/*
- * Copyright 2001-2009 Internet2
+ * Copyright 2001-2010 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
#include "Application.h"
#include "exceptions.h"
#include "ServiceProvider.h"
-#include "SPRequest.h"
#include "handler/AbstractHandler.h"
#include "handler/RemotedHandler.h"
#include "handler/SessionInitiator.h"
using namespace opensaml::saml2md;
#else
# include "lite/SAMLConstants.h"
-#include <xercesc/util/XMLUniDefs.hpp>
+# include <xercesc/util/XMLUniDefs.hpp>
#endif
using namespace shibsp;
pair<bool,long> unwrap(SPRequest& request, DDF& out) const;
pair<bool,long> run(SPRequest& request, string& entityID, bool isHandler=true) const;
+ const XMLCh* getProtocolFamily() const {
+ return samlconstants::SAML20P_NS;
+ }
+
private:
pair<bool,long> doRequest(
const Application& application,
};
SAML2SessionInitiator::SAML2SessionInitiator(const DOMElement* e, const char* appId)
- : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT".SessionInitiator.SAML2"), NULL, &m_remapper), m_appId(appId),
+ : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT".SessionInitiator.SAML2"), nullptr, &m_remapper), m_appId(appId),
m_paosNS(samlconstants::PAOS_NS), m_ecpNS(samlconstants::SAML20ECP_NS), m_paosBinding(samlconstants::SAML20_BINDING_PAOS)
{
static const XMLCh ECP[] = UNICODE_LITERAL_3(E,C,P);
- const XMLCh* flag = e ? e->getAttributeNS(NULL,ECP) : NULL;
+ const XMLCh* flag = e ? e->getAttributeNS(nullptr,ECP) : nullptr;
#ifdef SHIBSP_LITE
m_ecp = (flag && (*flag == chLatin_t || *flag == chDigit_1));
#else
- m_outgoing=NULL;
- m_ecp = NULL;
- m_requestTemplate=NULL;
+ m_outgoing=nullptr;
+ m_ecp = nullptr;
+ m_requestTemplate=nullptr;
if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
// Check for a template AuthnRequest to build from.
if (flag && (*flag == chLatin_t || *flag == chDigit_1)) {
try {
m_ecp = SAMLConfig::getConfig().MessageEncoderManager.newPlugin(
- samlconstants::SAML20_BINDING_PAOS, pair<const DOMElement*,const XMLCh*>(e,NULL)
+ samlconstants::SAML20_BINDING_PAOS, pair<const DOMElement*,const XMLCh*>(e,nullptr)
);
}
catch (exception& ex) {
try {
auto_ptr_char b(start);
MessageEncoder * encoder = SAMLConfig::getConfig().MessageEncoderManager.newPlugin(
- b.get(),pair<const DOMElement*,const XMLCh*>(e,NULL)
+ b.get(),pair<const DOMElement*,const XMLCh*>(e,nullptr)
);
- if (encoder->isUserAgentPresent()) {
+ if (encoder->isUserAgentPresent() && XMLString::equals(getProtocolFamily(), encoder->getProtocolFamily())) {
m_encoders[start] = encoder;
m_log.debug("supporting outgoing binding (%s)", b.get());
}
else {
delete encoder;
- m_log.warn("skipping outgoing binding (%s), not a front-channel mechanism", b.get());
+ m_log.warn("skipping outgoing binding (%s), not a SAML 2.0 front-channel mechanism", b.get());
}
}
catch (exception& ex) {
string address = m_appId + loc.second + "::run::SAML2SI";
setAddress(address.c_str());
}
+
+ m_supportedOptions.insert("isPassive");
}
void SAML2SessionInitiator::setParent(const PropertySet* parent)
}
// We have to know the IdP to function unless this is ECP.
