SP policy subclass for use by artifact resolver.

git-svn-id: https://svn.middleware.georgetown.edu/cpp-sp/trunk@2209 cb58f699-b61c-0410-a6fe-9272a202ed29

diff --git a/shibsp/Makefile.am b/shibsp/Makefile.am
index 8a22ece..aef97dc 100644 (file)
--- a/shibsp/Makefile.am
+++ b/shibsp/Makefile.am
@@ -66,7 +66,8 @@ reminclude_HEADERS = \
        remoting/ListenerService.h
        
 secinclude_HEADERS = \
-       security/PKIXTrustEngine.h
+       security/PKIXTrustEngine.h \
+       security/SecurityPolicy.h
 
 utilinclude_HEADERS = \
        util/DOMPropertySet.h \
@@ -109,6 +110,7 @@ libshibsp_la_SOURCES = \
        remoting/impl/TCPListener.cpp \
        remoting/impl/UnixListener.cpp \
        security/PKIXTrustEngine.cpp \
+       security/SecurityPolicy.cpp \
        util/DOMPropertySet.cpp \
        util/SPConstants.cpp \
        util/TemplateParameters.cpp

diff --git a/shibsp/attribute/resolver/impl/SimpleAttributeResolver.cpp b/shibsp/attribute/resolver/impl/SimpleAttributeResolver.cpp
index b09b71b..90ac16a 100644 (file)
--- a/shibsp/attribute/resolver/impl/SimpleAttributeResolver.cpp
+++ b/shibsp/attribute/resolver/impl/SimpleAttributeResolver.cpp
@@ -519,9 +519,9 @@ void SimpleResolverImpl::query(ResolutionContext& ctx, const NameIdentifier& nam
         return;\r
     }\r
 \r
-    SecurityPolicy policy;\r
+    shibsp::SecurityPolicy policy(ctx.getApplication());\r
     MetadataCredentialCriteria mcc(*AA);\r
-    shibsp::SOAPClient soaper(ctx.getApplication(),policy);\r
+    shibsp::SOAPClient soaper(policy);\r
     const PropertySet* policySettings = ctx.getApplication().getServiceProvider().getPolicySettings(ctx.getApplication().getString("policyId").second);\r
     pair<bool,bool> signedAssertions = policySettings->getBool("signedAssertions");\r
 \r
@@ -631,9 +631,9 @@ void SimpleResolverImpl::query(ResolutionContext& ctx, const NameID& nameid, con
         return;\r
     }\r
 \r
-    SecurityPolicy policy;\r
+    shibsp::SecurityPolicy policy(ctx.getApplication());\r
     MetadataCredentialCriteria mcc(*AA);\r
-    shibsp::SOAPClient soaper(ctx.getApplication(),policy);\r
+    shibsp::SOAPClient soaper(policy);\r
     const PropertySet* policySettings = ctx.getApplication().getServiceProvider().getPolicySettings(ctx.getApplication().getString("policyId").second);\r
     pair<bool,bool> signedAssertions = policySettings->getBool("signedAssertions");\r
 \r

diff --git a/shibsp/binding/SOAPClient.h b/shibsp/binding/SOAPClient.h
index ee16ada..4f18061 100644 (file)
--- a/shibsp/binding/SOAPClient.h
+++ b/shibsp/binding/SOAPClient.h
@@ -23,7 +23,7 @@
 #ifndef __shibsp_soap11client_h__
 #define __shibsp_soap11client_h__
 
-#include <shibsp/Application.h>
+#include <shibsp/security/SecurityPolicy.h>
 #include <saml/binding/SOAPClient.h>
 #include <xmltooling/security/CredentialResolver.h>
 
@@ -38,10 +38,9 @@ namespace shibsp {
         /**
          * Creates a SOAP client instance for an Application to use.
          * 
-         * @param application   reference to Application
-         * @param policy        reference to (empty) SecurityPolicy to apply
+         * @param policy        reference to SP-SecurityPolicy to apply
          */
-        SOAPClient(const Application& application, opensaml::SecurityPolicy& policy);
+        SOAPClient(SecurityPolicy& policy);
         
         virtual ~SOAPClient() {
             if (m_credResolver)

diff --git a/shibsp/binding/impl/SOAPClient.cpp b/shibsp/binding/impl/SOAPClient.cpp
index 49a3e38..2a8363f 100644 (file)
--- a/shibsp/binding/impl/SOAPClient.cpp
+++ b/shibsp/binding/impl/SOAPClient.cpp
@@ -21,6 +21,7 @@
  */
 
 #include "internal.h"
+#include "Application.h"
 #include "exceptions.h"
 #include "ServiceProvider.h"
 #include "binding/SOAPClient.h"
@@ -38,16 +39,10 @@ using namespace xmltooling;
 using namespace log4cpp;
 using namespace std;
 
