[cpp-sp] branch main updated: Remove AttributeFilter code.
Scott Cantor
cantor.2 at osu.edu
Wed Oct 30 21:21:33 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=69cbc1757ec3cc2a833197f45e9d1083e420de4f
The following commit(s) were added to refs/heads/main by this push:
new 69cbc175 Remove AttributeFilter code.
69cbc175 is described below
commit 69cbc1757ec3cc2a833197f45e9d1083e420de4f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 30 17:21:19 2024 -0400
Remove AttributeFilter code.
---
shibsp/Makefile.am | 7 -
shibsp/attribute/filtering/AttributeFilter.h | 77 ----
shibsp/attribute/filtering/BasicFilteringContext.h | 81 ----
shibsp/attribute/filtering/FilterPolicyContext.h | 70 ---
shibsp/attribute/filtering/FilteringContext.h | 121 -----
shibsp/attribute/filtering/MatchFunctor.h | 167 -------
.../attribute/filtering/impl/AndMatchFunctor.cpp | 141 ------
.../attribute/filtering/impl/AnyMatchFunctor.cpp | 55 ---
.../attribute/filtering/impl/AttributeFilter.cpp | 54 ---
.../impl/AttributeIssuerEntityAttributeFunctor.cpp | 83 ----
.../impl/AttributeIssuerEntityMatcherFunctor.cpp | 79 ----
.../impl/AttributeIssuerInEntityGroupFunctor.cpp | 108 -----
.../filtering/impl/AttributeIssuerRegexFunctor.cpp | 97 ----
.../impl/AttributeIssuerStringFunctor.cpp | 80 ----
.../impl/AttributeMatchesShibMDScopeFunctor.cpp | 149 ------
.../AttributeRequesterEntityAttributeFunctor.cpp | 82 ----
.../AttributeRequesterEntityMatcherFunctor.cpp | 79 ----
.../AttributeRequesterInEntityGroupFunctor.cpp | 108 -----
.../impl/AttributeRequesterRegexFunctor.cpp | 97 ----
.../impl/AttributeRequesterStringFunctor.cpp | 80 ----
.../filtering/impl/AttributeScopeRegexFunctor.cpp | 135 ------
.../filtering/impl/AttributeScopeStringFunctor.cpp | 141 ------
.../filtering/impl/AttributeValueRegexFunctor.cpp | 136 ------
.../filtering/impl/AttributeValueStringFunctor.cpp | 130 ------
.../impl/AuthenticationMethodRegexFunctor.cpp | 97 ----
.../impl/AuthenticationMethodStringFunctor.cpp | 84 ----
.../filtering/impl/BasicFilteringContext.cpp | 107 -----
.../filtering/impl/ChainingAttributeFilter.cpp | 91 ----
.../filtering/impl/DummyAttributeFilter.cpp | 62 ---
shibsp/attribute/filtering/impl/MatchFunctor.cpp | 313 -------------
.../filtering/impl/NameIDFormatFunctor.cpp | 126 -----
.../impl/NameIDQualifierStringFunctor.cpp | 173 -------
.../attribute/filtering/impl/NotMatchFunctor.cpp | 127 -----
.../impl/NumberOfAttributeValuesFunctor.cpp | 93 ----
shibsp/attribute/filtering/impl/OrMatchFunctor.cpp | 137 ------
.../impl/RegistrationAuthorityFunctor.cpp | 149 ------
.../filtering/impl/XMLAttributeFilter.cpp | 513 ---------------------
37 files changed, 4429 deletions(-)
diff --git a/shibsp/Makefile.am b/shibsp/Makefile.am
index 22994d41..e4cd946b 100644
--- a/shibsp/Makefile.am
+++ b/shibsp/Makefile.am
@@ -51,13 +51,6 @@ attrinclude_HEADERS = \
attribute/SimpleAttribute.h \
attribute/XMLAttribute.h
-attrfiltinclude_HEADERS = \
- attribute/filtering/AttributeFilter.h \
- attribute/filtering/BasicFilteringContext.h \
- attribute/filtering/FilteringContext.h \
- attribute/filtering/FilterPolicyContext.h \
- attribute/filtering/MatchFunctor.h
-
attrresinclude_HEADERS = \
attribute/resolver/AttributeExtractor.h \
attribute/resolver/AttributeResolver.h \
diff --git a/shibsp/attribute/filtering/AttributeFilter.h b/shibsp/attribute/filtering/AttributeFilter.h
deleted file mode 100644
index f98e345a..00000000
--- a/shibsp/attribute/filtering/AttributeFilter.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file shibsp/attribute/filtering/AttributeFilter.h
- *
- * Engine for filtering attribute values.
- */
-
-#ifndef __shibsp_attrfilt_h__
-#define __shibsp_attrfilt_h__
-
-#include <shibsp/base.h>
-
-#include <vector>
-#include <xmltooling/Lockable.h>
-
-namespace shibsp {
-
- class SHIBSP_API Attribute;
- class SHIBSP_API FilteringContext;
-
- /**
- * Engine for filtering attribute values.
- */
- class SHIBSP_API AttributeFilter : public virtual xmltooling::Lockable
- {
- MAKE_NONCOPYABLE(AttributeFilter);
- protected:
- AttributeFilter();
- public:
- virtual ~AttributeFilter();
-
- /**
- * Filters values out of a set of attributes.
- *
- * @param context a FilteringContext interface
- * @param attributes a mutable array containing the attributes to filter
- *
- * @throws AttributeFileringException thrown if there is a problem filtering attributes
- */
- virtual void filterAttributes(const FilteringContext& context, std::vector<Attribute*>& attributes) const=0;
- };
-
- /**
- * Registers AttributeFilter classes into the runtime.
- */
- void SHIBSP_API registerAttributeFilters();
-
- /** AttributeFilter based on an XML mapping schema. */
- #define XML_ATTRIBUTE_FILTER "XML"
-
- /** AttributeFilter based on rejecting/blocking all attributes. */
- #define DUMMY_ATTRIBUTE_FILTER "Dummy"
-
- /** AttributeFilter based on chaining together other filters. */
- #define CHAINING_ATTRIBUTE_FILTER "Chaining"
-};
-
-#endif /* __shibsp_attrfilt_h__ */
diff --git a/shibsp/attribute/filtering/BasicFilteringContext.h b/shibsp/attribute/filtering/BasicFilteringContext.h
deleted file mode 100644
index b9589a62..00000000
--- a/shibsp/attribute/filtering/BasicFilteringContext.h
+++ /dev/null
@@ -1,81 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file shibsp/attribute/filtering/BasicFilteringContext.h
- *
- * A trivial FilteringContext implementation.
- */
-
-#ifndef __shibsp_basicfiltctx_h__
-#define __shibsp_basicfiltctx_h__
-
-#include <shibsp/attribute/filtering/FilteringContext.h>
-
-namespace shibsp {
-
- class SHIBSP_API Attribute;
-
- /**
- * A trivial FilteringContext implementation.
- */
- class SHIBSP_API BasicFilteringContext : public FilteringContext
- {
- public:
- /**
- * Constructor.
- *
- * @param app reference to Application
- * @param attributes attributes being filtered
- * @param role metadata role of Attribute issuer, if any
- * @param authncontext_class method/category of authentication event, if known
- * @param authncontext_decl specifics of authentication event, if known
- */
- BasicFilteringContext(
- const Application& app,
- const std::vector<Attribute*>& attributes,
- const opensaml::saml2md::RoleDescriptor* role=nullptr,
- const XMLCh* authncontext_class=nullptr,
- const XMLCh* authncontext_decl=nullptr
- );
-
- virtual ~BasicFilteringContext();
-
- // Virtual function overrides.
- const Application& getApplication() const;
- const XMLCh* getAuthnContextClassRef() const;
- const XMLCh* getAuthnContextDeclRef() const;
- const XMLCh* getAttributeRequester() const;
- const XMLCh* getAttributeIssuer() const;
- const opensaml::saml2md::RoleDescriptor* getAttributeRequesterMetadata() const;
- const opensaml::saml2md::RoleDescriptor* getAttributeIssuerMetadata() const;
- const std::multimap<std::string,Attribute*>& getAttributes() const;
-
- private:
- const Application& m_app;
- std::multimap<std::string,Attribute*> m_attributes;
- const opensaml::saml2md::RoleDescriptor* m_role;
- const XMLCh* m_issuer;
- const XMLCh* m_class;
- const XMLCh* m_decl;
- };
-};
-
-#endif /* __shibsp_basicfiltctx_h__ */
diff --git a/shibsp/attribute/filtering/FilterPolicyContext.h b/shibsp/attribute/filtering/FilterPolicyContext.h
deleted file mode 100644
index 6e6735cc..00000000
--- a/shibsp/attribute/filtering/FilterPolicyContext.h
+++ /dev/null
@@ -1,70 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file shibsp/attribute/filtering/FilterPolicyContext.h
- *
- * Context for lookup of instantiated MatchFunctor objects.
- */
-
-#ifndef __shibsp_filtpolctx_h__
-#define __shibsp_filtpolctx_h__
-
-#include <shibsp/base.h>
-
-#include <map>
-#include <string>
-
-namespace shibsp {
-
- class SHIBSP_API MatchFunctor;
-
- /**
- * Context for lookup of instantiated MatchFunctor objects.
- */
- class SHIBSP_API FilterPolicyContext
- {
- MAKE_NONCOPYABLE(FilterPolicyContext);
- public:
- /**
- * Constructor.
- *
- * @param functors reference to a map of id/functor pairs
- */
- FilterPolicyContext(std::multimap<std::string,MatchFunctor*>& functors);
-
- virtual ~FilterPolicyContext();
-
- /**
- * Gets a mutable map to store id/functor pairs.
- *
- * <p>When storing new instances, use an empty string for unnamed objects.
- *
- * @return reference to a mutable map containing available MatchFunctors
- */
- std::multimap<std::string,MatchFunctor*>& getMatchFunctors() const;
-
- private:
- std::multimap<std::string,MatchFunctor*>& m_functors;
- };
-
-};
-
-#endif /* __shibsp_filtpolctx_h__ */
diff --git a/shibsp/attribute/filtering/FilteringContext.h b/shibsp/attribute/filtering/FilteringContext.h
deleted file mode 100644
index 40232a41..00000000
--- a/shibsp/attribute/filtering/FilteringContext.h
+++ /dev/null
@@ -1,121 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file shibsp/attribute/filtering/FilteringContext.h
- *
- * Context for attribute filtering operations.
- */
-
-#ifndef __shibsp_filtctx_h__
-#define __shibsp_filtctx_h__
-
-#include <shibsp/base.h>
-
-#include <map>
-#include <string>
-
-namespace opensaml {
- namespace saml2md {
- class SAML_API RoleDescriptor;
- };
-};
-
-namespace shibsp {
-
- class SHIBSP_API Application;
- class SHIBSP_API Attribute;
-
- /**
- * Context for attribute filtering operations.
- */
- class SHIBSP_API FilteringContext
- {
- MAKE_NONCOPYABLE(FilteringContext);
- protected:
- FilteringContext();
- public:
- virtual ~FilteringContext();
-
- /**
- * Gets the Application doing the filtering.
- *
- * @return reference to an Application
- */
- virtual const Application& getApplication() const=0;
-
- /**
- * Returns a URI containing an AuthnContextClassRef associated with the subject.
- *
- * <p>SAML 1.x AuthenticationMethods will be returned as class references.
- *
- * @return a URI identifying the authentication context class
- */
- virtual const XMLCh* getAuthnContextClassRef() const=0;
-
- /**
- * Returns a URI containing an AuthnContextDeclRef associated with the subject.
- *
- * @return a URI identifying the authentication context declaration
- */
- virtual const XMLCh* getAuthnContextDeclRef() const=0;
-
- /**
- * Gets the ID of the requester of the attributes, if known.
- *
- * @return requester of the attributes, or nullptr
- */
- virtual const XMLCh* getAttributeRequester() const=0;
-
- /**
- * Gets the ID of the issuer of the attributes, if known.
- *
- * @return ID of the issuer of the attributes, or nullptr
- */
- virtual const XMLCh* getAttributeIssuer() const=0;
-
- /**
- * Gets the SAML metadata for the attribute requesting role, if available.
- *
- * @return SAML metadata for the attribute requesting role, or nullptr
- */
- virtual const opensaml::saml2md::RoleDescriptor* getAttributeRequesterMetadata() const=0;
-
- /**
- * Gets the SAML metadata for the attribute issuing role, if available.
- *
- * @return SAML metadata for the attribute issuing role, or nullptr
- */
- virtual const opensaml::saml2md::RoleDescriptor* getAttributeIssuerMetadata() const=0;
-
- /**
- * Returns the set of Attributes being filtered.
- *
- * <p>No modifications should be performed, access is provided only for use by
- * MatchFunctors based on the presence of Attribute data.
- *
- * @return an immutable map of Attributes.
- */
- virtual const std::multimap<std::string,Attribute*>& getAttributes() const=0;
-
- };
-};
-
-#endif /* __shibsp_filtctx_h__ */
diff --git a/shibsp/attribute/filtering/MatchFunctor.h b/shibsp/attribute/filtering/MatchFunctor.h
deleted file mode 100644
index e4c9d14d..00000000
--- a/shibsp/attribute/filtering/MatchFunctor.h
+++ /dev/null
@@ -1,167 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file shibsp/attribute/filtering/MatchFunctor.h
- *
- * A function that evaluates whether an expressed criteria is met by the current filter context.
- */
-
-#ifndef __shibsp_matchfunc_h__
-#define __shibsp_matchfunc_h__
-
-#include <shibsp/base.h>
-
-namespace shibsp {
-
- class SHIBSP_API Attribute;
- class SHIBSP_API FilteringContext;
-
- /**
- * A function that evaluates whether an expressed criteria is met by the current filter context.
- */
- class SHIBSP_API MatchFunctor
- {
- MAKE_NONCOPYABLE(MatchFunctor);
- protected:
- MatchFunctor();
- public:
- virtual ~MatchFunctor();
-
- /**
- * Evaluates this matching criteria. This evaluation is used when a filtering engine determines policy
- * applicability.
- *
- * @param filterContext current filtering context
- * @return true if the criteria for this matching function are met
- * @throws AttributeFilteringException thrown if the function can not be evaluated
- */
- virtual bool evaluatePolicyRequirement(const FilteringContext& filterContext) const=0;
-
- /**
- * Evaluates this matching criteria. This evaluation is used when a filtering engine is filtering attribute
- * values.
- *
- * @param filterContext the current filtering context
- * @param attribute the attribute being evaluated
- * @param index the index of the attribute value being evaluated
- * @return true if the criteria for this matching function are met
- * @throws AttributeFilteringException thrown if the function can not be evaluated
- */
- virtual bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const=0;
- };
-
- /** Always evaluates to true. */
- extern SHIBSP_API xmltooling::QName AnyMatchFunctorType;
-
- /** Conjunction MatchFunctor. */
- extern SHIBSP_API xmltooling::QName AndMatchFunctorType;
-
- /** Disjunction MatchFunctor. */
- extern SHIBSP_API xmltooling::QName OrMatchFunctorType;
-
- /** Negating MatchFunctor. */
- extern SHIBSP_API xmltooling::QName NotMatchFunctorType;
-
- /** Matches the issuing entity's name. */
- extern SHIBSP_API xmltooling::QName AttributeIssuerStringType;
-
- /** Matches the requesting entity's name. */
- extern SHIBSP_API xmltooling::QName AttributeRequesterStringType;
-
- /** Matches the principal's authentication method/class or context reference. */
- extern SHIBSP_API xmltooling::QName AuthenticationMethodStringType;
-
- /** Matches an attribute's string value. */
- extern SHIBSP_API xmltooling::QName AttributeValueStringType;
-
- /** Matches an attribute's "scope". */
- extern SHIBSP_API xmltooling::QName AttributeScopeStringType;
-
- /** Matches the issuing entity's name. */
- extern SHIBSP_API xmltooling::QName AttributeIssuerRegexType;
-
- /** Matches the requesting entity's name. */
- extern SHIBSP_API xmltooling::QName AttributeRequesterRegexType;
-
- /** Matches the principal's authentication method/class or context reference. */
- extern SHIBSP_API xmltooling::QName AuthenticationMethodRegexType;
-
- /** Matches an attribute's string value. */
- extern SHIBSP_API xmltooling::QName AttributeValueRegexType;
-
- /** Matches an attribute's "scope". */
- extern SHIBSP_API xmltooling::QName AttributeScopeRegexType;
-
- /** Matches based on the number of values. */
- extern SHIBSP_API xmltooling::QName NumberOfAttributeValuesType;
-
- /** Matches based on metadata groups of issuer. */
- extern SHIBSP_API xmltooling::QName AttributeIssuerInEntityGroupType;
-
- /** Matches based on metadata groups of requester. */
- extern SHIBSP_API xmltooling::QName AttributeRequesterInEntityGroupType;
-
- /** Matches based on entity attributes of issuer. */
- extern SHIBSP_API xmltooling::QName AttributeIssuerEntityAttributeExactMatchType;
-
- /** Matches based on entity attributes of requester. */
- extern SHIBSP_API xmltooling::QName AttributeRequesterEntityAttributeExactMatchType;
-
- /** Matches based on entity attributes of issuer and a regex. */
- extern SHIBSP_API xmltooling::QName AttributeIssuerEntityAttributeRegexMatchType;
-
- /** Matches based on entity attributes of requester and a regex. */
- extern SHIBSP_API xmltooling::QName AttributeRequesterEntityAttributeRegexMatchType;
-
- /** Matches based on NameIDFormats of issuer. */
- extern SHIBSP_API xmltooling::QName AttributeIssuerNameIDFormatType;
-
- /** Matches based on NameIDFormats of requester. */
- extern SHIBSP_API xmltooling::QName AttributeRequesterNameIDFormatType;
-
- /** Matches based on issuer and pluggable criteria. */
- extern SHIBSP_API xmltooling::QName AttributeIssuerEntityMatcherType;
-
- /** Matches based on requester and pluggable criteria. */
- extern SHIBSP_API xmltooling::QName AttributeRequesterEntityMatcherType;
-
- /** Matches scope based on metadata Scope extensions. */
- extern SHIBSP_API xmltooling::QName AttributeScopeMatchesShibMDScopeType;
-
- /** Matches value based on metadata Scope extensions. */
- extern SHIBSP_API xmltooling::QName AttributeValueMatchesShibMDScopeType;
-
- /** Matches based on NameID NameQualifiers. */
- extern SHIBSP_API xmltooling::QName NameIDQualifierStringType;
-
- /** Matches based on RegistrationAuthority extension in issuer's metadata. */
- extern SHIBSP_API xmltooling::QName AttributeIssuerRegistrationAuthorityType;
-
- /** Matches based on RegistrationAuthority extension in requester's metadata. */
- extern SHIBSP_API xmltooling::QName RegistrationAuthorityType;
-
- /**
- * Registers MatchFunctor classes into the runtime.