- if (!ECP && (entityID.empty()))
+ if ((!ECP && entityID.empty()) || !checkCompatibility(request, isHandler))
return make_pair(false,0L);
string target;
- string postData;
- const Handler* ACS=NULL;
- const char* option;
+ pair<bool,const char*> prop;
+ const Handler* ACS=nullptr;
pair<bool,const char*> acClass, acComp, nidFormat, spQual;
bool isPassive=false,forceAuthn=false;
const Application& app=request.getApplication();
pair<bool,bool> acsByIndex = ECP ? make_pair(true,false) : getBool("acsByIndex");
if (isHandler) {
- option=request.getParameter("acsIndex");
- if (option) {
- ACS = app.getAssertionConsumerServiceByIndex(atoi(option));
+ prop.second = request.getParameter("acsIndex");
+ if (prop.second && *prop.second) {
+ ACS = app.getAssertionConsumerServiceByIndex(atoi(prop.second));
if (!ACS)
request.log(SPRequest::SPWarn, "invalid acsIndex specified in request, using acsIndex property");
else if (ECP && !XMLString::equals(ACS->getString("Binding").second, samlconstants::SAML20_BINDING_PAOS)) {
request.log(SPRequest::SPWarn, "acsIndex in request referenced a non-PAOS ACS, using default ACS location");
- ACS = NULL;
+ ACS = nullptr;
}
}
- option = request.getParameter("target");
- if (option)
- target = option;
+ prop = getString("target", request);
+ if (prop.first)
+ target = prop.second;
// Always need to recover target URL to compute handler below.
- recoverRelayState(request.getApplication(), request, request, target, false);
+ recoverRelayState(app, request, request, target, false);
+
+ pair<bool,bool> flag = getBool("isPassive", request);
+ isPassive = (flag.first && flag.second);
- pair<bool,bool> flag;
- option = request.getParameter("isPassive");
- if (option) {
- isPassive = (*option=='1' || *option=='t');
- }
- else {
- flag = getBool("isPassive");
- isPassive = (flag.first && flag.second);
- }
if (!isPassive) {
- option = request.getParameter("forceAuthn");
- if (option) {
- forceAuthn = (*option=='1' || *option=='t');
- }
- else {
- flag = getBool("forceAuthn");
- forceAuthn = (flag.first && flag.second);
- }
+ flag = getBool("forceAuthn", request);
+ forceAuthn = (flag.first && flag.second);
}
- if (acClass.second = request.getParameter("authnContextClassRef"))
- acClass.first = true;
- else
- acClass = getString("authnContextClassRef");
-
- if (acComp.second = request.getParameter("authnContextComparison"))
- acComp.first = true;
- else
- acComp = getString("authnContextComparison");
-
- if (nidFormat.second = request.getParameter("NameIDFormat"))
- nidFormat.first = true;
- else
- nidFormat = getString("NameIDFormat");
-
- if (spQual.second = request.getParameter("SPNameQualifier"))
- spQual.first = true;
- else
- spQual = getString("SPNameQualifier");
+ // Populate via parameter, map, or property.
+ acClass = getString("authnContextClassRef", request);
+ acComp = getString("authnContextComparison", request);
+ nidFormat = getString("NameIDFormat", request);
+ spQual = getString("SPNameQualifier", request);
}
else {
- // We're running as a "virtual handler" from within the filter.
- // The target resource is the current one and everything else is defaulted.
- target=request.getRequestURL();
- const PropertySet* settings = request.getRequestSettings().first;
-
- pair<bool,bool> flag = settings->getBool("isPassive");
- if (!flag.first)
- flag = getBool("isPassive");
+ // Check for a hardwired target value in the map or handler.
+ prop = getString("target", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
+ if (prop.first)
+ target = prop.second;
+ else
+ target = request.getRequestURL();
+
+ pair<bool,bool> flag = getBool("isPassive", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
isPassive = flag.first && flag.second;
if (!isPassive) {
- flag = settings->getBool("forceAuthn");
- if (!flag.first)
- flag = getBool("forceAuthn");
+ flag = getBool("forceAuthn", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
forceAuthn = flag.first && flag.second;
}
- acClass = settings->getString("authnContextClassRef");
- if (!acClass.first)
- acClass = getString("authnContextClassRef");
- acComp = settings->getString("authnContextComparison");
- if (!acComp.first)
- acComp = getString("authnContextComparison");
- nidFormat = settings->getString("NameIDFormat");
- if (!nidFormat.first)
- nidFormat = getString("NameIDFormat");
- spQual = settings->getString("SPNameQualifier");
- if (!spQual.first)
- spQual = getString("SPNameQualifier");
+ // Populate via map or property.
+ acClass = getString("authnContextClassRef", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
+ acComp = getString("authnContextComparison", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
+ nidFormat = getString("NameIDFormat", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
+ spQual = getString("SPNameQualifier", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
}
if (ECP)
if (!ACS) {
if (ECP) {
- const vector<const Handler*>& handlers = app.getAssertionConsumerServicesByBinding(m_paosBinding.get());
- if (handlers.empty())
+ ACS = app.getAssertionConsumerServiceByProtocol(getProtocolFamily(), samlconstants::SAML20_BINDING_PAOS);
+ if (!ACS)
throw ConfigurationException("Unable to locate PAOS response endpoint.");
- ACS = handlers.front();
}
else {
- pair<bool,unsigned int> index = getUnsignedInt("acsIndex");
- if (index.first) {
+ // Try fixed index property.
