[cpp-sp] branch master updated: SSPCPP-892 - Sync up filter schema with IdP
Scott Cantor
cantor.2 at osu.edu
Thu Mar 19 11:06:19 EDT 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=1c0e6c372a6257eb8c61dca15601122d49b0dff6
The following commit(s) were added to refs/heads/master by this push:
new 1c0e6c3 SSPCPP-892 - Sync up filter schema with IdP
1c0e6c3 is described below
commit 1c0e6c372a6257eb8c61dca15601122d49b0dff6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 19 11:05:20 2020 -0400
SSPCPP-892 - Sync up filter schema with IdP
https://issues.shibboleth.net/jira/browse/SSPCPP-892
Add NameIDFormat match functors.
---
Projects/vc15/shibsp/shibsp.vcxproj | 1 +
Projects/vc15/shibsp/shibsp.vcxproj.filters | 3 +
shibsp/Makefile.am | 1 +
shibsp/attribute/filtering/MatchFunctor.h | 6 +
shibsp/attribute/filtering/impl/MatchFunctor.cpp | 13 +++
.../filtering/impl/NameIDFormatFunctor.cpp | 126 +++++++++++++++++++++
6 files changed, 150 insertions(+)
diff --git a/Projects/vc15/shibsp/shibsp.vcxproj b/Projects/vc15/shibsp/shibsp.vcxproj
index 41cb134..44ef4bd 100644
--- a/Projects/vc15/shibsp/shibsp.vcxproj
+++ b/Projects/vc15/shibsp/shibsp.vcxproj
@@ -202,6 +202,7 @@
<ClCompile Include="..\..\..\shibsp\attribute\filtering\impl\AttributeRequesterEntityAttributeFunctor.cpp" />
<ClCompile Include="..\..\..\shibsp\attribute\filtering\impl\AttributeRequesterEntityMatcherFunctor.cpp" />
<ClCompile Include="..\..\..\shibsp\attribute\filtering\impl\DummyAttributeFilter.cpp" />
+ <ClCompile Include="..\..\..\shibsp\attribute\filtering\impl\NameIDFormatFunctor.cpp" />
<ClCompile Include="..\..\..\shibsp\attribute\filtering\impl\NameIDQualifierStringFunctor.cpp" />
<ClCompile Include="..\..\..\shibsp\attribute\filtering\impl\RegistrationAuthorityFunctor.cpp" />
<ClCompile Include="..\..\..\shibsp\attribute\resolver\impl\AssertionAttributeExtractor.cpp" />
diff --git a/Projects/vc15/shibsp/shibsp.vcxproj.filters b/Projects/vc15/shibsp/shibsp.vcxproj.filters
index b44df9b..e6ca412 100644
--- a/Projects/vc15/shibsp/shibsp.vcxproj.filters
+++ b/Projects/vc15/shibsp/shibsp.vcxproj.filters
@@ -438,6 +438,9 @@
<ClCompile Include="..\..\..\shibsp\impl\XMLApplication.cpp">
<Filter>Source Files\impl</Filter>
</ClCompile>
+ <ClCompile Include="..\..\..\shibsp\attribute\filtering\impl\NameIDFormatFunctor.cpp">
+ <Filter>Source Files\attribute\filtering\impl</Filter>
+ </ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="..\..\..\shibsp\GSSRequest.h">
diff --git a/shibsp/Makefile.am b/shibsp/Makefile.am
index ccae58d..02f6552 100644
--- a/shibsp/Makefile.am
+++ b/shibsp/Makefile.am
@@ -211,6 +211,7 @@ libshibsp_la_SOURCES = \
attribute/filtering/impl/AttributeScopeRegexFunctor.cpp \
attribute/filtering/impl/AttributeValueRegexFunctor.cpp \
attribute/filtering/impl/AuthenticationMethodRegexFunctor.cpp \
+ attribute/filtering/impl/NameIDFormatFunctor.cpp \
attribute/filtering/impl/NameIDQualifierStringFunctor.cpp \
attribute/filtering/impl/NumberOfAttributeValuesFunctor.cpp \
attribute/filtering/impl/AttributeIssuerInEntityGroupFunctor.cpp \
diff --git a/shibsp/attribute/filtering/MatchFunctor.h b/shibsp/attribute/filtering/MatchFunctor.h
index 4a102c0..e4c9d14 100644
--- a/shibsp/attribute/filtering/MatchFunctor.h
+++ b/shibsp/attribute/filtering/MatchFunctor.h
@@ -131,6 +131,12 @@ namespace shibsp {
/** Matches based on entity attributes of requester and a regex. */
extern SHIBSP_API xmltooling::QName AttributeRequesterEntityAttributeRegexMatchType;
+ /** Matches based on NameIDFormats of issuer. */
+ extern SHIBSP_API xmltooling::QName AttributeIssuerNameIDFormatType;
+
+ /** Matches based on NameIDFormats of requester. */
