[cpp-sp] branch main updated: Remove artifact resolution and SOAP support.
Scott Cantor
cantor.2 at osu.edu
Wed Oct 30 21:30:15 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=cbbe68a4caff4ea28ae3652be7d8743c62fac7df
The following commit(s) were added to refs/heads/main by this push:
new cbbe68a4 Remove artifact resolution and SOAP support.
cbbe68a4 is described below
commit cbbe68a4caff4ea28ae3652be7d8743c62fac7df
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 30 17:30:11 2024 -0400
Remove artifact resolution and SOAP support.
---
shibsp/Makefile.am | 4 +-
shibsp/binding/ArtifactResolver.h | 59 -------
shibsp/binding/SOAPClient.h | 86 ----------
shibsp/binding/impl/ArtifactResolver.cpp | 261 -------------------------------
shibsp/binding/impl/SOAPClient.cpp | 241 ----------------------------
5 files changed, 1 insertion(+), 650 deletions(-)
diff --git a/shibsp/Makefile.am b/shibsp/Makefile.am
index e33099eb..cd21a951 100644
--- a/shibsp/Makefile.am
+++ b/shibsp/Makefile.am
@@ -47,9 +47,7 @@ attrinclude_HEADERS = \
attribute/XMLAttribute.h
bindinclude_HEADERS = \
- binding/ArtifactResolver.h \
- binding/ProtocolProvider.h \
- binding/SOAPClient.h
+ binding/ProtocolProvider.h
handinclude_HEADERS = \
handler/AbstractHandler.h \
diff --git a/shibsp/binding/ArtifactResolver.h b/shibsp/binding/ArtifactResolver.h
deleted file mode 100644
index 19577130..00000000
--- a/shibsp/binding/ArtifactResolver.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file shibsp/binding/ArtifactResolver.h
- *
- * SAML artifact resolver for SP use.
- */
-
-#ifndef __shibsp_artres_h__
-#define __shibsp_artres_h__
-
-#include <shibsp/base.h>
-#include <saml/binding/MessageDecoder.h>
-
-namespace shibsp {
-
- /**
- * SAML artifact resolver for SP use.
- */
- class SHIBSP_API ArtifactResolver : public opensaml::MessageDecoder::ArtifactResolver {
- public:
- ArtifactResolver();
- virtual ~ArtifactResolver();
-
- bool isSupported(const opensaml::saml2md::SSODescriptorType& ssoDescriptor) const;
-
- opensaml::saml1p::Response* resolve(
- const std::vector<opensaml::SAMLArtifact*>& artifacts,
- const opensaml::saml2md::IDPSSODescriptor& idpDescriptor,
- opensaml::SecurityPolicy& policy
- ) const;
-
- opensaml::saml2p::ArtifactResponse* resolve(
- const opensaml::saml2p::SAML2Artifact& artifact,
- const opensaml::saml2md::SSODescriptorType& ssoDescriptor,
- opensaml::SecurityPolicy& policy
- ) const;
- };
-};
-
-#endif /* __shibsp_artres_h__ */
diff --git a/shibsp/binding/SOAPClient.h b/shibsp/binding/SOAPClient.h
deleted file mode 100644
index ebe36e3c..00000000
--- a/shibsp/binding/SOAPClient.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * @file shibsp/binding/SOAPClient.h
- *
- * Specialized SOAPClient for SP environment.
- */
-
-#ifndef __shibsp_soap11client_h__
-#define __shibsp_soap11client_h__
-
-#include <shibsp/base.h>
-
-#include <saml/binding/SOAPClient.h>
-
-namespace shibsp {
-
- class SHIBSP_API PropertySet;
- class SHIBSP_API SecurityPolicy;
-
- /**
- * Specialized SOAPClient for SP environment.
- */
- class SHIBSP_API SOAPClient : public opensaml::SOAPClient
- {
- public:
- /**
- * Creates a SOAP client instance for an Application to use.
- *
- * @param policy reference to SP-SecurityPolicy to apply
- */
- SOAPClient(SecurityPolicy& policy);
-
- virtual ~SOAPClient();
-
- /**
- * Override handles message signing for SAML payloads.
