[cpp-sp COMMIT] in /branches/REL_2: schemas/shibboleth-2.0-native-sp-config.xsd shibsp/attribute/resolver/impl/QueryA...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Mar  2 18:18:07 2012
New Revision: 3590

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3590&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-398

Modified:
    branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd
    branches/REL_2/shibsp/attribute/resolver/impl/QueryAttributeResolver.cpp
    branches/REL_2/shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp
    branches/REL_2/shibsp/handler/impl/SAML2Consumer.cpp

Modified: branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd?rev=3590&r1=3589&r2=3590&view=diff
==============================================================================
--- branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd (original)
+++ branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd Fri Mar  2 18:18:07 2012
@@ -402,7 +402,6 @@
     </sequence>
     <attribute name="id" type="conf:string" fixed="default"/>
     <attribute name="entityID" type="anyURI" use="required"/>
-    <attribute name="policyId" type="conf:string"/>
     <attributeGroup ref="conf:ApplicationGroup"/>
     <attributeGroup ref="conf:RelyingPartyGroup"/>
     <anyAttribute namespace="##other" processContents="lax"/>
@@ -429,7 +428,6 @@
     </sequence>
     <attribute name="id" type="conf:string" use="required"/>
     <attribute name="entityID" type="anyURI"/>
-    <attribute name="policyId" type="conf:string"/>
     <attributeGroup ref="conf:ApplicationGroup"/>
     <attributeGroup ref="conf:RelyingPartyGroup"/>
     <anyAttribute namespace="##other" processContents="lax"/>
@@ -437,10 +435,12 @@
 
   <attributeGroup name="ApplicationGroup">
     <attribute name="homeURL" type="anyURI"/>
+    <attribute name="policyId" type="conf:string"/>
     <attribute name="REMOTE_USER" type="conf:listOfStrings"/>
     <attribute name="unsetHeaders" type="conf:listOfStrings"/>
     <attribute name="metadataAttributePrefix" type="conf:string"/>
     <attribute name="attributePrefix" type="conf:string"/>
+    <attribute name="requireAuthenticatedCipher" type="boolean"/>
   </attributeGroup>
 
   <attributeGroup name="RelyingPartyGroup">

Modified: branches/REL_2/shibsp/attribute/resolver/impl/QueryAttributeResolver.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/attribute/resolver/impl/QueryAttributeResolver.cpp?rev=3590&r1=3589&r2=3590&view=diff
==============================================================================
--- branches/REL_2/shibsp/attribute/resolver/impl/QueryAttributeResolver.cpp (original)
+++ branches/REL_2/shibsp/attribute/resolver/impl/QueryAttributeResolver.cpp Fri Mar  2 18:18:07 2012
@@ -533,16 +533,26 @@
             m_log.warn("simple resolver only supports one assertion in the query response");
         }
 
-        CredentialResolver* cr=application.getCredentialResolver();
+        CredentialResolver* cr = application.getCredentialResolver();
         if (!cr) {
             m_log.warn("found encrypted assertion, but no CredentialResolver was available");
             throw FatalProfileException("Assertion was encrypted, but no decryption credentials are available.");
         }
 
+        // With this flag on, we block unauthenticated ciphertext when decrypting,
+        // unless the protocol was authenticated.
+        pair<bool,bool> authenticatedCipher = application.getBool("requireAuthenticatedCipher");
+        if (policy->isAuthenticated())
+            authenticatedCipher.second = false;
+
         // Attempt to decrypt it.
         try {
             Locker credlocker(cr);
-            auto_ptr<XMLObject> tokenwrapper(encassertions.front()->decrypt(*cr, relyingParty->getXMLString("entityID").second, &mcc));
+            auto_ptr<XMLObject> tokenwrapper(
+                encassertions.front()->decrypt(
+                    *cr, relyingParty->getXMLString("entityID").second, &mcc, authenticatedCipher.first && authenticatedCipher.second
+                    )
+                );
             newtoken = dynamic_cast<saml2::Assertion*>(tokenwrapper.get());
             if (newtoken) {
                 tokenwrapper.release();

Modified: branches/REL_2/shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp?rev=3590&r1=3589&r2=3590&view=diff
==============================================================================
--- branches/REL_2/shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp (original)
+++ branches/REL_2/shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp Fri Mar  2 18:18:07 2012
@@ -418,10 +418,20 @@
             throw FatalProfileException("Assertion was encrypted, but no decryption credentials are available.");
         }
 
+        // With this flag on, we block unauthenticated ciphertext when decrypting,
+        // unless the protocol was authenticated.

[... 112 lines stripped ...]