+ extern SHIBSP_API xmltooling::QName AttributeRequesterNameIDFormatType;
+
/** Matches based on issuer and pluggable criteria. */
extern SHIBSP_API xmltooling::QName AttributeIssuerEntityMatcherType;
diff --git a/shibsp/attribute/filtering/impl/MatchFunctor.cpp b/shibsp/attribute/filtering/impl/MatchFunctor.cpp
index 5bbfc71..282efd8 100644
--- a/shibsp/attribute/filtering/impl/MatchFunctor.cpp
+++ b/shibsp/attribute/filtering/impl/MatchFunctor.cpp
@@ -73,6 +73,8 @@ namespace shibsp {
DECL_FACTORY(AttributeRequesterEntityAttributeExactMatch);
DECL_FACTORY(AttributeIssuerEntityAttributeRegexMatch);
DECL_FACTORY(AttributeRequesterEntityAttributeRegexMatch);
+ DECL_FACTORY(AttributeIssuerNameIDFormat);
+ DECL_FACTORY(AttributeRequesterNameIDFormat);
DECL_FACTORY(AttributeIssuerEntityMatcher);
DECL_FACTORY(AttributeRequesterEntityMatcher);
DECL_FACTORY(AttributeScopeMatchesShibMDScope);
@@ -130,6 +132,9 @@ namespace shibsp {
static const XMLCh AttributeRequesterEntityAttributeRegexMatch[] = UNICODE_LITERAL_43(A,t,t,r,i,b,u,t,e,R,e,q,u,e,s,t,e,r,E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,R,e,g,e,x,M,a,t,c,h);
static const XMLCh EntityAttributeRegexMatch[] = UNICODE_LITERAL_25(E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,R,e,g,e,x,M,a,t,c,h);
+ static const XMLCh IssuerNameIDFormatExactMatch[] = UNICODE_LITERAL_28(I,s,s,u,e,r,N,a,m,e,I,D,F,o,r,m,a,t,E,x,a,c,t,M,a,t,c,h);
+ static const XMLCh NameIDFormatExactMatch[] = UNICODE_LITERAL_22(N,a,m,e,I,D,F,o,r,m,a,t,E,x,a,c,t,M,a,t,c,h);
+
static const XMLCh AttributeIssuerInEntityGroup[] = UNICODE_LITERAL_28(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,I,n,E,n,t,i,t,y,G,r,o,u,p);
static const XMLCh IssuerInEntityGroup[] = UNICODE_LITERAL_19(I,s,s,u,e,r,I,n,E,n,t,i,t,y,G,r,o,u,p);
@@ -211,6 +216,9 @@ DECL_PUBLIC_QNAME(AttributeRequesterEntityAttributeRegexMatch, EntityAttributeRe
DECL_SAML_QNAME(AttributeRequesterEntityAttributeRegexMatch, AttributeRequesterEntityAttributeRegexMatch);
DECL_SAML_QNAME(EntityAttributeRegexMatch, EntityAttributeRegexMatch);
+DECL_PUBLIC_QNAME(AttributeIssuerNameIDFormat, IssuerNameIDFormatExactMatch);
+DECL_PUBLIC_QNAME(AttributeRequesterNameIDFormat, NameIDFormatExactMatch);
+
DECL_PUBLIC_QNAME(AttributeIssuerInEntityGroup, IssuerInEntityGroup);
DECL_SAML_QNAME(AttributeIssuerInEntityGroup, AttributeIssuerInEntityGroup);
@@ -273,6 +281,11 @@ void SHIBSP_API shibsp::registerMatchFunctors()
REGISTER_FACTORY(AttributeIssuerEntityMatcher);
REGISTER_FACTORY(AttributeRequesterEntityMatcher);
+ // Explicit because there are no deprecated versions to register.
+ mgr.registerFactory(AttributeIssuerNameIDFormatType, AttributeIssuerNameIDFormatFactory);
+ mgr.registerFactory(AttributeRequesterNameIDFormatType, AttributeRequesterNameIDFormatFactory);
+
+ // Extra aliases for some deprecated types.
mgr.registerFactory(DeprecatedEntityAttributeExactMatchType, AttributeRequesterEntityAttributeExactMatchFactory);
mgr.registerFactory(DeprecatedEntityAttributeRegexMatchType, AttributeRequesterEntityAttributeRegexMatchFactory);
mgr.registerFactory(DeprecatedInEntityGroupType, AttributeRequesterInEntityGroupFactory);
diff --git a/shibsp/attribute/filtering/impl/NameIDFormatFunctor.cpp b/shibsp/attribute/filtering/impl/NameIDFormatFunctor.cpp
new file mode 100644
index 0000000..0cb7110
--- /dev/null
+++ b/shibsp/attribute/filtering/impl/NameIDFormatFunctor.cpp
@@ -0,0 +1,126 @@
+/**
+ * Licensed to the University Corporation for Advanced Internet
+ * Development, Inc. (UCAID) under one or more contributor license
+ * agreements. See the NOTICE file distributed with this work for
+ * additional information regarding copyright ownership.
