[cpp-sp COMMIT] /branches/REL_2/shibsp/handler/impl/ExternalAuthHandler.cpp

[noreply at shibboleth.net]

Author: scantor
Date: Thu Aug  2 19:55:24 2012
New Revision: 3747

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3747&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-488

Modified:
    branches/REL_2/shibsp/handler/impl/ExternalAuthHandler.cpp

Modified: branches/REL_2/shibsp/handler/impl/ExternalAuthHandler.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/handler/impl/ExternalAuthHandler.cpp?rev=3747&r1=3746&r2=3747&view=diff
==============================================================================
--- branches/REL_2/shibsp/handler/impl/ExternalAuthHandler.cpp (original)
+++ branches/REL_2/shibsp/handler/impl/ExternalAuthHandler.cpp Thu Aug  2 19:55:24 2012
@@ -94,7 +94,11 @@
 
     private:
         pair<bool,long> processMessage(
-            const Application& application, HTTPRequest& httpRequest, HTTPResponse& httpResponse, const DDF* respDDF=nullptr
+            const Application& application,
+            HTTPRequest& httpRequest,
+            HTTPResponse& httpResponse,
+            DDF& reqDDF,
+            const DDF* respDDF=nullptr
             ) const;
 #ifndef SHIBSP_LITE
         LoginEvent* newLoginEvent(const Application& application, const HTTPRequest& request) const;
@@ -174,8 +178,18 @@
 
     try {
         if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
-            // When out of process, we run natively and directly process the message.
-            return processMessage(request.getApplication(), request, request);
+            // When out of process, we run natively and directly process the message, except that we
+            // have to indirect the request anyway in order to override the client address. This is
+            // the simplest way to get a delegated HTTPRequest object, and since this code path is
+            // not really one we expect to use, it's good enough.
+            vector<string> headers(1, "User-Agent");
+            headers.push_back("Accept");
+            headers.push_back("Accept-Language");
+            headers.push_back("Cookie");
+            DDF in = wrap(request, &headers);
+            DDFJanitor jin(in);
+            scoped_ptr<HTTPRequest> fakedreq(getRequest(in));
+            return processMessage(request.getApplication(), *fakedreq, request, in);
         }
         else {
             // When not out of process, we remote all the message processing.
@@ -219,7 +233,7 @@
     // which we just return as an empty structure, or a response/redirect,
     // which we capture in the facade and send back.
     try {
-        processMessage(*app, *req, *resp, &ret);
+        processMessage(*app, *req, *resp, in, &ret);
     }
     catch (std::exception& ex) {
         m_log.error("raising exception: %s", ex.what());
@@ -229,7 +243,7 @@
 }
 
 pair<bool,long> ExternalAuth::processMessage(
-    const Application& application, HTTPRequest& httpRequest, HTTPResponse& httpResponse, const DDF* respDDF
+    const Application& application, HTTPRequest& httpRequest, HTTPResponse& httpResponse, DDF& reqDDF, const DDF* respDDF
     ) const
 {
 #ifndef SHIBSP_LITE
@@ -238,9 +252,19 @@
     MetadataProvider* m = application.getMetadataProvider(false);
     Locker mocker(m);
 
+    scoped_ptr<TransactionLog::Event> event;
+    LoginEvent* login_event = nullptr;
+    if (SPConfig::getConfig().isEnabled(SPConfig::Logging)) {
+        event.reset(SPConfig::getConfig().EventManager.newPlugin(LOGIN_EVENT, nullptr));
+        login_event = dynamic_cast<LoginEvent*>(event.get());
+        if (login_event)
+            login_event->m_app = &application;
+        else
+            m_log.warn("unable to audit event, log event object was of an incorrect type");
+    }
+
     string ctype(httpRequest.getContentType());
     if (ctype == "text/xml" || ctype == "application/samlassertion+xml") {
-        // Body should contain an assertion.
         const char* body = httpRequest.getRequestBody();
         if (!body)
             throw FatalProfileException("Request body was empty.");
@@ -322,6 +346,14 @@
         if (authnContext) {
             authncontext_class = authnContext->getAuthnContextClassRef() ? authnContext->getAuthnContextClassRef()->getReference() : nullptr;
             authncontext_decl = authnContext->getAuthnContextDeclRef() ? authnContext->getAuthnContextDeclRef()->getReference() : nullptr;
+        }
+
+        // Extract client address.
+        reqDDF.addmember("client_addr").string((const char*)nullptr);
+        if (ssoStatement->getSubjectLocality() && ssoStatement->getSubjectLocality()->getAddress()) {
+            auto_ptr_char addr(ssoStatement->getSubjectLocality()->getAddress());
+            if (addr.get())
+                reqDDF.getmember("client_addr").string(addr.get());
         }
 
         // The context will handle deleting attributes and tokens.
@@ -362,6 +394,24 @@
             &tokens,
             &ctx->getResolvedAttributes()
             );
+
+        if (login_event) {
+            login_event->m_binding = "ExternalAuth/XML";
+            login_event->m_sessionID = session_id.c_str();

[... 51 lines stripped ...]