[cpp-sp] branch master updated: CPPOST-114 - Add notion of profile to SecurityPolicy
Scott Cantor
cantor.2 at osu.edu
Wed Feb 12 18:56:03 EST 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=131a113105f65f87decb459afc358d659f2ede86
The following commit(s) were added to refs/heads/master by this push:
new 131a113 CPPOST-114 - Add notion of profile to SecurityPolicy
131a113 is described below
commit 131a113105f65f87decb459afc358d659f2ede86
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 12 18:55:17 2020 -0500
CPPOST-114 - Add notion of profile to SecurityPolicy
https://issues.shibboleth.net/jira/browse/CPPOST-114
Populate policies with appropriate profile constants.
---
adfs/adfs.cpp | 4 ++++
.../resolver/impl/QueryAttributeResolver.cpp | 8 +++++--
.../impl/SimpleAggregationAttributeResolver.cpp | 4 +++-
shibsp/handler/AssertionConsumerService.h | 12 +++++++++--
shibsp/handler/impl/AssertionConsumerService.cpp | 7 +++++-
shibsp/handler/impl/SAML1Consumer.cpp | 4 ++++
shibsp/handler/impl/SAML2ArtifactResolution.cpp | 4 +++-
shibsp/handler/impl/SAML2Consumer.cpp | 6 ++++++
shibsp/handler/impl/SAML2Logout.cpp | 4 +++-
shibsp/handler/impl/SAML2NameIDMgmt.cpp | 4 +++-
shibsp/impl/XMLSecurityPolicyProvider.cpp | 9 ++++++++
shibsp/security/SecurityPolicy.cpp | 7 ++++--
shibsp/security/SecurityPolicy.h | 8 ++++++-
shibsp/security/SecurityPolicyProvider.h | 25 +++++++++++++++++++++-
14 files changed, 93 insertions(+), 13 deletions(-)
diff --git a/adfs/adfs.cpp b/adfs/adfs.cpp
index 6eb4ff7..c29c145 100644
--- a/adfs/adfs.cpp
+++ b/adfs/adfs.cpp
@@ -194,6 +194,10 @@ namespace {
}
private:
+ const char* getProfile() const {
+ return WSFED_NS;
+ }
+
void implementProtocol(
const Application& application,
const HTTPRequest& httpRequest,
diff --git a/shibsp/attribute/resolver/impl/QueryAttributeResolver.cpp b/shibsp/attribute/resolver/impl/QueryAttributeResolver.cpp
index 561b4a2..7d6cb9b 100644
--- a/shibsp/attribute/resolver/impl/QueryAttributeResolver.cpp
+++ b/shibsp/attribute/resolver/impl/QueryAttributeResolver.cpp
@@ -297,7 +297,9 @@ void QueryResolver::SAML1Query(QueryContext& ctx) const
// Set up policy and SOAP client.
scoped_ptr<SecurityPolicy> policy(
- application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(application, nullptr, policyId)
+ application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(
+ samlconstants::SAML1_BINDING_SOAP, application, nullptr, policyId
+ )
);
policy->getAudiences().push_back(relyingParty->getXMLString("entityID").second);
MetadataCredentialCriteria mcc(*AA);
@@ -453,7 +455,9 @@ void QueryResolver::SAML2Query(QueryContext& ctx) const
// Set up policy and SOAP client.
scoped_ptr<SecurityPolicy> policy(
- application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(application, nullptr, policyId)
+ application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(
+ samlconstants::SAML20_PROFILE_QUERY, application, nullptr, policyId
+ )
);
policy->getAudiences().push_back(relyingParty->getXMLString("entityID").second);
MetadataCredentialCriteria mcc(*AA);
diff --git a/shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp b/shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp
index dd30c91..6d0b12d 100644
--- a/shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp
+++ b/shibsp/attribute/resolver/impl/SimpleAggregationAttributeResolver.cpp
@@ -355,7 +355,9 @@ void SimpleAggregationResolver::doQuery(SimpleAggregationContext& ctx, const cha
// Set up policy and SOAP client.
