Correct location of TransportOption feature, makes no sense inside policies.

[shibboleth/sp.git] / shibsp / binding / impl / SOAPClient.cpp

diff --git a/shibsp/binding/impl/SOAPClient.cpp b/shibsp/binding/impl/SOAPClient.cpp
index 2a8363f..656a2c8 100644 (file)
--- a/shibsp/binding/impl/SOAPClient.cpp
+++ b/shibsp/binding/impl/SOAPClient.cpp
@@ -26,7 +26,6 @@
 #include "ServiceProvider.h"
 #include "binding/SOAPClient.h"
 
-#include <log4cpp/Category.hh>
 #include <saml/saml2/metadata/Metadata.h>
 #include <xmltooling/soap/SOAP.h>
 #include <xmltooling/soap/HTTPSOAPTransport.h>
@@ -36,7 +35,6 @@ using namespace shibsp;
 using namespace opensaml::saml2md;
 using namespace xmlsignature;
 using namespace xmltooling;
-using namespace log4cpp;
 using namespace std;
 
 SOAPClient::SOAPClient(SecurityPolicy& policy)
@@ -48,22 +46,27 @@ SOAPClient::SOAPClient(SecurityPolicy& policy)
     setValidating(validate.first && validate.second);
 }
 
-void SOAPClient::send(const soap11::Envelope& env, MetadataCredentialCriteria& peer, const char* endpoint)
+void SOAPClient::send(const soap11::Envelope& env, const char* from, MetadataCredentialCriteria& to, const char* endpoint)
 {
     // Check for message signing requirements.   
-    m_relyingParty = m_app.getRelyingParty(dynamic_cast<const EntityDescriptor*>(peer.getRole().getParent()));
-    pair<bool,bool> flag = m_relyingParty->getBool("signRequests");
-    if (flag.first && flag.second) {
+    m_relyingParty = m_app.getRelyingParty(dynamic_cast<const EntityDescriptor*>(to.getRole().getParent()));
+    pair<bool,const char*> flag = m_relyingParty->getString("signing");
+    if (flag.first && (!strcmp(flag.second, "true") || !strcmp(flag.second, "back"))) {
         m_credResolver=m_app.getCredentialResolver();
         if (m_credResolver) {
             m_credResolver->lock();
             // Fill in criteria to use.
-            peer.setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
-            pair<bool,const char*> algcrit = m_relyingParty->getString("sigAlgorithm");
-            if (algcrit.first)
-                peer.setKeyAlgorithm(algcrit.second);
-            const Credential* cred = m_credResolver->resolve(&peer);
-            peer.setKeyAlgorithm(NULL);
+            to.setUsage(Credential::SIGNING_CREDENTIAL);
+            pair<bool,const char*> keyName = m_relyingParty->getString("keyName");
+            if (keyName.first)
+                to.getKeyNames().insert(keyName.second);
+            pair<bool,const XMLCh*> sigalg = m_relyingParty->getXMLString("signingAlg");
+            if (sigalg.first)
+                to.setXMLAlgorithm(sigalg.second);
+            const Credential* cred = m_credResolver->resolve(&to);
+            // Reset criteria back.
+            to.setKeyAlgorithm(NULL);
+            to.setKeySize(0);
 
             if (cred) {
                 // Check for message.
@@ -74,9 +77,11 @@ void SOAPClient::send(const soap11::Envelope& env, MetadataCredentialCriteria& p
                         // Build a Signature.
                         Signature* sig = SignatureBuilder::buildSignature();
                         msg->setSignature(sig);
-                        pair<bool,const XMLCh*> alg = m_relyingParty->getXMLString("sigAlgorithm");
-                        if (alg.first)
-                            sig->setSignatureAlgorithm(alg.second);
+                        if (sigalg.first)
+                            sig->setSignatureAlgorithm(sigalg.second);
+                        sigalg = m_relyingParty->getXMLString("digestAlg");
+                        if (sigalg.first)
+                            dynamic_cast<opensaml::ContentReference*>(sig->getContentReference())->setDigestAlgorithm(sigalg.second);
 
