second, "back"))) {
         m_credResolver=m_app.getCredentialResolver();
         if (m_credResolver) {
             m_credResolver->lock();
             // Fill in criteria to use.
-            peer.setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
+            to.setUsage(Credential::SIGNING_CREDENTIAL);
             pair<bool,const char*> keyName = m_relyingParty->getString("keyName");
             if (keyName.first)
-                peer.getKeyNames().insert(keyName.second);
-            pair<bool,const XMLCh*> sigalg = m_relyingParty->getXMLString("signatureAlg");
+                to.getKeyNames().insert(keyName.second);
+            pair<bool,const XMLCh*> sigalg = m_relyingParty->getXMLString("signingAlg");
             if (sigalg.first)
-                peer.setXMLAlgorithm(sigalg.second);
-            const Credential* cred = m_credResolver->resolve(&peer);
+                to.setXMLAlgorithm(sigalg.second);
+            const Credential* cred = m_credResolver->resolve(&to);
             // Reset criteria back.
-            peer.setKeyAlgorithm(NULL);
-            peer.setKeySize(0);
+            to.setKeyAlgorithm(NULL);
+            to.setKeySize(0);
 
             if (cred) {
                 // Check for message.
@@ -100,7 +98,7 @@ void SOAPClient::send(const soap11::Envelope& env, MetadataCredentialCriteria& p
         }
     }
     
-    opensaml::SOAPClient::send(env, peer, endpoint);
+    opensaml::SOAPClient::send(env, from, to, endpoint);
 }
 
 void SOAPClient::prepareTransport(SOAPTransport& transport)
@@ -111,13 +109,13 @@ void SOAPClient::prepareTransport(SOAPTransport& transport)
     Category& log=Category::getInstance(SHIBSP_LOGCAT".SOAPClient");
     log.debug("prepping SOAP transport for use by application (%s)", m_app.getId());
 
-    pair<bool,bool> flag = m_settings->getBool("requireConfidentiality");
+    pair<bool,bool> flag = m_relyingParty->getBool("requireConfidentiality");
     if ((!flag.first || flag.second) && !transport.isConfidential())
         throw opensaml::BindingException("Transport confidentiality required, but not available."); 
 
     flag = m_settings->getBool("validate");
     setValidating(flag.first && flag.second);
-    flag = m_settings->getBool("requireTransportAuth");
+    flag = m_relyingParty->getBool("requireTransportAuth");
     forceTransportAuthentication(!flag.first || flag.second);
 
     opensaml::SOAPClient::prepareTransport(transport);
@@ -130,7 +128,7 @@ void SOAPClient::prepareTransport(SOAPTransport& transport)
                 m_credResolver->lock();
         }
         if (m_credResolver) {
-            m_criteria->setUsage(CredentialCriteria::TLS_CREDENTIAL);
+            m_criteria->setUsage(Credential::TLS_CREDENTIAL);
             authType = m_relyingParty->getString("keyName");
             if (authType.first)
                 m_criteria->getKeyNames().insert(authType.second);
@@ -161,7 +159,7 @@ void SOAPClient::prepareTransport(SOAPTransport& transport)
             type = SOAPTransport::transport_auth_ntlm;
         else if (!strcmp(authType.second,"gss"))
             type = SOAPTransport::transport_auth_gss;
-        else
+        else if (strcmp(authType.second,"none"))
             log.error("unknown authType (%s) specified for RelyingParty", authType.second);
         if (type > SOAPTransport::transport_auth_none) {
             if (transport.setAuth(type,username.second,password.second))
@@ -171,14 +169,18 @@ void SOAPClient::prepareTransport(SOAPTransport& transport)
         }
     }
     
-    transport.setConnectTimeout(m_settings->getUnsignedInt("connectTimeout").second);
-    transport.setTimeout(m_settings->getUnsignedInt("timeout").second);
+    pair<bool,unsigned int> timeout = m_relyingParty->getUnsignedInt("connectTimeout"); 
+    transport.setConnectTimeout(timeout.first ? timeout.second : 10);
+    timeout = m_relyingParty->getUnsignedInt("timeout");
+    transport.setTimeout(timeout.first ? timeout.second : 20);
+    m_app.getServiceProvider().setTransportOptions(m_app.getString("policyId").second, transport);
 
     HTTPSOAPTransport* http = dynamic_cast<HTTPSOAPTransport*>(&transport);
     if (http) {
-        flag = m_settings->getBool("chunkedEncoding");
-        http->useChunkedEncoding(!flag.first || flag.second);
-        http->setRequestHeader("Shibboleth", PACKAGE_VERSION);
+        flag = m_relyingParty->getBool("chunkedEncoding");
+        http->useChunkedEncoding(flag.first && flag.second);
+        http->setRequestHeader("User-Agent", PACKAGE_NAME);
+        http->setRequestHeader(PACKAGE_NAME, PACKAGE_VERSION);
     }
 }
 
@@ -189,4 +191,5 @@ void SOAPClient::reset()
         m_credResolver->unlock();
     m_credResolver = NULL;
     opensaml::SOAPClient::reset();
-}
\ No newline at end of file
+}
+