scoped_ptr<SecurityPolicy> policy(
- application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(application, nullptr, policyId)
+ application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(
+ samlconstants::SAML20_PROFILE_QUERY, application, nullptr, policyId
+ )
);
if (m_metadata)
policy->setMetadataProvider(m_metadata.get());
diff --git a/shibsp/handler/AssertionConsumerService.h b/shibsp/handler/AssertionConsumerService.h
index a5bc8a9..7cf419b 100644
--- a/shibsp/handler/AssertionConsumerService.h
+++ b/shibsp/handler/AssertionConsumerService.h
@@ -121,11 +121,19 @@ namespace shibsp {
void generateMetadata(opensaml::saml2md::SPSSODescriptor& role, const char* handlerURL) const;
/**
+ * Returns a profile identifier to inject into the SecurityPolicy created
+ * by the base class.
+ *
+ * @return profile identifier if any
+ */
+ virtual const char* getProfile() const;
+
+ /**
* Implement protocol-specific handling of the incoming decoded message.
*
* <p>The result of implementing the protocol should be an exception or
* modifications to the request/response objects to reflect processing
- * of the message.
+ * of the message.</p>
*
* @param application reference to application receiving message
* @param httpRequest client request that included message
@@ -159,7 +167,7 @@ namespace shibsp {
* including NameID and token extraction and filtering followed by
* secondary resolution.
*
- * <p>The caller must free the returned context handle.
+ * <p>The caller must free the returned context handle.</p>
*
* @param application reference to application receiving message
* @param request request delivering message, if any
diff --git a/shibsp/handler/impl/AssertionConsumerService.cpp b/shibsp/handler/impl/AssertionConsumerService.cpp
index a896af6..5b03c34 100644
--- a/shibsp/handler/impl/AssertionConsumerService.cpp
+++ b/shibsp/handler/impl/AssertionConsumerService.cpp
@@ -170,7 +170,7 @@ pair<bool,long> AssertionConsumerService::processMessage(
// Create the policy.
scoped_ptr<opensaml::SecurityPolicy> policy(
application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(
- application, &IDPSSODescriptor::ELEMENT_QNAME, prop.second
+ getProfile(), application, &IDPSSODescriptor::ELEMENT_QNAME, prop.second
)
);
@@ -344,6 +344,11 @@ const char* AssertionConsumerService::getEventType() const
#ifndef SHIBSP_LITE
+const char* AssertionConsumerService::getProfile() const
+{
+ return nullptr;
+}
+
const XMLCh* AssertionConsumerService::getProtocolFamily() const
{
return m_decoder ? m_decoder->getProtocolFamily() : nullptr;
diff --git a/shibsp/handler/impl/SAML1Consumer.cpp b/shibsp/handler/impl/SAML1Consumer.cpp
index 470e463..15e27e4 100644
--- a/shibsp/handler/impl/SAML1Consumer.cpp
+++ b/shibsp/handler/impl/SAML1Consumer.cpp
@@ -88,6 +88,10 @@ namespace shibsp {
}
private:
+ const char* getProfile() const {
+ return m_post ? samlconstants::SAML1_PROFILE_BROWSER_POST : samlconstants::SAML1_PROFILE_BROWSER_ARTIFACT;
+ }
+
void implementProtocol(
const Application& application,
const HTTPRequest& httpRequest,
diff --git a/shibsp/handler/impl/SAML2ArtifactResolution.cpp b/shibsp/handler/impl/SAML2ArtifactResolution.cpp
index d7e755c..48eeaa4 100644
--- a/shibsp/handler/impl/SAML2ArtifactResolution.cpp
+++ b/shibsp/handler/impl/SAML2ArtifactResolution.cpp
@@ -278,7 +278,9 @@ pair<bool,long> SAML2ArtifactResolution::processMessage(const Application& appli
// Create the policy.
scoped_ptr<SecurityPolicy> policy(
- application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(application, &IDPSSODescriptor::ELEMENT_QNAME, policyId.second)
+ application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(
+ samlconstants::SAML20_PROFILE_ARTIFACT, application, &IDPSSODescriptor::ELEMENT_QNAME, policyId.second
+ )
);
// Decode the message and verify that it's a secured ArtifactResolve request.