- */
- void SHIBSP_API registerMatchFunctors();
-};
-
-#endif /* __shibsp_matchfunc_h__ */
diff --git a/shibsp/attribute/filtering/impl/AndMatchFunctor.cpp b/shibsp/attribute/filtering/impl/AndMatchFunctor.cpp
deleted file mode 100644
index 533615dc..00000000
--- a/shibsp/attribute/filtering/impl/AndMatchFunctor.cpp
+++ /dev/null
@@ -1,141 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AndMatchFunctor.cpp
- *
- * A MatchFunctor that logical ANDs the results of contained functors.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-#include "util/SPConstants.h"
-
-#define BOOST_BIND_GLOBAL_PLACEHOLDERS
-#include <boost/bind.hpp>
-#include <xercesc/util/XMLUniDefs.hpp>
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
- /**
- * A MatchFunctor that logical ANDs the results of contained functors.
- */
- class SHIBSP_DLLLOCAL AndMatchFunctor : public MatchFunctor
- {
- public:
- AndMatchFunctor(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport=true);
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (m_functors.empty())
- return false;
- vector<const MatchFunctor*>::const_iterator i = find_if(
- m_functors.begin(), m_functors.end(),
- boost::bind(&MatchFunctor::evaluatePolicyRequirement, _1, boost::cref(filterContext)) == false
- );
- return (i == m_functors.end());
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- if (m_functors.empty())
- return false;
- vector<const MatchFunctor*>::const_iterator i = find_if(
- m_functors.begin(), m_functors.end(),
- boost::bind(&MatchFunctor::evaluatePermitValue, _1, boost::cref(filterContext), boost::cref(attribute), index) == false
- );
- return (i == m_functors.end());
- }
-
- private:
- MatchFunctor* buildFunctor(const DOMElement* e, const FilterPolicyContext* functorMap, bool deprecationSupport);
-
- vector<const MatchFunctor*> m_functors;
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AndMatchFunctorFactory(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport)
- {
- return new AndMatchFunctor(p, deprecationSupport);
- }
-
- static XMLCh _id[] = UNICODE_LITERAL_2(i,d);
- static XMLCh _ref[] = UNICODE_LITERAL_3(r,e,f);
- static XMLCh Rule[] = UNICODE_LITERAL_4(R,u,l,e);
- static XMLCh RuleReference[] = UNICODE_LITERAL_13(R,u,l,e,R,e,f,e,r,e,n,c,e);
-};
-
-AndMatchFunctor::AndMatchFunctor(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport)
-{
- MatchFunctor* func;
- const DOMElement* e = XMLHelper::getFirstChildElement(p.second);
- while (e) {
- func = nullptr;
-
- if (XMLString::equals(e->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS)) {
- auto_ptr_char ns(e->getNamespaceURI());
- SPConfig::getConfig().deprecation().warn("legacy Attribute Filter namespace '%s'", ns.get());
- }
-
- if (XMLString::equals(e->getLocalName(), Rule)) {
- func = buildFunctor(e, p.first, deprecationSupport);
- }
- else if (XMLString::equals(e->getLocalName(), RuleReference)) {
- string ref = XMLHelper::getAttrString(e, nullptr, _ref);
- if (!ref.empty()) {
- multimap<string,MatchFunctor*>::const_iterator rule = p.first->getMatchFunctors().find(ref);
- func = (rule!=p.first->getMatchFunctors().end()) ? rule->second : nullptr;
- }
- }
-
- if (func)
- m_functors.push_back(func);
-
- e = XMLHelper::getNextSiblingElement(e);
- }
-}
-
-MatchFunctor* AndMatchFunctor::buildFunctor(const DOMElement* e, const FilterPolicyContext* functorMap, bool deprecationSupport)
-{
- // We'll track and map IDs just for consistency, but don't require them or worry about dups.
- string id = XMLHelper::getAttrString(e, nullptr, _id);
- if (!id.empty() && functorMap->getMatchFunctors().count(id))
- id.clear();
-
- scoped_ptr<xmltooling::QName> type(XMLHelper::getXSIType(e));
- if (!type)
- throw ConfigurationException("Child Rule found with no xsi:type.");
-
- if (XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS) ||
- XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_SAML_NS)) {
-
- auto_ptr_char ns(type->getNamespaceURI());
- SPConfig::getConfig().deprecation().warn("legacy Attribute Filter namespace '%s'", ns.get());
- }
-
- auto_ptr<MatchFunctor> func(SPConfig::getConfig().MatchFunctorManager.newPlugin(*type, make_pair(functorMap,e), deprecationSupport));
- functorMap->getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func.get()));
- return func.release();
-}
diff --git a/shibsp/attribute/filtering/impl/AnyMatchFunctor.cpp b/shibsp/attribute/filtering/impl/AnyMatchFunctor.cpp
deleted file mode 100644
index 143c5f5b..00000000
--- a/shibsp/attribute/filtering/impl/AnyMatchFunctor.cpp
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AnyMatchFunctor.cpp
- *
- * A match function that returns true to evaluations.
- */
-
-#include "internal.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-using namespace shibsp;
-
-namespace shibsp {
-
- /**
- * A match function that returns true to evaluations. Note, the result may still be negated.
- */
- class SHIBSP_DLLLOCAL AnyMatchFunctor : public MatchFunctor
- {
- public:
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- return true;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return true;
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AnyMatchFunctorFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AnyMatchFunctor();
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeFilter.cpp b/shibsp/attribute/filtering/impl/AttributeFilter.cpp
deleted file mode 100644
index 726c16cb..00000000
--- a/shibsp/attribute/filtering/impl/AttributeFilter.cpp
+++ /dev/null
@@ -1,54 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeFilter.cpp
- *
- * Engine for filtering attribute values.
- */
-
-#include "internal.h"
-#include "attribute/filtering/AttributeFilter.h"
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace std;
-
-namespace shibsp {
- SHIBSP_DLLLOCAL PluginManager<AttributeFilter,string,const DOMElement*>::Factory XMLAttributeFilterFactory;
- SHIBSP_DLLLOCAL PluginManager<AttributeFilter,string,const DOMElement*>::Factory DummyAttributeFilterFactory;
- SHIBSP_DLLLOCAL PluginManager<AttributeFilter,string,const DOMElement*>::Factory ChainingAttributeFilterFactory;
-};
-
-void SHIBSP_API shibsp::registerAttributeFilters()
-{
- SPConfig& conf = SPConfig::getConfig();
- conf.AttributeFilterManager.registerFactory(XML_ATTRIBUTE_FILTER, XMLAttributeFilterFactory);
- conf.AttributeFilterManager.registerFactory(DUMMY_ATTRIBUTE_FILTER, DummyAttributeFilterFactory);
- conf.AttributeFilterManager.registerFactory(CHAINING_ATTRIBUTE_FILTER, ChainingAttributeFilterFactory);
-}
-
-AttributeFilter::AttributeFilter()
-{
-}
-
-AttributeFilter::~AttributeFilter()
-{
-}
diff --git a/shibsp/attribute/filtering/impl/AttributeIssuerEntityAttributeFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeIssuerEntityAttributeFunctor.cpp
deleted file mode 100644
index 55dabd49..00000000
--- a/shibsp/attribute/filtering/impl/AttributeIssuerEntityAttributeFunctor.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeIssuerEntityAttributeFunctor.cpp
- *
- * A match function that checks if the attribute issuer contains an entity attribute with the
- * specified value or regex.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <saml/SAMLConfig.h>
-#include <saml/saml2/metadata/EntityMatcher.h>
-#include <saml/saml2/metadata/Metadata.h>
-
-using namespace opensaml::saml2md;
-using opensaml::SAMLConfig;
-
-namespace shibsp {
-
- /**
- * A match function that checks if the attribute issuer contains an entity attribute with the
- * specified value or regex.
- */
- class SHIBSP_DLLLOCAL AttributeIssuerEntityAttributeFunctor : public MatchFunctor
- {
- boost::scoped_ptr<EntityMatcher> m_matcher;
- public:
- AttributeIssuerEntityAttributeFunctor(const DOMElement* e, bool deprecationSupport=true)
- : m_matcher(SAMLConfig::getConfig().EntityMatcherManager.newPlugin(ENTITYATTR_ENTITY_MATCHER, e, deprecationSupport)) {
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (filterContext.getAttributeIssuerMetadata()) {
- const EntityDescriptor* entity = dynamic_cast<EntityDescriptor*>(filterContext.getAttributeIssuerMetadata()->getParent());
- if (entity)
- return m_matcher->matches(*entity);
- }
- return false;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeIssuerEntityAttributeExactMatchFactory(
- const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport
- )
- {
- return new AttributeIssuerEntityAttributeFunctor(p.second, deprecationSupport);
- }
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeIssuerEntityAttributeRegexMatchFactory(
- const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport
- )
- {
- return new AttributeIssuerEntityAttributeFunctor(p.second, deprecationSupport);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeIssuerEntityMatcherFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeIssuerEntityMatcherFunctor.cpp
deleted file mode 100644
index f9ecd07a..00000000
--- a/shibsp/attribute/filtering/impl/AttributeIssuerEntityMatcherFunctor.cpp
+++ /dev/null
@@ -1,79 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeIssuerEntityMatcherFunctor.cpp
- *
- * A match function that checks if the attribute issuer matches pluggable criteria.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <saml/SAMLConfig.h>
-#include <saml/saml2/metadata/EntityMatcher.h>
-#include <saml/saml2/metadata/Metadata.h>
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace opensaml::saml2md;
-using opensaml::SAMLConfig;
-using xmltooling::XMLHelper;
-
-namespace shibsp {
-
- /**
- * A match function that checks if the attribute issuer matches pluggable criteria.
- */
- class SHIBSP_DLLLOCAL AttributeIssuerEntityMatcherFunctor : public MatchFunctor
- {
- boost::scoped_ptr<EntityMatcher> m_matcher;
- public:
- AttributeIssuerEntityMatcherFunctor(const DOMElement* e, bool deprecationSupport=true) {
- static const XMLCh matcher[] = UNICODE_LITERAL_7(m,a,t,c,h,e,r);
- std::string type(XMLHelper::getAttrString(e, nullptr, matcher));
- if (!type.empty())
- m_matcher.reset(SAMLConfig::getConfig().EntityMatcherManager.newPlugin(type.c_str(), e, deprecationSupport));
- else
- throw ConfigurationException("AttributeIssuerEntityMatcher MatchFunctor requires a matcher attribute.");
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (filterContext.getAttributeIssuerMetadata()) {
- const EntityDescriptor* entity = dynamic_cast<EntityDescriptor*>(filterContext.getAttributeIssuerMetadata()->getParent());
- if (entity)
- return m_matcher->matches(*entity);
- }
- return false;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeIssuerEntityMatcherFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport)
- {
- return new AttributeIssuerEntityMatcherFunctor(p.second, deprecationSupport);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeIssuerInEntityGroupFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeIssuerInEntityGroupFunctor.cpp
deleted file mode 100644
index 23a55a8e..00000000
--- a/shibsp/attribute/filtering/impl/AttributeIssuerInEntityGroupFunctor.cpp
+++ /dev/null
@@ -1,108 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeIssuerInEntityGroupFunctor.cpp
- *
- * A match function that evaluates to true if the attribute issuer is found in metadata and is a member
- * of the given entity group.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-#include "metadata/MetadataProviderCriteria.h"
-
-#include <xmltooling/Lockable.h>
-#include <xmltooling/util/XMLHelper.h>
-#include <saml/saml2/metadata/Metadata.h>
-#include <saml/saml2/metadata/MetadataProvider.h>
-
-using namespace opensaml::saml2md;
-using namespace xmltooling;
-using namespace std;
-
-namespace shibsp {
-
- static const XMLCh checkAffiliations[] = UNICODE_LITERAL_17(c,h,e,c,k,A,f,f,i,l,i,a,t,i,o,n,s);
- static const XMLCh groupID[] = UNICODE_LITERAL_7(g,r,o,u,p,I,D);
-
- /**
- * A match function that evaluates to true if the attribute issuer is found in metadata and is a member
- * of the given entity group.
- */
- class SHIBSP_DLLLOCAL AttributeIssuerInEntityGroupFunctor : public MatchFunctor
- {
- const XMLCh* m_group;
- bool m_checkAffiliations;
- public:
- AttributeIssuerInEntityGroupFunctor(const DOMElement* e)
- : m_checkAffiliations(XMLHelper::getAttrBool(e, false, checkAffiliations)) {
- m_group = e ? e->getAttributeNS(nullptr,groupID) : nullptr;
- if (!m_group || !*m_group)
- throw ConfigurationException("AttributeIssuerInEntityGroup MatchFunctor requires non-empty groupID attribute.");
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- const RoleDescriptor* issuer = filterContext.getAttributeIssuerMetadata();
- if (!issuer)
- return false;
- const EntitiesDescriptor* group = dynamic_cast<const EntitiesDescriptor*>(issuer->getParent()->getParent());
- while (group) {
- if (XMLString::equals(group->getName(), m_group))
- return true;
- group = dynamic_cast<const EntitiesDescriptor*>(group->getParent());
- }
-
- if (m_checkAffiliations) {
- // Use metadata to invoke the SSO service directly.
- MetadataProvider* m = filterContext.getApplication().getMetadataProvider();
- Locker locker(m);
- MetadataProviderCriteria mc(filterContext.getApplication(), m_group);
- pair<const EntityDescriptor*,const RoleDescriptor*> entity = m->getEntityDescriptor(mc);
- if (entity.first) {
- const AffiliationDescriptor* affiliation = entity.first->getAffiliationDescriptor();
- if (affiliation) {
- const vector<AffiliateMember*>& members = affiliation->getAffiliateMembers();
- for (vector<AffiliateMember*>::const_iterator i = members.begin(); i != members.end(); ++i) {
- if (XMLString::equals(filterContext.getAttributeIssuer(), (*i)->getID())) {
- return true;
- }
- }
- }
- }
- }
-
- return false;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeIssuerInEntityGroupFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeIssuerInEntityGroupFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeIssuerRegexFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeIssuerRegexFunctor.cpp
deleted file mode 100644
index 39aa404f..00000000
--- a/shibsp/attribute/filtering/impl/AttributeIssuerRegexFunctor.cpp
+++ /dev/null
@@ -1,97 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeIssuerRegexFunctor.cpp
- *
- * A match function that evaluates to true if the Attribute issuer matches the provided regular
- * expression.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-
-#include <xercesc/util/regx/RegularExpression.hpp>
-
-namespace shibsp {
-
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh options[] = UNICODE_LITERAL_7(o,p,t,i,o,n,s);
- static const XMLCh regex[] = UNICODE_LITERAL_5(r,e,g,e,x);
-
- /**
- * A match function that evaluates to true if the Attribute issuer matches the provided regular
- * expression.
- */
- class SHIBSP_DLLLOCAL AttributeIssuerRegexFunctor : public MatchFunctor
- {
- boost::scoped_ptr<RegularExpression> m_regex;
- public:
- AttributeIssuerRegexFunctor(const DOMElement* e) {
- const XMLCh* r = e ? e->getAttributeNS(nullptr, regex) : nullptr;
- if (!r || !*r)
- throw ConfigurationException("AttributeIssuerRegex MatchFunctor requires non-empty regex attribute.");
-
- try {
- const XMLCh* opts = e->getAttributeNS(nullptr, options);
- if (!opts) {
- bool flag = xmltooling::XMLHelper::getAttrBool(e, true, caseSensitive);
- if (!flag) {
- static const XMLCh i_option[] = UNICODE_LITERAL_1(i);
- opts = i_option;
- }
- }
-
- m_regex.reset(new RegularExpression(r, opts));
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw ConfigurationException(temp.get());
- }
- }
-
- virtual ~AttributeIssuerRegexFunctor() {}
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- try {
- return m_regex->matches(filterContext.getAttributeIssuer());
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw AttributeFilteringException(temp.get());
- }
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeIssuerRegexFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeIssuerRegexFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeIssuerStringFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeIssuerStringFunctor.cpp
deleted file mode 100644
index b4bdb430..00000000
--- a/shibsp/attribute/filtering/impl/AttributeIssuerStringFunctor.cpp
+++ /dev/null
@@ -1,80 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeIssuerStringFunctor.cpp
- *
- * A match function that matches the attribute issuer's name against the specified value.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-using xmltooling::XMLHelper;
-
-namespace shibsp {
-
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh ignoreCase[] = UNICODE_LITERAL_10(i,g,n,o,r,e,C,a,s,e);
- static const XMLCh value[] = UNICODE_LITERAL_5(v,a,l,u,e);
-
- /**
- * A match function that matches the attribute issuer's name against the specified value.
