[cpp-sp] branch main updated: SSPCPP-936 - Support AttributeConsumingServiceIndex in the AuthnRequest
Scott Cantor
cantor.2 at osu.edu
Tue Oct 26 18:23:14 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=5fe9886c109965105af38dba6117a9a361841eca
The following commit(s) were added to refs/heads/main by this push:
new 5fe9886c SSPCPP-936 - Support AttributeConsumingServiceIndex in the AuthnRequest
5fe9886c is described below
commit 5fe9886c109965105af38dba6117a9a361841eca
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 26 14:21:29 2021 -0400
SSPCPP-936 - Support AttributeConsumingServiceIndex in the AuthnRequest
https://shibboleth.atlassian.net/browse/SSPCPP-936
---
schemas/shibboleth-3.0-native-sp-config.xsd | 3 +++
shibsp/handler/impl/SAML2SessionInitiator.cpp | 22 +++++++++++++++++++++-
2 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/schemas/shibboleth-3.0-native-sp-config.xsd b/schemas/shibboleth-3.0-native-sp-config.xsd
index 3f39260c..f06affa3 100644
--- a/schemas/shibboleth-3.0-native-sp-config.xsd
+++ b/schemas/shibboleth-3.0-native-sp-config.xsd
@@ -310,6 +310,7 @@
<attribute name="sslError" type="conf:anyURI"/>
<attribute name="target" type="conf:anyURI"/>
<attribute name="acsIndex" type="unsignedShort"/>
+ <attribute name="attributeIndex" type="conf:string"/>
<attribute name="REMOTE_ADDR" type="conf:string"/>
<attribute name="encoding" type="conf:string"/>
<attribute name="attributeValueDelimiter" type="conf:string"/>
@@ -529,6 +530,7 @@
<attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
<attribute name="NameIDFormat" type="conf:anyURI"/>
<attribute name="SPNameQualifier" type="conf:string"/>
+ <attribute name="attributeIndex" type="conf:string"/>
<attribute name="requestDelegation" type="boolean"/>
</attributeGroup>
@@ -661,6 +663,7 @@
<attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
<attribute name="NameIDFormat" type="conf:anyURI"/>
<attribute name="SPNameQualifier" type="conf:string"/>
+ <attribute name="attributeIndex" type="conf:string"/>
<attribute name="requestDelegation" type="boolean"/>
<attribute name="target" type="conf:anyURI"/>
<attribute name="discoveryPolicy" type="conf:string"/>
diff --git a/shibsp/handler/impl/SAML2SessionInitiator.cpp b/shibsp/handler/impl/SAML2SessionInitiator.cpp
index 7aadabe5..fed5b401 100644
--- a/shibsp/handler/impl/SAML2SessionInitiator.cpp
+++ b/shibsp/handler/impl/SAML2SessionInitiator.cpp
@@ -102,6 +102,7 @@ namespace shibsp {
HTTPResponse& httpResponse,
const char* entityID,
const XMLCh* acsIndex,
+ const char* attributeIndex,
bool artifactInbound,
const char* acsLocation,
const XMLCh* acsBinding,
@@ -258,7 +259,7 @@ pair<bool,long> SAML2SessionInitiator::run(SPRequest& request, string& entityID,
string target;
pair<bool,const char*> prop;
const Handler* ACS = nullptr;
- pair<bool,const char*> acClass, acComp, nidFormat, spQual;
+ pair<bool,const char*> acClass, acComp, nidFormat, spQual, attributeIndex;
const char* requestTemplate = nullptr;
const char* outgoingBinding = nullptr;
bool isPassive=false,forceAuthn=false;
@@ -307,6 +308,7 @@ pair<bool,long> SAML2SessionInitiator::run(SPRequest& request, string& entityID,
}
// Populate via parameter, map, or property.
+ attributeIndex = getString("attributeIndex", request, settingMask);
acClass = getString("authnContextClassRef", request, settingMask);
acComp = getString("authnContextComparison", request, settingMask);
nidFormat = getString("NameIDFormat", request, settingMask);
@@ -329,6 +331,7 @@ pair<bool,long> SAML2SessionInitiator::run(SPRequest& request, string& entityID,
}
// Populate via map or property.
+ attributeIndex = getString("attributeIndex", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
acClass = getString("authnContextClassRef", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
acComp = getString("authnContextComparison", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
nidFormat = getString("NameIDFormat", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED);
@@ -398,6 +401,7 @@ pair<bool,long> SAML2SessionInitiator::run(SPRequest& request, string& entityID,
return doRequest(
app, &request, request, entityID.c_str(),
ix.second,
+ attributeIndex.first ? attributeIndex.second : nullptr,
XMLString::equals(ACS->getString("Binding").second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT),
nullptr, nullptr,
isPassive, forceAuthn,
@@ -429,6 +433,7 @@ pair<bool,long> SAML2SessionInitiator::run(SPRequest& request, string& entityID,
return doRequest(
app, &request, request, entityID.c_str(),
nullptr,
+ attributeIndex.first ? attributeIndex.second : nullptr,
XMLString::equals(ACS->getString("Binding").second, samlconstants::SAML20_BINDING_HTTP_ARTIFACT),
ACSloc.c_str(), ACS->getXMLString("Binding").second,
isPassive, forceAuthn,
@@ -452,6 +457,8 @@ pair<bool,long> SAML2SessionInitiator::run(SPRequest& request, string& entityID,
in.addmember("isPassive").integer(1);
else if (forceAuthn)
in.addmember("forceAuthn").integer(1);
+ if (attributeIndex.first)
+ in.addmember("attributeIndex").string(attributeIndex.second);
if (acClass.first)
in.addmember("authnContextClassRef").string(acClass.second);
if (acComp.first)
@@ -547,6 +554,7 @@ void SAML2SessionInitiator::receive(DDF& in, ostream& out)
doRequest(
*app, nullptr, *http, in["entity_id"].string(),
index.get(),
+ in["attributeIndex"].string(),
(in["artifact"].integer() != 0),
in["acsLocation"].string(), bind.get(),
in["isPassive"].integer() == 1,
@@ -571,6 +579,7 @@ pair<bool,long> SAML2SessionInitiator::doRequest(
HTTPResponse& httpResponse,
const char* entityID,
const XMLCh* acsIndex,
+ const char* attributeIndex,
bool artifactInbound,
const char* acsLocation,
const XMLCh* acsBinding,
@@ -730,6 +739,17 @@ pair<bool,long> SAML2SessionInitiator::doRequest(
req->getNameIDPolicy()->setSPNameQualifier(rpQual.second);
}
+ // AttributeConsumingService may be specified, or inferred from RelyingParty.
+ if (attributeIndex && *attributeIndex) {
+ auto_ptr_XMLCh wideacs(attributeIndex);
+ req->setAttributeConsumingServiceIndex(wideacs.get());
+ }
+ else {
+ pair<bool,const XMLCh*> attrIndex = relyingParty->getXMLString("attributeIndex");
+ if (attrIndex.first)
+ req->setAttributeConsumingServiceIndex(attrIndex.second);
+ }
+
// If no specified AC class, infer from RelyingParty.
if (!authnContextClassRef || !*authnContextClassRef) {
pair<bool,const char*> rpContextClassRef = relyingParty->getString("authnContextClassRef");
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list