[cpp-opensaml] branch master updated: CPPOST-114 - Add notion of profile to SecurityPolicy
Scott Cantor
cantor.2 at osu.edu
Wed Feb 12 18:54:44 EST 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=a4e6374ffe568ee47c5b6da39f6498f9624b4219
The following commit(s) were added to refs/heads/master by this push:
new a4e6374 CPPOST-114 - Add notion of profile to SecurityPolicy
a4e6374 is described below
commit a4e6374ffe568ee47c5b6da39f6498f9624b4219
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 12 18:53:42 2020 -0500
CPPOST-114 - Add notion of profile to SecurityPolicy
https://issues.shibboleth.net/jira/browse/CPPOST-114
---
saml/binding/SecurityPolicy.h | 22 ++++++++++++---
saml/binding/SecurityPolicyRule.h | 31 +++++++++++++++++++---
saml/binding/impl/ClientCertAuthRule.cpp | 10 ++++---
saml/binding/impl/MessageFlowRule.cpp | 8 ++++--
saml/binding/impl/NullSecurityRule.cpp | 7 ++++-
saml/binding/impl/SecurityPolicy.cpp | 29 ++++++++++++++++++--
saml/binding/impl/SimpleSigningRule.cpp | 7 ++++-
saml/binding/impl/XMLSigningRule.cpp | 7 ++++-
saml/profile/impl/AudienceRestrictionRule.cpp | 6 ++++-
saml/profile/impl/ConditionsRule.cpp | 6 ++++-
saml/profile/impl/IgnoreRule.cpp | 7 ++++-
saml/saml1/profile/impl/SAML1BrowserSSORule.cpp | 15 ++++++++---
saml/saml2/profile/impl/BearerConfirmationRule.cpp | 18 +++++++++----
.../profile/impl/DelegationRestrictionRule.cpp | 6 ++++-
saml/util/SAMLConstants.cpp | 12 +++++++++
saml/util/SAMLConstants.h | 18 +++++++++++++
16 files changed, 179 insertions(+), 30 deletions(-)
diff --git a/saml/binding/SecurityPolicy.h b/saml/binding/SecurityPolicy.h
index b7ecc18..ad85e89 100644
--- a/saml/binding/SecurityPolicy.h
+++ b/saml/binding/SecurityPolicy.h
@@ -73,17 +73,26 @@ namespace opensaml {
* @param role identifies the role (generally IdP or SP) of the policy peer
* @param trustEngine TrustEngine to authenticate policy peer
* @param validate true iff XML parsing should be done with validation
+ * @param profile profile identifier
*/
SecurityPolicy(
const saml2md::MetadataProvider* metadataProvider=nullptr,
const xmltooling::QName* role=nullptr,
const xmltooling::TrustEngine* trustEngine=nullptr,
- bool validate=true
+ bool validate=true,
+ const char* profile=nullptr
);
virtual ~SecurityPolicy();
/**
+ * Returns the profile identifier associated with the transaction.
+ *
+ * @return the profile identifier
+ */
+ const char* getProfile() const;
+
+ /**
* Returns the locked MetadataProvider supplied to the policy.
*
* @return the supplied MetadataProvider or nullptr
@@ -176,6 +185,13 @@ namespace opensaml {
std::vector<const SecurityPolicyRule*>& getRules();
/**
+ * Sets the profile identifier associated with the transaction.
+ *
+ * @param id the profile identifier
+ */
+ void setProfile(const char* id);
+
+ /**
* Sets a locked MetadataProvider for the policy.
