[cpp-opensaml] branch master updated: Remove unused/deprecated validators.
Scott Cantor
cantor.2 at osu.edu
Fri Apr 27 12:12:49 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=6dd9e635ae1f44adc35f93bc24f4e8bab67cfc83
The following commit(s) were added to refs/heads/master by this push:
new 6dd9e63 Remove unused/deprecated validators.
6dd9e63 is described below
commit 6dd9e635ae1f44adc35f93bc24f4e8bab67cfc83
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Apr 27 12:12:42 2018 -0400
Remove unused/deprecated validators.
---
Projects/vc15/saml/saml.vcxproj | 8 --
Projects/vc15/saml/saml.vcxproj.filters | 27 -----
saml/Makefile.am | 24 +---
saml/saml1/profile/AssertionValidator.h | 94 ----------------
saml/saml1/profile/BrowserSSOProfileValidator.h | 63 -----------
saml/saml1/profile/impl/AssertionValidator.cpp | 122 ---------------------
.../profile/impl/BrowserSSOProfileValidator.cpp | 94 ----------------
saml/saml2/profile/AssertionValidator.h | 94 ----------------
saml/saml2/profile/BrowserSSOProfileValidator.h | 99 -----------------
saml/saml2/profile/impl/Assertion20Validator.cpp | 119 --------------------
.../profile/impl/BrowserSSOProfile20Validator.cpp | 115 -------------------
11 files changed, 6 insertions(+), 853 deletions(-)
diff --git a/Projects/vc15/saml/saml.vcxproj b/Projects/vc15/saml/saml.vcxproj
index 295da05..74b64c2 100644
--- a/Projects/vc15/saml/saml.vcxproj
+++ b/Projects/vc15/saml/saml.vcxproj
@@ -211,8 +211,6 @@
<ClCompile Include="..\..\..\saml\saml1\binding\impl\SAML1SOAPEncoder.cpp" />
<ClCompile Include="..\..\..\saml\saml1\binding\impl\SAMLArtifactType0001.cpp" />
<ClCompile Include="..\..\..\saml\saml1\binding\impl\SAMLArtifactType0002.cpp" />
- <ClCompile Include="..\..\..\saml\saml1\profile\impl\AssertionValidator.cpp" />
- <ClCompile Include="..\..\..\saml\saml1\profile\impl\BrowserSSOProfileValidator.cpp" />
<ClCompile Include="..\..\..\saml\saml1\profile\impl\SAML1BrowserSSORule.cpp" />
<ClCompile Include="..\..\..\saml\signature\ContentReference.cpp" />
<ClCompile Include="..\..\..\saml\signature\SignatureProfileValidator.cpp" />
@@ -269,9 +267,7 @@
<ClCompile Include="..\..\..\saml\saml2\binding\impl\SAML2SOAPClient.cpp" />
<ClCompile Include="..\..\..\saml\saml2\binding\impl\SAML2SOAPDecoder.cpp" />
<ClCompile Include="..\..\..\saml\saml2\binding\impl\SAML2SOAPEncoder.cpp" />
- <ClCompile Include="..\..\..\saml\saml2\profile\impl\Assertion20Validator.cpp" />
<ClCompile Include="..\..\..\saml\saml2\profile\impl\BearerConfirmationRule.cpp" />
- <ClCompile Include="..\..\..\saml\saml2\profile\impl\BrowserSSOProfile20Validator.cpp" />
<ClCompile Include="..\..\..\saml\saml2\profile\impl\DelegationRestrictionRule.cpp" />
<ClCompile Include="..\..\..\saml\saml2\profile\impl\SAML2AssertionPolicy.cpp" />
<ClCompile Include="..\..\..\saml\encryption\EncryptedKeyResolver.cpp" />
@@ -310,8 +306,6 @@
<ClInclude Include="..\..\..\saml\saml1\binding\SAML1SOAPClient.h" />
<ClInclude Include="..\..\..\saml\saml1\binding\SAMLArtifactType0001.h" />
<ClInclude Include="..\..\..\saml\saml1\binding\SAMLArtifactType0002.h" />
- <ClInclude Include="..\..\..\saml\saml1\profile\AssertionValidator.h" />
- <ClInclude Include="..\..\..\saml\saml1\profile\BrowserSSOProfileValidator.h" />
<ClInclude Include="..\..\..\saml\signature\ContentReference.h" />
<ClInclude Include="..\..\..\saml\signature\SignableObject.h" />
<ClInclude Include="..\..\..\saml\signature\SignatureProfileValidator.h" />
@@ -329,8 +323,6 @@
<ClInclude Include="..\..\..\saml\saml2\binding\SAML2ArtifactType0004.h" />
<ClInclude Include="..\..\..\saml\saml2\binding\SAML2MessageDecoder.h" />
<ClInclude Include="..\..\..\saml\saml2\binding\SAML2SOAPClient.h" />