diff --git a/shibsp/handler/impl/SAML2Consumer.cpp b/shibsp/handler/impl/SAML2Consumer.cpp
index 8c47029..e285d59 100644
--- a/shibsp/handler/impl/SAML2Consumer.cpp
+++ b/shibsp/handler/impl/SAML2Consumer.cpp
@@ -73,6 +73,7 @@ namespace shibsp {
SAML2Consumer(const DOMElement* e, const char* appId, bool deprecationSupport=true)
: AssertionConsumerService(e, appId, Category::getInstance(SHIBSP_LOGCAT ".SSO.SAML2"), nullptr, nullptr, deprecationSupport) {
#ifndef SHIBSP_LITE
+ m_paos = XMLString::equals(getString("Binding").second, samlconstants::SAML20_BINDING_PAOS);
if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess))
m_ssoRule.reset(SAMLConfig::getConfig().SecurityPolicyRuleManager.newPlugin(BEARER_POLICY_RULE, e, deprecationSupport));
#endif
@@ -86,6 +87,10 @@ namespace shibsp {
}
private:
+ const char* getProfile() const {
+ return m_paos ? samlconstants::SAML20_PROFILE_SSO_ECP : samlconstants::SAML20_PROFILE_SSO_BROWSER;
+ }
+
void implementProtocol(
const Application& application,
const HTTPRequest& httpRequest,
@@ -95,6 +100,7 @@ namespace shibsp {
const XMLObject& xmlObject
) const;
+ bool m_paos;
scoped_ptr<SecurityPolicyRule> m_ssoRule;
#else
const XMLCh* getProtocolFamily() const {
diff --git a/shibsp/handler/impl/SAML2Logout.cpp b/shibsp/handler/impl/SAML2Logout.cpp
index e6a6c93..d8e3a41 100644
--- a/shibsp/handler/impl/SAML2Logout.cpp
+++ b/shibsp/handler/impl/SAML2Logout.cpp
@@ -357,7 +357,9 @@ pair<bool,long> SAML2Logout::doRequest(const Application& application, HTTPReque
// Create the policy.
scoped_ptr<SecurityPolicy> policy(
- application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(application, &IDPSSODescriptor::ELEMENT_QNAME, policyId.second)
+ application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(
+ samlconstants::SAML20_PROFILE_SSO_LOGOUT, application, &IDPSSODescriptor::ELEMENT_QNAME, policyId.second
+ )
);
// Decode the message.
diff --git a/shibsp/handler/impl/SAML2NameIDMgmt.cpp b/shibsp/handler/impl/SAML2NameIDMgmt.cpp
index 2e8956a..ae93adf 100644
--- a/shibsp/handler/impl/SAML2NameIDMgmt.cpp
+++ b/shibsp/handler/impl/SAML2NameIDMgmt.cpp
@@ -256,7 +256,9 @@ pair<bool,long> SAML2NameIDMgmt::doRequest(const Application& application, HTTPR
// Create the policy.
scoped_ptr<SecurityPolicy> policy(
- application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(application, &IDPSSODescriptor::ELEMENT_QNAME, policyId.second)
+ application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(
+ samlconstants::SAML20_PROFILE_SSO_NAMEID_MGMT, application, &IDPSSODescriptor::ELEMENT_QNAME, policyId.second
+ )
);
// Decode the message.