*
* @param metadata a locked MetadataProvider or nullptr
@@ -417,7 +433,7 @@ namespace opensaml {
private:
// information extracted from message
- xmltooling::xstring m_messageID;
+ xmltooling::xstring m_messageID, m_correlationID, m_inResponseTo;
time_t m_issueInstant;
boost::scoped_ptr<saml2::Issuer> m_issuer;
const saml2md::RoleDescriptor* m_issuerRole;
@@ -433,8 +449,8 @@ namespace opensaml {
bool m_entityOnly;
// contextual information
+ std::string m_profile;
mutable time_t m_ts;
- xmltooling::xstring m_correlationID, m_inResponseTo;
std::vector<xmltooling::xstring> m_audiences;
};
diff --git a/saml/binding/SecurityPolicyRule.h b/saml/binding/SecurityPolicyRule.h
index 644cd45..eb24fdf 100644
--- a/saml/binding/SecurityPolicyRule.h
+++ b/saml/binding/SecurityPolicyRule.h
@@ -29,6 +29,14 @@
#include <saml/base.h>
+#include <set>
+#include <string>
+
+#if defined (_MSC_VER)
+#pragma warning( push )
+#pragma warning( disable : 4251 )
+#endif
+
namespace xmltooling {
class XMLTOOL_API GenericRequest;
class XMLTOOL_API XMLObject;
@@ -48,7 +56,12 @@ namespace opensaml {
{
MAKE_NONCOPYABLE(SecurityPolicyRule);
protected:
- SecurityPolicyRule();
+ /**
+ * Constructor.
+ *
+ * @param e root of configuration
+ */
+ SecurityPolicyRule(const xercesc::DOMElement* e=nullptr);
public:
virtual ~SecurityPolicyRule();
@@ -63,12 +76,15 @@ namespace opensaml {
* Evaluates the rule against the given request and message.
*
* <p>An exception will be raised if the message is fatally invalid according to
- * a policy rule.
+ * a policy rule.</p>
*
* <p>The return value is used to indicate whether a message was ignored or
* successfully processed. A false value signals that the rule wasn't successful
* because the rule was inapplicable to the message, but allows other rules to
- * return an alternate result.
+ * return an alternate result.</p>
+ *
+ * <p>The base class version of this method will check for a non-empty profile set
+ * and return false iff the active profile from the policy is not in the set.</p>
*
* @param message the incoming message
* @param request the protocol request
@@ -79,7 +95,10 @@ namespace opensaml {
const xmltooling::XMLObject& message,
const xmltooling::GenericRequest* request,
SecurityPolicy& policy
- ) const=0;
+ ) const;
+
+ protected:
+ std::set<std::string> m_profiles;
};
/**
@@ -171,4 +190,8 @@ namespace opensaml {
#define BEARER_POLICY_RULE "Bearer"
};
+#if defined (_MSC_VER)
+#pragma warning( pop )
+#endif
+
#endif /* __saml_secrule_h__ */
diff --git a/saml/binding/impl/ClientCertAuthRule.cpp b/saml/binding/impl/ClientCertAuthRule.cpp
index 37abe3b..9cd672b 100644
--- a/saml/binding/impl/ClientCertAuthRule.cpp
+++ b/saml/binding/impl/ClientCertAuthRule.cpp
@@ -68,16 +68,18 @@ namespace opensaml {
static const XMLCh errorFatal[] = UNICODE_LITERAL_10(e,r,r,o,r,F,a,t,a,l);
};
-ClientCertAuthRule::ClientCertAuthRule(const DOMElement* e) : m_errorFatal(XMLHelper::getAttrBool(e, false, errorFatal))
+ClientCertAuthRule::ClientCertAuthRule(const DOMElement* e)
+ : SecurityPolicyRule(e), m_errorFatal(XMLHelper::getAttrBool(e, false, errorFatal))
{
}
bool ClientCertAuthRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
{
- Category& log=Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.ClientCertAuth");