- *
- * @param env SOAP envelope to send
- * @param from identity of sending application
- * @param to peer to send message to, expressed in metadata terms
- * @param endpoint URL of endpoint to recieve message
- */
- void send(const soap11::Envelope& env, const char* from, opensaml::saml2md::MetadataCredentialCriteria& to, const char* endpoint);
-
- void reset();
-
- protected:
- /**
- * Override prepares transport by applying policy settings from Application.
- *
- * @param transport reference to transport layer
- */
- void prepareTransport(xmltooling::SOAPTransport& transport);
-
- /** Application supplied to client. */
- const Application& m_app;
-
- /** RelyingParty properties, set after transport prep. */
- const PropertySet* m_relyingParty;
-
- /** Locked CredentialResolver for transport, set after transport prep. */
- xmltooling::CredentialResolver* m_credResolver;
- };
-
-};
-
-#endif /* __shibsp_soap11client_h__ */
diff --git a/shibsp/binding/impl/ArtifactResolver.cpp b/shibsp/binding/impl/ArtifactResolver.cpp
deleted file mode 100644
index 878f05ea..00000000
--- a/shibsp/binding/impl/ArtifactResolver.cpp
+++ /dev/null
@@ -1,261 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * ArtifactResolver.cpp
- *
- * SAML artifact resolver for SP use.
- */
-
-#include "internal.h"
-#include "Application.h"
-#include "binding/ArtifactResolver.h"
-#include "binding/SOAPClient.h"
-#include "security/SecurityPolicy.h"
-#include "util/SPConstants.h"
-
-#include <fstream>
-#define BOOST_BIND_GLOBAL_PLACEHOLDERS
-#include <boost/bind.hpp>
-#include <boost/algorithm/string.hpp>
-#include <xmltooling/XMLToolingConfig.h>
-#include <xmltooling/util/ParserPool.h>
-#include <xmltooling/util/PathResolver.h>
-#include <saml/exceptions.h>
-#include <saml/saml1/core/Protocols.h>
-#include <saml/saml1/binding/SAML1SOAPClient.h>
-#include <saml/saml2/core/Protocols.h>
-#include <saml/saml2/binding/SAML2Artifact.h>
-#include <saml/saml2/binding/SAML2SOAPClient.h>
-#include <saml/saml2/metadata/EndpointManager.h>
-#include <saml/saml2/metadata/Metadata.h>
-#include <saml/saml2/metadata/MetadataCredentialCriteria.h>
-#include <saml/util/SAMLConstants.h>
-
-using namespace shibsp;
-using namespace opensaml::saml1p;
-using namespace opensaml::saml2;
-using namespace opensaml::saml2p;
-using namespace opensaml::saml2md;
-using namespace opensaml;
-using namespace xmltooling;
-using namespace boost;
-using namespace std;
-
-ArtifactResolver::ArtifactResolver()
-{
-}
-
-ArtifactResolver::~ArtifactResolver()
-{
-}
-
-bool ArtifactResolver::isSupported(const SSODescriptorType& ssoDescriptor) const
-{
- if (MessageDecoder::ArtifactResolver::isSupported(ssoDescriptor))
- return true;
-
- EndpointManager<ArtifactResolutionService> mgr(ssoDescriptor.getArtifactResolutionServices());
- if (ssoDescriptor.hasSupport(samlconstants::SAML20P_NS)) {
- return (mgr.getByBinding(shibspconstants::SHIB2_BINDING_FILE) != nullptr);
- }
-
- return false;
-}
-
-saml1p::Response* ArtifactResolver::resolve(
- const vector<SAMLArtifact*>& artifacts,
- const IDPSSODescriptor& idpDescriptor,
- opensaml::SecurityPolicy& policy
- ) const
-{
- MetadataCredentialCriteria mcc(idpDescriptor);
- shibsp::SecurityPolicy& sppolicy = dynamic_cast<shibsp::SecurityPolicy&>(policy);
- shibsp::SOAPClient soaper(sppolicy);
-
- bool foundEndpoint = false;
- auto_ptr_XMLCh binding(samlconstants::SAML1_BINDING_SOAP);
- saml1p::Response* response=nullptr;
- const vector<ArtifactResolutionService*>& endpoints=idpDescriptor.getArtifactResolutionServices();
- for (vector<ArtifactResolutionService*>::const_iterator ep=endpoints.begin(); !response && ep!=endpoints.end(); ++ep) {
- try {
- if (!XMLString::equals((*ep)->getBinding(),binding.get()))
- continue;
- foundEndpoint = true;
- auto_ptr_char loc((*ep)->getLocation());
- saml1p::Request* request = saml1p::RequestBuilder::buildRequest();