- <ClInclude Include="..\..\..\saml\saml2\profile\AssertionValidator.h" />
- <ClInclude Include="..\..\..\saml\saml2\profile\BrowserSSOProfileValidator.h" />
<ClInclude Include="..\..\..\saml\saml2\profile\SAML2AssertionPolicy.h" />
<ClInclude Include="..\..\..\saml\encryption\EncryptedKeyResolver.h" />
<ClInclude Include="..\..\..\saml\binding\ArtifactMap.h" />
diff --git a/Projects/vc15/saml/saml.vcxproj.filters b/Projects/vc15/saml/saml.vcxproj.filters
index 554e3c1..4598f4b 100644
--- a/Projects/vc15/saml/saml.vcxproj.filters
+++ b/Projects/vc15/saml/saml.vcxproj.filters
@@ -90,9 +90,6 @@
<Filter Include="Header Files\saml1\binding">
<UniqueIdentifier>{4f044deb-351b-449b-9885-c14dca4aaeaf}</UniqueIdentifier>
</Filter>
- <Filter Include="Header Files\saml1\profile">
- <UniqueIdentifier>{b8c7e006-06dc-4cc1-acb6-7801f11baa92}</UniqueIdentifier>
- </Filter>
<Filter Include="Header Files\signature">
<UniqueIdentifier>{ad3727af-1c55-4895-ad7f-5e91f6c0d3e6}</UniqueIdentifier>
</Filter>
@@ -174,12 +171,6 @@
<ClCompile Include="..\..\..\saml\saml1\binding\impl\SAMLArtifactType0002.cpp">
<Filter>Source Files\saml1\binding\impl</Filter>
</ClCompile>
- <ClCompile Include="..\..\..\saml\saml1\profile\impl\AssertionValidator.cpp">
- <Filter>Source Files\saml1\profile\impl</Filter>
- </ClCompile>
- <ClCompile Include="..\..\..\saml\saml1\profile\impl\BrowserSSOProfileValidator.cpp">
- <Filter>Source Files\saml1\profile\impl</Filter>
- </ClCompile>
<ClCompile Include="..\..\..\saml\saml1\profile\impl\SAML1BrowserSSORule.cpp">
<Filter>Source Files\saml1\profile\impl</Filter>
</ClCompile>
@@ -291,15 +282,9 @@
<ClCompile Include="..\..\..\saml\saml2\binding\impl\SAML2SOAPEncoder.cpp">
<Filter>Source Files\saml2\binding\impl</Filter>
</ClCompile>
- <ClCompile Include="..\..\..\saml\saml2\profile\impl\Assertion20Validator.cpp">
- <Filter>Source Files\saml2\profile\impl</Filter>
- </ClCompile>
<ClCompile Include="..\..\..\saml\saml2\profile\impl\BearerConfirmationRule.cpp">
<Filter>Source Files\saml2\profile\impl</Filter>
</ClCompile>
- <ClCompile Include="..\..\..\saml\saml2\profile\impl\BrowserSSOProfile20Validator.cpp">
- <Filter>Source Files\saml2\profile\impl</Filter>
- </ClCompile>
<ClCompile Include="..\..\..\saml\saml2\profile\impl\DelegationRestrictionRule.cpp">
<Filter>Source Files\saml2\profile\impl</Filter>
</ClCompile>
@@ -425,12 +410,6 @@
<ClInclude Include="..\..\..\saml\saml1\binding\SAMLArtifactType0002.h">
<Filter>Header Files\saml1\binding</Filter>
</ClInclude>
- <ClInclude Include="..\..\..\saml\saml1\profile\AssertionValidator.h">
- <Filter>Header Files\saml1\profile</Filter>
- </ClInclude>
- <ClInclude Include="..\..\..\saml\saml1\profile\BrowserSSOProfileValidator.h">
- <Filter>Header Files\saml1\profile</Filter>
- </ClInclude>
<ClInclude Include="..\..\..\saml\signature\ContentReference.h">
<Filter>Header Files\signature</Filter>
</ClInclude>
@@ -482,12 +461,6 @@
<ClInclude Include="..\..\..\saml\saml2\binding\SAML2SOAPClient.h">
<Filter>Header Files\saml2\binding</Filter>
</ClInclude>
- <ClInclude Include="..\..\..\saml\saml2\profile\AssertionValidator.h">
- <Filter>Header Files\saml2\profile</Filter>
- </ClInclude>
- <ClInclude Include="..\..\..\saml\saml2\profile\BrowserSSOProfileValidator.h">
- <Filter>Header Files\saml2\profile</Filter>
- </ClInclude>
<ClInclude Include="..\..\..\saml\saml2\profile\SAML2AssertionPolicy.h">
<Filter>Header Files\saml2\profile</Filter>
</ClInclude>
diff --git a/saml/Makefile.am b/saml/Makefile.am
index 8c03b36..80452c7 100644
--- a/saml/Makefile.am
+++ b/saml/Makefile.am
@@ -18,8 +18,6 @@ saml1bindincludedir = $(includedir)/saml/saml1/binding
saml1coreincludedir = $(includedir)/saml/saml1/core
-saml1profincludedir = $(includedir)/saml/saml1/profile
-