- */
- class SHIBSP_DLLLOCAL AttributeIssuerStringFunctor : public MatchFunctor
- {
- const XMLCh* m_value;
- bool m_caseSensitive;
- public:
- AttributeIssuerStringFunctor(const DOMElement* e)
- : m_value(e ? e->getAttributeNS(nullptr, value) : nullptr), m_caseSensitive(true) {
- if (!m_value || !*m_value)
- throw ConfigurationException("AttributeIssuerString MatchFunctor requires non-empty value attribute.");
-
- if (e->hasAttributeNS(nullptr, caseSensitive)) {
- m_caseSensitive = XMLHelper::getAttrBool(e, true, caseSensitive);
- }
- else if (e->hasAttributeNS(nullptr, ignoreCase)) {
- m_caseSensitive = !XMLHelper::getAttrBool(e, false, ignoreCase);
- }
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (m_caseSensitive)
- return XMLString::equals(m_value, filterContext.getAttributeIssuer());
- else
- return (XMLString::compareIString(m_value, filterContext.getAttributeIssuer()) == 0);
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeIssuerStringFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeIssuerStringFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp
deleted file mode 100644
index 23f0b879..00000000
--- a/shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp
+++ /dev/null
@@ -1,149 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeScopeMatchesShibMDScopeFunctor.cpp
- *
- * A match function that ensures that an attributes value's scope matches
- * a scope given in metadata for the entity or role.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-#include "metadata/MetadataExt.h"
-
-#include <saml/saml2/metadata/Metadata.h>
-#include <xercesc/util/regx/RegularExpression.hpp>
-
-using namespace opensaml::saml2md;
-using namespace xmltooling;
-using namespace std;
-
-namespace shibsp {
-
- /**
- * A match function that ensures that a string matches a scope given in metadata for the entity or role.
- */
- class SHIBSP_DLLLOCAL AbstractAttributeMatchesShibMDScopeFunctor : public MatchFunctor
- {
- public:
- AbstractAttributeMatchesShibMDScopeFunctor() : m_log(Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter")) {}
-
- bool evaluatePolicyRequirement(const FilteringContext&) const {
- throw AttributeFilteringException("Metadata scope matching not usable as a PolicyRequirement.");
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- const RoleDescriptor* issuer = filterContext.getAttributeIssuerMetadata();
- if (!issuer)
- return false;
-
- const char* s = getStringToMatch(attribute, index);
- if (!s || !*s) {
- m_log.warn("attribute (%s) missing scope", attribute.getId());
- return false;
- }
- auto_arrayptr<XMLCh> widestr(fromUTF8(s));
-
- const Scope* rule;
- const Extensions* ext = issuer->getExtensions();
- if (ext) {
- const vector<XMLObject*>& exts = ext->getUnknownXMLObjects();
- for (vector<XMLObject*>::const_iterator e = exts.begin(); e != exts.end(); ++e) {
- rule = dynamic_cast<const Scope*>(*e);
- if (rule && matches(*rule, widestr)) {
- return true;
- }
- }
- }
-
- ext = dynamic_cast<const EntityDescriptor*>(issuer->getParent())->getExtensions();
- if (ext) {
- const vector<XMLObject*>& exts = ext->getUnknownXMLObjects();
- for (vector<XMLObject*>::const_iterator e = exts.begin(); e != exts.end(); ++e) {
- rule = dynamic_cast<const Scope*>(*e);
- if (rule && matches(*rule, widestr)) {
- return true;
- }
- }
- }
-
- m_log.warn("attribute (%s) invalid scope (%s)", attribute.getId(), s);
- return false;
- }
-
- protected:
- virtual const char* getStringToMatch(const Attribute& attribute, size_t index) const = 0;
-
- private:
- Category& m_log;
-
- bool matches(const Scope& rule, auto_arrayptr<XMLCh>& scope) const {
- const XMLCh* val = rule.getValue();
- if (val && *val) {
- if (rule.Regexp()) {
- try {
- RegularExpression re(val);
- return re.matches(scope.get());
- }
- catch (XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw ConfigurationException(temp.get());
- }
- }
- else {
- return XMLString::equals(val, scope.get());
- }
- }
- return false;
- }
- };
-
- class AttributeScopeMatchesShibMDScopeFunctor : public AbstractAttributeMatchesShibMDScopeFunctor
- {
- protected:
- const char* getStringToMatch(const Attribute& attribute, size_t index) const {
- return attribute.getScope(index);
- }
- };
-
- class AttributeValueMatchesShibMDScopeFunctor : public AbstractAttributeMatchesShibMDScopeFunctor
- {
- protected:
- const char* getStringToMatch(const Attribute& attribute, size_t index) const {
- return attribute.getString(index);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeScopeMatchesShibMDScopeFactory(const pair<const FilterPolicyContext*,const DOMElement*>&, bool)
- {
- return new AttributeScopeMatchesShibMDScopeFunctor();
- }
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeValueMatchesShibMDScopeFactory(const pair<const FilterPolicyContext*,const DOMElement*>&, bool)
- {
- return new AttributeValueMatchesShibMDScopeFunctor();
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeRequesterEntityAttributeFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeRequesterEntityAttributeFunctor.cpp
deleted file mode 100644
index a897823c..00000000
--- a/shibsp/attribute/filtering/impl/AttributeRequesterEntityAttributeFunctor.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeRequesterEntityAttributeFunctor.cpp
- *
- * A match function that checks if the attribute requester contains an entity attribute with the
- * specified value or regex.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <saml/SAMLConfig.h>
-#include <saml/saml2/metadata/EntityMatcher.h>
-#include <saml/saml2/metadata/Metadata.h>
-
-using namespace opensaml::saml2md;
-using opensaml::SAMLConfig;
-
-namespace shibsp {
-
- /**
- * A match function that checks if the attribute requester contains an entity attribute with the
- * specified value or regex.
- */
- class SHIBSP_DLLLOCAL AttributeRequesterEntityAttributeFunctor : public MatchFunctor
- {
- boost::scoped_ptr<EntityMatcher> m_matcher;
- public:
- AttributeRequesterEntityAttributeFunctor(const DOMElement* e, bool deprecationSupport)
- : m_matcher(SAMLConfig::getConfig().EntityMatcherManager.newPlugin(ENTITYATTR_ENTITY_MATCHER, e, deprecationSupport)) {
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (filterContext.getAttributeRequesterMetadata()) {
- const EntityDescriptor* entity = dynamic_cast<EntityDescriptor*>(filterContext.getAttributeRequesterMetadata()->getParent());
- if (entity)
- return m_matcher->matches(*entity);
- }
- return false;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeRequesterEntityAttributeExactMatchFactory(
- const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport
- )
- {
- return new AttributeRequesterEntityAttributeFunctor(p.second, deprecationSupport);
- }
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeRequesterEntityAttributeRegexMatchFactory(
- const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport
- )
- {
- return new AttributeRequesterEntityAttributeFunctor(p.second, deprecationSupport);
- }
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeRequesterEntityMatcherFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeRequesterEntityMatcherFunctor.cpp
deleted file mode 100644
index 06af18f6..00000000
--- a/shibsp/attribute/filtering/impl/AttributeRequesterEntityMatcherFunctor.cpp
+++ /dev/null
@@ -1,79 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeRequesterEntityMatcherFunctor.cpp
- *
- * A match function that checks if the attribute requester matches pluggable criteria.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <saml/SAMLConfig.h>
-#include <saml/saml2/metadata/EntityMatcher.h>
-#include <saml/saml2/metadata/Metadata.h>
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace opensaml::saml2md;
-using opensaml::SAMLConfig;
-using xmltooling::XMLHelper;
-
-namespace shibsp {
-
- /**
- * A match function that checks if the attribute requester matches pluggable criteria.
- */
- class SHIBSP_DLLLOCAL AttributeRequesterEntityMatcherFunctor : public MatchFunctor
- {
- boost::scoped_ptr<EntityMatcher> m_matcher;
- public:
- AttributeRequesterEntityMatcherFunctor(const DOMElement* e, bool deprecationSupport=true) {
- static const XMLCh matcher[] = UNICODE_LITERAL_7(m,a,t,c,h,e,r);
- std::string type(XMLHelper::getAttrString(e, nullptr, matcher));
- if (!type.empty())
- m_matcher.reset(SAMLConfig::getConfig().EntityMatcherManager.newPlugin(type.c_str(), e, deprecationSupport));
- else
- throw ConfigurationException("AttributeRequesterEntityMatcher MatchFunctor requires a matcher attribute.");
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (filterContext.getAttributeRequesterMetadata()) {
- const EntityDescriptor* entity = dynamic_cast<EntityDescriptor*>(filterContext.getAttributeRequesterMetadata()->getParent());
- if (entity)
- return m_matcher->matches(*entity);
- }
- return false;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeRequesterEntityMatcherFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport)
- {
- return new AttributeRequesterEntityMatcherFunctor(p.second, deprecationSupport);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeRequesterInEntityGroupFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeRequesterInEntityGroupFunctor.cpp
deleted file mode 100644
index c2b21f7e..00000000
--- a/shibsp/attribute/filtering/impl/AttributeRequesterInEntityGroupFunctor.cpp
+++ /dev/null
@@ -1,108 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeRequesterInEntityGroupFunctor.cpp
- *
- * A match function that evaluates to true if the attribute requester is found in metadata and is a member
- * of the given entity group.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-#include "metadata/MetadataProviderCriteria.h"
-
-#include <xmltooling/Lockable.h>
-#include <xmltooling/util/XMLHelper.h>
-#include <saml/saml2/metadata/Metadata.h>
-#include <saml/saml2/metadata/MetadataProvider.h>
-
-using namespace opensaml::saml2md;
-using namespace xmltooling;
-using namespace std;
-
-namespace shibsp {
-
- static const XMLCh checkAffiliations[] = UNICODE_LITERAL_17(c,h,e,c,k,A,f,f,i,l,i,a,t,i,o,n,s);
- static const XMLCh groupID[] = UNICODE_LITERAL_7(g,r,o,u,p,I,D);
-
- /**
- * A match function that evaluates to true if the attribute requester is found in metadata and is a member
- * of the given entity group.
- */
- class SHIBSP_DLLLOCAL AttributeRequesterInEntityGroupFunctor : public MatchFunctor
- {
- const XMLCh* m_group;
- bool m_checkAffiliations;
- public:
- AttributeRequesterInEntityGroupFunctor(const DOMElement* e)
- : m_checkAffiliations(XMLHelper::getAttrBool(e, false, checkAffiliations)) {
- m_group = e ? e->getAttributeNS(nullptr,groupID) : nullptr;
- if (!m_group || !*m_group)
- throw ConfigurationException("AttributeRequesterInEntityGroup MatchFunctor requires non-empty groupID attribute.");
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- const RoleDescriptor* req = filterContext.getAttributeRequesterMetadata();
- if (!req)
- return false;
- const EntitiesDescriptor* group = dynamic_cast<const EntitiesDescriptor*>(req->getParent()->getParent());
- while (group) {
- if (XMLString::equals(group->getName(), m_group))
- return true;
- group = dynamic_cast<const EntitiesDescriptor*>(group->getParent());
- }
-
- if (m_checkAffiliations) {
- // Use metadata to invoke the SSO service directly.
- MetadataProvider* m = filterContext.getApplication().getMetadataProvider();
- Locker locker(m);
- MetadataProviderCriteria mc(filterContext.getApplication(), m_group);
- pair<const EntityDescriptor*,const RoleDescriptor*> entity = m->getEntityDescriptor(mc);
- if (entity.first) {
- const AffiliationDescriptor* affiliation = entity.first->getAffiliationDescriptor();
- if (affiliation) {
- const vector<AffiliateMember*>& members = affiliation->getAffiliateMembers();
- for (vector<AffiliateMember*>::const_iterator i = members.begin(); i != members.end(); ++i) {
- if (XMLString::equals(filterContext.getAttributeRequester(), (*i)->getID())) {
- return true;
- }
- }
- }
- }
- }
-
- return false;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeRequesterInEntityGroupFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeRequesterInEntityGroupFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeRequesterRegexFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeRequesterRegexFunctor.cpp
deleted file mode 100644
index 80095a41..00000000
--- a/shibsp/attribute/filtering/impl/AttributeRequesterRegexFunctor.cpp
+++ /dev/null
@@ -1,97 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeRequesterRegexFunctor.cpp
- *
- * A match function that evaluates to true if the Attribute requester matches the provided regular
- * expression.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-
-#include <xercesc/util/regx/RegularExpression.hpp>
-
-namespace shibsp {
-
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh options[] = UNICODE_LITERAL_7(o,p,t,i,o,n,s);
- static const XMLCh regex[] = UNICODE_LITERAL_5(r,e,g,e,x);
-
- /**
- * A match function that evaluates to true if the Attribute requester matches the provided regular
- * expression.
- */
- class SHIBSP_DLLLOCAL AttributeRequesterRegexFunctor : public MatchFunctor
- {
- boost::scoped_ptr<RegularExpression> m_regex;
- public:
- AttributeRequesterRegexFunctor(const DOMElement* e) {
- const XMLCh* r = e ? e->getAttributeNS(nullptr, regex) : nullptr;
- if (!r || !*r)
- throw ConfigurationException("AttributeRequesterRegex MatchFunctor requires non-empty regex attribute.");
-
- try {
- const XMLCh* opts = e->getAttributeNS(nullptr, options);
- if (!opts) {
- bool flag = xmltooling::XMLHelper::getAttrBool(e, true, caseSensitive);
- if (!flag) {
- static const XMLCh i_option[] = UNICODE_LITERAL_1(i);
- opts = i_option;
- }
- }
-
- m_regex.reset(new RegularExpression(r, opts));
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw ConfigurationException(temp.get());
- }
- }
-
- virtual ~AttributeRequesterRegexFunctor() {}
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- try {
- return m_regex->matches(filterContext.getAttributeRequester());
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw AttributeFilteringException(temp.get());
- }
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeRequesterRegexFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeRequesterRegexFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeRequesterStringFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeRequesterStringFunctor.cpp
deleted file mode 100644
index 7d4b42a3..00000000
--- a/shibsp/attribute/filtering/impl/AttributeRequesterStringFunctor.cpp
+++ /dev/null
@@ -1,80 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeRequesterStringFunctor.cpp
- *
- * A match function that matches the attribute requester's name against the specified value.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-using xmltooling::XMLHelper;
-
-namespace shibsp {
-
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh ignoreCase[] = UNICODE_LITERAL_10(i,g,n,o,r,e,C,a,s,e);
- static const XMLCh value[] = UNICODE_LITERAL_5(v,a,l,u,e);
-
- /**
- * A match function that matches the attribute requester's name against the specified value.
- */
- class SHIBSP_DLLLOCAL AttributeRequesterStringFunctor : public MatchFunctor
- {
- const XMLCh* m_value;
- bool m_caseSensitive;
- public:
- AttributeRequesterStringFunctor(const DOMElement* e)
- : m_value(e ? e->getAttributeNS(nullptr,value) : nullptr), m_caseSensitive(true) {
- if (!m_value || !*m_value)
- throw ConfigurationException("AttributeRequesterString MatchFunctor requires non-empty value attribute.");
-
- if (e->hasAttributeNS(nullptr, caseSensitive)) {
- m_caseSensitive = XMLHelper::getAttrBool(e, true, caseSensitive);
- }
- else if (e->hasAttributeNS(nullptr, ignoreCase)) {
- m_caseSensitive = !XMLHelper::getAttrBool(e, false, ignoreCase);
- }
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (m_caseSensitive)
- return XMLString::equals(m_value, filterContext.getAttributeRequester());
- else
- return (XMLString::compareIString(m_value, filterContext.getAttributeRequester()) == 0);
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeRequesterStringFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeRequesterStringFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AttributeScopeRegexFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeScopeRegexFunctor.cpp
deleted file mode 100644
index da0f6bca..00000000
--- a/shibsp/attribute/filtering/impl/AttributeScopeRegexFunctor.cpp
+++ /dev/null
@@ -1,135 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeScopeRegexFunctor.cpp
- *
- * A match function that evaluates an attribute value's scope against the
- * provided regular expression.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-#include <xercesc/util/regx/RegularExpression.hpp>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
- static const XMLCh attributeID[] = UNICODE_LITERAL_11(a,t,t,r,i,b,u,t,e,I,D);
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh options[] = UNICODE_LITERAL_7(o,p,t,i,o,n,s);
- static const XMLCh regex[] = UNICODE_LITERAL_5(r,e,g,e,x);
-
- /**
- * A match function that evaluates an attribute value's scope against the provided regular expression.
- */
- class SHIBSP_DLLLOCAL AttributeScopeRegexFunctor : public MatchFunctor
- {
- string m_attributeID;
- scoped_ptr<RegularExpression> m_regex;
-
- bool hasScope(const FilteringContext& filterContext) const;
- bool matches(const Attribute& attribute, size_t index) const;
-
- public:
- AttributeScopeRegexFunctor(const DOMElement* e) : m_attributeID(XMLHelper::getAttrString(e, nullptr, attributeID)) {
- const XMLCh* r = e ? e->getAttributeNS(nullptr, regex) : nullptr;
- if (!r || !*r)
- throw ConfigurationException("AttributeScopeRegex MatchFunctor requires non-empty regex attribute.");
-
- try {
- const XMLCh* opts = e->getAttributeNS(nullptr, options);
- if (!opts) {
- bool flag = xmltooling::XMLHelper::getAttrBool(e, true, caseSensitive);
- if (!flag) {
- static const XMLCh i_option[] = UNICODE_LITERAL_1(i);
- opts = i_option;
- }
- }
-
- m_regex.reset(new RegularExpression(r, opts));
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw ConfigurationException(temp.get());
- }
- }
-
- virtual ~AttributeScopeRegexFunctor() {}
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (m_attributeID.empty())
- throw AttributeFilteringException("No attributeID specified.");
- return hasScope(filterContext);
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- if (m_attributeID.empty() || m_attributeID == attribute.getId())
- return matches(attribute, index);
- return hasScope(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeScopeRegexFactory(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeScopeRegexFunctor(p.second);
- }
-
-};
-
-bool AttributeScopeRegexFunctor::hasScope(const FilteringContext& filterContext) const
-{
- size_t count;
- pair<multimap<string,Attribute*>::const_iterator,multimap<string,Attribute*>::const_iterator> attrs =
- filterContext.getAttributes().equal_range(m_attributeID);
- for (; attrs.first != attrs.second; ++attrs.first) {
- count = attrs.first->second->valueCount();
- for (size_t index = 0; index < count; ++index) {
- if (matches(*(attrs.first->second), index))
- return true;
- }
- }
- return false;
-}
-
-bool AttributeScopeRegexFunctor::matches(const Attribute& attribute, size_t index) const
-{
- const char* val = attribute.getScope(index);
- if (!val)
- return false;
- auto_arrayptr<XMLCh> temp(fromUTF8(val));
- try {
- return m_regex->matches(temp.get());
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw AttributeFilteringException(temp.get());
- }
-}
diff --git a/shibsp/attribute/filtering/impl/AttributeScopeStringFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeScopeStringFunctor.cpp
deleted file mode 100644
index 039801c7..00000000
--- a/shibsp/attribute/filtering/impl/AttributeScopeStringFunctor.cpp
+++ /dev/null
@@ -1,141 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeScopeStringFunctor.cpp
- *
- * A match function that matches the scope of an attribute value against
- * the specified value.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace std;
-
-namespace shibsp {
-
- static const XMLCh attributeID[] = UNICODE_LITERAL_11(a,t,t,r,i,b,u,t,e,I,D);
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh ignoreCase[] = UNICODE_LITERAL_10(i,g,n,o,r,e,C,a,s,e);
- static const XMLCh value[] = UNICODE_LITERAL_5(v,a,l,u,e);
-
- /**
- * A match function that matches the scope of an attribute value against the specified value.
