/*
- * Copyright 2001-2007 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
#include "internal.h"
#include "Application.h"
-#include "exceptions.h"
#include "ServiceProvider.h"
#include "binding/SOAPClient.h"
+#include "security/SecurityPolicy.h"
-#include <log4cpp/Category.hh>
+#include <saml/exceptions.h>
#include <saml/saml2/metadata/Metadata.h>
+#include <saml/saml2/metadata/MetadataCredentialCriteria.h>
+#include <saml/signature/ContentReference.h>
+#include <xmltooling/security/Credential.h>
+#include <xmltooling/signature/Signature.h>
#include <xmltooling/soap/SOAP.h>
#include <xmltooling/soap/HTTPSOAPTransport.h>
#include <xmltooling/util/NDC.h>
using namespace opensaml::saml2md;
using namespace xmlsignature;
using namespace xmltooling;
-using namespace log4cpp;
using namespace std;
SOAPClient::SOAPClient(SecurityPolicy& policy)
- : opensaml::SOAPClient(policy), m_app(policy.getApplication()), m_settings(NULL), m_relyingParty(NULL), m_credResolver(NULL)
+ : opensaml::SOAPClient(policy), m_app(policy.getApplication()), m_relyingParty(nullptr), m_credResolver(nullptr)
{
- m_settings = m_app.getServiceProvider().getPolicySettings(m_app.getString("policyId").second);
- pair<bool,bool> validate = m_settings->getBool("validate");
- policy.setValidating(validate.first && validate.second);
- setValidating(validate.first && validate.second);
}
-void SOAPClient::send(const soap11::Envelope& env, MetadataCredentialCriteria& peer, const char* endpoint)
+SOAPClient::~SOAPClient()
+{
+ if (m_credResolver)
+ m_credResolver->unlock();
+}
+
+void SOAPClient::send(const soap11::Envelope& env, const char* from, MetadataCredentialCriteria& to, const char* endpoint)
{
// Check for message signing requirements.
- m_relyingParty = m_app.getRelyingParty(dynamic_cast<const EntityDescriptor*>(peer.getRole().getParent()));
- pair<bool,bool> flag = m_relyingParty->getBool("signRequests");
- if (flag.first && flag.second) {
+ m_relyingParty = m_app.getRelyingParty(dynamic_cast<const EntityDescriptor*>(to.getRole().getParent()));
+ pair<bool,const char*> flag = m_relyingParty->getString("signing");
+ if (flag.first && (!strcmp(flag.second, "true") || !strcmp(flag.second, "back"))) {
m_credResolver=m_app.getCredentialResolver();
if (m_credResolver) {
m_credResolver->lock();
// Fill in criteria to use.
- peer.setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
- pair<bool,const char*> algcrit = m_relyingParty->getString("sigAlgorithm");
- if (algcrit.first)
- peer.setKeyAlgorithm(algcrit.second);
- const Credential* cred = m_credResolver->resolve(&peer);
- peer.setKeyAlgorithm(NULL);
+ to.setUsage(Credential::SIGNING_CREDENTIAL);
+ pair<bool,const char*> keyName = m_relyingParty->getString("keyName");
+ if (keyName.first)
+ to.getKeyNames().insert(keyName.second);
+ pair<bool,const XMLCh*> sigalg = m_relyingParty->getXMLString("signingAlg");
+ if (sigalg.first)
+ to.setXMLAlgorithm(sigalg.second);
+ const Credential* cred = m_credResolver->resolve(&to);
+ // Reset criteria back.
+ to.setKeyAlgorithm(nullptr);
+ to.setKeySize(0);
+ to.getKeyNames().clear();
if (cred) {
// Check for message.
// Build a Signature.