+ *
+ * UCAID licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the
+ * License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+/**
+ * AttributeIssuerRegistrationAuthority.cpp
+ *
+ * A match function that evaluates to true if the attribute issuer's metadata includes
+ * a matching RegistrationAuthority extension.
+ */
+
+#include "internal.h"
+#include "exceptions.h"
+#include "attribute/filtering/FilteringContext.h"
+#include "attribute/filtering/FilterPolicyContext.h"
+#include "attribute/filtering/MatchFunctor.h"
+
+#include <boost/iterator/indirect_iterator.hpp>
+#include <saml/saml2/metadata/Metadata.h>
+
+
+using namespace opensaml::saml2md;
+using namespace boost;
+using namespace std;
+
+namespace shibsp {
+
+ static const XMLCh nameIdFormat[] = UNICODE_LITERAL_12(n,a,m,e,I,d,F,o,r,m,a,t);
+
+ /**
+ * A match function base class that evaluates to true if the supplied metadata includes
+ * a matching NameIDFormat.
+ */
+ class SHIBSP_DLLLOCAL AbstractNameIDFormatFunctor : public MatchFunctor
+ {
+ const XMLCh* m_format;
+ public:
+ AbstractNameIDFormatFunctor(const DOMElement* e) : m_format(e ? e->getAttributeNS(nullptr, nameIdFormat) : nullptr) {
+ if (!m_format || !*m_format)
+ throw ConfigurationException("NameIDFormat MatchFunctor requires non-empty nameIdFormat attribute.");
+ }
+
+ bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
+ const vector<NameIDFormat*>* formats = getFormats(filterContext);
+ if (!formats)
+ return false;
+
+ for (indirect_iterator<vector<NameIDFormat*>::const_iterator> i = make_indirect_iterator(formats->begin());
+ i != make_indirect_iterator(formats->end()); ++i) {
+ if (XMLString::equals(m_format, i->getFormat()))
+ return true;
+ }
+
+ return false;
+ }
+
+ bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
+ return evaluatePolicyRequirement(filterContext);
+ }
+
+ protected:
+ virtual const vector<NameIDFormat*>* getFormats(const FilteringContext& filterContext) const = 0;
+ };
+
+ class SHIBSP_DLLLOCAL AttributeIssuerNameIDFormatFunctor : public AbstractNameIDFormatFunctor
+ {
+ public:
+ AttributeIssuerNameIDFormatFunctor(const DOMElement* e) : AbstractNameIDFormatFunctor(e) {}
+
+ protected:
+ const vector<NameIDFormat*>* getFormats(const FilteringContext& filterContext) const {
+ if (filterContext.getAttributeIssuerMetadata()) {
+ const IDPSSODescriptor* idp = dynamic_cast<const IDPSSODescriptor*>(filterContext.getAttributeIssuerMetadata());
+ if (idp)
+ return &(idp->getNameIDFormats());
+ const AttributeAuthorityDescriptor* aa =
+ dynamic_cast<const AttributeAuthorityDescriptor*>(filterContext.getAttributeIssuerMetadata());
+ if (aa)
+ return &(aa->getNameIDFormats());
+ }
+ return nullptr;
+ }
+ };
+
+ class SHIBSP_DLLLOCAL AttributeRequesterNameIDFormatFunctor : public AbstractNameIDFormatFunctor
+ {
+ public:
+ AttributeRequesterNameIDFormatFunctor(const DOMElement* e) : AbstractNameIDFormatFunctor(e) {}
+
+ protected:
+ const vector<NameIDFormat*>* getFormats(const FilteringContext& filterContext) const {
+ const SPSSODescriptor* sp = dynamic_cast<const SPSSODescriptor*>(filterContext.getAttributeRequesterMetadata());
+ if (sp)
+ return &(sp->getNameIDFormats());
+ return nullptr;
+ }
+ };
+
+
+ MatchFunctor* SHIBSP_DLLLOCAL AttributeIssuerNameIDFormatFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
+ {
+ return new AttributeIssuerNameIDFormatFunctor(p.second);
+ }
+
+ MatchFunctor* SHIBSP_DLLLOCAL AttributeRequesterNameIDFormatFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
+ {
+ return new AttributeRequesterNameIDFormatFunctor(p.second);
+ }
+
+};
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list