[cpp-opensaml] branch master updated: Improve rule logging.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=1db1f88e6784f85b0f14a344036226a5107571de

The following commit(s) were added to refs/heads/master by this push:
       new  1db1f88   Improve rule logging.
1db1f88 is described below

commit 1db1f88e6784f85b0f14a344036226a5107571de
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 11 13:44:37 2020 -0500

    Improve rule logging.
---
 saml/binding/impl/MessageFlowRule.cpp              | 15 +++++++++------
 saml/saml2/profile/impl/BearerConfirmationRule.cpp |  9 ++++++---
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/saml/binding/impl/MessageFlowRule.cpp b/saml/binding/impl/MessageFlowRule.cpp
index ac98e94..e7d2792 100644
--- a/saml/binding/impl/MessageFlowRule.cpp
+++ b/saml/binding/impl/MessageFlowRule.cpp
@@ -78,7 +78,8 @@ MessageFlowRule::MessageFlowRule(const DOMElement* e)
 bool MessageFlowRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
 {
     Category& log=Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.MessageFlow");
-    log.debug("evaluating message flow policy (replay checking %s, expiration %lu)", m_checkReplay ? "on" : "off", m_expires);
+    log.debug("evaluating message flow policy (correlation %s, replay checking %s, expiration %lu)",
+        m_correlation ? "on" : "off", m_checkReplay ? "on" : "off", m_expires);
 
     time_t now = policy.getTime();
     time_t skew = XMLToolingConfig::getConfig().clock_skew_secs;
@@ -101,15 +102,17 @@ bool MessageFlowRule::evaluate(const XMLObject& message, const GenericRequest* r
 
     if (m_correlation) {
         if (policy.getCorrelationID() && *(policy.getCorrelationID())) {
-            if (!XMLString::equals(policy.getCorrelationID(), policy.getInResponseTo())) {
-                log.warn("Response correlation ID did not match request ID");
+            if (XMLString::equals(policy.getCorrelationID(), policy.getInResponseTo())) {
+                log.debug("request/response correlation validated");
+            }
+            else {
                 auto_ptr_char requestID(policy.getCorrelationID());
-                throw SecurityPolicyException("Rejecting non-correlated response to request ID ($1).",
-                    params(1, requestID.get()));
+                log.warn("response correlation ID did not match request ID (%s)", requestID.get());
+                throw SecurityPolicyException("Rejecting non-correlated response to request ID.");
             }
         }
         else if (policy.getInResponseTo() && *(policy.getInResponseTo())) {
-            log.warn("Response correlation failed due to lack of request ID to compare against");
+            log.warn("request/response correlation failed due to lack of request ID to compare against");
             throw SecurityPolicyException("Response correlation failed with lack of correlation ID");
         }
     }
diff --git a/saml/saml2/profile/impl/BearerConfirmationRule.cpp b/saml/saml2/profile/impl/BearerConfirmationRule.cpp
index 745fa0e..a2175c0 100644
--- a/saml/saml2/profile/impl/BearerConfirmationRule.cpp
+++ b/saml/saml2/profile/impl/BearerConfirmationRule.cpp
@@ -109,13 +109,16 @@ bool BearerConfirmationRule::evaluate(const XMLObject& message, const GenericReq
 
                 if (m_correlation) {
                     if (policy.getCorrelationID() && *(policy.getCorrelationID())) {
-                        if (!XMLString::equals(policy.getCorrelationID(), data ? data->getInResponseTo() : nullptr)) {
-                            msg = "bearer confirmation failed with request correlation mismatch";
+                        if (XMLString::equals(policy.getCorrelationID(), data ? data->getInResponseTo() : nullptr)) {
+                            log.debug("request/response correlation validated");
+                        }
+                        else {
+                            msg = "bearer confirmation failed on lack of request/response correlation";
                             continue;
                         }
                     }
                     else if (data && data->getInResponseTo() && *(data->getInResponseTo())) {
-                        msg = "bearer confirmation issued in response to request failed with lack of correlation ID";
+                        msg = "bearer confirmation issued in response to request failed on lack of correlation ID";
                         continue;
                     }
                 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.