- */
- class SHIBSP_DLLLOCAL AttributeScopeStringFunctor : public MatchFunctor
- {
- string m_attributeID;
- auto_arrayptr<char> m_value;
- bool m_caseSensitive;
-
- bool hasScope(const FilteringContext& filterContext) const;
-
- public:
- AttributeScopeStringFunctor(const DOMElement* e)
- : m_attributeID(XMLHelper::getAttrString(e, nullptr, attributeID)),
- m_value(e ? toUTF8(e->getAttributeNS(nullptr, value)) : nullptr),
- m_caseSensitive(true) {
- if (!m_value.get() || !*m_value.get()) {
- throw ConfigurationException("AttributeScopeString MatchFunctor requires non-empty value attribute.");
- }
-
- if (e->hasAttributeNS(nullptr, caseSensitive)) {
- m_caseSensitive = XMLHelper::getAttrBool(e, true, caseSensitive);
- }
- else if (e->hasAttributeNS(nullptr, ignoreCase)) {
- m_caseSensitive = !XMLHelper::getAttrBool(e, false, ignoreCase);
- }
- }
-
- virtual ~AttributeScopeStringFunctor() {}
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (m_attributeID.empty())
- throw AttributeFilteringException("No attributeID specified.");
- return hasScope(filterContext);
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- if (m_attributeID.empty() || m_attributeID == attribute.getId()) {
- const char* scope = attribute.getScope(index);
- if (!scope) {
- return false;
- }
- else if (!m_caseSensitive) {
-#ifdef HAVE_STRCASECMP
- return !strcasecmp(scope, m_value.get());
-#else
- return !stricmp(scope, m_value.get());
-#endif
- }
- else {
- return !strcmp(scope, m_value.get());
- }
- }
- return hasScope(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeScopeStringFactory(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeScopeStringFunctor(p.second);
- }
-
-};
-
-bool AttributeScopeStringFunctor::hasScope(const FilteringContext& filterContext) const
-{
- size_t count;
- const char* scope;
- pair<multimap<string,Attribute*>::const_iterator,multimap<string,Attribute*>::const_iterator> attrs =
- filterContext.getAttributes().equal_range(m_attributeID);
- for (; attrs.first != attrs.second; ++attrs.first) {
- count = attrs.first->second->valueCount();
- for (size_t index = 0; index < count; ++index) {
- scope = attrs.first->second->getScope(index);
- if (!scope) {
- return false;
- }
- else if (!m_caseSensitive) {
-#ifdef HAVE_STRCASECMP
- if (!strcasecmp(scope, m_value.get()))
- return true;
-#else
- if (!stricmp(scope, m_value.get()))
- return true;
-#endif
- }
- else {
- if (!strcmp(scope, m_value.get()))
- return true;
- }
- }
- }
- return false;
-}
diff --git a/shibsp/attribute/filtering/impl/AttributeValueRegexFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeValueRegexFunctor.cpp
deleted file mode 100644
index 3d1d2363..00000000
--- a/shibsp/attribute/filtering/impl/AttributeValueRegexFunctor.cpp
+++ /dev/null
@@ -1,136 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeValueRegexFunctor.cpp
- *
- * A match function that evaluates an attribute's value against the provided
- * regular expression.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-#include <xercesc/util/regx/RegularExpression.hpp>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
- static const XMLCh attributeID[] = UNICODE_LITERAL_11(a,t,t,r,i,b,u,t,e,I,D);
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh options[] = UNICODE_LITERAL_7(o,p,t,i,o,n,s);
- static const XMLCh regex[] = UNICODE_LITERAL_5(r,e,g,e,x);
-
- /**
- * A match function that evaluates an attribute's value against the provided regular expression.
- */
- class SHIBSP_DLLLOCAL AttributeValueRegexFunctor : public MatchFunctor
- {
- string m_attributeID;
- scoped_ptr<RegularExpression> m_regex;
-
- bool hasValue(const FilteringContext& filterContext) const;
- bool matches(const Attribute& attribute, size_t index) const;
-
- public:
- AttributeValueRegexFunctor(const DOMElement* e)
- : m_attributeID(XMLHelper::getAttrString(e, nullptr, attributeID)) {
- const XMLCh* r = e ? e->getAttributeNS(nullptr, regex) : nullptr;
- if (!r || !*r)
- throw ConfigurationException("AttributeValueRegex MatchFunctor requires non-empty regex attribute.");
-
- try {
- const XMLCh* opts = e->getAttributeNS(nullptr, options);
- if (!opts) {
- bool flag = xmltooling::XMLHelper::getAttrBool(e, true, caseSensitive);
- if (!flag) {
- static const XMLCh i_option[] = UNICODE_LITERAL_1(i);
- opts = i_option;
- }
- }
-
- m_regex.reset(new RegularExpression(r, opts));
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw ConfigurationException(temp.get());
- }
- }
-
- virtual ~AttributeValueRegexFunctor() {}
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (m_attributeID.empty())
- throw AttributeFilteringException("No attributeID specified.");
- return hasValue(filterContext);
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- if (m_attributeID.empty() || m_attributeID == attribute.getId())
- return matches(attribute, index);
- return hasValue(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeValueRegexFactory(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeValueRegexFunctor(p.second);
- }
-
-};
-
-bool AttributeValueRegexFunctor::hasValue(const FilteringContext& filterContext) const
-{
- size_t count;
- pair<multimap<string,Attribute*>::const_iterator,multimap<string,Attribute*>::const_iterator> attrs =
- filterContext.getAttributes().equal_range(m_attributeID);
- for (; attrs.first != attrs.second; ++attrs.first) {
- count = attrs.first->second->valueCount();
- for (size_t index = 0; index < count; ++index) {
- if (matches(*(attrs.first->second), index))
- return true;
- }
- }
- return false;
-}
-
-bool AttributeValueRegexFunctor::matches(const Attribute& attribute, size_t index) const
-{
- const char* val = attribute.getString(index);
- if (!val)
- return false;
- auto_arrayptr<XMLCh> temp(fromUTF8(val));
- try {
- return m_regex->matches(temp.get());
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw AttributeFilteringException(temp.get());
- }
-}
diff --git a/shibsp/attribute/filtering/impl/AttributeValueStringFunctor.cpp b/shibsp/attribute/filtering/impl/AttributeValueStringFunctor.cpp
deleted file mode 100644
index 38285e1d..00000000
--- a/shibsp/attribute/filtering/impl/AttributeValueStringFunctor.cpp
+++ /dev/null
@@ -1,130 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeValueStringFunctor.cpp
- *
- * A match function that matches the value of an attribute against the
- * specified value.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace std;
-
-namespace shibsp {
-
- static const XMLCh attributeID[] = UNICODE_LITERAL_11(a,t,t,r,i,b,u,t,e,I,D);
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh ignoreCase[] = UNICODE_LITERAL_10(i,g,n,o,r,e,C,a,s,e);
- static const XMLCh value[] = UNICODE_LITERAL_5(v,a,l,u,e);
-
- /**
- * A match function that matches the value of an attribute against the specified value.
- */
- class SHIBSP_DLLLOCAL AttributeValueStringFunctor : public MatchFunctor
- {
- string m_attributeID;
- auto_arrayptr<char> m_value;
-
- bool hasValue(const FilteringContext& filterContext) const;
- bool matches(const Attribute& attribute, size_t index) const;
-
- public:
- AttributeValueStringFunctor(const DOMElement* e)
- : m_attributeID(XMLHelper::getAttrString(e, nullptr, attributeID)),
- m_value(e ? toUTF8(e->getAttributeNS(nullptr, value)) : nullptr) {
- if (!m_value.get() || !*m_value.get()) {
- throw ConfigurationException("AttributeValueString MatchFunctor requires non-empty value attribute.");
- }
-
- if (e->hasAttributeNS(nullptr, ignoreCase)) {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.AttributeValueString").warn(
- "ignoreCase property ignored by AttributeValueString MatchFunctor in favor of attribute's caseSensitive property"
- );
- }
-
- if (e->hasAttributeNS(nullptr, caseSensitive)) {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.AttributeValueString").warn(
- "caseSensitive property ignored by AttributeValueString MatchFunctor in favor of attribute's caseSensitive property"
- );
- }
- }
-
- virtual ~AttributeValueStringFunctor() {}
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (m_attributeID.empty())
- throw AttributeFilteringException("No attributeID specified.");
- return hasValue(filterContext);
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- if (m_attributeID.empty() || m_attributeID == attribute.getId())
- return matches(attribute, index);
- return hasValue(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeValueStringFactory(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeValueStringFunctor(p.second);
- }
-
-};
-
-bool AttributeValueStringFunctor::hasValue(const FilteringContext& filterContext) const
-{
- size_t count;
- pair<multimap<string,Attribute*>::const_iterator,multimap<string,Attribute*>::const_iterator> attrs =
- filterContext.getAttributes().equal_range(m_attributeID);
- for (; attrs.first != attrs.second; ++attrs.first) {
- count = attrs.first->second->valueCount();
- for (size_t index = 0; index < count; ++index) {
- if (matches(*(attrs.first->second), index))
- return true;
- }
- }
- return false;
-}
-
-bool AttributeValueStringFunctor::matches(const Attribute& attribute, size_t index) const
-{
- const char* val = attribute.getString(index);
- if (!val)
- return false;
- if (attribute.isCaseSensitive())
- return !strcmp(m_value.get(), val);
-
-#ifdef HAVE_STRCASECMP
- return !strcasecmp(m_value.get(), val);
-#else
- return !stricmp(m_value.get(), val);
-#endif
-}
diff --git a/shibsp/attribute/filtering/impl/AuthenticationMethodRegexFunctor.cpp b/shibsp/attribute/filtering/impl/AuthenticationMethodRegexFunctor.cpp
deleted file mode 100644
index 825ba21d..00000000
--- a/shibsp/attribute/filtering/impl/AuthenticationMethodRegexFunctor.cpp
+++ /dev/null
@@ -1,97 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AuthenticationMethodRegexFunctor.cpp
- *
- * A match function that evaluates to true if the user's authentication
- * method matches the provided regular expression.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-
-#include <xercesc/util/regx/RegularExpression.hpp>
-
-namespace shibsp {
-
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh options[] = UNICODE_LITERAL_7(o,p,t,i,o,n,s);
- static const XMLCh regex[] = UNICODE_LITERAL_5(r,e,g,e,x);
-
- /**
- * A match function that evaluates to true if the user's authentication method matches the provided regular
- * expression.
- */
- class SHIBSP_DLLLOCAL AuthenticationMethodRegexFunctor : public MatchFunctor
- {
- boost::scoped_ptr<RegularExpression> m_regex;
- public:
- AuthenticationMethodRegexFunctor(const DOMElement* e) {
- const XMLCh* r = e ? e->getAttributeNS(nullptr, regex) : nullptr;
- if (!r || !*r)
- throw ConfigurationException("AuthenticationMethodRegex MatchFunctor requires non-empty regex attribute.");
-
- try {
- const XMLCh* opts = e->getAttributeNS(nullptr, options);
- if (!opts) {
- bool flag = xmltooling::XMLHelper::getAttrBool(e, true, caseSensitive);
- if (!flag) {
- static const XMLCh i_option[] = UNICODE_LITERAL_1(i);
- opts = i_option;
- }
- }
-
- m_regex.reset(new RegularExpression(r, opts));
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw ConfigurationException(temp.get());
- }
- }
-
- virtual ~AuthenticationMethodRegexFunctor() {}
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- try {
- return (m_regex->matches(filterContext.getAuthnContextClassRef()) || m_regex->matches(filterContext.getAuthnContextDeclRef()));
- }
- catch (const XMLException& ex) {
- xmltooling::auto_ptr_char temp(ex.getMessage());
- throw AttributeFilteringException(temp.get());
- }
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AuthenticationMethodRegexFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AuthenticationMethodRegexFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/AuthenticationMethodStringFunctor.cpp b/shibsp/attribute/filtering/impl/AuthenticationMethodStringFunctor.cpp
deleted file mode 100644
index c817a400..00000000
--- a/shibsp/attribute/filtering/impl/AuthenticationMethodStringFunctor.cpp
+++ /dev/null
@@ -1,84 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AuthenticationMethodStringFunctor.cpp
- *
- * Match functor that compares the user's authentication method against
- * a given string.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-
-using xmltooling::XMLHelper;
-
-namespace shibsp {
-
- static const XMLCh caseSensitive[] = UNICODE_LITERAL_13(c,a,s,e,S,e,n,s,i,t,i,v,e);
- static const XMLCh ignoreCase[] = UNICODE_LITERAL_10(i,g,n,o,r,e,C,a,s,e);
- static const XMLCh value[] = UNICODE_LITERAL_5(v,a,l,u,e);
-
- /**
- * Match functor that compares the user's authentication method against a given string.
- */
- class SHIBSP_DLLLOCAL AuthenticationMethodStringFunctor : public MatchFunctor
- {
- const XMLCh* m_value;
- bool m_caseSensitive;
- public:
- AuthenticationMethodStringFunctor(const DOMElement* e)
- : m_value(e ? e->getAttributeNS(nullptr,value) : nullptr), m_caseSensitive(true) {
- if (!m_value || !*m_value)
- throw ConfigurationException("AuthenticationMethodString MatchFunctor requires non-empty value attribute.");
-
- if (e->hasAttributeNS(nullptr, caseSensitive)) {
- m_caseSensitive = XMLHelper::getAttrBool(e, true, caseSensitive);
- }
- else if (e->hasAttributeNS(nullptr, ignoreCase)) {
- m_caseSensitive = !XMLHelper::getAttrBool(e, false, ignoreCase);
- }
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (!m_caseSensitive)
- return (XMLString::compareIString(m_value, filterContext.getAuthnContextClassRef()) == 0 ||
- XMLString::compareIString(m_value, filterContext.getAuthnContextDeclRef()) == 0);
- else
- return XMLString::equals(m_value, filterContext.getAuthnContextClassRef()) ||
- XMLString::equals(m_value, filterContext.getAuthnContextDeclRef());
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL AuthenticationMethodStringFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AuthenticationMethodStringFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/BasicFilteringContext.cpp b/shibsp/attribute/filtering/impl/BasicFilteringContext.cpp
deleted file mode 100644
index 8be45894..00000000
--- a/shibsp/attribute/filtering/impl/BasicFilteringContext.cpp
+++ /dev/null
@@ -1,107 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * BasicFilteringContext.cpp
- *
- * A trivial FilteringContext implementation.
- */
-
-#include "internal.h"
-#include "Application.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/BasicFilteringContext.h"
-
-#include <saml/saml2/metadata/Metadata.h>
-
-using namespace shibsp;
-using namespace opensaml::saml2md;
-using namespace std;
-
-FilteringContext::FilteringContext()
-{
-}
-
-FilteringContext::~FilteringContext()
-{
-}
-
-BasicFilteringContext::BasicFilteringContext(
- const Application& app,
- const vector<Attribute*>& attributes,
- const RoleDescriptor* role,
- const XMLCh* authncontext_class,
- const XMLCh* authncontext_decl
- ) : m_app(app), m_role(role), m_issuer(nullptr), m_class(authncontext_class), m_decl(authncontext_decl)
-{
- if (role)
- m_issuer = dynamic_cast<EntityDescriptor*>(role->getParent())->getEntityID();
- for (vector<Attribute*>::const_iterator a = attributes.begin(); a != attributes.end(); ++a)
- m_attributes.insert(multimap<string,Attribute*>::value_type((*a)->getId(), *a));
-}
-
-BasicFilteringContext::~BasicFilteringContext()
-{
-}
-
-const Application& BasicFilteringContext::getApplication() const
-{
- return m_app;
-}
-
-const XMLCh* BasicFilteringContext::getAuthnContextClassRef() const
-{
- return m_class;
-}
-
-const XMLCh* BasicFilteringContext::getAuthnContextDeclRef() const
-{
- return m_decl;
-}
-
-const XMLCh* BasicFilteringContext::getAttributeRequester() const
-{
- if (getAttributeIssuerMetadata()) {
- return getApplication().getRelyingParty(
- dynamic_cast<const EntityDescriptor*>(getAttributeIssuerMetadata()->getParent())
- )->getXMLString("entityID").second;
- }
- return getApplication().getRelyingParty(getAttributeIssuer())->getXMLString("entityID").second;
-}
-
-const XMLCh* BasicFilteringContext::getAttributeIssuer() const
-{
- return m_issuer;
-}
-
-const RoleDescriptor* BasicFilteringContext::getAttributeRequesterMetadata() const
-{
- return nullptr;
-}
-
-const RoleDescriptor* BasicFilteringContext::getAttributeIssuerMetadata() const
-{
- return m_role;
-}
-
-const multimap<string,Attribute*>& BasicFilteringContext::getAttributes() const
-{
- return m_attributes;
-}
diff --git a/shibsp/attribute/filtering/impl/ChainingAttributeFilter.cpp b/shibsp/attribute/filtering/impl/ChainingAttributeFilter.cpp
deleted file mode 100644
index ac3905b2..00000000
--- a/shibsp/attribute/filtering/impl/ChainingAttributeFilter.cpp
+++ /dev/null
@@ -1,91 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * ChainingAttributeFilter.cpp
- *
- * Chains together multiple AttributeFilter plugins.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/AttributeFilter.h"
-#include "attribute/filtering/FilteringContext.h"
-
-#include <boost/ptr_container/ptr_vector.hpp>
-#include <xercesc/util/XMLUniDefs.hpp>
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
- class SHIBSP_DLLLOCAL ChainingAttributeFilter : public AttributeFilter
- {
- public:
- ChainingAttributeFilter(const DOMElement* e, bool deprecationSupport=true);
- virtual ~ChainingAttributeFilter() {}
-
- Lockable* lock() {
- return this;
- }
- void unlock() {
- }
-
- void filterAttributes(const FilteringContext& context, vector<Attribute*>& attributes) const {
- for (ptr_vector<AttributeFilter>::iterator i = m_filters.begin(); i != m_filters.end(); ++i) {
- Locker locker(&(*i));
- i->filterAttributes(context, attributes);
- }
- }
-
- private:
- mutable ptr_vector<AttributeFilter> m_filters;
- };
-
- static const XMLCh _AttributeFilter[] = UNICODE_LITERAL_15(A,t,t,r,i,b,u,t,e,F,i,l,t,e,r);
- static const XMLCh _type[] = UNICODE_LITERAL_4(t,y,p,e);
-
- AttributeFilter* SHIBSP_DLLLOCAL ChainingAttributeFilterFactory(const DOMElement* const & e, bool deprecationSupport)
- {
- return new ChainingAttributeFilter(e, deprecationSupport);
- }
-};
-
-ChainingAttributeFilter::ChainingAttributeFilter(const DOMElement* e, bool deprecationSupport)
-{
- // Load up the chain of handlers.