-
- if (!request)
+ if (!request || !SecurityPolicyRule::evaluate(message, request, policy)) {
return false;
+ }
+
+ Category& log=Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.ClientCertAuth");
if (!policy.getIssuerMetadata()) {
log.debug("ignoring message, no issuer metadata supplied");
diff --git a/saml/binding/impl/MessageFlowRule.cpp b/saml/binding/impl/MessageFlowRule.cpp
index e7d2792..5f473b3 100644
--- a/saml/binding/impl/MessageFlowRule.cpp
+++ b/saml/binding/impl/MessageFlowRule.cpp
@@ -68,8 +68,8 @@ static const XMLCh checkReplay[] = UNICODE_LITERAL_11(c,h,e,c,k,R,e,p,l,a,y);
static const XMLCh checkCorrelation[] = UNICODE_LITERAL_16(c,h,e,c,k,C,o,r,r,e,l,a,t,i,o,n);
static const XMLCh expires[] = UNICODE_LITERAL_7(e,x,p,i,r,e,s);
-MessageFlowRule::MessageFlowRule(const DOMElement* e)
- : m_checkReplay(XMLHelper::getAttrBool(e, true, checkReplay)),
+MessageFlowRule::MessageFlowRule(const DOMElement* e) : SecurityPolicyRule(e),
+ m_checkReplay(XMLHelper::getAttrBool(e, true, checkReplay)),
m_correlation(XMLHelper::getAttrBool(e, false, checkCorrelation)),
m_expires(XMLHelper::getAttrInt(e, XMLToolingConfig::getConfig().clock_skew_secs, expires))
{
@@ -77,6 +77,10 @@ MessageFlowRule::MessageFlowRule(const DOMElement* e)
bool MessageFlowRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
{
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
Category& log=Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.MessageFlow");
log.debug("evaluating message flow policy (correlation %s, replay checking %s, expiration %lu)",
m_correlation ? "on" : "off", m_checkReplay ? "on" : "off", m_expires);
diff --git a/saml/binding/impl/NullSecurityRule.cpp b/saml/binding/impl/NullSecurityRule.cpp
index a3efcf0..436b690 100644
--- a/saml/binding/impl/NullSecurityRule.cpp
+++ b/saml/binding/impl/NullSecurityRule.cpp
@@ -39,13 +39,18 @@ namespace opensaml {
class SAML_DLLLOCAL NullSecurityRule : public SecurityPolicyRule
{
public:
- NullSecurityRule(const DOMElement* e) : m_log(Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.NullSecurity")) {}
+ NullSecurityRule(const DOMElement* e)
+ : SecurityPolicyRule(e), m_log(Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.NullSecurity")) {}
virtual ~NullSecurityRule() {}
const char* getType() const {
return NULLSECURITY_POLICY_RULE;
}
bool evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const {
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
m_log.warn("security enforced using NULL policy rule, be sure you know what you're doing");
policy.setAuthenticated(true);
return true;
diff --git a/saml/binding/impl/SecurityPolicy.cpp b/saml/binding/impl/SecurityPolicy.cpp
index 0cb436f..bf581bb 100644
--- a/saml/binding/impl/SecurityPolicy.cpp
+++ b/saml/binding/impl/SecurityPolicy.cpp
@@ -31,6 +31,7 @@
#include "saml2/core/Assertions.h"
#include <boost/bind.hpp>
+#include <boost/algorithm/string.hpp>
#include <xercesc/util/XMLUniDefs.hpp>
using namespace opensaml::saml2md;
@@ -58,6 +59,8 @@ namespace opensaml {
SAML_DLLLOCAL PluginManager<SecurityPolicyRule,string,const DOMElement*>::Factory BearerConfirmationRuleFactory;
SAML_DLLLOCAL PluginManager<SecurityPolicyRule,string,const DOMElement*>::Factory DelegationRestrictionRuleFactory;