+ pair<bool,unsigned int> index = getUnsignedInt("acsIndex", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
+ if (index.first)
ACS = app.getAssertionConsumerServiceByIndex(index.second);
- if (!ACS)
- request.log(SPRequest::SPWarn, "invalid acsIndex property, using default ACS location");
- }
- if (!ACS)
- ACS = app.getDefaultAssertionConsumerService();
}
}
- // Validate the ACS for use with this protocol.
- if (!ECP) {
- pair<bool,const char*> ACSbinding = ACS ? ACS->getString("Binding") : pair<bool,const char*>(false,NULL);
- if (ACSbinding.first) {
- pair<bool,const char*> compatibleBindings = getString("compatibleBindings");
- if (compatibleBindings.first && strstr(compatibleBindings.second, ACSbinding.second) == NULL) {
- m_log.error("configured or requested ACS has non-SAML 2.0 binding");
- throw ConfigurationException("Configured or requested ACS has non-SAML 2.0 binding ($1).", params(1, ACSbinding.second));
- }
- else if (strcmp(ACSbinding.second, samlconstants::SAML20_BINDING_HTTP_POST) &&
- strcmp(ACSbinding.second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT) &&
- strcmp(ACSbinding.second, samlconstants::SAML20_BINDING_HTTP_POST_SIMPLESIGN)) {
- m_log.error("configured or requested ACS has non-SAML 2.0 binding");
- throw ConfigurationException("Configured or requested ACS has non-SAML 2.0 binding ($1).", params(1, ACSbinding.second));
- }
- }
+ // If we picked by index, validate the ACS for use with this protocol.
+ if (!ECP && (!ACS || !XMLString::equals(getProtocolFamily(), ACS->getProtocolFamily()))) {
+ if (ACS)
+ request.log(SPRequest::SPWarn, "invalid acsIndex property, or non-SAML 2.0 ACS, using default SAML 2.0 ACS");
+ ACS = app.getAssertionConsumerServiceByProtocol(getProtocolFamily());
+ if (!ACS)
+ throw ConfigurationException("Unable to locate a SAML 2.0 ACS endpoint to use for response.");
}
// To invoke the request builder, the key requirement is to figure out how
// to express the ACS, by index or value, and if by value, where.
// We have to compute the handlerURL no matter what, because we may need to
// flip the index to an SSL-version.
- string ACSloc=request.getHandlerURL(target.c_str());
+ string ACSloc = request.getHandlerURL(target.c_str());
SPConfig& conf = SPConfig::getConfig();
if (conf.isEnabled(SPConfig::OutOfProcess)) {
// Pass by Index.
if (isHandler) {
// We may already have RelayState set if we looped back here,
- // but just in case target is a resource, we reset it back.
- target.erase();
- option = request.getParameter("target");
- if (option)
- target = option;
+ // but we've turned it back into a resource by this point, so if there's
+ // a target on the URL, reset to that value.
+ prop.second = request.getParameter("target");
+ if (prop.second && *prop.second)
+ target = prop.second;
}
// Determine index to use.
- pair<bool,const XMLCh*> ix = pair<bool,const XMLCh*>(false,NULL);
- if (ACS) {
- if (!strncmp(ACSloc.c_str(), "https", 5)) {
- ix = ACS->getXMLString("sslIndex", shibspconstants::ASCII_SHIB2SPCONFIG_NS);
- if (!ix.first)
- ix = ACS->getXMLString("index");
- }
- else {
+ pair<bool,const XMLCh*> ix = pair<bool,const XMLCh*>(false,nullptr);
+ if (!strncmp(ACSloc.c_str(), "https", 5)) {
+ ix = ACS->getXMLString("sslIndex", shibspconstants::ASCII_SHIB2SPCONFIG_NS);
+ if (!ix.first)
ix = ACS->getXMLString("index");
- }
+ }
+ else {
+ ix = ACS->getXMLString("index");
}
return doRequest(
app, &request, request, entityID.c_str(),
ix.second,
- ACS ? XMLString::equals(ACS->getString("Binding").second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT) : false,
- NULL, NULL,
+ XMLString::equals(ACS->getString("Binding").second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT),
+ nullptr, nullptr,
isPassive, forceAuthn,
- acClass.first ? acClass.second : NULL,
- acComp.first ? acComp.second : NULL,
- nidFormat.first ? nidFormat.second : NULL,
- spQual.first ? spQual.second : NULL,
+ acClass.first ? acClass.second : nullptr,
+ acComp.first ? acComp.second : nullptr,
+ nidFormat.first ? nidFormat.second : nullptr,
+ spQual.first ? spQual.second : nullptr,
target
);
}
// Since we're not passing by index, we need to fully compute the return URL and binding.