- e = XMLHelper::getFirstChildElement(e, _AttributeFilter);
- while (e) {
- string t(XMLHelper::getAttrString(e, nullptr, _type));
- if (!t.empty()) {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.Chaining").info("building AttributeFilter of type (%s)...", t.c_str());
- auto_ptr<AttributeFilter> np(SPConfig::getConfig().AttributeFilterManager.newPlugin(t.c_str(), e, deprecationSupport));
- m_filters.push_back(np.get());
- np.release();
- }
- e = XMLHelper::getNextSiblingElement(e, _AttributeFilter);
- }
- if (m_filters.empty())
- throw ConfigurationException("Chaining AttributeFilter plugin requires at least one child plugin.");
-}
diff --git a/shibsp/attribute/filtering/impl/DummyAttributeFilter.cpp b/shibsp/attribute/filtering/impl/DummyAttributeFilter.cpp
deleted file mode 100644
index 3bb11f8c..00000000
--- a/shibsp/attribute/filtering/impl/DummyAttributeFilter.cpp
+++ /dev/null
@@ -1,62 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * DummyAttributeFilter.cpp
- *
- * Pathological AttributeFilter that rejects all attributes.
- */
-
-#include "internal.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/AttributeFilter.h"
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace std;
-
-namespace shibsp {
-
- class SHIBSP_DLLLOCAL DummyAttributeFilter : public AttributeFilter
- {
- public:
- DummyAttributeFilter(const DOMElement* e) {
- }
- virtual ~DummyAttributeFilter() {
- }
-
- Lockable* lock() {
- return this;
- }
- void unlock() {
- }
-
- void filterAttributes(const FilteringContext& context, vector<Attribute*>& attributes) const {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.Dummy").warn("filtering out all attributes");
- for_each(attributes.begin(), attributes.end(), xmltooling::cleanup<Attribute>());
- attributes.clear();
- }
- };
-
- AttributeFilter* SHIBSP_DLLLOCAL DummyAttributeFilterFactory(const DOMElement* const & e, bool)
- {
- return new DummyAttributeFilter(e);
- }
-};
diff --git a/shibsp/attribute/filtering/impl/MatchFunctor.cpp b/shibsp/attribute/filtering/impl/MatchFunctor.cpp
deleted file mode 100644
index 282efd80..00000000
--- a/shibsp/attribute/filtering/impl/MatchFunctor.cpp
+++ /dev/null
@@ -1,313 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * MatchFunctor.cpp
- *
- * A function that evaluates whether an expressed criteria is met by the current filter context.
- */
-
-#include "internal.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-#include "util/SPConstants.h"
-
-#include <xercesc/util/XMLUniDefs.hpp>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace std;
-
-#define DECL_FACTORY(name) \
- SHIBSP_DLLLOCAL PluginManager< MatchFunctor,xmltooling::QName,pair<const FilterPolicyContext*,const DOMElement*> >::Factory name##Factory
-
-#define DECL_PUBLIC_QNAME(name,lit) \
- xmltooling::QName shibsp::name##Type(shibspconstants::SHIB2ATTRIBUTEFILTER_NS, lit)
-
-#define DECL_BASIC_QNAME(name,lit) \
- SHIBSP_DLLLOCAL static xmltooling::QName Deprecated##name##Type(shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS, lit)
-
-#define DECL_SAML_QNAME(name,lit) \
- SHIBSP_DLLLOCAL static xmltooling::QName Deprecated##name##Type(shibspconstants::SHIB2ATTRIBUTEFILTER_MF_SAML_NS, lit)
-
-#define REGISTER_FACTORY(name) \
- mgr.registerFactory(name##Type, name##Factory); \
- mgr.registerFactory(Deprecated##name##Type, name##Factory)
-
-namespace shibsp {
- DECL_FACTORY(AnyMatchFunctor);
- DECL_FACTORY(AndMatchFunctor);
- DECL_FACTORY(OrMatchFunctor);
- DECL_FACTORY(NotMatchFunctor);
- DECL_FACTORY(AttributeIssuerString);
- DECL_FACTORY(AttributeRequesterString);
- DECL_FACTORY(AuthenticationMethodString);
- DECL_FACTORY(AttributeValueString);
- DECL_FACTORY(AttributeScopeString);
- DECL_FACTORY(AttributeIssuerRegex);
- DECL_FACTORY(AttributeRequesterRegex);
- DECL_FACTORY(AuthenticationMethodRegex);
- DECL_FACTORY(AttributeValueRegex);
- DECL_FACTORY(AttributeScopeRegex);
- DECL_FACTORY(NumberOfAttributeValues);
- DECL_FACTORY(AttributeIssuerInEntityGroup);
- DECL_FACTORY(AttributeRequesterInEntityGroup);
- DECL_FACTORY(AttributeIssuerEntityAttributeExactMatch);
- DECL_FACTORY(AttributeRequesterEntityAttributeExactMatch);
- DECL_FACTORY(AttributeIssuerEntityAttributeRegexMatch);
- DECL_FACTORY(AttributeRequesterEntityAttributeRegexMatch);
- DECL_FACTORY(AttributeIssuerNameIDFormat);
- DECL_FACTORY(AttributeRequesterNameIDFormat);
- DECL_FACTORY(AttributeIssuerEntityMatcher);
- DECL_FACTORY(AttributeRequesterEntityMatcher);
- DECL_FACTORY(AttributeScopeMatchesShibMDScope);
- DECL_FACTORY(AttributeValueMatchesShibMDScope);
- DECL_FACTORY(NameIDQualifierString);
- DECL_FACTORY(AttributeIssuerRegistrationAuthority);
- DECL_FACTORY(RegistrationAuthority);
-
-
- static const XMLCh ANY[] = UNICODE_LITERAL_3(A,N,Y);
- static const XMLCh AND[] = UNICODE_LITERAL_3(A,N,D);
- static const XMLCh OR[] = UNICODE_LITERAL_2(O,R);
- static const XMLCh NOT[] = UNICODE_LITERAL_3(N,O,T);
-
- static const XMLCh AttributeIssuerString[] = UNICODE_LITERAL_21(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,S,t,r,i,n,g);
- static const XMLCh Issuer[] = UNICODE_LITERAL_6(I,s,s,u,e,r);
-
- static const XMLCh AttributeRequesterString[] = UNICODE_LITERAL_24(A,t,t,r,i,b,u,t,e,R,e,q,u,e,s,t,e,r,S,t,r,i,n,g);
- static const XMLCh Requester[] = UNICODE_LITERAL_9(R,e,q,u,e,s,t,e,r);
-
- static const XMLCh AuthenticationMethodString[] = UNICODE_LITERAL_26(A,u,t,h,e,n,t,i,c,a,t,i,o,n,M,e,t,h,o,d,S,t,r,i,n,g);
- static const XMLCh AuthenticationMethod[] = UNICODE_LITERAL_20(A,u,t,h,e,n,t,i,c,a,t,i,o,n,M,e,t,h,o,d);
-
- static const XMLCh AttributeValueString[] = UNICODE_LITERAL_20(A,t,t,r,i,b,u,t,e,V,a,l,u,e,S,t,r,i,n,g);
- static const XMLCh Value[] = UNICODE_LITERAL_5(V,a,l,u,e);
-
- static const XMLCh AttributeScopeString[] = UNICODE_LITERAL_20(A,t,t,r,i,b,u,t,e,S,c,o,p,e,S,t,r,i,n,g);
- static const XMLCh Scope[] = UNICODE_LITERAL_5(S,c,o,p,e);
-
- static const XMLCh AttributeIssuerRegex[] = UNICODE_LITERAL_20(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,R,e,g,e,x);
- static const XMLCh IssuerRegex[] = UNICODE_LITERAL_11(I,s,s,u,e,r,R,e,g,e,x);
-
- static const XMLCh AttributeRequesterRegex[] = UNICODE_LITERAL_23(A,t,t,r,i,b,u,t,e,R,e,q,u,e,s,t,e,r,R,e,g,e,x);
- static const XMLCh RequesterRegex[] = UNICODE_LITERAL_14(R,e,q,u,e,s,t,e,r,R,e,g,e,x);
-
- static const XMLCh AuthenticationMethodRegex[] = UNICODE_LITERAL_25(A,u,t,h,e,n,t,i,c,a,t,i,o,n,M,e,t,h,o,d,R,e,g,e,x);
-
- static const XMLCh AttributeValueRegex[] = UNICODE_LITERAL_19(A,t,t,r,i,b,u,t,e,V,a,l,u,e,R,e,g,e,x);
- static const XMLCh ValueRegex[] = UNICODE_LITERAL_10(V,a,l,u,e,R,e,g,e,x);
-
- static const XMLCh AttributeScopeRegex[] = UNICODE_LITERAL_19(A,t,t,r,i,b,u,t,e,S,c,o,p,e,R,e,g,e,x);
- static const XMLCh ScopeRegex[] = UNICODE_LITERAL_10(S,c,o,p,e,R,e,g,e,x);
-
- static const XMLCh NumberOfAttributeValues[] = UNICODE_LITERAL_23(N,u,m,b,e,r,O,f,A,t,t,r,i,b,u,t,e,V,a,l,u,e,s);
-
- static const XMLCh AttributeIssuerEntityAttributeExactMatch[] = UNICODE_LITERAL_40(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,E,x,a,c,t,M,a,t,c,h);
- static const XMLCh IssuerEntityAttributeExactMatch[] = UNICODE_LITERAL_31(I,s,s,u,e,r,E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,E,x,a,c,t,M,a,t,c,h);
-
- static const XMLCh AttributeRequesterEntityAttributeExactMatch[] = UNICODE_LITERAL_43(A,t,t,r,i,b,u,t,e,R,e,q,u,e,s,t,e,r,E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,E,x,a,c,t,M,a,t,c,h);
- static const XMLCh EntityAttributeExactMatch[] = UNICODE_LITERAL_25(E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,E,x,a,c,t,M,a,t,c,h);
-
- static const XMLCh AttributeIssuerEntityAttributeRegexMatch[] = UNICODE_LITERAL_40(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,R,e,g,e,x,M,a,t,c,h);
- static const XMLCh IssuerEntityAttributeRegexMatch[] = UNICODE_LITERAL_31(I,s,s,u,e,r,E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,R,e,g,e,x,M,a,t,c,h);
-
- static const XMLCh AttributeRequesterEntityAttributeRegexMatch[] = UNICODE_LITERAL_43(A,t,t,r,i,b,u,t,e,R,e,q,u,e,s,t,e,r,E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,R,e,g,e,x,M,a,t,c,h);
- static const XMLCh EntityAttributeRegexMatch[] = UNICODE_LITERAL_25(E,n,t,i,t,y,A,t,t,r,i,b,u,t,e,R,e,g,e,x,M,a,t,c,h);
-
- static const XMLCh IssuerNameIDFormatExactMatch[] = UNICODE_LITERAL_28(I,s,s,u,e,r,N,a,m,e,I,D,F,o,r,m,a,t,E,x,a,c,t,M,a,t,c,h);
- static const XMLCh NameIDFormatExactMatch[] = UNICODE_LITERAL_22(N,a,m,e,I,D,F,o,r,m,a,t,E,x,a,c,t,M,a,t,c,h);
-
- static const XMLCh AttributeIssuerInEntityGroup[] = UNICODE_LITERAL_28(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,I,n,E,n,t,i,t,y,G,r,o,u,p);
- static const XMLCh IssuerInEntityGroup[] = UNICODE_LITERAL_19(I,s,s,u,e,r,I,n,E,n,t,i,t,y,G,r,o,u,p);
-
- static const XMLCh AttributeRequesterInEntityGroup[] = UNICODE_LITERAL_31(A,t,t,r,i,b,u,t,e,R,e,q,u,e,s,t,e,r,I,n,E,n,t,i,t,y,G,r,o,u,p);
- static const XMLCh InEntityGroup[] = UNICODE_LITERAL_13(I,n,E,n,t,i,t,y,G,r,o,u,p);
-
- static const XMLCh AttributeIssuerRegistrationAuthority[] = UNICODE_LITERAL_36(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,R,e,g,i,s,t,r,a,t,i,o,n,A,u,t,h,o,r,i,t,y);
- static const XMLCh IssuerRegistrationAuthority[] = UNICODE_LITERAL_27(I,s,s,u,e,r,R,e,g,i,s,t,r,a,t,i,o,n,A,u,t,h,o,r,i,t,y);
-
- static const XMLCh RegistrationAuthority[] = UNICODE_LITERAL_21(R,e,g,i,s,t,r,a,t,i,o,n,A,u,t,h,o,r,i,t,y);
-
- static const XMLCh AttributeScopeMatchesShibMDScope[] = UNICODE_LITERAL_32(A,t,t,r,i,b,u,t,e,S,c,o,p,e,M,a,t,c,h,e,s,S,h,i,b,M,D,S,c,o,p,e);
- static const XMLCh ScopeMatchesShibMDScope[] = UNICODE_LITERAL_23(S,c,o,p,e,M,a,t,c,h,e,s,S,h,i,b,M,D,S,c,o,p,e);
-
- static const XMLCh AttributeValueMatchesShibMDScope[] = UNICODE_LITERAL_32(A,t,t,r,i,b,u,t,e,V,a,l,u,e,M,a,t,c,h,e,s,S,h,i,b,M,D,S,c,o,p,e);
- static const XMLCh ValueMatchesShibMDScope[] = UNICODE_LITERAL_23(V,a,l,u,e,M,a,t,c,h,e,s,S,h,i,b,M,D,S,c,o,p,e);
-
- static const XMLCh NameIDQualifierString[] = UNICODE_LITERAL_21(N,a,m,e,I,D,Q,u,a,l,i,f,i,e,r,S,t,r,i,n,g);
- static const XMLCh AttributeIssuerEntityMatcher[] = UNICODE_LITERAL_28(A,t,t,r,i,b,u,t,e,I,s,s,u,e,r,E,n,t,i,t,y,M,a,t,c,h,e,r);
- static const XMLCh AttributeRequesterEntityMatcher[] = UNICODE_LITERAL_31(A,t,t,r,i,b,u,t,e,R,e,q,u,e,s,t,e,r,E,n,t,i,t,y,M,a,t,c,h,e,r);
-};
-
-DECL_PUBLIC_QNAME(AnyMatchFunctor, ANY);
-DECL_BASIC_QNAME(AnyMatchFunctor, ANY);
-
-DECL_PUBLIC_QNAME(AndMatchFunctor, AND);
-DECL_BASIC_QNAME(AndMatchFunctor, AND);
-
-DECL_PUBLIC_QNAME(OrMatchFunctor, OR);
-DECL_BASIC_QNAME(OrMatchFunctor, OR);
-
-DECL_PUBLIC_QNAME(NotMatchFunctor, NOT);
-DECL_BASIC_QNAME(NotMatchFunctor, NOT);
-
-DECL_PUBLIC_QNAME(AttributeIssuerString, Issuer);
-DECL_BASIC_QNAME(AttributeIssuerString, AttributeIssuerString);
-
-DECL_PUBLIC_QNAME(AttributeRequesterString, Requester);
-DECL_BASIC_QNAME(AttributeRequesterString, AttributeRequesterString);
-
-DECL_PUBLIC_QNAME(AuthenticationMethodString, AuthenticationMethod);
-DECL_BASIC_QNAME(AuthenticationMethodString, AuthenticationMethodString);
-
-DECL_PUBLIC_QNAME(AttributeValueString, Value);
-DECL_BASIC_QNAME(AttributeValueString, AttributeValueString);
-
-DECL_PUBLIC_QNAME(AttributeScopeString, Scope);
-DECL_BASIC_QNAME(AttributeScopeString, AttributeScopeString);
-
-DECL_PUBLIC_QNAME(AttributeIssuerRegex, IssuerRegex);
-DECL_BASIC_QNAME(AttributeIssuerRegex, AttributeIssuerRegex);
-
-DECL_PUBLIC_QNAME(AttributeRequesterRegex, RequesterRegex);
-DECL_BASIC_QNAME(AttributeRequesterRegex, AttributeRequesterRegex);
-
-DECL_PUBLIC_QNAME(AuthenticationMethodRegex, AuthenticationMethodRegex);
-DECL_BASIC_QNAME(AuthenticationMethodRegex, AuthenticationMethodRegex);
-
-DECL_PUBLIC_QNAME(AttributeValueRegex, ValueRegex);
-DECL_BASIC_QNAME(AttributeValueRegex, AttributeValueRegex);
-
-DECL_PUBLIC_QNAME(AttributeScopeRegex, ScopeRegex);
-DECL_BASIC_QNAME(AttributeScopeRegex, AttributeScopeRegex);
-
-DECL_PUBLIC_QNAME(NumberOfAttributeValues, NumberOfAttributeValues);
-DECL_BASIC_QNAME(NumberOfAttributeValues, NumberOfAttributeValues);
-
-DECL_PUBLIC_QNAME(AttributeIssuerEntityAttributeExactMatch, IssuerEntityAttributeExactMatch);
-DECL_SAML_QNAME(AttributeIssuerEntityAttributeExactMatch, AttributeIssuerEntityAttributeExactMatch);
-
-DECL_PUBLIC_QNAME(AttributeRequesterEntityAttributeExactMatch, EntityAttributeExactMatch);
-DECL_SAML_QNAME(AttributeRequesterEntityAttributeExactMatch, AttributeRequesterEntityAttributeExactMatch);
-DECL_SAML_QNAME(EntityAttributeExactMatch, EntityAttributeExactMatch);
-
-DECL_PUBLIC_QNAME(AttributeIssuerEntityAttributeRegexMatch, IssuerEntityAttributeRegexMatch);
-DECL_SAML_QNAME(AttributeIssuerEntityAttributeRegexMatch, AttributeIssuerEntityAttributeRegexMatch);
-
-DECL_PUBLIC_QNAME(AttributeRequesterEntityAttributeRegexMatch, EntityAttributeRegexMatch);
-DECL_SAML_QNAME(AttributeRequesterEntityAttributeRegexMatch, AttributeRequesterEntityAttributeRegexMatch);
-DECL_SAML_QNAME(EntityAttributeRegexMatch, EntityAttributeRegexMatch);
-
-DECL_PUBLIC_QNAME(AttributeIssuerNameIDFormat, IssuerNameIDFormatExactMatch);
-DECL_PUBLIC_QNAME(AttributeRequesterNameIDFormat, NameIDFormatExactMatch);
-
-DECL_PUBLIC_QNAME(AttributeIssuerInEntityGroup, IssuerInEntityGroup);
-DECL_SAML_QNAME(AttributeIssuerInEntityGroup, AttributeIssuerInEntityGroup);
-
-DECL_PUBLIC_QNAME(AttributeRequesterInEntityGroup, InEntityGroup);
-DECL_SAML_QNAME(AttributeRequesterInEntityGroup, AttributeRequesterInEntityGroup);
-DECL_SAML_QNAME(InEntityGroup, InEntityGroup);
-
-DECL_PUBLIC_QNAME(AttributeIssuerRegistrationAuthority, IssuerRegistrationAuthority);
-DECL_SAML_QNAME(AttributeIssuerRegistrationAuthority, AttributeIssuerRegistrationAuthority);
-
-DECL_PUBLIC_QNAME(RegistrationAuthority, RegistrationAuthority);
-DECL_SAML_QNAME(RegistrationAuthority, RegistrationAuthority);
-
-DECL_PUBLIC_QNAME(AttributeScopeMatchesShibMDScope, ScopeMatchesShibMDScope);
-DECL_SAML_QNAME(AttributeScopeMatchesShibMDScope, AttributeScopeMatchesShibMDScope);
-
-DECL_PUBLIC_QNAME(AttributeValueMatchesShibMDScope, ValueMatchesShibMDScope);
-DECL_SAML_QNAME(AttributeValueMatchesShibMDScope, AttributeValueMatchesShibMDScope);
-
-DECL_PUBLIC_QNAME(NameIDQualifierString, NameIDQualifierString);
-DECL_SAML_QNAME(NameIDQualifierString, NameIDQualifierString);
-
-DECL_PUBLIC_QNAME(AttributeIssuerEntityMatcher, AttributeIssuerEntityMatcher);
-DECL_SAML_QNAME(AttributeIssuerEntityMatcher, AttributeIssuerEntityMatcher);