- request->setMinorVersion(idpDescriptor.hasSupport(samlconstants::SAML11_PROTOCOL_ENUM) ? 1 : 0);
- for (vector<SAMLArtifact*>::const_iterator a = artifacts.begin(); a!=artifacts.end(); ++a) {
- auto_ptr_XMLCh artbuf((*a)->encode().c_str());
- AssertionArtifact* aa = AssertionArtifactBuilder::buildAssertionArtifact();
- aa->setArtifact(artbuf.get());
- request->getAssertionArtifacts().push_back(aa);
- }
-
- SAML1SOAPClient client(soaper, false);
- client.sendSAML(request, sppolicy.getApplication().getId(), mcc, loc.get());
- response = client.receiveSAML();
- }
- catch (std::exception& ex) {
- Category::getInstance(SHIBSP_LOGCAT ".ArtifactResolver").error("exception resolving SAML 1.x artifact(s): %s", ex.what());
- soaper.reset();
- }
- }
-
- if (!foundEndpoint)
- throw MetadataException("No compatible endpoint found in issuer's metadata.");
- else if (!response)
- throw BindingException("Unable to resolve artifact(s) into a SAML response.");
- const xmltooling::QName* code = (response->getStatus() && response->getStatus()->getStatusCode()) ? response->getStatus()->getStatusCode()->getValue() : nullptr;
- if (!code || *code != saml1p::StatusCode::SUCCESS) {
- scoped_ptr<saml1p::Response> wrapper(response);
- BindingException ex("Identity provider returned a SAML error during artifact resolution.");
- annotateException(&ex, &idpDescriptor, response->getStatus()); // rethrow
- }
-
- // The SOAP client handles policy evaluation against the SOAP and Response layer,
- // but no security checking is done here.
- return response;
-}
-
-ArtifactResponse* ArtifactResolver::resolve(
- const SAML2Artifact& artifact,
- const SSODescriptorType& ssoDescriptor,
- opensaml::SecurityPolicy& policy
- ) const
-{
- Category& log = Category::getInstance(SHIBSP_LOGCAT ".Handler.ArtifactResolver");
-
- MetadataCredentialCriteria mcc(ssoDescriptor);
- shibsp::SecurityPolicy& sppolicy = dynamic_cast<shibsp::SecurityPolicy&>(policy);
- shibsp::SOAPClient soaper(sppolicy);
-
- bool foundEndpoint = false;
- auto_ptr_XMLCh binding(samlconstants::SAML20_BINDING_SOAP);
- ArtifactResponse* response=nullptr;
-
- vector<ArtifactResolutionService*>::const_iterator ep_start, ep_end;
- const vector<ArtifactResolutionService*>& endpoints = ssoDescriptor.getArtifactResolutionServices();
- ep_start = find_if(endpoints.begin(), endpoints.end(),
- boost::bind(&pair<bool,int>::second, boost::bind(&IndexedEndpointType::getIndex, _1)) == artifact.getEndpointIndex());
- if (ep_start == endpoints.end()) {
- ep_start = endpoints.begin();
- ep_end = endpoints.end();
- }
- else {
- ep_end = ep_start + 1;
- }
-
- const PropertySet* rp = sppolicy.getApplication().getRelyingParty(dynamic_cast<const EntityDescriptor*>(ssoDescriptor.getParent()));
- pair<bool,bool> artifactByFilesystem = rp->getBool("artifactByFilesystem");
-
- for (vector<ArtifactResolutionService*>::const_iterator ep = ep_start; !response && ep != ep_end; ++ep) {
- try {
- if (XMLString::equals((*ep)->getBinding(), binding.get())) {
- foundEndpoint = true;
- auto_ptr_char loc((*ep)->getLocation());
- ArtifactResolve* request = ArtifactResolveBuilder::buildArtifactResolve();
- Issuer* iss = IssuerBuilder::buildIssuer();
- request->setIssuer(iss);
- iss->setName(rp->getXMLString("entityID").second);
- auto_ptr_XMLCh artbuf(artifact.encode().c_str());
- Artifact* a = ArtifactBuilder::buildArtifact();
- a->setArtifact(artbuf.get());
- request->setArtifact(a);
-
- SAML2SOAPClient client(soaper, false);
- client.sendSAML(request, sppolicy.getApplication().getId(), mcc, loc.get());
- StatusResponseType* srt = client.receiveSAML();
- if (!(response = dynamic_cast<ArtifactResponse*>(srt))) {
- delete srt;
- break;
- }
- }
- else if (artifactByFilesystem.first && artifactByFilesystem.second && XMLString::equals((*ep)->getBinding(), shibspconstants::SHIB2_BINDING_FILE)) {
- // This implements a resolution process against the local file system for custom integration needs.