// Compute the ACS URL. We add the ACS location to the base handlerURL.
- pair<bool,const char*> loc=ACS ? ACS->getString("Location") : pair<bool,const char*>(false,NULL);
- if (loc.first) ACSloc+=loc.second;
+ prop = ACS->getString("Location");
+ if (prop.first)
+ ACSloc += prop.second;
if (isHandler) {
// We may already have RelayState set if we looped back here,
- // but just in case target is a resource, we reset it back.
- target.erase();
- option = request.getParameter("target");
- if (option)
- target = option;
+ // but we've turned it back into a resource by this point, so if there's
+ // a target on the URL, reset to that value.
+ prop.second = request.getParameter("target");
+ if (prop.second && *prop.second)
+ target = prop.second;
}
return doRequest(
app, &request, request, entityID.c_str(),
- NULL,
- ACS ? XMLString::equals(ACS->getString("Binding").second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT) : false,
- ACSloc.c_str(), ACS ? ACS->getXMLString("Binding").second : NULL,
+ nullptr,
+ XMLString::equals(ACS->getString("Binding").second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT),
+ ACSloc.c_str(), ACS->getXMLString("Binding").second,
isPassive, forceAuthn,
- acClass.first ? acClass.second : NULL,
- acComp.first ? acComp.second : NULL,
- nidFormat.first ? nidFormat.second : NULL,
- spQual.first ? spQual.second : NULL,
+ acClass.first ? acClass.second : nullptr,
+ acComp.first ? acComp.second : nullptr,
+ nidFormat.first ? nidFormat.second : nullptr,
+ spQual.first ? spQual.second : nullptr,
target
);
}
if (spQual.first)
in.addmember("SPNameQualifier").string(spQual.second);
if (acsByIndex.first && acsByIndex.second) {
- if (ACS) {
- // Determine index to use.
- pair<bool,const char*> ix = pair<bool,const char*>(false,NULL);
- if (!strncmp(ACSloc.c_str(), "https", 5)) {
- ix = ACS->getString("sslIndex", shibspconstants::ASCII_SHIB2SPCONFIG_NS);
- if (!ix.first)
- ix = ACS->getString("index");
- }
- else {
+ // Determine index to use.
+ pair<bool,const char*> ix = pair<bool,const char*>(false,nullptr);
+ if (!strncmp(ACSloc.c_str(), "https", 5)) {
+ ix = ACS->getString("sslIndex", shibspconstants::ASCII_SHIB2SPCONFIG_NS);
+ if (!ix.first)
ix = ACS->getString("index");
- }
- in.addmember("acsIndex").string(ix.second);
- if (XMLString::equals(ACS->getString("Binding").second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT))
- in.addmember("artifact").integer(1);
}
+ else {
+ ix = ACS->getString("index");
+ }
+ in.addmember("acsIndex").string(ix.second);
+ if (XMLString::equals(ACS->getString("Binding").second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT))
+ in.addmember("artifact").integer(1);
}
else {
// Since we're not passing by index, we need to fully compute the return URL and binding.
// Compute the ACS URL. We add the ACS location to the base handlerURL.
- pair<bool,const char*> loc=ACS ? ACS->getString("Location") : pair<bool,const char*>(false,NULL);
- if (loc.first) ACSloc+=loc.second;
+ prop = ACS->getString("Location");
+ if (prop.first)
+ ACSloc += prop.second;
in.addmember("acsLocation").string(ACSloc.c_str());
- if (ACS) {
- loc = ACS->getString("Binding");
- in.addmember("acsBinding").string(loc.second);
- if (XMLString::equals(loc.second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT))
- in.addmember("artifact").integer(1);
- }
+ prop = ACS->getString("Binding");
+ in.addmember("acsBinding").string(prop.second);
+ if (XMLString::equals(prop.second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT))
+ in.addmember("artifact").integer(1);
}
if (isHandler) {
// We may already have RelayState set if we looped back here,
- // but just in case target is a resource, we reset it back.