-
-DECL_PUBLIC_QNAME(AttributeRequesterEntityMatcher, AttributeRequesterEntityMatcher);
-DECL_SAML_QNAME(AttributeRequesterEntityMatcher, AttributeRequesterEntityMatcher);
-
-void SHIBSP_API shibsp::registerMatchFunctors()
-{
- PluginManager< MatchFunctor,xmltooling::QName,pair<const FilterPolicyContext*,const DOMElement*> >& mgr =
- SPConfig::getConfig().MatchFunctorManager;
-
- REGISTER_FACTORY(AnyMatchFunctor);
- REGISTER_FACTORY(AndMatchFunctor);
- REGISTER_FACTORY(OrMatchFunctor);
- REGISTER_FACTORY(NotMatchFunctor);
- REGISTER_FACTORY(AttributeIssuerString);
- REGISTER_FACTORY(AttributeRequesterString);
- REGISTER_FACTORY(AuthenticationMethodString);
- REGISTER_FACTORY(AttributeValueString);
- REGISTER_FACTORY(AttributeScopeString);
- REGISTER_FACTORY(AttributeIssuerRegex);
- REGISTER_FACTORY(AttributeRequesterRegex);
- REGISTER_FACTORY(AuthenticationMethodRegex);
- REGISTER_FACTORY(AttributeValueRegex);
- REGISTER_FACTORY(AttributeScopeRegex);
- REGISTER_FACTORY(NumberOfAttributeValues);
- REGISTER_FACTORY(AttributeIssuerEntityAttributeExactMatch);
- REGISTER_FACTORY(AttributeRequesterEntityAttributeExactMatch);
- REGISTER_FACTORY(AttributeIssuerEntityAttributeRegexMatch);
- REGISTER_FACTORY(AttributeRequesterEntityAttributeRegexMatch);
- REGISTER_FACTORY(AttributeIssuerInEntityGroup);
- REGISTER_FACTORY(AttributeRequesterInEntityGroup);
- REGISTER_FACTORY(AttributeIssuerRegistrationAuthority);
- REGISTER_FACTORY(RegistrationAuthority);
- REGISTER_FACTORY(AttributeScopeMatchesShibMDScope);
- REGISTER_FACTORY(AttributeValueMatchesShibMDScope);
- REGISTER_FACTORY(NameIDQualifierString);
- REGISTER_FACTORY(AttributeIssuerEntityMatcher);
- REGISTER_FACTORY(AttributeRequesterEntityMatcher);
-
- // Explicit because there are no deprecated versions to register.
- mgr.registerFactory(AttributeIssuerNameIDFormatType, AttributeIssuerNameIDFormatFactory);
- mgr.registerFactory(AttributeRequesterNameIDFormatType, AttributeRequesterNameIDFormatFactory);
-
- // Extra aliases for some deprecated types.
- mgr.registerFactory(DeprecatedEntityAttributeExactMatchType, AttributeRequesterEntityAttributeExactMatchFactory);
- mgr.registerFactory(DeprecatedEntityAttributeRegexMatchType, AttributeRequesterEntityAttributeRegexMatchFactory);
- mgr.registerFactory(DeprecatedInEntityGroupType, AttributeRequesterInEntityGroupFactory);
-}
-
-MatchFunctor::MatchFunctor()
-{
-}
-
-MatchFunctor::~MatchFunctor()
-{
-}
-
-FilterPolicyContext::FilterPolicyContext(multimap<string,MatchFunctor*>& functors) : m_functors(functors)
-{
-}
-
-FilterPolicyContext::~FilterPolicyContext()
-{
-}
-
-multimap<string,MatchFunctor*>& FilterPolicyContext::getMatchFunctors() const
-{
- return m_functors;
-}
diff --git a/shibsp/attribute/filtering/impl/NameIDFormatFunctor.cpp b/shibsp/attribute/filtering/impl/NameIDFormatFunctor.cpp
deleted file mode 100644
index 0cb7110e..00000000
--- a/shibsp/attribute/filtering/impl/NameIDFormatFunctor.cpp
+++ /dev/null
@@ -1,126 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeIssuerRegistrationAuthority.cpp
- *
- * A match function that evaluates to true if the attribute issuer's metadata includes
- * a matching RegistrationAuthority extension.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <boost/iterator/indirect_iterator.hpp>
-#include <saml/saml2/metadata/Metadata.h>
-
-
-using namespace opensaml::saml2md;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
- static const XMLCh nameIdFormat[] = UNICODE_LITERAL_12(n,a,m,e,I,d,F,o,r,m,a,t);
-
- /**
- * A match function base class that evaluates to true if the supplied metadata includes
- * a matching NameIDFormat.
- */
- class SHIBSP_DLLLOCAL AbstractNameIDFormatFunctor : public MatchFunctor
- {
- const XMLCh* m_format;
- public:
- AbstractNameIDFormatFunctor(const DOMElement* e) : m_format(e ? e->getAttributeNS(nullptr, nameIdFormat) : nullptr) {
- if (!m_format || !*m_format)
- throw ConfigurationException("NameIDFormat MatchFunctor requires non-empty nameIdFormat attribute.");
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- const vector<NameIDFormat*>* formats = getFormats(filterContext);
- if (!formats)
- return false;
-
- for (indirect_iterator<vector<NameIDFormat*>::const_iterator> i = make_indirect_iterator(formats->begin());
- i != make_indirect_iterator(formats->end()); ++i) {
- if (XMLString::equals(m_format, i->getFormat()))
- return true;
- }
-
- return false;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
-
- protected:
- virtual const vector<NameIDFormat*>* getFormats(const FilteringContext& filterContext) const = 0;
- };
-
- class SHIBSP_DLLLOCAL AttributeIssuerNameIDFormatFunctor : public AbstractNameIDFormatFunctor
- {
- public:
- AttributeIssuerNameIDFormatFunctor(const DOMElement* e) : AbstractNameIDFormatFunctor(e) {}
-
- protected:
- const vector<NameIDFormat*>* getFormats(const FilteringContext& filterContext) const {
- if (filterContext.getAttributeIssuerMetadata()) {
- const IDPSSODescriptor* idp = dynamic_cast<const IDPSSODescriptor*>(filterContext.getAttributeIssuerMetadata());
- if (idp)
- return &(idp->getNameIDFormats());
- const AttributeAuthorityDescriptor* aa =
- dynamic_cast<const AttributeAuthorityDescriptor*>(filterContext.getAttributeIssuerMetadata());
- if (aa)
- return &(aa->getNameIDFormats());
- }
- return nullptr;
- }
- };
-
- class SHIBSP_DLLLOCAL AttributeRequesterNameIDFormatFunctor : public AbstractNameIDFormatFunctor
- {
- public:
- AttributeRequesterNameIDFormatFunctor(const DOMElement* e) : AbstractNameIDFormatFunctor(e) {}
-
- protected:
- const vector<NameIDFormat*>* getFormats(const FilteringContext& filterContext) const {
- const SPSSODescriptor* sp = dynamic_cast<const SPSSODescriptor*>(filterContext.getAttributeRequesterMetadata());
- if (sp)
- return &(sp->getNameIDFormats());
- return nullptr;
- }
- };
-
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeIssuerNameIDFormatFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeIssuerNameIDFormatFunctor(p.second);
- }
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeRequesterNameIDFormatFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeRequesterNameIDFormatFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/NameIDQualifierStringFunctor.cpp b/shibsp/attribute/filtering/impl/NameIDQualifierStringFunctor.cpp
deleted file mode 100644
index 8a49d11c..00000000
--- a/shibsp/attribute/filtering/impl/NameIDQualifierStringFunctor.cpp
+++ /dev/null
@@ -1,173 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * NameIDQualifierStringFunctor.cpp
- *
- * A match function that ensures that a NameID-valued attribute's qualifier(s)
- * match particular values.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/NameIDAttribute.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <saml/saml2/core/Assertions.h>
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace shibsp;
-using namespace xmltooling::logging;
-using namespace xmltooling;
-using namespace std;
-using opensaml::saml2::NameID;
-
-namespace shibsp {
-
- static const XMLCh attributeID[] = UNICODE_LITERAL_11(a,t,t,r,i,b,u,t,e,I,D);
-
- /**
- * A match function that ensures that a NameID-valued attribute's qualifier(s)
- * match particular values.
- */
- class SHIBSP_DLLLOCAL NameIDQualifierStringFunctor : public MatchFunctor
- {
- string m_attributeID,m_matchNameQualifier,m_matchSPNameQualifier;
-
- bool hasValue(const FilteringContext& filterContext) const;
- bool matches(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const;
-
- public:
- NameIDQualifierStringFunctor(const DOMElement* e)
- : m_attributeID(XMLHelper::getAttrString(e, nullptr, attributeID)),
- m_matchNameQualifier(XMLHelper::getAttrString(e, nullptr, NameID::NAMEQUALIFIER_ATTRIB_NAME)),
- m_matchSPNameQualifier(XMLHelper::getAttrString(e, nullptr, NameID::SPNAMEQUALIFIER_ATTRIB_NAME)) {
- }
-
- virtual ~NameIDQualifierStringFunctor() {
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (m_attributeID.empty())
- throw AttributeFilteringException("No attributeID specified.");
- return hasValue(filterContext);
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- if (m_attributeID.empty() || m_attributeID == attribute.getId())
- return matches(filterContext, attribute, index);
- return hasValue(filterContext);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL NameIDQualifierStringFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new NameIDQualifierStringFunctor(p.second);
- }
-
-};
-
-bool NameIDQualifierStringFunctor::hasValue(const FilteringContext& filterContext) const
-{
- size_t count;
- pair<multimap<string,Attribute*>::const_iterator,multimap<string,Attribute*>::const_iterator> attrs =
- filterContext.getAttributes().equal_range(m_attributeID);
- for (; attrs.first != attrs.second; ++attrs.first) {
- count = attrs.first->second->valueCount();
- for (size_t index = 0; index < count; ++index) {
- if (matches(filterContext, *(attrs.first->second), index))
- return true;
- }
- }
- return false;
-}
-
-bool NameIDQualifierStringFunctor::matches(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const
-{
- const NameIDAttribute* nameattr = dynamic_cast<const NameIDAttribute*>(&attribute);
- if (!nameattr) {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter").warn(
- "NameIDQualifierString MatchFunctor applied to non-NameID-valued attribute (%s)", attribute.getId()
- );
- return false;
- }
-
- const NameIDAttribute::Value& val = nameattr->getValues()[index];
- if (!val.m_NameQualifier.empty()) {
- if (m_matchNameQualifier.empty()) {
- auto_ptr_char issuer(filterContext.getAttributeIssuer());
- if (issuer.get() && *issuer.get()) {
- if (val.m_NameQualifier != issuer.get()) {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter").warn(
- "NameIDQualifierString MatchFunctor rejecting NameQualifier (%s), should be (%s)",
- val.m_NameQualifier.c_str(), issuer.get()
- );
- return false;
- }
- }
- else {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter").warn(
- "NameIDQualifierString MatchFunctor rejecting NameQualifier (%s), attribute issuer unknown",
- val.m_NameQualifier.c_str()
- );
- return false;
- }
- }
- else if (m_matchNameQualifier != val.m_NameQualifier) {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter").warn(
- "NameIDQualifierString MatchFunctor rejecting NameQualifier (%s), should be (%s)",
- val.m_NameQualifier.c_str(), m_matchNameQualifier.c_str()
- );
- return false;
- }
- }
- if (!val.m_SPNameQualifier.empty()) {
- if (m_matchSPNameQualifier.empty()) {
- auto_ptr_char req(filterContext.getAttributeRequester());
- if (req.get() && *req.get()) {
- if (val.m_SPNameQualifier != req.get()) {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter").warn(
- "NameIDQualifierString MatchFunctor rejecting SPNameQualifier (%s), should be (%s)",
- val.m_SPNameQualifier.c_str(), req.get()
- );
- return false;
- }
- }
- else {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter").warn(
- "NameIDQualifierString MatchFunctor rejecting SPNameQualifier (%s), attribute requester unknown",
- val.m_SPNameQualifier.c_str()
- );
- return false;
- }
- }
- else if (m_matchSPNameQualifier != val.m_SPNameQualifier) {
- Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter").warn(
- "NameIDQualifierString MatchFunctor rejecting SPNameQualifier (%s), should be (%s)",
- val.m_SPNameQualifier.c_str(), m_matchSPNameQualifier.c_str()
- );
- return false;
- }
- }
-
- return true;
-}
diff --git a/shibsp/attribute/filtering/impl/NotMatchFunctor.cpp b/shibsp/attribute/filtering/impl/NotMatchFunctor.cpp
deleted file mode 100644
index 82351fae..00000000
--- a/shibsp/attribute/filtering/impl/NotMatchFunctor.cpp
+++ /dev/null
@@ -1,127 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * NotMatchFunctor.cpp
- *
- * A MatchFunctor that negates the result of a contained functor.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-#include "util/SPConstants.h"
-
-#include <xercesc/util/XMLUniDefs.hpp>
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
- /**
- * A MatchFunctor that negates the result of a contained functor.
- */
- class SHIBSP_DLLLOCAL NotMatchFunctor : public MatchFunctor
- {
- public:
- NotMatchFunctor(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport=true);
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- if (m_functor)
- return !(m_functor->evaluatePolicyRequirement(filterContext));
- return false;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- if (m_functor)
- return !(m_functor->evaluatePermitValue(filterContext, attribute, index));
- return false;
- }
-
- private:
- MatchFunctor* buildFunctor(const DOMElement* e, const FilterPolicyContext* functorMap, bool deprecationSupport);
-
- const MatchFunctor* m_functor;
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL NotMatchFunctorFactory(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport)
- {
- return new NotMatchFunctor(p, deprecationSupport);
- }
-
- static XMLCh _id[] = UNICODE_LITERAL_2(i,d);
- static XMLCh _ref[] = UNICODE_LITERAL_3(r,e,f);
- static XMLCh Rule[] = UNICODE_LITERAL_4(R,u,l,e);
- static XMLCh RuleReference[] = UNICODE_LITERAL_13(R,u,l,e,R,e,f,e,r,e,n,c,e);
-};
-
-NotMatchFunctor::NotMatchFunctor(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport) : m_functor(nullptr)
-{
- const DOMElement* e = XMLHelper::getFirstChildElement(p.second);
- if (e) {
-
- if (XMLString::equals(e->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS)) {
- auto_ptr_char ns(e->getNamespaceURI());
- SPConfig::getConfig().deprecation().warn("legacy Attribute Filter namespace '%s'", ns.get());
- }
-
- if (XMLString::equals(e->getLocalName(), Rule)) {
- m_functor = buildFunctor(e, p.first, deprecationSupport);
- }
- else if (XMLString::equals(e->getLocalName(), RuleReference)) {
- string ref = XMLHelper::getAttrString(e, nullptr, _ref);
- if (!ref.empty()) {
- multimap<string,MatchFunctor*>::const_iterator rule = p.first->getMatchFunctors().find(ref);
- m_functor = (rule!=p.first->getMatchFunctors().end()) ? rule->second : nullptr;
- }
- }
- }
-
- if (!m_functor)
- throw ConfigurationException("No child Rule installed into NotMatchFunctor.");
-}
-
-MatchFunctor* NotMatchFunctor::buildFunctor(const DOMElement* e, const FilterPolicyContext* functorMap, bool deprecationSupport)
-{
- // We'll track and map IDs just for consistency, but don't require them or worry about dups.
