[cpp-sp] 02/02: SSPCPP-775 - Client-side session storage

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=be6731e3dfe92bbe8748c9145f1ca2c53014582b

commit be6731e3dfe92bbe8748c9145f1ca2c53014582b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Mar 16 20:17:08 2018 -0400

    SSPCPP-775 - Client-side session storage
    
    https://issues.shibboleth.net/jira/browse/SSPCPP-775
    
    Batch file to maintain DataSealer keys.
---
 Projects/vc15/Shibboleth.sln               |  1 +
 configs/Makefile.am                        |  1 +
 configs/seckeygen.bat                      | 70 ++++++++++++++++++++++++++++++
 shibsp/impl/StorageServiceSessionCache.cpp |  6 ++-
 4 files changed, 76 insertions(+), 2 deletions(-)

diff --git a/Projects/vc15/Shibboleth.sln b/Projects/vc15/Shibboleth.sln
index ed9f6ea..c2b5a7d 100644
--- a/Projects/vc15/Shibboleth.sln
+++ b/Projects/vc15/Shibboleth.sln
@@ -51,6 +51,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Config", "Config", "{2543BC
 		..\..\configs\example-shibboleth2.xml = ..\..\configs\example-shibboleth2.xml
 		..\..\configs\globalLogout.html = ..\..\configs\globalLogout.html
 		..\..\configs\keygen.bat = ..\..\configs\keygen.bat
+		..\..\configs\seckeygen.bat = ..\..\configs\seckeygen.bat
 		..\..\configs\keygen.sh = ..\..\configs\keygen.sh
 		..\..\configs\localLogout.html = ..\..\configs\localLogout.html
 		..\..\configs\Makefile.am = ..\..\configs\Makefile.am
diff --git a/configs/Makefile.am b/configs/Makefile.am
index 906e107..9c310b7 100644
--- a/configs/Makefile.am
+++ b/configs/Makefile.am
@@ -168,6 +168,7 @@ EXTRA_DIST = \
 	shibd-debian.in \
 	shibd-osx.plist.in \
 	keygen.bat \
+	seckeygen.bat \
 	keygen.sh \
 	metagen.sh \
 	SetService32.bat \
diff --git a/configs/seckeygen.bat b/configs/seckeygen.bat
new file mode 100644
index 0000000..579c62d
--- /dev/null
+++ b/configs/seckeygen.bat
@@ -0,0 +1,70 @@
+ at echo off
+setlocal ENABLEDELAYEDEXPANSION
+
+set /A HISTORY=14
+set FILENAME=sealer.keys
+set OUT=%~dp0
+
+:opt_start
+set PARAM=%1
+
+if not defined PARAM goto opt_end
+if %1==-o goto opt_out
+if %1==-h goto opt_history
+if %1==-f goto opt_filename
+goto usage
+:opt_end
+
+set PATH=%PATH%;%ProgramFiles%\Shibboleth\SP\lib\
+if exist %OUT%\%FILENAME%.tmp del /Q %OUT%\%FILENAME%.tmp
+
+set /A LINECOUNT=0
+if exist %OUT%\%FILENAME% goto getlinecount
+
+:compute
+set /A CHOP=LINECOUNT + 1
+if %CHOP% LEQ %HISTORY% (set /A CHOP=0) else (set /A CHOP=CHOP - HISTORY)
+echo Removing %CHOP% old key(s)...
+
+if exist %OUT%\%FILENAME% (goto :regurgitate) else (set /A KEYVER=1)
+
+:addkey
+for /F %%a in ('openssl.exe rand -base64 16') do set KEYVAL=%%a
+echo %KEYVER%:%KEYVAL% >> %OUT%\%FILENAME%.tmp
+move /Y %OUT%\%FILENAME%.tmp %OUT%\%FILENAME%
+echo Added key version: %KEYVER%
+exit /b
+
+:getlinecount
+for /F %%a in ('type %OUT%\%FILENAME% ^| find /V /C ""') do set LINECOUNT=%%a
+goto compute
+
+:regurgitate
+for /F "delims=: tokens=1,2" %%i in (%OUT%\%FILENAME%) do (
+    if !CHOP! GTR 0 (set /A CHOP=!CHOP! - 1) else (echo %%i:%%j >> %OUT%\%FILENAME%.tmp)
+	set KEYVER=%%i
+)
+set /A KEYVER=KEYVER + 1
+goto addkey
+
+:opt_out
+set OUT=%2
+shift
+shift
+goto opt_start
+
+:opt_filename
+set FILENAME=%2
+shift
+shift
+goto opt_start
+
+:opt_history
+set HISTORY=%2
+shift
+shift
+goto opt_start
+
+:usage
+echo usage: seckeygen [-h key history to maintain] [-f filename] [-o output dir]
+exit /b
diff --git a/shibsp/impl/StorageServiceSessionCache.cpp b/shibsp/impl/StorageServiceSessionCache.cpp
index 829a39b..1205e0a 100644
--- a/shibsp/impl/StorageServiceSessionCache.cpp
+++ b/shibsp/impl/StorageServiceSessionCache.cpp
@@ -176,8 +176,10 @@ SSCache::SSCache(const DOMElement* e)
             }
         }
 
-        if (!m_persistedAttributeIds.empty() && XMLToolingConfig::getConfig().getDataSealer() == nullptr) {
-            throw ConfigurationException("Persisting sessions across nodes requires DataSealer component, check configuration");
+        if (!m_persistedAttributeIds.empty()) {
+			if (XMLToolingConfig::getConfig().getDataSealer() == nullptr)
+				throw ConfigurationException("Persisting sessions across nodes requires DataSealer component, check configuration");
+			XMLToolingConfig::getConfig().getDataSealer()->wrap("testing", time(nullptr)); // should throw if no key is installed
         }
     }
 #endif

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.