- // The local filesystem is presumed to be "secure" so that unsigned, unencrypted responses are acceptable.
- // The binding here is not SOAP, but rather REST-like, with the base location used to construct a filename
- // containing the artifact message handle.
- SPConfig::getConfig().deprecation().warn("Local artifact resolution");
- foundEndpoint = true;
- auto_ptr_char temp((*ep)->getLocation());
- if (temp.get()) {
- string loc(temp.get());
- if (starts_with(loc, "file://"))
- loc = loc.substr(7);
- XMLToolingConfig::getConfig().getPathResolver()->resolve(loc, PathResolver::XMLTOOLING_RUN_FILE);
- loc += '/' + SAMLArtifact::toHex(artifact.getMessageHandle());
- ifstream in(loc.c_str());
- if (in) {
- auto_ptr<XMLObject> xmlObject;
- try {
- DOMDocument* doc = (policy.getValidating() ? XMLToolingConfig::getConfig().getValidatingParser() : XMLToolingConfig::getConfig().getParser()).parse(in);
- XercesJanitor<DOMDocument> docjanitor(doc);
-
- if (log.isDebugEnabled()) {
- string buf;
- XMLHelper::serialize(doc->getDocumentElement(), buf);
- log.debugStream() << "received XML:\n" << buf << logging::eol;
- }
- xmlObject.reset(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true));
- docjanitor.release();
- }
- catch (std::exception&) {
- in.close();
- remove(loc.c_str());
- throw;
- }
- in.close();
- remove(loc.c_str());
- if (response = dynamic_cast<ArtifactResponse*>(xmlObject.get())) {
- xmlObject.release();
- policy.setAuthenticated(true);
- }
- else {
- break;
- }
- }
- else {
- throw BindingException("Unable to open artifact response file ($1)", params(1, loc.c_str()));
- }
- }
- }
- }
- catch (std::exception& ex) {
- log.error("exception resolving SAML 2.0 artifact: %s", ex.what());
- soaper.reset();
- }
- }
-
- if (!foundEndpoint)
- throw MetadataException("No compatible endpoint found in issuer's metadata.");
- else if (!response)
- throw BindingException("Unable to resolve artifact(s) into a SAML response.");
- else if (!response->getStatus() || !response->getStatus()->getStatusCode() ||
- !XMLString::equals(response->getStatus()->getStatusCode()->getValue(), saml2p::StatusCode::SUCCESS)) {
- scoped_ptr<ArtifactResponse> wrapper(response);
- BindingException ex("Identity provider returned a SAML error during artifact resolution.");
- annotateException(&ex, &ssoDescriptor, response->getStatus()); // rethrow
- }
-
- // The SOAP client handles policy evaluation against the SOAP and Response layer,
- // but no security checking is done here.
- return response;
-}
diff --git a/shibsp/binding/impl/SOAPClient.cpp b/shibsp/binding/impl/SOAPClient.cpp
deleted file mode 100644
index bbc214af..00000000
--- a/shibsp/binding/impl/SOAPClient.cpp
+++ /dev/null
@@ -1,241 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * SOAPClient.cpp
- *
- * Specialized SOAPClient for SP environment.