- string id = XMLHelper::getAttrString(e, nullptr, _id);
- if (!id.empty() && functorMap->getMatchFunctors().count(id))
- id.clear();
-
- scoped_ptr<xmltooling::QName> type(XMLHelper::getXSIType(e));
- if (!type)
- throw ConfigurationException("Child Rule found with no xsi:type.");
-
- if (XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS) ||
- XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_SAML_NS)) {
-
- auto_ptr_char ns(type->getNamespaceURI());
- SPConfig::getConfig().deprecation().warn("legacy Attribute Filter namespace '%s'", ns.get());
- }
-
- auto_ptr<MatchFunctor> func(SPConfig::getConfig().MatchFunctorManager.newPlugin(*type, make_pair(functorMap,e), deprecationSupport));
- functorMap->getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func.get()));
- return func.release();
-}
diff --git a/shibsp/attribute/filtering/impl/NumberOfAttributeValuesFunctor.cpp b/shibsp/attribute/filtering/impl/NumberOfAttributeValuesFunctor.cpp
deleted file mode 100644
index 7811303d..00000000
--- a/shibsp/attribute/filtering/impl/NumberOfAttributeValuesFunctor.cpp
+++ /dev/null
@@ -1,93 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * NumberOfAttributeValuesFunctor.cpp
- *
- * A match function that evaluates to true if the given attribute has as a number
- * of values that falls between the minimum and maximum.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace shibsp;
-using namespace std;
-using xmltooling::XMLHelper;
-
-namespace shibsp {
-
- static const XMLCh attributeID[] = UNICODE_LITERAL_11(a,t,t,r,i,b,u,t,e,I,D);
- static const XMLCh maximum[] = UNICODE_LITERAL_7(m,a,x,i,m,u,m);
- static const XMLCh minimum[] = UNICODE_LITERAL_7(m,i,n,i,m,u,m);
-
- /**
- * A match function that evaluates to true if the given attribute has as a number
- * of values that falls between the minimum and maximum.
- */
- class SHIBSP_DLLLOCAL NumberOfAttributeValuesFunctor : public MatchFunctor
- {
- unsigned int m_min,m_max;
- string m_attributeID;
-
- size_t count(const FilteringContext& filterContext) const;
-
- public:
- NumberOfAttributeValuesFunctor(const DOMElement* e)
- : m_min(XMLHelper::getAttrInt(e, 0, minimum)),
- m_max(XMLHelper::getAttrInt(e, INT_MAX, maximum)),
- m_attributeID(XMLHelper::getAttrString(e, nullptr, attributeID)) {
- if (m_attributeID.empty())
- throw ConfigurationException("No attributeID specified.");
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- size_t c = count(filterContext);
- return (m_min <= c && c <= m_max);
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- size_t c = count(filterContext);
- return (m_min <= c && c <= m_max);
- }
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL NumberOfAttributeValuesFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new NumberOfAttributeValuesFunctor(p.second);
- }
-
-};
-
-size_t NumberOfAttributeValuesFunctor::count(const FilteringContext& filterContext) const
-{
- size_t count = 0;
- pair<multimap<string,Attribute*>::const_iterator,multimap<string,Attribute*>::const_iterator> attrs =
- filterContext.getAttributes().equal_range(m_attributeID);
- for (; attrs.first != attrs.second; ++attrs.first)
- count += attrs.first->second->valueCount();
- return count;
-}
diff --git a/shibsp/attribute/filtering/impl/OrMatchFunctor.cpp b/shibsp/attribute/filtering/impl/OrMatchFunctor.cpp
deleted file mode 100644
index c6de23aa..00000000
--- a/shibsp/attribute/filtering/impl/OrMatchFunctor.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * OrMatchFunctor.cpp
- *
- * A MatchFunctor that logical ORs the results of contained functors.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-#include "util/SPConstants.h"
-
-#define BOOST_BIND_GLOBAL_PLACEHOLDERS
-#include <boost/bind.hpp>
-#include <xercesc/util/XMLUniDefs.hpp>
-#include <xmltooling/util/XMLHelper.h>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
- /**
- * A MatchFunctor that logical ORs the results of contained functors.
- */
- class SHIBSP_DLLLOCAL OrMatchFunctor : public MatchFunctor
- {
- public:
- OrMatchFunctor(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport=true);
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- vector<const MatchFunctor*>::const_iterator i = find_if(
- m_functors.begin(), m_functors.end(),
- boost::bind(&MatchFunctor::evaluatePolicyRequirement, _1, boost::cref(filterContext)) == true
- );
- return (i != m_functors.end());
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- vector<const MatchFunctor*>::const_iterator i = find_if(
- m_functors.begin(), m_functors.end(),
- boost::bind(&MatchFunctor::evaluatePermitValue, _1, boost::cref(filterContext), boost::cref(attribute), index) == true
- );
- return (i != m_functors.end());
- }
-
- private:
- MatchFunctor* buildFunctor(const DOMElement* e, const FilterPolicyContext* functorMap, bool deprecationSupport);
-
- vector<const MatchFunctor*> m_functors;
- };
-
- MatchFunctor* SHIBSP_DLLLOCAL OrMatchFunctorFactory(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport)
- {
- return new OrMatchFunctor(p, deprecationSupport);
- }
-
- static XMLCh _id[] = UNICODE_LITERAL_2(i,d);
- static XMLCh _ref[] = UNICODE_LITERAL_3(r,e,f);
- static XMLCh Rule[] = UNICODE_LITERAL_4(R,u,l,e);
- static XMLCh RuleReference[] = UNICODE_LITERAL_13(R,u,l,e,R,e,f,e,r,e,n,c,e);
-};
-
-OrMatchFunctor::OrMatchFunctor(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool deprecationSupport)
-{
- MatchFunctor* func;
- const DOMElement* e = XMLHelper::getFirstChildElement(p.second);
- while (e) {
- func = nullptr;
-
- if (XMLString::equals(e->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS)) {
- auto_ptr_char ns(e->getNamespaceURI());
- SPConfig::getConfig().deprecation().warn("legacy Attribute Filter namespace '%s'", ns.get());
- }
-
- if (XMLString::equals(e->getLocalName(), Rule)) {
- func = buildFunctor(e, p.first, deprecationSupport);
- }
- else if (XMLString::equals(e->getLocalName(), RuleReference)) {
- string ref = XMLHelper::getAttrString(e, nullptr, _ref);
- if (!ref.empty()) {
- multimap<string,MatchFunctor*>::const_iterator rule = p.first->getMatchFunctors().find(ref);
- func = (rule!=p.first->getMatchFunctors().end()) ? rule->second : nullptr;
- }
- }
-
- if (func)
- m_functors.push_back(func);
-
- e = XMLHelper::getNextSiblingElement(e);
- }
-}
-
-MatchFunctor* OrMatchFunctor::buildFunctor(const DOMElement* e, const FilterPolicyContext* functorMap, bool deprecationSupport)
-{
- // We'll track and map IDs just for consistency, but don't require them or worry about dups.
- string id = XMLHelper::getAttrString(e, nullptr, _id);
- if (!id.empty() && functorMap->getMatchFunctors().count(id))
- id.clear();
-
- scoped_ptr<xmltooling::QName> type(XMLHelper::getXSIType(e));
- if (!type)
- throw ConfigurationException("Child Rule found with no xsi:type.");
-
- if (XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS) ||
- XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_SAML_NS)) {
-
- auto_ptr_char ns(type->getNamespaceURI());
- SPConfig::getConfig().deprecation().warn("legacy Attribute Filter namespace '%s'", ns.get());
- }
-
- auto_ptr<MatchFunctor> func(SPConfig::getConfig().MatchFunctorManager.newPlugin(*type, make_pair(functorMap,e), deprecationSupport));
- functorMap->getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func.get()));
- return func.release();
-}
diff --git a/shibsp/attribute/filtering/impl/RegistrationAuthorityFunctor.cpp b/shibsp/attribute/filtering/impl/RegistrationAuthorityFunctor.cpp
deleted file mode 100644
index e860e09c..00000000
--- a/shibsp/attribute/filtering/impl/RegistrationAuthorityFunctor.cpp
+++ /dev/null
@@ -1,149 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * AttributeIssuerRegistrationAuthority.cpp
- *
- * A match function that evaluates to true if the attribute issuer's metadata includes
- * a matching RegistrationAuthority extension.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-
-#include <set>
-#include <boost/algorithm/string.hpp>
-#include <boost/lambda/bind.hpp>
-#include <boost/lambda/casts.hpp>
-#include <boost/lambda/lambda.hpp>
-#include <xmltooling/util/XMLHelper.h>
-#include <saml/saml2/metadata/Metadata.h>
-
-using namespace opensaml::saml2md;
-using namespace xmltooling;
-using namespace boost::lambda;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
- static const XMLCh registrars[] = UNICODE_LITERAL_10(r,e,g,i,s,t,r,a,r,s);
- static const XMLCh matchIfMetadataSilent[] = UNICODE_LITERAL_21(m,a,t,c,h,I,f,M,e,t,a,d,a,t,a,S,i,l,e,n,t);
-
- /**
- * A match function base class that evaluates to true if the supplied metadata includes
- * a matching RegistrationAuthority extension.
- */
- class SHIBSP_DLLLOCAL AbstractRegistrationAuthorityFunctor : public MatchFunctor
- {
- bool m_matchIfMetadataSilent;
- set<string> m_registrars;
- public:
- AbstractRegistrationAuthorityFunctor(const DOMElement* e)
- : m_matchIfMetadataSilent(XMLHelper::getAttrBool(e, false, matchIfMetadataSilent)) {
- const XMLCh* prop = e ? e->getAttributeNS(nullptr,registrars) : nullptr;
- if (!prop || !*prop)
- throw ConfigurationException("AttributeIssuerRegistrationAuthorityFunctor MatchFunctor requires non-empty registrars attribute.");
- auto_ptr_char regs(prop);
- string dup(regs.get());
- split(m_registrars, dup, is_space(), algorithm::token_compress_on);
- if (m_registrars.empty())
- throw ConfigurationException("AttributeIssuerRegistrationAuthorityFunctor MatchFunctor requires non-empty registrars attribute.");
- }
-
- bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
- const RoleDescriptor* issuer = getMetadata(filterContext);
- if (!issuer)
- return m_matchIfMetadataSilent;
-
- const EntityDescriptor* entity = dynamic_cast<const EntityDescriptor*>(issuer->getParent());
- const RegistrationInfo* info = getRegistrationInfo(entity->getExtensions());
- if (!info) {
- const EntitiesDescriptor* group = dynamic_cast<const EntitiesDescriptor*>(entity->getParent());
- while (!info && group) {
- info = getRegistrationInfo(group->getExtensions());
- group = dynamic_cast<const EntitiesDescriptor*>(group->getParent());
- }
- }
-
- if (info) {
- auto_ptr_char authority(info->getRegistrationAuthority());
- return authority.get() && m_registrars.find(authority.get()) != m_registrars.end();
- }
- return m_matchIfMetadataSilent;
- }
-
- bool evaluatePermitValue(const FilteringContext& filterContext, const Attribute& attribute, size_t index) const {
- return evaluatePolicyRequirement(filterContext);
- }
-
- protected:
- virtual const RoleDescriptor* getMetadata(const FilteringContext& filterContext) const = 0;
-
- private:
- const RegistrationInfo* getRegistrationInfo(const Extensions* extensions) const {
- if (extensions) {
- const vector<XMLObject*>& exts = extensions->getUnknownXMLObjects();
- const XMLObject* xo = find_if(exts, ll_dynamic_cast<RegistrationInfo*>(_1) != ((RegistrationInfo*)nullptr));
- if (xo) {
- return dynamic_cast<const RegistrationInfo*>(xo);
- }
- }
- return nullptr;
- }
- };
-
- class SHIBSP_DLLLOCAL AttributeIssuerRegistrationAuthorityFunctor : public AbstractRegistrationAuthorityFunctor
- {
- public:
- AttributeIssuerRegistrationAuthorityFunctor(const DOMElement* e) : AbstractRegistrationAuthorityFunctor(e) {}
-
- protected:
- const RoleDescriptor* getMetadata(const FilteringContext& filterContext) const {
- return filterContext.getAttributeIssuerMetadata();
- }
- };
-
- class SHIBSP_DLLLOCAL AttributeRequesterRegistrationAuthorityFunctor : public AbstractRegistrationAuthorityFunctor
- {
- public:
- AttributeRequesterRegistrationAuthorityFunctor(const DOMElement* e) : AbstractRegistrationAuthorityFunctor(e) {}
-
- protected:
- const RoleDescriptor* getMetadata(const FilteringContext& filterContext) const {
- return filterContext.getAttributeRequesterMetadata();
- }
- };
-
-
- MatchFunctor* SHIBSP_DLLLOCAL AttributeIssuerRegistrationAuthorityFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeIssuerRegistrationAuthorityFunctor(p.second);
- }
-
- MatchFunctor* SHIBSP_DLLLOCAL RegistrationAuthorityFactory(const std::pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
- {
- return new AttributeRequesterRegistrationAuthorityFunctor(p.second);
- }
-
-};
diff --git a/shibsp/attribute/filtering/impl/XMLAttributeFilter.cpp b/shibsp/attribute/filtering/impl/XMLAttributeFilter.cpp
deleted file mode 100644
index 887e77a2..00000000
--- a/shibsp/attribute/filtering/impl/XMLAttributeFilter.cpp
+++ /dev/null
@@ -1,513 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * XMLAttributeFilter.cpp
- *
- * AttributeFilter based on an XML policy language.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "Application.h"
-#include "ServiceProvider.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/AttributeFilter.h"
-#include "attribute/filtering/FilteringContext.h"
-#include "attribute/filtering/FilterPolicyContext.h"
-#include "attribute/filtering/MatchFunctor.h"
-#include "util/SPConstants.h"
-
-#include <boost/iterator/indirect_iterator.hpp>
-#include <boost/tuple/tuple.hpp>
-#include <xmltooling/util/NDC.h>
-#include <xmltooling/util/ReloadableXMLFile.h>
-#include <xmltooling/util/Threads.h>
-#include <xmltooling/util/XMLHelper.h>
-#include <xercesc/util/XMLUniDefs.hpp>
-
-using shibspconstants::SHIB2ATTRIBUTEFILTER_NS;
-using namespace shibsp;
-using namespace opensaml::saml2md;
-using namespace opensaml;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
-#if defined (_MSC_VER)
- #pragma warning( push )
- #pragma warning( disable : 4250 )
-#endif
-
- // Each Policy has a functor for determining applicability and a map of
- // attribute IDs to Accept/Deny functor pairs (which can include nullptrs).