saml2bindincludedir = $(includedir)/saml/saml2/binding
saml2coreincludedir = $(includedir)/saml/saml2/core
@@ -67,10 +65,6 @@ saml1bindinclude_HEADERS = \
saml1/binding/SAML1MessageDecoder.h \
saml1/binding/SAML1SOAPClient.h
-saml1profinclude_HEADERS = \
- saml1/profile/AssertionValidator.h \
- saml1/profile/BrowserSSOProfileValidator.h
-
saml2coreinclude_HEADERS = \
saml2/core/Assertions.h \
saml2/core/Protocols.h
@@ -86,7 +80,7 @@ saml2mdinclude_HEADERS = \
saml2/metadata/DiscoverableMetadataProvider.h \
saml2/metadata/AbstractDynamicMetadataProvider.h \
saml2/metadata/EndpointManager.h \
- saml2/metadata/EntityMatcher.h \
+ saml2/metadata/EntityMatcher.h \
saml2/metadata/Metadata.h \
saml2/metadata/MetadataCredentialContext.h \
saml2/metadata/MetadataCredentialCriteria.h \
@@ -95,8 +89,6 @@ saml2mdinclude_HEADERS = \
saml2/metadata/ObservableMetadataProvider.h
saml2profinclude_HEADERS = \
- saml2/profile/AssertionValidator.h \
- saml2/profile/BrowserSSOProfileValidator.h \
saml2/profile/SAML2AssertionPolicy.h
noinst_HEADERS = \
@@ -104,7 +96,7 @@ noinst_HEADERS = \
libsaml_la_SOURCES = \
SAMLConfig.cpp \
- version.cpp \
+ version.cpp \
binding/impl/ArtifactMap.cpp \
binding/impl/ClientCertAuthRule.cpp \
binding/impl/MessageDecoder.cpp \
@@ -133,8 +125,6 @@ libsaml_la_SOURCES = \
saml1/binding/impl/SAML1SOAPDecoder.cpp \
saml1/binding/impl/SAML1SOAPEncoder.cpp \
saml1/binding/impl/SAML1SOAPClient.cpp \
- saml1/profile/impl/AssertionValidator.cpp \
- saml1/profile/impl/BrowserSSOProfileValidator.cpp \
saml1/profile/impl/SAML1BrowserSSORule.cpp \
saml2/core/impl/Assertions.cpp \
saml2/core/impl/Assertions20Impl.cpp \
@@ -147,8 +137,8 @@ libsaml_la_SOURCES = \
saml2/metadata/impl/DiscoverableMetadataProvider.cpp \
saml2/metadata/impl/AbstractDynamicMetadataProvider.cpp \
saml2/metadata/impl/LocalDynamicMetadataProvider.cpp \
- saml2/metadata/impl/EntityAttributesEntityMatcher.cpp \
- saml2/metadata/impl/EntityAttributesMetadataFilter.cpp \
+ saml2/metadata/impl/EntityAttributesEntityMatcher.cpp \
+ saml2/metadata/impl/EntityAttributesMetadataFilter.cpp \
saml2/metadata/impl/EntityRoleMetadataFilter.cpp \
saml2/metadata/impl/FolderMetadataProvider.cpp \
saml2/metadata/impl/MetadataCredentialContext.cpp \
@@ -156,12 +146,12 @@ libsaml_la_SOURCES = \
saml2/metadata/impl/MetadataImpl.cpp \
saml2/metadata/impl/MetadataProvider.cpp \
saml2/metadata/impl/MetadataSchemaValidators.cpp \
- saml2/metadata/impl/NameEntityMatcher.cpp \
+ saml2/metadata/impl/NameEntityMatcher.cpp \
saml2/metadata/impl/NullMetadataProvider.cpp \
saml2/metadata/impl/ObservableMetadataProvider.cpp \
saml2/metadata/impl/RequireValidUntilMetadataFilter.cpp \
saml2/metadata/impl/SignatureMetadataFilter.cpp \
- saml2/metadata/impl/RegistrationAuthorityEntityMatcher.cpp \
+ saml2/metadata/impl/RegistrationAuthorityEntityMatcher.cpp \
saml2/metadata/impl/WhitelistMetadataFilter.cpp \
saml2/metadata/impl/XMLMetadataProvider.cpp \
saml2/binding/impl/SAML2Artifact.cpp \
@@ -178,8 +168,6 @@ libsaml_la_SOURCES = \
saml2/binding/impl/SAML2SOAPDecoder.cpp \
saml2/binding/impl/SAML2SOAPEncoder.cpp \
saml2/binding/impl/SAML2SOAPClient.cpp \
- saml2/profile/impl/Assertion20Validator.cpp \
- saml2/profile/impl/BrowserSSOProfile20Validator.cpp \
saml2/profile/impl/BearerConfirmationRule.cpp \
saml2/profile/impl/DelegationRestrictionRule.cpp \
saml2/profile/impl/SAML2AssertionPolicy.cpp \
diff --git a/saml/saml1/profile/AssertionValidator.h b/saml/saml1/profile/AssertionValidator.h
deleted file mode 100644
index 216ab84..0000000
--- a/saml/saml1/profile/AssertionValidator.h
+++ /dev/null
@@ -1,94 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file saml/saml1/profile/AssertionValidator.h
- *
- * SAML 1.x basic assertion validator.
