Adjusted ACL API to take authn statement as well as attrs.

git-svn-id: https://svn.middleware.georgetown.edu/cpp-sp/trunk@1058 cb58f699-b61c-0410-a6fe-9272a202ed29

diff --git a/apache/mod_apache.cpp b/apache/mod_apache.cpp
index e1fe35a..8630a14 100644 (file)
--- a/apache/mod_apache.cpp
+++ b/apache/mod_apache.cpp
@@ -325,7 +325,7 @@ extern "C" int shib_check_user(request_rec* r)
     // Do we have an access control plugin?
     if (settings.second) {
         Locker acllock(settings.second);
-        if (!settings.second->authorized(assertions)) {
+        if (!settings.second->authorized(*sso_statement,assertions)) {
             for (int k = 0; k < assertions.size(); k++)
                 delete assertions[k];
             delete sso_statement;
@@ -381,23 +381,21 @@ extern "C" int shib_check_user(request_rec* r)
     ap_table_unset(r->headers_in,"Shib-Origin-Site");
     ap_table_unset(r->headers_in,"Shib-Authentication-Method");
     ap_table_unset(r->headers_in,"Shib-NameIdentifier-Format");
-    if (sso_statement) {
-        auto_ptr_char os(sso_statement->getSubject()->getNameIdentifier()->getNameQualifier());
-        auto_ptr_char am(sso_statement->getAuthMethod());
-        ap_table_set(r->headers_in,"Shib-Origin-Site", os.get());
-        ap_table_set(r->headers_in,"Shib-Authentication-Method", am.get());
-        
-        // Export NameID?
-        AAP wrapper(provs,sso_statement->getSubject()->getNameIdentifier()->getFormat(),Constants::SHIB_ATTRIBUTE_NAMESPACE_URI);
-        if (!wrapper.fail() && wrapper->getHeader()) {
-            auto_ptr_char form(sso_statement->getSubject()->getNameIdentifier()->getFormat());
-            auto_ptr_char nameid(sso_statement->getSubject()->getNameIdentifier()->getName());
-            ap_table_set(r->headers_in,"Shib-NameIdentifier-Format",form.get());
-            if (!strcmp(wrapper->getHeader(),"REMOTE_USER"))
-                SH_AP_USER(r)=ap_pstrdup(r->pool,nameid.get());
-            else
-                ap_table_set(r->headers_in,wrapper->getHeader(),nameid.get());
-        }
+    auto_ptr_char os(sso_statement->getSubject()->getNameIdentifier()->getNameQualifier());
+    auto_ptr_char am(sso_statement->getAuthMethod());
+    ap_table_set(r->headers_in,"Shib-Origin-Site", os.get());
+    ap_table_set(r->headers_in,"Shib-Authentication-Method", am.get());
+    
+    // Export NameID?
+    AAP wrapper(provs,sso_statement->getSubject()->getNameIdentifier()->getFormat(),Constants::SHIB_ATTRIBUTE_NAMESPACE_URI);
+    if (!wrapper.fail() && wrapper->getHeader()) {
+        auto_ptr_char form(sso_statement->getSubject()->getNameIdentifier()->getFormat());
+        auto_ptr_char nameid(sso_statement->getSubject()->getNameIdentifier()->getName());
+        ap_table_set(r->headers_in,"Shib-NameIdentifier-Format",form.get());
+        if (!strcmp(wrapper->getHeader(),"REMOTE_USER"))
+            SH_AP_USER(r)=ap_pstrdup(r->pool,nameid.get());
+        else
+            ap_table_set(r->headers_in,wrapper->getHeader(),nameid.get());
     }
     
     ap_table_unset(r->headers_in,"Shib-Application-ID");

diff --git a/isapi_shib/isapi_shib.cpp b/isapi_shib/isapi_shib.cpp
index 08351d1..13f7bf4 100644 (file)
--- a/isapi_shib/isapi_shib.cpp
+++ b/isapi_shib/isapi_shib.cpp
@@ -552,7 +552,7 @@ extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificat
         // Do we have an access control plugin?
         if (settings.second) {
             Locker acllock(settings.second);
-            if (!settings.second->authorized(assertions)) {
+            if (!settings.second->authorized(*sso_statement,assertions)) {
                 for (int k = 0; k < assertions.size(); k++)
                     delete assertions[k];
                 delete sso_statement;
@@ -609,29 +609,27 @@ extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificat
         pn->SetHeader(pfc,"Shib-NameIdentifier-Format:","");
 