- struct SHIBSP_DLLLOCAL Policy
- {
- Policy() : m_applies(nullptr) {}
- const MatchFunctor* m_applies;
- typedef multimap< string,pair<const MatchFunctor*,const MatchFunctor*> > rules_t;
- rules_t m_rules;
- };
-
- class SHIBSP_DLLLOCAL XMLFilterImpl
- {
- public:
- XMLFilterImpl(const DOMElement* e, Category& log, bool deprecationSupport);
- ~XMLFilterImpl() {
- if (m_document)
- m_document->release();
- for_each(m_policyReqRules.begin(), m_policyReqRules.end(), cleanup_pair<string,MatchFunctor>());
- for_each(m_permitValRules.begin(), m_permitValRules.end(), cleanup_pair<string,MatchFunctor>());
- for_each(m_denyValRules.begin(), m_denyValRules.end(), cleanup_pair<string,MatchFunctor>());
- }
-
- void setDocument(DOMDocument* doc) {
- m_document = doc;
- }
-
- void filterAttributes(const FilteringContext& context, vector<Attribute*>& attributes) const;
-
- private:
- MatchFunctor* buildFunctor(
- const DOMElement* e, const FilterPolicyContext& functorMap, const char* logname, bool standalone, bool deprecationSupport
- );
- boost::tuple<string,const MatchFunctor*,const MatchFunctor*> buildAttributeRule(
- const DOMElement* e, const FilterPolicyContext& permMap, const FilterPolicyContext& denyMap, bool standalone, bool deprecationSupport
- );
-
- Category& m_log;
- DOMDocument* m_document;
- vector<Policy> m_policies;
- map< string,boost::tuple<string,const MatchFunctor*,const MatchFunctor*> > m_attrRules;
- multimap<string,MatchFunctor*> m_policyReqRules;
- multimap<string,MatchFunctor*> m_permitValRules;
- multimap<string,MatchFunctor*> m_denyValRules;
- };
-
- class SHIBSP_DLLLOCAL XMLFilter : public AttributeFilter, public ReloadableXMLFile
- {
- public:
- XMLFilter(const DOMElement* e, bool deprecationSupport=true)
- : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter"), true, deprecationSupport), m_deprecationSupport(deprecationSupport) {
- background_load();
- }
- ~XMLFilter() {
- shutdown();
- }
-
- void filterAttributes(const FilteringContext& context, vector<Attribute*>& attributes) const {
- m_impl->filterAttributes(context, attributes);
- }
-
- protected:
- pair<bool,DOMElement*> background_load();
-
- private:
- bool m_deprecationSupport;
- scoped_ptr<XMLFilterImpl> m_impl;
- };
-
-#if defined (_MSC_VER)
- #pragma warning( pop )
-#endif
-
- AttributeFilter* SHIBSP_DLLLOCAL XMLAttributeFilterFactory(const DOMElement* const & e, bool)
- {
- return new XMLFilter(e);
- }
-
- static const XMLCh AttributeFilterPolicyGroup[] = UNICODE_LITERAL_26(A,t,t,r,i,b,u,t,e,F,i,l,t,e,r,P,o,l,i,c,y,G,r,o,u,p);
- static const XMLCh AttributeFilterPolicy[] = UNICODE_LITERAL_21(A,t,t,r,i,b,u,t,e,F,i,l,t,e,r,P,o,l,i,c,y);
- static const XMLCh AttributeRule[] = UNICODE_LITERAL_13(A,t,t,r,i,b,u,t,e,R,u,l,e);
- static const XMLCh AttributeRuleReference[] = UNICODE_LITERAL_22(A,t,t,r,i,b,u,t,e,R,u,l,e,R,e,f,e,r,e,n,c,e);
- static const XMLCh DenyValueRule[] = UNICODE_LITERAL_13(D,e,n,y,V,a,l,u,e,R,u,l,e);
- static const XMLCh DenyValueRuleReference[] = UNICODE_LITERAL_22(D,e,n,y,V,a,l,u,e,R,u,l,e,R,e,f,e,r,e,n,c,e);
- static const XMLCh PermitValueRule[] = UNICODE_LITERAL_15(P,e,r,m,i,t,V,a,l,u,e,R,u,l,e);
- static const XMLCh PermitValueRuleReference[] = UNICODE_LITERAL_24(P,e,r,m,i,t,V,a,l,u,e,R,u,l,e,R,e,f,e,r,e,n,c,e);
- static const XMLCh PolicyRequirementRule[] = UNICODE_LITERAL_21(P,o,l,i,c,y,R,e,q,u,i,r,e,m,e,n,t,R,u,l,e);
- static const XMLCh PolicyRequirementRuleReference[]=UNICODE_LITERAL_30(P,o,l,i,c,y,R,e,q,u,i,r,e,m,e,n,t,R,u,l,e,R,e,f,e,r,e,n,c,e);
- static const XMLCh attributeID[] = UNICODE_LITERAL_11(a,t,t,r,i,b,u,t,e,I,D);
- static const XMLCh permitAny[] = UNICODE_LITERAL_9(p,e,r,m,i,t,A,n,y);
- static const XMLCh _id[] = UNICODE_LITERAL_2(i,d);
- static const XMLCh _ref[] = UNICODE_LITERAL_3(r,e,f);
-};
-
-XMLFilterImpl::XMLFilterImpl(const DOMElement* e, Category& log, bool deprecationSupport) : m_log(log), m_document(nullptr)
-{
-#ifdef _DEBUG
- xmltooling::NDC ndc("XMLFilterImpl");
-#endif
-
- if (!XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, AttributeFilterPolicyGroup))
- throw ConfigurationException("XML AttributeFilter requires afp:AttributeFilterPolicyGroup at root of configuration.");
-
- FilterPolicyContext reqFunctors(m_policyReqRules);
- FilterPolicyContext permFunctors(m_permitValRules);
- FilterPolicyContext denyFunctors(m_denyValRules);
-
- DOMElement* child = XMLHelper::getFirstChildElement(e);
- while (child) {
- if (XMLHelper::isNodeNamed(child, SHIB2ATTRIBUTEFILTER_NS, PolicyRequirementRule)) {
- buildFunctor(child, reqFunctors, "PolicyRequirementRule", true, deprecationSupport);
- }
- else if (XMLHelper::isNodeNamed(child, SHIB2ATTRIBUTEFILTER_NS, PermitValueRule)) {
- buildFunctor(child, permFunctors, "PermitValueRule", true, deprecationSupport);
- }
- else if (XMLHelper::isNodeNamed(child, SHIB2ATTRIBUTEFILTER_NS, DenyValueRule)) {
- buildFunctor(child, denyFunctors, "DenyValueRule", true, deprecationSupport);
- }
- else if (XMLHelper::isNodeNamed(child, SHIB2ATTRIBUTEFILTER_NS, AttributeRule)) {
- buildAttributeRule(child, permFunctors, denyFunctors, true, deprecationSupport);
- }
- else if (XMLHelper::isNodeNamed(child, SHIB2ATTRIBUTEFILTER_NS, AttributeFilterPolicy)) {
- e = XMLHelper::getFirstChildElement(child);
- MatchFunctor* func = nullptr;
- if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, PolicyRequirementRule)) {
- func = buildFunctor(e, reqFunctors, "PolicyRequirementRule", false, deprecationSupport);
- }
- else if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, PolicyRequirementRuleReference)) {
- string ref(XMLHelper::getAttrString(e, nullptr, _ref));
- if (!ref.empty()) {
- multimap<string,MatchFunctor*>::const_iterator prr = m_policyReqRules.find(ref);
- func = (prr!=m_policyReqRules.end()) ? prr->second : nullptr;
- }
- }
- if (func) {
- m_policies.push_back(Policy());
- m_policies.back().m_applies = func;
- e = XMLHelper::getNextSiblingElement(e);
- while (e) {
- if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, AttributeRule)) {
- boost::tuple<string,const MatchFunctor*,const MatchFunctor*> rule = buildAttributeRule(e, permFunctors, denyFunctors, false, deprecationSupport);
- if (rule.get<1>() || rule.get<2>())
- m_policies.back().m_rules.insert(Policy::rules_t::value_type(rule.get<0>(), make_pair(rule.get<1>(), rule.get<2>())));
- }
- else if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, AttributeRuleReference)) {
- string ref(XMLHelper::getAttrString(e, nullptr, _ref));
- if (!ref.empty()) {
- map< string,boost::tuple<string,const MatchFunctor*,const MatchFunctor*> >::const_iterator ar = m_attrRules.find(ref);
- if (ar != m_attrRules.end()) {
- m_policies.back().m_rules.insert(
- Policy::rules_t::value_type(ar->second.get<0>(), make_pair(ar->second.get<1>(), ar->second.get<2>()))
- );
- }
- else {
- m_log.warn("skipping invalid AttributeRuleReference (%s)", ref.c_str());
- }
- }
- }
- e = XMLHelper::getNextSiblingElement(e);
- }
- }
- else {
- m_log.warn("skipping AttributeFilterPolicy, PolicyRequirementRule invalid or missing");
- }
- }
- child = XMLHelper::getNextSiblingElement(child);
- }
-}
-
-MatchFunctor* XMLFilterImpl::buildFunctor(
- const DOMElement* e, const FilterPolicyContext& functorMap, const char* logname, bool standalone, bool deprecationSupport
- )
-{
- string id(XMLHelper::getAttrString(e, nullptr, _id));
-
- if (standalone && id.empty()) {
- m_log.warn("skipping stand-alone %s with no id", logname);
- return nullptr;
- }
- else if (!id.empty() && functorMap.getMatchFunctors().count(id)) {
- if (standalone) {
- m_log.warn("skipping duplicate stand-alone %s with id (%s)", logname, id.c_str());
- return nullptr;
- }
- else
- id.clear();
- }
-
- scoped_ptr<xmltooling::QName> type(XMLHelper::getXSIType(e));
- if (type) {
- if (XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS) ||
- XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_SAML_NS)) {
-
- auto_ptr_char ns(type->getNamespaceURI());
- SPConfig::getConfig().deprecation().warn("legacy Attribute Filter namespace '%s'", ns.get());
- }
-
- try {
- auto_ptr<MatchFunctor> func(SPConfig::getConfig().MatchFunctorManager.newPlugin(*type, make_pair(&functorMap,e), deprecationSupport));
- functorMap.getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func.get()));
- return func.release();
- }
- catch (const exception& ex) {
- m_log.error("error building %s with type (%s): %s", logname, type->toString().c_str(), ex.what());
- }
- }
- else if (standalone)
- m_log.warn("skipping stand-alone %s with no xsi:type", logname);
- else
- m_log.error("%s with no xsi:type", logname);
-
- return nullptr;
-}
-
-boost::tuple<string,const MatchFunctor*,const MatchFunctor*> XMLFilterImpl::buildAttributeRule(
- const DOMElement* e, const FilterPolicyContext& permMap, const FilterPolicyContext& denyMap, bool standalone, bool deprecationSupport
- )
-{
- string id(XMLHelper::getAttrString(e, nullptr, _id));
-
- if (standalone && id.empty()) {
- m_log.warn("skipping stand-alone AttributeRule with no id");
- return boost::tuple<string,const MatchFunctor*,const MatchFunctor*>(string(),nullptr,nullptr);
- }
- else if (!id.empty() && m_attrRules.count(id)) {
- if (standalone) {
- m_log.warn("skipping duplicate stand-alone AttributeRule with id (%s)", id.c_str());
- return boost::tuple<string,const MatchFunctor*,const MatchFunctor*>(string(),nullptr,nullptr);
- }
- else
- id.clear();
- }
-
- string attrID(XMLHelper::getAttrString(e, nullptr, attributeID));
- if (attrID.empty())
- m_log.warn("skipping AttributeRule with no attributeID");
-
- MatchFunctor* perm = nullptr;
- MatchFunctor* deny = nullptr;
-
- if (XMLHelper::getAttrBool(e, false, permitAny)) {
- m_log.debug("installing implicit ANY permit rule for attribute (%s)", attrID.c_str());
- perm = SPConfig::getConfig().MatchFunctorManager.newPlugin(AnyMatchFunctorType, make_pair(&permMap,(const DOMElement*)nullptr), deprecationSupport);
- return boost::make_tuple(attrID, perm, deny);
- }
-
- e = XMLHelper::getFirstChildElement(e);
- if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, PermitValueRule)) {
- perm = buildFunctor(e, permMap, "PermitValueRule", false, deprecationSupport);
- e = XMLHelper::getNextSiblingElement(e);
- }
- else if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, PermitValueRuleReference)) {
- string ref(XMLHelper::getAttrString(e, nullptr, _ref));
- if (!ref.empty()) {
- multimap<string,MatchFunctor*>::const_iterator pvr = m_permitValRules.find(ref);
- perm = (pvr!=m_permitValRules.end()) ? pvr->second : nullptr;
- }
- e = XMLHelper::getNextSiblingElement(e);
- }
-
- if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, DenyValueRule)) {
- deny = buildFunctor(e, denyMap, "DenyValueRule", false, deprecationSupport);
- }
- else if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, DenyValueRuleReference)) {
- string ref(XMLHelper::getAttrString(e, nullptr, _ref));
- if (!ref.empty()) {
- multimap<string,MatchFunctor*>::const_iterator pvr = m_denyValRules.find(ref);
- deny = (pvr!=m_denyValRules.end()) ? pvr->second : nullptr;
- }
- }
-
- if (perm || deny) {
- if (!id.empty()) {
- m_attrRules[id] = boost::make_tuple(attrID, perm, deny);
- return m_attrRules[id];
- }
- else {
- return boost::make_tuple(attrID, perm, deny);
- }
- }
-
- if (!id.empty())
- m_log.warn("skipping AttributeRule (%s), permit and denial rule(s) invalid or missing", id.c_str());
- else
- m_log.warn("skipping AttributeRule, permit and denial rule(s) invalid or missing");
- return boost::tuple<string,const MatchFunctor*,const MatchFunctor*>(string(),nullptr,nullptr);
-}
-
-void XMLFilterImpl::filterAttributes(const FilteringContext& context, vector<Attribute*>& attributes) const
-{
- auto_ptr_char issuer(context.getAttributeIssuer());
-
- m_log.debug("filtering %lu attribute(s) from (%s)", attributes.size(), issuer.get() ? issuer.get() : "unknown source");
-
- if (m_policies.empty()) {
- m_log.warn("no filter policies were loaded, filtering out all attributes from (%s)", issuer.get() ? issuer.get() : "unknown source");
- for_each(attributes.begin(), attributes.end(), xmltooling::cleanup<Attribute>());
- attributes.clear();
- return;
- }
-
- // We have to evaluate every policy that applies against each attribute before deciding what to keep.
-
- // For efficiency, we build an array of the policies that apply in advance.
- vector<const Policy*> applicablePolicies;
- for (vector<Policy>::const_iterator p = m_policies.begin(); p != m_policies.end(); ++p) {
- if (p->m_applies->evaluatePolicyRequirement(context))
- applicablePolicies.push_back(&(*p));
- }
-
- // For further efficiency, we declare arrays to store the applicable rules for an Attribute.
- vector< pair<const MatchFunctor*,const MatchFunctor*> > applicableRules;
- vector< pair<const MatchFunctor*,const MatchFunctor*> > wildcardRules;
-
- // Store off the wildcards ahead of time.
- for (indirect_iterator<vector<const Policy*>::const_iterator> pol = make_indirect_iterator(applicablePolicies.begin());
- pol != make_indirect_iterator(applicablePolicies.end()); ++pol) {
- pair<Policy::rules_t::const_iterator,Policy::rules_t::const_iterator> rules = pol->m_rules.equal_range("*");
- for (; rules.first!=rules.second; ++rules.first)
- wildcardRules.push_back(rules.first->second);
- }
-
- // To track what to keep without removing anything from the original set until the end, we maintain
- // a map of each Attribute object to a boolean array with true flags indicating what to delete.
- // A single dimension array tracks attributes being removed entirely.
- vector<bool> deletedAttributes(attributes.size(), false);
- map< Attribute*, vector<bool> > deletedPositions;
-
- // Loop over each attribute to filter them.
- for (vector<Attribute*>::size_type a = 0; a < attributes.size(); ++a) {
- Attribute* attr = attributes[a];
-
- // Clear the rule store.
- applicableRules.clear();
-
- // Look for rules to run in each policy.
- for (indirect_iterator<vector<const Policy*>::const_iterator> pol = make_indirect_iterator(applicablePolicies.begin());
- pol != make_indirect_iterator(applicablePolicies.end()); ++pol) {
- pair<Policy::rules_t::const_iterator,Policy::rules_t::const_iterator> rules = pol->m_rules.equal_range(attr->getId());
- for (; rules.first!=rules.second; ++rules.first)
- applicableRules.push_back(rules.first->second);
- }
-
- // If no rules found, apply wildcards.
- const vector< pair<const MatchFunctor*,const MatchFunctor*> >& rulesToRun =
- applicableRules.empty() ? wildcardRules : applicableRules;
-
- // If no rules apply, remove the attribute entirely.
- if (rulesToRun.empty()) {
- m_log.warn(
- "no rule found, will remove attribute (%s) from (%s)",
- attr->getId(), issuer.get() ? issuer.get() : "unknown source"
- );
- deletedAttributes[a] = true;
- continue;
- }
-
- // Run each permit/deny rule.
- m_log.debug(
- "applying filtering rule(s) for attribute (%s) from (%s)",
- attr->getId(), issuer.get() ? issuer.get() : "unknown source"
- );
-
- bool kickit;
-
- // Examine each value.
- for (size_t count = attr->valueCount(), index = 0; index < count; ++index) {
-
- // Assume we're kicking it out.
- kickit=true;
-
- for (vector< pair<const MatchFunctor*,const MatchFunctor*> >::const_iterator r = rulesToRun.begin(); r != rulesToRun.end(); ++r) {
- // If there's a permit rule that passes, don't kick it.
- if (r->first && r->first->evaluatePermitValue(context, *attr, index))
- kickit = false;
- if (!kickit && r->second && r->second->evaluatePermitValue(context, *attr, index))
- kickit = true;
- }
-
- // If we're kicking it, record that in the tracker.
- if (kickit) {
- m_log.warn(
- "removed value at position (%lu) of attribute (%s) from (%s)",
- index, attr->getId(), issuer.get() ? issuer.get() : "unknown source"
- );
- deletedPositions[attr].resize(index+1);
- deletedPositions[attr][index] = true;
- }
- }
- }
-
- // Final step: go over the deletedPositions matrix and apply the actual changes. In order to delete
- // any attributes that end up with no values, we have to do it by looping over the originals.
- for (vector<Attribute*>::size_type a = 0; a < attributes.size();) {
- Attribute* attr = attributes[a];
-
- if (deletedAttributes[a]) {
- m_log.warn(
- "removing filtered attribute (%s) from (%s)",
- attr->getId(), issuer.get() ? issuer.get() : "unknown source"
- );
- delete attr;
- deletedAttributes.erase(deletedAttributes.begin() + a);
- attributes.erase(attributes.begin() + a);
- continue;
- }
- else if (deletedPositions.count(attr) > 0) {
- // To do the removal, we loop over the bits backwards so that the
- // underlying value sequence doesn't get distorted by any removals.
- // Index has to be offset by one because size_type is unsigned.
- const vector<bool>& row = deletedPositions[attr];
- for (vector<bool>::size_type index = row.size(); index > 0; --index) {
- if (row[index-1])
- attr->removeValue(index-1);
- }
- }
-
- // Check for no values.
- if (attr->valueCount() == 0) {
- m_log.warn(
- "no values left, removing attribute (%s) from (%s)",
- attr->getId(), issuer.get() ? issuer.get() : "unknown source"
- );
- delete attr;
- deletedAttributes.erase(deletedAttributes.begin() + a);
- attributes.erase(attributes.begin() + a);
- continue;
- }
-
- ++a;
- }
-}
-
-pair<bool,DOMElement*> XMLFilter::background_load()
-{
- // Load from source using base class.
- pair<bool,DOMElement*> raw = ReloadableXMLFile::load();
-
- // If we own it, wrap it.
- XercesJanitor<DOMDocument> docjanitor(raw.first ? raw.second->getOwnerDocument() : nullptr);
-
- scoped_ptr<XMLFilterImpl> impl(new XMLFilterImpl(raw.second, m_log, m_deprecationSupport));
-
- // If we held the document, transfer it to the impl. If we didn't, it's a no-op.
- impl->setDocument(docjanitor.release());
-
- // Perform the swap inside a lock.
- if (m_lock)
- m_lock->wrlock();
- SharedLock locker(m_lock, false);
- m_impl.swap(impl);
-
- return make_pair(false,(DOMElement*)nullptr);
-}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list