                         // Sign it. The marshalling step in the base class should be a no-op.
                         vector<Signature*> sigs(1,sig);
@@ -93,7 +98,7 @@ void SOAPClient::send(const soap11::Envelope& env, MetadataCredentialCriteria& p
         }
     }
     
-    opensaml::SOAPClient::send(env, peer, endpoint);
+    opensaml::SOAPClient::send(env, from, to, endpoint);
 }
 
 void SOAPClient::prepareTransport(SOAPTransport& transport)
@@ -104,13 +109,13 @@ void SOAPClient::prepareTransport(SOAPTransport& transport)
     Category& log=Category::getInstance(SHIBSP_LOGCAT".SOAPClient");
     log.debug("prepping SOAP transport for use by application (%s)", m_app.getId());
 
-    pair<bool,bool> flag = m_settings->getBool("requireConfidentiality");
+    pair<bool,bool> flag = m_relyingParty->getBool("requireConfidentiality");
     if ((!flag.first || flag.second) && !transport.isConfidential())
         throw opensaml::BindingException("Transport confidentiality required, but not available."); 
 
     flag = m_settings->getBool("validate");
     setValidating(flag.first && flag.second);
-    flag = m_settings->getBool("requireTransportAuth");
+    flag = m_relyingParty->getBool("requireTransportAuth");
     forceTransportAuthentication(!flag.first || flag.second);
 
     opensaml::SOAPClient::prepareTransport(transport);
@@ -123,7 +128,10 @@ void SOAPClient::prepareTransport(SOAPTransport& transport)
                 m_credResolver->lock();
         }
         if (m_credResolver) {
-            m_criteria->setUsage(CredentialCriteria::TLS_CREDENTIAL);
+            m_criteria->setUsage(Credential::TLS_CREDENTIAL);
+            authType = m_relyingParty->getString("keyName");
+            if (authType.first)
+                m_criteria->getKeyNames().insert(authType.second);
             const Credential* cred = m_credResolver->resolve(m_criteria);
             if (cred) {
                 if (!transport.setCredential(cred))
@@ -151,7 +159,7 @@ void SOAPClient::prepareTransport(SOAPTransport& transport)
             type = SOAPTransport::transport_auth_ntlm;
         else if (!strcmp(authType.second,"gss"))
             type = SOAPTransport::transport_auth_gss;
-        else
+        else if (strcmp(authType.second,"none"))
             log.error("unknown authType (%s) specified for RelyingParty", authType.second);
         if (type > SOAPTransport::transport_auth_none) {
             if (transport.setAuth(type,username.second,password.second))
@@ -161,14 +169,18 @@ void SOAPClient::prepareTransport(SOAPTransport& transport)
         }
     }
     
-    transport.setConnectTimeout(m_settings->getUnsignedInt("connectTimeout").second);
-    transport.setTimeout(m_settings->getUnsignedInt("timeout").second);
+    pair<bool,unsigned int> timeout = m_relyingParty->getUnsignedInt("connectTimeout"); 
+    transport.setConnectTimeout(timeout.first ? timeout.second : 10);
+    timeout = m_relyingParty->getUnsignedInt("timeout");
+    transport.setTimeout(timeout.first ? timeout.second : 20);
+    m_app.getServiceProvider().setTransportOptions(transport);
 
     HTTPSOAPTransport* http = dynamic_cast<HTTPSOAPTransport*>(&transport);
     if (http) {
-        flag = m_settings->getBool("chunkedEncoding");
-        http->useChunkedEncoding(!flag.first || flag.second);
-        http->setRequestHeader("Shibboleth", PACKAGE_VERSION);
+        flag = m_relyingParty->getBool("chunkedEncoding");
+        http->useChunkedEncoding(flag.first && flag.second);
+        http->setRequestHeader("User-Agent", PACKAGE_NAME);
+        http->setRequestHeader(PACKAGE_NAME, PACKAGE_VERSION);
     }
 }
 
@@ -179,4 +191,5 @@ void SOAPClient::reset()
         m_credResolver->unlock();
     m_credResolver = NULL;
     opensaml::SOAPClient::reset();
-}
\ No newline at end of file
+}
+