         // Export the SAML AuthnMethod and the origin site name.
-        if (sso_statement) {
-            auto_ptr_char os(sso_statement->getSubject()->getNameIdentifier()->getNameQualifier());
-            auto_ptr_char am(sso_statement->getAuthMethod());
-            pn->SetHeader(pfc,"Shib-Origin-Site:", const_cast<char*>(os.get()));
-            pn->SetHeader(pfc,"Shib-Authentication-Method:", const_cast<char*>(am.get()));
-
-            // Export NameID?
-            AAP wrapper(provs,sso_statement->getSubject()->getNameIdentifier()->getFormat(),Constants::SHIB_ATTRIBUTE_NAMESPACE_URI);
-            if (!wrapper.fail() && wrapper->getHeader()) {
-                auto_ptr_char form(sso_statement->getSubject()->getNameIdentifier()->getFormat());
-                auto_ptr_char nameid(sso_statement->getSubject()->getNameIdentifier()->getName());
-                pn->SetHeader(pfc,"Shib-NameIdentifier-Format:",const_cast<char*>(form.get()));
-                if (!strcmp(wrapper->getHeader(),"REMOTE_USER")) {
-                    char* principal=const_cast<char*>(nameid.get());
-                    pn->SetHeader(pfc,"remote-user:",principal);
-                    pfc->pFilterContext=pfc->AllocMem(pfc,strlen(principal)+1,0);
-                    if (pfc->pFilterContext)
-                        strcpy(static_cast<char*>(pfc->pFilterContext),principal);
-                }
-                else {
-                    string hname=string(wrapper->getHeader()) + ':';
-                    pn->SetHeader(pfc,const_cast<char*>(wrapper->getHeader()),const_cast<char*>(nameid.get()));
-                }
+        auto_ptr_char os(sso_statement->getSubject()->getNameIdentifier()->getNameQualifier());
+        auto_ptr_char am(sso_statement->getAuthMethod());
+        pn->SetHeader(pfc,"Shib-Origin-Site:", const_cast<char*>(os.get()));
+        pn->SetHeader(pfc,"Shib-Authentication-Method:", const_cast<char*>(am.get()));
+
+        // Export NameID?
+        AAP wrapper(provs,sso_statement->getSubject()->getNameIdentifier()->getFormat(),Constants::SHIB_ATTRIBUTE_NAMESPACE_URI);
+        if (!wrapper.fail() && wrapper->getHeader()) {
+            auto_ptr_char form(sso_statement->getSubject()->getNameIdentifier()->getFormat());
+            auto_ptr_char nameid(sso_statement->getSubject()->getNameIdentifier()->getName());
+            pn->SetHeader(pfc,"Shib-NameIdentifier-Format:",const_cast<char*>(form.get()));
+            if (!strcmp(wrapper->getHeader(),"REMOTE_USER")) {
+                char* principal=const_cast<char*>(nameid.get());
+                pn->SetHeader(pfc,"remote-user:",principal);
+                pfc->pFilterContext=pfc->AllocMem(pfc,strlen(principal)+1,0);
+                if (pfc->pFilterContext)
+                    strcpy(static_cast<char*>(pfc->pFilterContext),principal);
+            }
+            else {
+                string hname=string(wrapper->getHeader()) + ':';
+                pn->SetHeader(pfc,const_cast<char*>(wrapper->getHeader()),const_cast<char*>(nameid.get()));
             }
         }
 

diff --git a/shib-target/shib-target.h b/shib-target/shib-target.h
index c6a96dd..f9d5eb0 100644 (file)
--- a/shib-target/shib-target.h
+++ b/shib-target/shib-target.h
@@ -160,7 +160,9 @@ namespace shibtarget {
 
     struct SHIBTARGET_EXPORTS IAccessControl : public virtual shibboleth::ILockable, public virtual shibboleth::IPlugIn
     {
-        virtual bool authorized(const saml::Iterator<saml::SAMLAssertion*>& creds) const=0;
+        virtual bool authorized(
+            const saml::SAMLAuthenticationStatement& authn, const saml::Iterator<saml::SAMLAssertion*>& attrs
+            ) const=0;
         virtual ~IAccessControl() {}
     };