diff --git a/shibsp/impl/XMLSecurityPolicyProvider.cpp b/shibsp/impl/XMLSecurityPolicyProvider.cpp
index a4f0f6b..077912c 100644
--- a/shibsp/impl/XMLSecurityPolicyProvider.cpp
+++ b/shibsp/impl/XMLSecurityPolicyProvider.cpp
@@ -188,6 +188,15 @@ SecurityPolicy* SecurityPolicyProvider::createSecurityPolicy(
return new SecurityPolicy(application, role, (validate.first && validate.second), policyId);
}
+SecurityPolicy* SecurityPolicyProvider::createSecurityPolicy(
+ const char* profile, const Application& application, const xmltooling::QName* role, const char* policyId
+ ) const
+{
+ SecurityPolicy* policy = createSecurityPolicy(application, role, policyId);
+ policy->setProfile(profile);
+ return policy;
+}
+
XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl(const DOMElement* e, Category& log)
: m_document(nullptr), m_includeDefaultBlacklist(true), m_defaultPolicy(m_policyMap.end())
{
diff --git a/shibsp/security/SecurityPolicy.cpp b/shibsp/security/SecurityPolicy.cpp
index 81aeed1..41c1dbb 100644
--- a/shibsp/security/SecurityPolicy.cpp
+++ b/shibsp/security/SecurityPolicy.cpp
@@ -35,8 +35,11 @@ using namespace shibsp;
using namespace opensaml::saml2;
using namespace std;
-SecurityPolicy::SecurityPolicy(const Application& application, const xmltooling::QName* role, bool validate, const char* policyId)
- : opensaml::SecurityPolicy(application.getMetadataProvider(), role, application.getTrustEngine(), validate), m_application(application) {
+SecurityPolicy::SecurityPolicy(
+ const Application& application, const xmltooling::QName* role, bool validate, const char* policyId, const char* profile
+ ) : opensaml::SecurityPolicy(application.getMetadataProvider(), role, application.getTrustEngine(), validate, profile),
+ m_application(application) {
+
const vector<const opensaml::SecurityPolicyRule*>& rules =
application.getServiceProvider().getSecurityPolicyProvider()->getPolicyRules(policyId ? policyId : application.getString("policyId").second);
getRules().assign(rules.begin(), rules.end());
diff --git a/shibsp/security/SecurityPolicy.h b/shibsp/security/SecurityPolicy.h
index 012b1a8..fac73f5 100644
--- a/shibsp/security/SecurityPolicy.h
+++ b/shibsp/security/SecurityPolicy.h
@@ -47,8 +47,14 @@ namespace shibsp {
* @param role identifies the role (generally IdP or SP) of the policy peer
* @param validate true iff XML parsing should be done with validation
* @param policyId identifies policy rules to auto-attach, defaults to the application's set
+ * @param profile identifies the profile of the transaction being performed
*/
- SecurityPolicy(const Application& application, const xmltooling::QName* role=nullptr, bool validate=true, const char* policyId=nullptr);
+ SecurityPolicy(
+ const Application& application,
+ const xmltooling::QName* role=nullptr,
+ bool validate=true,
+ const char* policyId=nullptr,
+ const char* profile=nullptr);
virtual ~SecurityPolicy();
diff --git a/shibsp/security/SecurityPolicyProvider.h b/shibsp/security/SecurityPolicyProvider.h
index 3fed8b2..0b7c635 100644
--- a/shibsp/security/SecurityPolicyProvider.h
+++ b/shibsp/security/SecurityPolicyProvider.h
@@ -102,19 +102,42 @@ namespace shibsp {
virtual const std::vector<xmltooling::xstring>& getAlgorithmWhitelist() const=0;
/**
+ * @Deprecated
+ *
* Returns a SecurityPolicy applicable to an application and/or policy identifier.
*
* <p>The caller <strong>MUST</strong> lock the application's MetadataProvider for the life
- * of the returned object.
+ * of the returned object.</p>
*
* @param application reference to application applying policy
* @param role identifies the role (generally IdP or SP) of the policy peer
* @param policyId identifies policy, defaults to the application's default
+ * @param profle
* @return a new policy instance, which the caller is responsible for freeing
*/
virtual SecurityPolicy* createSecurityPolicy(
const Application& application, const xmltooling::QName* role, const char* policyId=nullptr
) const;
+
+ /**
+ * Returns a SecurityPolicy applicable to an application and/or policy identifier.
+ *
+ * <p>The caller <strong>MUST</strong> lock the application's MetadataProvider for the life
+ * of the returned object.</p>
+ *
+ * @param profile profile identifier for the transaction
+ * @param application reference to application applying policy
+ * @param role identifies the role (generally IdP or SP) of the policy peer
+ * @param policyId identifies policy, defaults to the application's default
+ * @param profle
+ * @return a new policy instance, which the caller is responsible for freeing
+ */
+ virtual SecurityPolicy* createSecurityPolicy(
+ const char* profile,
+ const Application& application,
+ const xmltooling::QName* role,
+ const char* policyId=nullptr
+ ) const;
};
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list