- */
-
-#ifndef __saml1_assval_h__
-#define __saml1_assval_h__
-
-#include <saml/base.h>
-
-#include <ctime>
-#include <vector>
-#include <xmltooling/validation/Validator.h>
-
-namespace opensaml {
- namespace saml1 {
-
- class SAML_API Assertion;
- class SAML_API Condition;
-
- /**
- * @deprecated
- * SAML 1.x basic assertion validator provides time and audience condition checking.
- */
- class SAML_API AssertionValidator : public virtual xmltooling::Validator
- {
- public:
- /**
- * Constructor
- *
- * @param recipient name of assertion recipient (implicit audience)
- * @param audiences additional audience values
- * @param ts timestamp to evaluate assertion conditions, or 0 to bypass check
- */
- AssertionValidator(const XMLCh* recipient, const std::vector<const XMLCh*>* audiences=nullptr, time_t ts=0);
-
- virtual ~AssertionValidator();
-
- void validate(const xmltooling::XMLObject* xmlObject) const;
-
- /**
- * Type-safe validation method.
- *
- * @param assertion assertion to validate
- */
- virtual void validateAssertion(const Assertion& assertion) const;
-
- /**
- * Condition validation.
- *
- * <p>The base class version only understands AudienceRestrictionConditions.
- * All other condition types will be rejected and require subclassing to
- * prevent validation failure.
- *
- * @param condition condition to validate
- */
- virtual void validateCondition(const Condition* condition) const;
-
- protected:
- /** Name of recipient (implicit audience). */
- const XMLCh* m_recipient;
-
- /** Additional audience values. */
- const std::vector<const XMLCh*>* m_audiences;
-
- /** Timestamp to evaluate assertion conditions. */
- time_t m_ts;
- };
-
- };
-};
-
-#endif /* __saml1_assval_h__ */
diff --git a/saml/saml1/profile/BrowserSSOProfileValidator.h b/saml/saml1/profile/BrowserSSOProfileValidator.h
deleted file mode 100644
index 086a357..0000000
--- a/saml/saml1/profile/BrowserSSOProfileValidator.h
+++ /dev/null
@@ -1,63 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file saml/saml1/profile/BrowserSSOProfileValidator.h
- *
- * SAML 1.x Browser SSO Profile Assertion Validator.
- */
-
-#ifndef __saml1_ssoval_h__
-#define __saml1_ssoval_h__
-
-#include <saml/saml1/profile/AssertionValidator.h>
-
-namespace opensaml {
- namespace saml1 {
-
- /**
- * @deprecated
- * SAML 1.x Browser SSO Profile Assertion Validator
- *
- * <p>In addition to standard core requirements for validity, SSO assertions
- * <strong>MUST</strong> have NotBefore/NotOnOrAfter attributes and each subject statement
- * <strong>MUST</strong> be confirmable via bearer or artifact method.
- */
- class SAML_API BrowserSSOProfileValidator : public AssertionValidator
- {
- public:
- /**
- * Constructor
- *
- * @recipient name of assertion recipient (implicit audience)
- * @param audiences additional audience values
- * @param ts timestamp to evaluate assertion conditions, or 0 to bypass check
- */
- BrowserSSOProfileValidator(const XMLCh* recipient, const std::vector<const XMLCh*>* audiences=nullptr, time_t ts=0);
-
- virtual ~BrowserSSOProfileValidator();
-
- void validateAssertion(const Assertion& assertion) const;
- };
-
- };
-};
-
-#endif /* __saml1_ssoval_h__ */
diff --git a/saml/saml1/profile/impl/AssertionValidator.cpp b/saml/saml1/profile/impl/AssertionValidator.cpp
deleted file mode 100644
index 403edc0..0000000
--- a/saml/saml1/profile/impl/AssertionValidator.cpp
+++ /dev/null
@@ -1,122 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AssertionValidator.cpp
- *
- * SAML 1.x basic assertion validator
- */
-
-#include "internal.h"
-#include "saml1/core/Assertions.h"
-#include "saml1/profile/AssertionValidator.h"
-
-#include <boost/bind.hpp>
-#include <xmltooling/logging.h>
-#include <xmltooling/XMLToolingConfig.h>
-#include <xmltooling/util/NDC.h>
-
-using namespace opensaml::saml1;
-using namespace xmltooling::logging;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-AssertionValidator::AssertionValidator(const XMLCh* recipient, const vector<const XMLCh*>* audiences, time_t ts)
- : m_recipient(recipient), m_audiences(audiences), m_ts(ts)
-{
-}
-
-AssertionValidator::~AssertionValidator()
-{
-}
-
-void AssertionValidator::validate(const xmltooling::XMLObject* xmlObject) const
-{
- const Assertion* a=dynamic_cast<const Assertion*>(xmlObject);
- if (!a)
- throw ValidationException("Validator only applies to SAML 1.x Assertion objects.");
- validateAssertion(*a);
-}
-
-void AssertionValidator::validateAssertion(const Assertion& assertion) const
-{
-#ifdef _DEBUG
- xmltooling::NDC ndc("validate");
-#endif
-
- const Conditions* conds = assertion.getConditions();
- if (!conds)
- return;
-
- // First verify the time conditions, using the specified timestamp, if non-zero.