Signature* sig = SignatureBuilder::buildSignature();
msg->setSignature(sig);
- pair<bool,const XMLCh*> alg = m_relyingParty->getXMLString("sigAlgorithm");
- if (alg.first)
- sig->setSignatureAlgorithm(alg.second);
+ if (sigalg.first)
+ sig->setSignatureAlgorithm(sigalg.second);
+ sigalg = m_relyingParty->getXMLString("digestAlg");
+ if (sigalg.first)
+ dynamic_cast<opensaml::ContentReference*>(sig->getContentReference())->setDigestAlgorithm(sigalg.second);
// Sign it. The marshalling step in the base class should be a no-op.
vector<Signature*> sigs(1,sig);
- env.marshall((DOMDocument*)NULL,&sigs,cred);
+ env.marshall((DOMDocument*)nullptr,&sigs,cred);
}
}
}
}
}
- opensaml::SOAPClient::send(env, peer, endpoint);
+ opensaml::SOAPClient::send(env, from, to, endpoint);
}
void SOAPClient::prepareTransport(SOAPTransport& transport)
Category& log=Category::getInstance(SHIBSP_LOGCAT".SOAPClient");
log.debug("prepping SOAP transport for use by application (%s)", m_app.getId());
- pair<bool,bool> flag = m_settings->getBool("requireConfidentiality");
+ pair<bool,bool> flag = m_relyingParty->getBool("requireConfidentiality");
if ((!flag.first || flag.second) && !transport.isConfidential())
throw opensaml::BindingException("Transport confidentiality required, but not available.");
- flag = m_settings->getBool("validate");
- setValidating(flag.first && flag.second);
- flag = m_settings->getBool("requireTransportAuth");
+ setValidating(getPolicy().getValidating());
+ flag = m_relyingParty->getBool("requireTransportAuth");
forceTransportAuthentication(!flag.first || flag.second);
opensaml::SOAPClient::prepareTransport(transport);
m_credResolver->lock();
}
if (m_credResolver) {
- m_criteria->setUsage(CredentialCriteria::TLS_CREDENTIAL);
+ m_criteria->setUsage(Credential::TLS_CREDENTIAL);
+ authType = m_relyingParty->getString("keyName");
+ if (authType.first)
+ m_criteria->getKeyNames().insert(authType.second);
const Credential* cred = m_credResolver->resolve(m_criteria);
+ m_criteria->getKeyNames().clear();
if (cred) {
if (!transport.setCredential(cred))
log.error("failed to load Credential into SOAPTransport");
type = SOAPTransport::transport_auth_ntlm;
else if (!strcmp(authType.second,"gss"))
type = SOAPTransport::transport_auth_gss;
- else
+ else if (strcmp(authType.second,"none"))
log.error("unknown authType (%s) specified for RelyingParty", authType.second);
if (type > SOAPTransport::transport_auth_none) {
if (transport.setAuth(type,username.second,password.second))
}
}
- transport.setConnectTimeout(m_settings->getUnsignedInt("connectTimeout").second);
- transport.setTimeout(m_settings->getUnsignedInt("timeout").second);
+ pair<bool,unsigned int> timeout = m_relyingParty->getUnsignedInt("connectTimeout");
+ transport.setConnectTimeout(timeout.first ? timeout.second : 10);
+ timeout = m_relyingParty->getUnsignedInt("timeout");
+ transport.setTimeout(timeout.first ? timeout.second : 20);
+ m_app.getServiceProvider().setTransportOptions(transport);
HTTPSOAPTransport* http = dynamic_cast<HTTPSOAPTransport*>(&transport);
if (http) {
- flag = m_settings->getBool("chunkedEncoding");
- http->useChunkedEncoding(!flag.first || flag.second);
- http->setRequestHeader("Shibboleth", PACKAGE_VERSION);
+ flag = m_relyingParty->getBool("chunkedEncoding");
+ http->useChunkedEncoding(flag.first && flag.second);
+ http->setRequestHeader("User-Agent", PACKAGE_NAME);
+ http->setRequestHeader(PACKAGE_NAME, PACKAGE_VERSION);
}
}
void SOAPClient::reset()
{
- m_relyingParty = NULL;
+ m_relyingParty = nullptr;
if (m_credResolver)
m_credResolver->unlock();
- m_credResolver = NULL;
+ m_credResolver = nullptr;
opensaml::SOAPClient::reset();
-}
\ No newline at end of file
+}
+
projects / shibboleth / sp.git / blobdiff