[cpp-opensaml] branch master updated: Tune down a handful of profile errors to warn level.
Scott Cantor
cantor.2 at osu.edu
Thu Feb 21 14:57:25 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=58e56bbaad49a5e8184f16ea729b4ee736fa32f0
The following commit(s) were added to refs/heads/master by this push:
new 58e56bb Tune down a handful of profile errors to warn level.
58e56bb is described below
commit 58e56bbaad49a5e8184f16ea729b4ee736fa32f0
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 21 14:57:19 2019 -0500
Tune down a handful of profile errors to warn level.
---
saml/binding/impl/ClientCertAuthRule.cpp | 2 +-
saml/binding/impl/MessageFlowRule.cpp | 4 ++--
saml/binding/impl/SimpleSigningRule.cpp | 4 ++--
saml/binding/impl/XMLSigningRule.cpp | 4 ++--
saml/profile/impl/AudienceRestrictionRule.cpp | 4 ++--
saml/saml2/profile/impl/BearerConfirmationRule.cpp | 2 +-
6 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/saml/binding/impl/ClientCertAuthRule.cpp b/saml/binding/impl/ClientCertAuthRule.cpp
index 636aa15..37abe3b 100644
--- a/saml/binding/impl/ClientCertAuthRule.cpp
+++ b/saml/binding/impl/ClientCertAuthRule.cpp
@@ -103,7 +103,7 @@ bool ClientCertAuthRule::evaluate(const XMLObject& message, const GenericRequest
if (!x509trust->validate(chain.front(), chain, *(policy.getMetadataProvider()), &cc)) {
if (m_errorFatal)
throw SecurityPolicyException("Client certificate supplied, but could not be verified.");
- log.error("unable to verify certificate chain with supplied trust engine");
+ log.warn("unable to verify certificate chain with supplied trust engine");
return false;
}
diff --git a/saml/binding/impl/MessageFlowRule.cpp b/saml/binding/impl/MessageFlowRule.cpp
index 90a5086..d9a4b96 100644
--- a/saml/binding/impl/MessageFlowRule.cpp
+++ b/saml/binding/impl/MessageFlowRule.cpp
@@ -85,12 +85,12 @@ bool MessageFlowRule::evaluate(const XMLObject& message, const GenericRequest* r
}
else {
if (issueInstant > now + skew) {
- log.errorStream() << "rejected not-yet-valid message, timestamp (" << issueInstant <<
+ log.warnStream() << "rejected not-yet-valid message, timestamp (" << issueInstant <<
"), newest allowed (" << now + skew << ")" << logging::eol;
throw SecurityPolicyException("Message rejected, was issued in the future.");
}
else if (issueInstant < now - skew - m_expires) {
- log.errorStream() << "rejected expired message, timestamp (" << issueInstant <<
+ log.warnStream() << "rejected expired message, timestamp (" << issueInstant <<
"), oldest allowed (" << (now - skew - m_expires) << ")" << logging::eol;
throw SecurityPolicyException("Message expired, was issued too long ago.");
}
diff --git a/saml/binding/impl/SimpleSigningRule.cpp b/saml/binding/impl/SimpleSigningRule.cpp
index 2035366..375a6a9 100644
--- a/saml/binding/impl/SimpleSigningRule.cpp
+++ b/saml/binding/impl/SimpleSigningRule.cpp
@@ -123,7 +123,7 @@ bool SimpleSigningRule::evaluate(const XMLObject& message, const GenericRequest*
const char* sigAlgorithm = request->getParameter("SigAlg");
if (!sigAlgorithm) {
- log.error("SigAlg parameter not found, no way to verify the signature");
+ log.warn("SigAlg parameter not found, no way to verify the signature");
return false;
}
@@ -214,7 +214,7 @@ bool SimpleSigningRule::evaluate(const XMLObject& message, const GenericRequest*
cc.setXMLAlgorithm(alg.get());
if (!sigtrust->validate(alg.get(), signature, keyInfo, input.c_str(), input.length(), *(policy.getMetadataProvider()), &cc)) {
- log.error("unable to verify message signature with supplied trust engine");
+ log.warn("unable to verify message signature with supplied trust engine");
if (m_errorFatal)
throw SecurityPolicyException("Message was signed, but signature could not be verified.");
return false;
diff --git a/saml/binding/impl/XMLSigningRule.cpp b/saml/binding/impl/XMLSigningRule.cpp
index a9df22e..77542f6 100644
--- a/saml/binding/impl/XMLSigningRule.cpp
+++ b/saml/binding/impl/XMLSigningRule.cpp
@@ -99,7 +99,7 @@ bool XMLSigningRule::evaluate(const XMLObject& message, const GenericRequest* re
sigval.validateSignature(*(signable->getSignature()));
}
catch (ValidationException& ve) {
- log.error("signature profile failed to validate: %s", ve.what());
+ log.warn("signature profile failed to validate: %s", ve.what());
if (m_errorFatal)
throw;
return false;
@@ -109,7 +109,7 @@ bool XMLSigningRule::evaluate(const XMLObject& message, const GenericRequest* re
MetadataCredentialCriteria cc(*(policy.getIssuerMetadata()));
if (!sigtrust->validate(*(signable->getSignature()), *(policy.getMetadataProvider()), &cc)) {
- log.error("unable to verify message signature with supplied trust engine");
+ log.warn("unable to verify message signature with supplied trust engine");
if (m_errorFatal)
throw SecurityPolicyException("Message was signed, but signature could not be verified.");
return false;
diff --git a/saml/profile/impl/AudienceRestrictionRule.cpp b/saml/profile/impl/AudienceRestrictionRule.cpp
index d66bf9f..a7a3692 100644
--- a/saml/profile/impl/AudienceRestrictionRule.cpp
+++ b/saml/profile/impl/AudienceRestrictionRule.cpp
@@ -100,7 +100,7 @@ bool AudienceRestrictionRule::evaluate(const XMLObject& message, const GenericRe
ostringstream os;
os << *ac2;
- Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.AudienceRestriction").error(
+ Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.AudienceRestriction").warn(
"unacceptable AudienceRestriction in assertion (%s)", os.str().c_str()
);
throw SecurityPolicyException("Assertion contains an unacceptable AudienceRestriction.");
@@ -129,7 +129,7 @@ bool AudienceRestrictionRule::evaluate(const XMLObject& message, const GenericRe
ostringstream os;
os << *ac1;
- Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.AudienceRestriction").error(
+ Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.AudienceRestriction").warn(
"unacceptable AudienceRestrictionCondition in assertion (%s)", os.str().c_str()
);
throw SecurityPolicyException("Assertion contains an unacceptable AudienceRestrictionCondition.");
diff --git a/saml/saml2/profile/impl/BearerConfirmationRule.cpp b/saml/saml2/profile/impl/BearerConfirmationRule.cpp
index 0353675..8406348 100644
--- a/saml/saml2/profile/impl/BearerConfirmationRule.cpp
+++ b/saml/saml2/profile/impl/BearerConfirmationRule.cpp
@@ -139,7 +139,7 @@ bool BearerConfirmationRule::evaluate(const XMLObject& message, const GenericReq
}
}
- log.error(msg ? msg : "no error message");
+ log.warn(msg ? msg : "no error message");
if (m_fatal)
throw SecurityPolicyException("Unable to locate satisfiable bearer SubjectConfirmation in assertion.");
return false;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list