- if (m_ts>0) {
- unsigned int skew = XMLToolingConfig::getConfig().clock_skew_secs;
- time_t t=conds->getNotBeforeEpoch();
- if (m_ts+skew < t)
- throw ValidationException("Assertion is not yet valid.");
- t=conds->getNotOnOrAfterEpoch();
- if (t <= m_ts-skew)
- throw ValidationException("Assertion is no longer valid.");
- }
-
- // Now we process conditions, starting with the known types and then extensions.
-
- const vector<AudienceRestrictionCondition*>& acvec = conds->getAudienceRestrictionConditions();
- for_each(acvec.begin(), acvec.end(), boost::bind(&AssertionValidator::validateCondition, this, _1));
-
- const vector<DoNotCacheCondition*>& dncvec = conds->getDoNotCacheConditions();
- for_each(dncvec.begin(), dncvec.end(), boost::bind(&AssertionValidator::validateCondition, this, _1));
-
- const vector<Condition*>& convec = conds->getConditions();
- for_each(convec.begin(), convec.end(), boost::bind(&AssertionValidator::validateCondition, this, _1));
-}
-
-void AssertionValidator::validateCondition(const Condition* c) const
-{
- const AudienceRestrictionCondition* ac=dynamic_cast<const AudienceRestrictionCondition*>(c);
- if (!ac) {
- Category::getInstance(SAML_LOGCAT ".AssertionValidator").error("unrecognized Condition in assertion (%s)",
- c->getSchemaType() ? c->getSchemaType()->toString().c_str() : c->getElementQName().toString().c_str());
- throw ValidationException("Assertion contains an unrecognized condition.");
- }
-
- bool found = false;
- const vector<Audience*>& auds1 = ac->getAudiences();
- for (vector<Audience*>::const_iterator a = auds1.begin(); !found && a!=auds1.end(); ++a) {
- if (XMLString::equals(m_recipient, (*a)->getAudienceURI())) {
- found = true;
- }
- else if (m_audiences) {
- for (vector<const XMLCh*>::const_iterator a2 = m_audiences->begin(); !found && a2!=m_audiences->end(); ++a2) {
- found = XMLString::equals((*a)->getAudienceURI(), *a2);
- }
- }
- }
-
- if (!found) {
- ostringstream os;
- os << *ac;
- Category::getInstance(SAML_LOGCAT ".AssertionValidator").error(
- "unacceptable AudienceRestrictionCondition in assertion (%s)", os.str().c_str()
- );
- throw ValidationException("Assertion contains an unacceptable AudienceRestrictionCondition.");
- }
-}
diff --git a/saml/saml1/profile/impl/BrowserSSOProfileValidator.cpp b/saml/saml1/profile/impl/BrowserSSOProfileValidator.cpp
deleted file mode 100644
index a841ae5..0000000
--- a/saml/saml1/profile/impl/BrowserSSOProfileValidator.cpp
+++ /dev/null
@@ -1,94 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * BrowserSSOProfileValidator.cpp
- *
- * SAML 1.x Browser SSO Profile Assertion Validator.