}
+
+ static const XMLCh profiles[] = UNICODE_LITERAL_8(p,r,o,f,i,l,e,s);
};
void SAML_API opensaml::registerSecurityPolicyRules()
@@ -76,19 +79,30 @@ void SAML_API opensaml::registerSecurityPolicyRules()
conf.SecurityPolicyRuleManager.registerFactory(DELEGATION_POLICY_RULE, saml2::DelegationRestrictionRuleFactory);
}
-SecurityPolicyRule::SecurityPolicyRule()
+SecurityPolicyRule::SecurityPolicyRule(const DOMElement* e)
{
+ string profiles(XMLHelper::getAttrString(e, nullptr, profiles));
+ trim(profiles);
+ split(m_profiles, profiles, is_space(), algorithm::token_compress_on);
}
SecurityPolicyRule::~SecurityPolicyRule()
{
}
+bool SecurityPolicyRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
+{
+ const char* profile = policy.getProfile();
+ return !profile || m_profiles.empty() || m_profiles.find(profile) != m_profiles.end();
+}
+
+
SecurityPolicy::SecurityPolicy(
const saml2md::MetadataProvider* metadataProvider,
const xmltooling::QName* role,
const xmltooling::TrustEngine* trustEngine,
- bool validate
+ bool validate,
+ const char* profile
) : m_metadataCriteria(nullptr),
m_issueInstant(0),
m_issuerRole(nullptr),
@@ -98,6 +112,7 @@ SecurityPolicy::SecurityPolicy(
m_trust(trustEngine),
m_validate(validate),
m_entityOnly(true),
+ m_profile(profile ? profile : ""),
m_ts(0)
{
}
@@ -107,6 +122,11 @@ SecurityPolicy::~SecurityPolicy()
delete m_metadataCriteria;
}
+const char* SecurityPolicy::getProfile() const
+{
+ return m_profile.c_str();
+}
+
const MetadataProvider* SecurityPolicy::getMetadataProvider() const
{
return m_metadata;
@@ -173,6 +193,11 @@ vector<const SecurityPolicyRule*>& SecurityPolicy::getRules()
return m_rules;
}
+void SecurityPolicy::setProfile(const char* id)
+{
+ m_profile = id ? id : "";
+}
+
void SecurityPolicy::setMetadataProvider(const MetadataProvider* metadata)
{
m_metadata = metadata;
diff --git a/saml/binding/impl/SimpleSigningRule.cpp b/saml/binding/impl/SimpleSigningRule.cpp
index 375a6a9..24e95a6 100644
--- a/saml/binding/impl/SimpleSigningRule.cpp
+++ b/saml/binding/impl/SimpleSigningRule.cpp
@@ -94,12 +94,17 @@ bool SimpleSigningRule::appendParameter(string& s, const char* data, const char*
return true;
}
-SimpleSigningRule::SimpleSigningRule(const DOMElement* e) : m_errorFatal(XMLHelper::getAttrBool(e, false, errorFatal))
+SimpleSigningRule::SimpleSigningRule(const DOMElement* e)
+ : SecurityPolicyRule(e), m_errorFatal(XMLHelper::getAttrBool(e, false, errorFatal))
{
}
bool SimpleSigningRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
{
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
Category& log=Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.SimpleSigning");
if (!policy.getIssuerMetadata()) {
diff --git a/saml/binding/impl/XMLSigningRule.cpp b/saml/binding/impl/XMLSigningRule.cpp
index 77542f6..5532445 100644
--- a/saml/binding/impl/XMLSigningRule.cpp
+++ b/saml/binding/impl/XMLSigningRule.cpp
@@ -70,12 +70,17 @@ namespace opensaml {
static const XMLCh errorFatal[] = UNICODE_LITERAL_10(e,r,r,o,r,F,a,t,a,l);
};
-XMLSigningRule::XMLSigningRule(const DOMElement* e) : m_errorFatal(XMLHelper::getAttrBool(e, false, errorFatal))
+XMLSigningRule::XMLSigningRule(const DOMElement* e)