-SOAPClient::SOAPClient(const Application& application, opensaml::SecurityPolicy& policy)
-    : opensaml::SOAPClient(policy), m_app(application), m_settings(NULL), m_relyingParty(NULL), m_credResolver(NULL)
+SOAPClient::SOAPClient(SecurityPolicy& policy)
+    : opensaml::SOAPClient(policy), m_app(policy.getApplication()), m_settings(NULL), m_relyingParty(NULL), m_credResolver(NULL)
 {
-    pair<bool,const char*> policyId = m_app.getString("policyId");
-    m_settings = application.getServiceProvider().getPolicySettings(policyId.second);
-    const vector<const opensaml::SecurityPolicyRule*>& rules = application.getServiceProvider().getPolicyRules(policyId.second);
-    for (vector<const opensaml::SecurityPolicyRule*>::const_iterator rule=rules.begin(); rule!=rules.end(); ++rule)
-        policy.addRule(*rule);
-    policy.setMetadataProvider(application.getMetadataProvider());
-    policy.setTrustEngine(application.getTrustEngine());
+    m_settings = m_app.getServiceProvider().getPolicySettings(m_app.getString("policyId").second);
     pair<bool,bool> validate = m_settings->getBool("validate");
     policy.setValidating(validate.first && validate.second);
     setValidating(validate.first && validate.second);

diff --git a/shibsp/security/SecurityPolicy.cpp b/shibsp/security/SecurityPolicy.cpp
new file mode 100644 (file)
index 0000000..ec9c28a
--- /dev/null
+++ b/shibsp/security/SecurityPolicy.cpp
@@ -0,0 +1,39 @@
+/*
+ *  Copyright 2001-2007 Internet2
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * SecurityPolicy.cpp
+ * 
+ * SP-specific SecurityPolicy subclass.
+ */
+
+#include "internal.h"
+#include "Application.h"
+#include "ServiceProvider.h"
+#include "security/SecurityPolicy.h"
+
+using namespace shibsp;
+
+SecurityPolicy::SecurityPolicy(const Application& application, const xmltooling::QName* role, bool validate)
+    : opensaml::SecurityPolicy(
+        application.getServiceProvider().getPolicyRules(application.getString("policyId").second),
+        application.getMetadataProvider(),
+        role,
+        application.getTrustEngine(),
+        validate),
+        m_application(application)
+{
+}

diff --git a/shibsp/security/SecurityPolicy.h b/shibsp/security/SecurityPolicy.h
new file mode 100644 (file)
index 0000000..74745ff
--- /dev/null
+++ b/shibsp/security/SecurityPolicy.h
@@ -0,0 +1,65 @@
+/*
+ *  Copyright 2001-2007 Internet2
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file shibsp/security/SecurityPolicy.h
+ * 
+ * SP-specific SecurityPolicy subclass.
+ */
+
+#ifndef __shibsp_secpol_h__
+#define __shibsp_secpol_h__
+
+#include <shibsp/base.h>
+#include <saml/binding/SecurityPolicy.h>
+
+namespace shibsp {
+    
+    class SHIBSP_API Application;
+
+    /**
+     * SP-specific SecurityPolicy subclass.
+     */
+    class SHIBSP_API SecurityPolicy : public opensaml::SecurityPolicy
+    {
+    public:
+        /**
+         * Constructor for policy.
+         * 
+         * @param application       an Application instance
+         * @param role              identifies the role (generally IdP or SP) of the policy peer 
+         * @param validate          true iff XML parsing should be done with validation
+         */
+        SecurityPolicy(const Application& application, const xmltooling::QName* role=NULL, bool validate=true);
+
+        virtual ~SecurityPolicy() {}
+
+        /**
+         * Returns the Application associated with the policy.
+         * 
+         * @return the associated Application
+         */
+        const Application& getApplication() const {
+            return m_application;
+        }
+
+    private:
+        const Application& m_application;
+    };
+
+};
+
+#endif /* __shibsp_secpol_h__ */

diff --git a/shibsp/shibsp.vcproj b/shibsp/shibsp.vcproj
index cda16c8..b987060 100644 (file)
--- a/shibsp/shibsp.vcproj
+++ b/shibsp/shibsp.vcproj
@@ -225,6 +225,10 @@
                                        RelativePath=".\security\PKIXTrustEngine.cpp"\r
                                        >\r
                                </File>\r
+                               <File\r
+                                       RelativePath=".\security\SecurityPolicy.cpp"\r
+                                       >\r
+                               </File>\r
                        </Filter>\r
                        <Filter\r
                                Name="metadata"\r
@@ -455,6 +459,10 @@
                                        RelativePath=".\security\PKIXTrustEngine.h"\r
                                        >\r
                                </File>\r
+                               <File\r
+                                       RelativePath=".\security\SecurityPolicy.h"\r
+                                       >\r
+                               </File>\r
                        </Filter>\r
                        <Filter\r
                                Name="metadata"\r

diff --git a/util/samlquery.cpp b/util/samlquery.cpp
index 3206d66..cbc1cdf 100644 (file)
--- a/util/samlquery.cpp
+++ b/util/samlquery.cpp
@@ -159,8 +159,8 @@ int main(int argc,char* argv[])
         else\r
             throw MetadataException("No AttributeAuthority role found in metadata.");\r
 \r
-        SecurityPolicy policy;\r
-        shibsp::SOAPClient soaper(*app,policy);\r
+        shibsp::SecurityPolicy policy(*app);\r
+        shibsp::SOAPClient soaper(policy);\r
         MetadataCredentialCriteria mcc(*AA);\r
 \r
         if (ver == v20) {\r