- */
-
-#include "internal.h"
-#include "saml1/core/Assertions.h"
-#include "saml1/profile/BrowserSSOProfileValidator.h"
-
-#include <xmltooling/logging.h>
-#include <xmltooling/util/NDC.h>
-
-using namespace opensaml::saml1;
-using namespace xmltooling::logging;
-using namespace xmltooling;
-using namespace std;
-
-namespace {
- class SAML_DLLLOCAL _checkMethod : public unary_function<const SubjectStatement*,void>,
- public unary_function<const ConfirmationMethod*,bool>
- {
- public:
- void operator()(const SubjectStatement* s) const {
- const Subject* sub = s->getSubject();
- if (s) {
- const SubjectConfirmation* sc = sub->getSubjectConfirmation();
- if (sc) {
- const vector<ConfirmationMethod*>& methods = sc->getConfirmationMethods();
- if (find_if(methods.begin(), methods.end(), _checkMethod())!=methods.end())
- return; // methods checked out
- }
- }
- throw ValidationException("Assertion contained a statement without a supported ConfirmationMethod.");
- }
-
- bool operator()(const ConfirmationMethod* cm) const {
- const XMLCh* m = cm->getMethod();
- return (XMLString::equals(m,SubjectConfirmation::BEARER) ||
- XMLString::equals(m,SubjectConfirmation::ARTIFACT) ||
- XMLString::equals(m,SubjectConfirmation::ARTIFACT01));
- }
- };
-};
-
-BrowserSSOProfileValidator::BrowserSSOProfileValidator(const XMLCh* recipient, const std::vector<const XMLCh*>* audiences, time_t ts)
- : AssertionValidator(recipient, audiences, ts)
-{
-}
-
-BrowserSSOProfileValidator::~BrowserSSOProfileValidator()
-{
-}
-
-void BrowserSSOProfileValidator::validateAssertion(const Assertion& assertion) const
-{
-#ifdef _DEBUG
- xmltooling::NDC ndc("validate");
-#endif
-
- // Make sure the assertion is bounded.
- const Conditions* conds = assertion.getConditions();
- if (!conds || !conds->getNotBefore() || !conds->getNotOnOrAfter())
- throw ValidationException("SSO assertions MUST contain NotBefore/NotOnOrAfter attributes.");
-
- // Each statement MUST have proper confirmation requirements.
- const vector<AuthenticationStatement*>& authn = assertion.getAuthenticationStatements();
- for_each(authn.begin(), authn.end(), _checkMethod());
- const vector<AttributeStatement*>& attr = assertion.getAttributeStatements();
- for_each(attr.begin(), attr.end(), _checkMethod());
-
- // Pass up for additional checking.
- AssertionValidator::validateAssertion(assertion);
-}
diff --git a/saml/saml2/profile/AssertionValidator.h b/saml/saml2/profile/AssertionValidator.h
deleted file mode 100644
index b6ef86e..0000000
--- a/saml/saml2/profile/AssertionValidator.h
+++ /dev/null
@@ -1,94 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file saml/saml2/profile/AssertionValidator.h
- *
- * SAML 2.0 basic assertion validator.
- */
-
-#ifndef __saml2_assval_h__
-#define __saml2_assval_h__
-
-#include <saml/base.h>
-
-#include <ctime>
-#include <vector>
-#include <xmltooling/validation/Validator.h>
-
-namespace opensaml {
- namespace saml2 {
-
- class SAML_API Assertion;
- class SAML_API Condition;
-
- /**
- * @deprecated
- * SAML 2.0 basic assertion validator provides time and audience condition checking.
- */
- class SAML_API AssertionValidator : public virtual xmltooling::Validator
- {
- public:
- /**
- * Constructor
- *
- * @param recipient name of assertion recipient (implicit audience)
- * @param audiences additional audience values
- * @param ts timestamp to evaluate assertion conditions, or 0 to bypass check
- */
- AssertionValidator(const XMLCh* recipient, const std::vector<const XMLCh*>* audiences=nullptr, time_t ts=0);
-
- virtual ~AssertionValidator();
-
- void validate(const xmltooling::XMLObject* xmlObject) const;
-
- /**
- * Type-safe validation method.
- *
- * @param assertion assertion to validate
- */
- virtual void validateAssertion(const Assertion& assertion) const;
-
- /**
- * Condition validation.
- *
- * <p>The base class version only understands AudienceRestriction conditions.
- * All other condition types will be rejected and require subclassing to
- * prevent validation failure.
- *
- * @param condition condition to validate
- */
- virtual void validateCondition(const Condition* condition) const;
-
- protected:
- /** Name of recipient (implicit audience). */
- const XMLCh* m_recipient;
-
- /** Additional audience values. */
- const std::vector<const XMLCh*>* m_audiences;
-
- /** Timestamp to evaluate assertion conditions. */
- time_t m_ts;
- };
-
- };
-};
-
-#endif /* __saml2_assval_h__ */
diff --git a/saml/saml2/profile/BrowserSSOProfileValidator.h b/saml/saml2/profile/BrowserSSOProfileValidator.h
deleted file mode 100644
index d075327..0000000
--- a/saml/saml2/profile/BrowserSSOProfileValidator.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file saml/saml2/profile/BrowserSSOProfileValidator.h
- *
- * SAML 2.0 Browser SSO Profile Assertion Validator.