+ : SecurityPolicyRule(e), m_errorFatal(XMLHelper::getAttrBool(e, false, errorFatal))
{
}
bool XMLSigningRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
{
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
Category& log=Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.XMLSigning");
if (!policy.getIssuerMetadata()) {
diff --git a/saml/profile/impl/AudienceRestrictionRule.cpp b/saml/profile/impl/AudienceRestrictionRule.cpp
index a7a3692..349c7ef 100644
--- a/saml/profile/impl/AudienceRestrictionRule.cpp
+++ b/saml/profile/impl/AudienceRestrictionRule.cpp
@@ -63,7 +63,7 @@ namespace opensaml {
}
};
-AudienceRestrictionRule::AudienceRestrictionRule(const DOMElement* e)
+AudienceRestrictionRule::AudienceRestrictionRule(const DOMElement* e) : SecurityPolicyRule(e)
{
e = e ? XMLHelper::getFirstChildElement(e, saml2::Audience::LOCAL_NAME) : nullptr;
while (e) {
@@ -75,6 +75,10 @@ AudienceRestrictionRule::AudienceRestrictionRule(const DOMElement* e)
bool AudienceRestrictionRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
{
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
static bool (*equals_fn)(const XMLCh*, const XMLCh*) = &XMLString::equals;
const saml2::AudienceRestriction* ac2=dynamic_cast<const saml2::AudienceRestriction*>(&message);
diff --git a/saml/profile/impl/ConditionsRule.cpp b/saml/profile/impl/ConditionsRule.cpp
index 06ed158..7d883d2 100644
--- a/saml/profile/impl/ConditionsRule.cpp
+++ b/saml/profile/impl/ConditionsRule.cpp
@@ -80,7 +80,7 @@ namespace opensaml {
"</PolicyRule>";
};
-ConditionsRule::ConditionsRule(const DOMElement* e, bool deprecationSupport) : m_doc(nullptr)
+ConditionsRule::ConditionsRule(const DOMElement* e, bool deprecationSupport) : SecurityPolicyRule(e), m_doc(nullptr)
{
Category& log=Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.Conditions");
@@ -109,6 +109,10 @@ ConditionsRule::ConditionsRule(const DOMElement* e, bool deprecationSupport) : m
bool ConditionsRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
{
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
const saml2::Assertion* a2=dynamic_cast<const saml2::Assertion*>(&message);
if (a2) {
const saml2::Conditions* conds = a2->getConditions();
diff --git a/saml/profile/impl/IgnoreRule.cpp b/saml/profile/impl/IgnoreRule.cpp
index 7eb854b..746bed2 100644
--- a/saml/profile/impl/IgnoreRule.cpp
+++ b/saml/profile/impl/IgnoreRule.cpp
@@ -46,7 +46,8 @@ namespace opensaml {
{
public:
IgnoreRule(const DOMElement* e)
- : m_log(Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.Ignore")), m_qname(XMLHelper::getNodeValueAsQName(e)) {
+ : SecurityPolicyRule(e), m_log(Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.Ignore")),
+ m_qname(XMLHelper::getNodeValueAsQName(e)) {
if (!m_qname)
throw SecurityPolicyException("No schema type or element name supplied to Ignore rule.");
}
@@ -56,6 +57,10 @@ namespace opensaml {
return IGNORE_POLICY_RULE;
}
bool evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const {
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
if (message.getSchemaType()) {
if (*m_qname != *(message.getSchemaType()))
return false;
diff --git a/saml/saml1/profile/impl/SAML1BrowserSSORule.cpp b/saml/saml1/profile/impl/SAML1BrowserSSORule.cpp
index d3c7208..3d70b56 100644