- target.erase();
- option = request.getParameter("target");
- if (option)
- target = option;
+ // but we've turned it back into a resource by this point, so if there's
+ // a target on the URL, reset to that value.
+ prop.second = request.getParameter("target");
+ if (prop.second && *prop.second)
+ target = prop.second;
}
if (!target.empty())
in.addmember("RelayState").unsafe_string(target.c_str());
{
// Find application.
const char* aid=in["application_id"].string();
- const Application* app=aid ? SPConfig::getConfig().getServiceProvider()->getApplication(aid) : NULL;
+ const Application* app=aid ? SPConfig::getConfig().getServiceProvider()->getApplication(aid) : nullptr;
if (!app) {
// Something's horribly wrong.
m_log.error("couldn't find application (%s) to generate AuthnRequest", aid ? aid : "(missing)");
throw ConfigurationException("Unable to locate application for new session, deleted?");
}
- DDF ret(NULL);
+ DDF ret(nullptr);
DDFJanitor jout(ret);
// Wrap the outgoing object with a Response facade.
// a false/0 return, which we just return as an empty structure, or a response/redirect,
// which we capture in the facade and send back.
doRequest(
- *app, NULL, *http.get(), in["entity_id"].string(),
+ *app, nullptr, *http.get(), in["entity_id"].string(),
index.get(),
(in["artifact"].integer() != 0),
in["acsLocation"].string(), bind.get(),
#ifndef SHIBSP_LITE
bool ECP = XMLString::equals(acsBinding, m_paosBinding.get());
- pair<const EntityDescriptor*,const RoleDescriptor*> entity = pair<const EntityDescriptor*,const RoleDescriptor*>(NULL,NULL);
- const IDPSSODescriptor* role = NULL;
- const EndpointType* ep = NULL;
- const MessageEncoder* encoder = NULL;
+ pair<const EntityDescriptor*,const RoleDescriptor*> entity = pair<const EntityDescriptor*,const RoleDescriptor*>(nullptr,nullptr);
+ const IDPSSODescriptor* role = nullptr;
+ const EndpointType* ep = nullptr;
+ const MessageEncoder* encoder = nullptr;
// We won't need this for ECP, but safety dictates we get the lock here.
MetadataProvider* m=app.getMetadataProvider();
auto_ptr<AuthnRequest> req(m_requestTemplate ? m_requestTemplate->cloneAuthnRequest() : AuthnRequestBuilder::buildAuthnRequest());
if (m_requestTemplate) {
// Freshen TS and ID.
- req->setID(NULL);
- req->setIssueInstant(time(NULL));
+ req->setID(nullptr);
+ req->setIssueInstant(time(nullptr));
}
if (ep)
}
if (reqContext->getAuthnContextClassRefs().empty() && reqContext->getAuthnContextDeclRefs().empty()) {
- req->setRequestedAuthnContext(NULL);
+ req->setRequestedAuthnContext(nullptr);
}
else if (authnContextComparison) {
auto_ptr_XMLCh widecomp(authnContextComparison);
lifetime.second = 28800;
if (!req->getConditions())
req->setConditions(ConditionsBuilder::buildConditions());
- req->getConditions()->setNotOnOrAfter(time(NULL) + lifetime.second + 300);
+ req->getConditions()->setNotOnOrAfter(time(nullptr) + lifetime.second + 300);
AudienceRestriction* audrest = AudienceRestrictionBuilder::buildAudienceRestriction();
req->getConditions()->getConditions().push_back(audrest);
Audience* aud = AudienceBuilder::buildAudience();
scoping->setIDPList(idplist);
}
VectorOf(IDPEntry) entries = idplist->getIDPEntrys();
- if (find_if(entries, bind2nd(_sameIdP(), wideid.get())) == NULL) {
+ if (find_if(entries, bind2nd(_sameIdP(), wideid.get())) == nullptr) {
IDPEntry* entry = IDPEntryBuilder::buildIDPEntry();
entry->setProviderID(wideid.get());
entries.push_back(entry);
}
}
- auto_ptr_char dest(ep ? ep->getLocation() : NULL);
+ auto_ptr_char dest(ep ? ep->getLocation() : nullptr);
if (httpRequest) {
// If the request object is available, we're responsible for the POST data.
projects / shibboleth / sp.git / blobdiff