- */
-
-#ifndef __saml2_ssoval_h__
-#define __saml2_ssoval_h__
-
-#include <saml/saml2/profile/AssertionValidator.h>
-
-#include <xmltooling/unicode.h>
-
-namespace opensaml {
- namespace saml2 {
-
-#if defined (_MSC_VER)
- #pragma warning( push )
- #pragma warning( disable : 4251 )
-#endif
-
- /**
- * @deprecated
- * SAML 2.0 Browser SSO Profile Assertion Validator
- *
- * <p>In addition to standard core requirements for validity, SSO assertions
- * <strong>MUST</strong> be bearer-confirmable.
- */
- class SAML_API BrowserSSOProfileValidator : public AssertionValidator
- {
- public:
- /**
- * Constructor
- *
- * @param recipient name of assertion recipient (implicit audience)
- * @param audiences additional audience values
- * @param ts timestamp to evaluate assertion conditions, or 0 to bypass check
- * @param destination server location to which assertion was delivered, or 0 to bypass check
- * @param requestID ID of request that resulted in assertion, or nullptr if unsolicited
- */
- BrowserSSOProfileValidator(
- const XMLCh* recipient,
- const std::vector<const XMLCh*>* audiences=nullptr,
- time_t ts=0,
- const char* destination=nullptr,
- const char* requestID=nullptr
- );
-
- virtual ~BrowserSSOProfileValidator();
-
- void validateAssertion(const Assertion& assertion) const;
-
- /**
- * Return address information from the confirmed bearer SubjectConfirmation, if any.
- *
- * @return address information
- */
- const char* getAddress() const;
-
- protected:
- /** Server location to which assertion was delivered. */
- xmltooling::auto_ptr_XMLCh m_destination;
-
- /** ID of request that resulted in assertions. */
- xmltooling::auto_ptr_XMLCh m_requestID;
-
- private:
- /** Address in confirmed bearer SubjectConfirmationData. */
- mutable std::string m_address;
- };
-
-#if defined (_MSC_VER)
- #pragma warning( pop )
-#endif
-
- };
-};
-
-#endif /* __saml2_ssoval_h__ */
diff --git a/saml/saml2/profile/impl/Assertion20Validator.cpp b/saml/saml2/profile/impl/Assertion20Validator.cpp
deleted file mode 100644
index a1e0599..0000000
--- a/saml/saml2/profile/impl/Assertion20Validator.cpp
+++ /dev/null
@@ -1,119 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * Assertion20Validator.cpp
- *
- * SAML 2.0 basic assertion validator.
- */
-
-#include "internal.h"
-#include "saml2/core/Assertions.h"
-#include "saml2/profile/AssertionValidator.h"
-
-#include <boost/bind.hpp>
-#include <xmltooling/logging.h>
-#include <xmltooling/XMLToolingConfig.h>
-#include <xmltooling/util/NDC.h>
-
-using namespace opensaml::saml2;
-using namespace xmltooling::logging;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-AssertionValidator::AssertionValidator(const XMLCh* recipient, const vector<const XMLCh*>* audiences, time_t ts)
- : m_recipient(recipient), m_audiences(audiences), m_ts(ts)
-{
-}
-
-AssertionValidator::~AssertionValidator()
-{
-}
-
-void AssertionValidator::validate(const xmltooling::XMLObject* xmlObject) const
-{
- const Assertion* a=dynamic_cast<const Assertion*>(xmlObject);
- if (!a)
- throw ValidationException("Validator only applies to SAML 2.0 Assertion objects.");
- validateAssertion(*a);
-}
-
-void AssertionValidator::validateAssertion(const Assertion& assertion) const
-{
-#ifdef _DEBUG
- xmltooling::NDC ndc("validate");
-#endif
-
- const Conditions* conds = assertion.getConditions();
- if (!conds)
- return;
-
- // First verify the time conditions, using the specified timestamp, if non-zero.
- if (m_ts>0) {
- unsigned int skew = XMLToolingConfig::getConfig().clock_skew_secs;
- time_t t=conds->getNotBeforeEpoch();
- if (m_ts+skew < t)
- throw ValidationException("Assertion is not yet valid.");
- t=conds->getNotOnOrAfterEpoch();
- if (t <= m_ts-skew)
- throw ValidationException("Assertion is no longer valid.");
- }
-
- // Now we process conditions, starting with the known types and then extensions.