--- a/saml/saml1/profile/impl/SAML1BrowserSSORule.cpp
+++ b/saml/saml1/profile/impl/SAML1BrowserSSORule.cpp
@@ -42,7 +42,12 @@ namespace opensaml {
class SAML_DLLLOCAL BrowserSSORule : public opensaml::SecurityPolicyRule
{
public:
- BrowserSSORule() {}
+ BrowserSSORule(const DOMElement* e) : SecurityPolicyRule(e) {
+ if (m_profiles.empty()) {
+ m_profiles.insert(samlconstants::SAML1_PROFILE_BROWSER_POST);
+ m_profiles.insert(samlconstants::SAML1_PROFILE_BROWSER_ARTIFACT);
+ }
+ }
virtual ~BrowserSSORule() {}
const char* getType() const {
@@ -52,9 +57,9 @@ namespace opensaml {
bool evaluate(const XMLObject& message, const GenericRequest* request, opensaml::SecurityPolicy& policy) const;
};
- opensaml::SecurityPolicyRule* SAML_DLLLOCAL BrowserSSORuleFactory(const DOMElement* const &, bool)
+ opensaml::SecurityPolicyRule* SAML_DLLLOCAL BrowserSSORuleFactory(const DOMElement* const & e, bool)
{
- return new BrowserSSORule();
+ return new BrowserSSORule(e);
}
class SAML_DLLLOCAL _checkMethod : public unary_function<const SubjectStatement*,void>,
@@ -86,6 +91,10 @@ namespace opensaml {
bool BrowserSSORule::evaluate(const XMLObject& message, const GenericRequest* request, opensaml::SecurityPolicy& policy) const
{
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
const Assertion* a=dynamic_cast<const Assertion*>(&message);
if (!a)
return false;
diff --git a/saml/saml2/profile/impl/BearerConfirmationRule.cpp b/saml/saml2/profile/impl/BearerConfirmationRule.cpp
index a2175c0..03f7f31 100644
--- a/saml/saml2/profile/impl/BearerConfirmationRule.cpp
+++ b/saml/saml2/profile/impl/BearerConfirmationRule.cpp
@@ -70,16 +70,24 @@ namespace opensaml {
};
};
-BearerConfirmationRule::BearerConfirmationRule(const DOMElement* e)
- : m_validity(XMLHelper::getAttrBool(e, true, checkValidity)),
- m_recipient(XMLHelper::getAttrBool(e, true, checkRecipient)),
- m_correlation(XMLHelper::getAttrBool(e, true, checkCorrelation)),
- m_fatal(XMLHelper::getAttrBool(e, true, missingFatal))
+BearerConfirmationRule::BearerConfirmationRule(const DOMElement* e) : SecurityPolicyRule(e),
+ m_validity(XMLHelper::getAttrBool(e, true, checkValidity)),
+ m_recipient(XMLHelper::getAttrBool(e, true, checkRecipient)),
+ m_correlation(XMLHelper::getAttrBool(e, true, checkCorrelation)),
+ m_fatal(XMLHelper::getAttrBool(e, true, missingFatal))
{
+ if (m_profiles.empty()) {
+ m_profiles.insert(samlconstants::SAML20_PROFILE_SSO_BROWSER);
+ m_profiles.insert(samlconstants::SAML20_PROFILE_SSO_ECP);
+ }
}
bool BearerConfirmationRule::evaluate(const XMLObject& message, const GenericRequest* request, opensaml::SecurityPolicy& policy) const
{
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
const Assertion* a=dynamic_cast<const Assertion*>(&message);
if (!a)
return false;
diff --git a/saml/saml2/profile/impl/DelegationRestrictionRule.cpp b/saml/saml2/profile/impl/DelegationRestrictionRule.cpp
index 480fa5c..289125c 100644
--- a/saml/saml2/profile/impl/DelegationRestrictionRule.cpp
+++ b/saml/saml2/profile/impl/DelegationRestrictionRule.cpp
@@ -122,7 +122,7 @@ namespace opensaml {
};
DelegationRestrictionRule::DelegationRestrictionRule(const DOMElement* e)
- : m_match(MATCH_ANY), m_maxTime(XMLHelper::getAttrInt(e, 0, maxTimeSinceDelegation))