- const vector<AudienceRestriction*>& acvec = conds->getAudienceRestrictions();
- for_each(acvec.begin(), acvec.end(), boost::bind(&AssertionValidator::validateCondition, this, _1));
-
- const vector<OneTimeUse*>& dncvec = conds->getOneTimeUses();
- for_each(dncvec.begin(), dncvec.end(), boost::bind(&AssertionValidator::validateCondition, this, _1));
-
- const vector<Condition*>& convec = conds->getConditions();
- for_each(convec.begin(), convec.end(), boost::bind(&AssertionValidator::validateCondition, this, _1));
-}
-
-void AssertionValidator::validateCondition(const Condition* c) const
-{
- const AudienceRestriction* ac=dynamic_cast<const AudienceRestriction*>(c);
- if (!ac) {
- Category::getInstance(SAML_LOGCAT ".AssertionValidator").error("unrecognized Condition in assertion (%s)",
- c->getSchemaType() ? c->getSchemaType()->toString().c_str() : c->getElementQName().toString().c_str());
- throw ValidationException("Assertion contains an unrecognized condition.");
- }
-
- bool found = false;
- const vector<Audience*>& auds1 = ac->getAudiences();
- for (vector<Audience*>::const_iterator a = auds1.begin(); !found && a!=auds1.end(); ++a) {
- if (XMLString::equals(m_recipient, (*a)->getAudienceURI())) {
- found = true;
- }
- else if (m_audiences) {
- for (vector<const XMLCh*>::const_iterator a2 = m_audiences->begin(); !found && a2!=m_audiences->end(); ++a2) {
- found = XMLString::equals((*a)->getAudienceURI(), *a2);
- }
- }
- }
-
- if (!found) {
- ostringstream os;
- os << *ac;
- Category::getInstance(SAML_LOGCAT ".AssertionValidator").error("unacceptable AudienceRestriction in assertion (%s)", os.str().c_str());
- throw ValidationException("Assertion contains an unacceptable AudienceRestriction.");
- }
-}
diff --git a/saml/saml2/profile/impl/BrowserSSOProfile20Validator.cpp b/saml/saml2/profile/impl/BrowserSSOProfile20Validator.cpp
deleted file mode 100644
index 0869567..0000000
--- a/saml/saml2/profile/impl/BrowserSSOProfile20Validator.cpp
+++ /dev/null
@@ -1,115 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * BrowserSSOProfile20Validator.cpp
- *
- * SAML 2.0 Browser SSO Profile Assertion Validator.
- */
-
-#include "internal.h"
-#include "saml2/core/Assertions.h"
-#include "saml2/profile/BrowserSSOProfileValidator.h"
-
-#include <xmltooling/logging.h>
-#include <xmltooling/XMLToolingConfig.h>
-#include <xmltooling/util/NDC.h>
-
-using namespace opensaml::saml2;
-using namespace xmltooling::logging;
-using namespace xmltooling;
-using namespace std;
-
-BrowserSSOProfileValidator::BrowserSSOProfileValidator(
- const XMLCh* recipient,
- const vector<const XMLCh*>* audiences,
- time_t ts,
- const char* destination,
- const char* requestID
- ) : AssertionValidator(recipient, audiences, ts), m_destination(destination), m_requestID(requestID)
-{
-}
-
-BrowserSSOProfileValidator::~BrowserSSOProfileValidator()
-{
-}
-
-void BrowserSSOProfileValidator::validateAssertion(const Assertion& assertion) const
-{
-#ifdef _DEBUG
- xmltooling::NDC ndc("validate");
-#endif
- Category& log = Category::getInstance(SAML_LOGCAT ".AssertionValidator");
-
- // The assertion MUST have proper confirmation requirements.
- const char* msg="assertion is missing bearer SubjectConfirmation";
- const Subject* subject = assertion.getSubject();
- if (subject) {
- const vector<SubjectConfirmation*>& confs = subject->getSubjectConfirmations();
- for (vector<SubjectConfirmation*>::const_iterator sc = confs.begin(); sc!=confs.end(); ++sc) {
- if (XMLString::equals((*sc)->getMethod(), SubjectConfirmation::BEARER)) {
- const SubjectConfirmationDataType* data = dynamic_cast<const SubjectConfirmationDataType*>((*sc)->getSubjectConfirmationData());
-
- if (m_destination.get()) {
- if (!XMLString::equals(m_destination.get(), data ? data->getRecipient() : nullptr)) {
- msg = "bearer confirmation failed with recipient mismatch";
- continue;
- }
- }
-
- if (m_requestID.get()) {
- if (!XMLString::equals(m_requestID.get(), data ? data->getInResponseTo() : nullptr)) {
- msg = "bearer confirmation failed with request correlation mismatch";
- continue;
- }
- }
-
- if (m_ts) {
- if (!data || !data->getNotOnOrAfter()) {
- msg = "bearer confirmation missing NotOnOrAfter attribute";
- continue;
- }
- else if (data->getNotOnOrAfterEpoch() <= m_ts - XMLToolingConfig::getConfig().clock_skew_secs) {
- msg = "bearer confirmation has expired";
- continue;
- }
- }
-
- // Save off client address.
- if (data) {
- auto_ptr_char ip(data->getAddress());
- if (ip.get())
- m_address = ip.get();
- }
-
- // Pass up for additional checking.
- return AssertionValidator::validateAssertion(assertion);
- }
- }
- }
-
- log.error(msg ? msg : "no error message");
- throw ValidationException("Unable to locate satisfiable bearer SubjectConfirmation in assertion.");
-}
-
-const char* BrowserSSOProfileValidator::getAddress() const
-{
- return m_address.c_str();
-}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list