+ : SecurityPolicyRule(e), m_match(MATCH_ANY), m_maxTime(XMLHelper::getAttrInt(e, 0, maxTimeSinceDelegation))
{
if (e) {
const XMLCh* m = e ? e->getAttributeNS(nullptr, match) : nullptr;
@@ -148,6 +148,10 @@ DelegationRestrictionRule::DelegationRestrictionRule(const DOMElement* e)
bool DelegationRestrictionRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
{
+ if (!SecurityPolicyRule::evaluate(message, request, policy)) {
+ return false;
+ }
+
const DelegationRestrictionType* drt=dynamic_cast<const DelegationRestrictionType*>(&message);
if (!drt)
return false;
diff --git a/saml/util/SAMLConstants.cpp b/saml/util/SAMLConstants.cpp
index 439cd7f..3616652 100644
--- a/saml/util/SAMLConstants.cpp
+++ b/saml/util/SAMLConstants.cpp
@@ -289,6 +289,18 @@ const char samlconstants::SAML1_PROFILE_BROWSER_ARTIFACT[] = "urn:oasis:names:tc
const char samlconstants::SAML1_PROFILE_BROWSER_POST[] = "urn:oasis:names:tc:SAML:1.0:profiles:browser-post";
+const char samlconstants::SAML20_PROFILE_SSO_BROWSER[] = "urn:oasis:names:tc:SAML:2.0:profiles:SSO:browser";
+
+const char samlconstants::SAML20_PROFILE_SSO_ECP[] = "urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp";
+
+const char samlconstants::SAML20_PROFILE_SSO_LOGOUT[] = "urn:oasis:names:tc:SAML:2.0:profiles:SSO:logout";
+
+const char samlconstants::SAML20_PROFILE_SSO_NAMEID_MGMT[] = "urn:oasis:names:tc:SAML:2.0:profiles:SSO:nameid-mgmt";
+
+const char samlconstants::SAML20_PROFILE_ARTIFACT[] = "urn:oasis:names:tc:SAML:2.0:profiles:artifact";
+
+const char samlconstants::SAML20_PROFILE_QUERY[] = "urn:oasis:names:tc:SAML:2.0:profiles:query";
+
const char samlconstants::SAML20_BINDING_SOAP[] = "urn:oasis:names:tc:SAML:2.0:bindings:SOAP";
const char samlconstants::SAML20_BINDING_PAOS[] = "urn:oasis:names:tc:SAML:2.0:bindings:PAOS";
diff --git a/saml/util/SAMLConstants.h b/saml/util/SAMLConstants.h
index a840875..5d54c06 100644
--- a/saml/util/SAMLConstants.h
+++ b/saml/util/SAMLConstants.h
@@ -191,6 +191,24 @@ namespace samlconstants {
/** SAML 1.x Browser POST profile ("urn:oasis:names:tc:SAML:1.0:profiles:browser-post") */
extern SAML_API const char SAML1_PROFILE_BROWSER_POST[];
+ /** SAML 2.0 Browser SSO Profile ("urn:oasis:names:tc:SAML:2.0:profiles:SSO:browser") */
+ extern SAML_API const char SAML20_PROFILE_SSO_BROWSER[];
+
+ /** SAML 2.0 Enhanced Client/Proxy SSO Profile ("urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp") */
+ extern SAML_API const char SAML20_PROFILE_SSO_ECP[];
+
+ /** SAML 2.0 Logout Profile ("urn:oasis:names:tc:SAML:2.0:profiles:SSO:logout") */
+ extern SAML_API const char SAML20_PROFILE_SSO_LOGOUT[];
+
+ /** SAML 2.0 NameID Management Profile ("urn:oasis:names:tc:SAML:2.0:profiles:SSO:nameid-mgmt") */
+ extern SAML_API const char SAML20_PROFILE_SSO_NAMEID_MGMT[];
+
+ /** SAML 2.0 Artifact Resolution Profile ("urn:oasis:names:tc:SAML:2.0:profiles:artifact") */
+ extern SAML_API const char SAML20_PROFILE_ARTIFACT[];
+
+ /** SAML 2.0 Query Profile ("urn:oasis:names:tc:SAML:2.0:profiles:query") */
+ extern SAML_API const char SAML20_PROFILE_QUERY[];
+
/** SAML 2.0 SOAP binding ("urn:oasis:names:tc:SAML:2.0:bindings:SOAP") */
extern SAML_API const char SAML20_BINDING_SOAP[];
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list