- */
-
-#include "internal.h"
-#include "Application.h"
-#include "ServiceProvider.h"
-#include "binding/SOAPClient.h"
-#include "security/SecurityPolicy.h"
-
-#include <saml/exceptions.h>
-#include <saml/saml2/metadata/Metadata.h>
-#include <saml/saml2/metadata/MetadataCredentialCriteria.h>
-#include <saml/signature/ContentReference.h>
-#include <xmltooling/security/Credential.h>
-#include <xmltooling/signature/Signature.h>
-#include <xmltooling/soap/SOAP.h>
-#include <xmltooling/soap/HTTPSOAPTransport.h>
-#include <xmltooling/soap/OpenSSLSOAPTransport.h>
-#include <xmltooling/util/NDC.h>
-
-using namespace shibsp;
-using namespace opensaml::saml2md;
-using namespace xmlsignature;
-using namespace xmltooling;
-using namespace std;
-
-SOAPClient::SOAPClient(SecurityPolicy& policy)
- : opensaml::SOAPClient(policy), m_app(policy.getApplication()), m_relyingParty(nullptr), m_credResolver(nullptr)
-{
-}
-
-SOAPClient::~SOAPClient()
-{
- if (m_credResolver)
- m_credResolver->unlock();
-}
-
-void SOAPClient::send(const soap11::Envelope& env, const char* from, MetadataCredentialCriteria& to, const char* endpoint)
-{
- // Check for message signing requirements.
- m_relyingParty = m_app.getRelyingParty(dynamic_cast<const EntityDescriptor*>(to.getRole().getParent()));
- pair<bool, const char*> signing = m_relyingParty->getString("signing");
- if (SPConfig::shouldSignOrEncrypt(signing.first ? signing.second : "conditional", endpoint, false)) {
- m_credResolver=m_app.getCredentialResolver();
- if (m_credResolver) {
- m_credResolver->lock();
- const Credential* cred = nullptr;
-
- // Fill in criteria to use.
- to.setUsage(Credential::SIGNING_CREDENTIAL);
- pair<bool,const char*> keyName = m_relyingParty->getString("keyName");
- if (keyName.first)
- to.getKeyNames().insert(keyName.second);
-
- // Check for an explicit algorithm, in which case resolve a credential directly.
- pair<bool,const XMLCh*> sigalg = m_relyingParty->getXMLString("signingAlg");
- if (sigalg.first) {
- to.setXMLAlgorithm(sigalg.second);
- cred = m_credResolver->resolve(&to);
- }
- else {
- // Prefer credential based on peer's requirements.
- pair<const SigningMethod*,const Credential*> p = to.getRole().getSigningMethod(*m_credResolver, to);
- if (p.first)
- sigalg = make_pair(true, p.first->getAlgorithm());
- if (p.second)
- cred = p.second;
- }
-
- // Reset criteria back.
- to.reset();
-
- if (cred) {
- // Check for message.
- const vector<XMLObject*>& bodies=const_cast<const soap11::Body*>(env.getBody())->getUnknownXMLObjects();
- if (!bodies.empty()) {
- opensaml::SignableObject* msg = dynamic_cast<opensaml::SignableObject*>(bodies.front());
- if (msg) {
- // Build a Signature.
- Signature* sig = SignatureBuilder::buildSignature();
- msg->setSignature(sig);
- if (sigalg.first)
- sig->setSignatureAlgorithm(sigalg.second);
- sigalg = m_relyingParty->getXMLString("digestAlg");
- if (!sigalg.first) {
- const DigestMethod* dm = to.getRole().getDigestMethod();
- if (dm)
- sigalg = make_pair(true, dm->getAlgorithm());
- }
- if (sigalg.first)
- dynamic_cast<opensaml::ContentReference*>(sig->getContentReference())->setDigestAlgorithm(sigalg.second);
-
- // Sign it. The marshalling step in the base class should be a no-op.
- vector<Signature*> sigs(1,sig);
- env.marshall((DOMDocument*)nullptr,&sigs,cred);
- }
- }
- }
- else {
- Category::getInstance(SHIBSP_LOGCAT ".SOAPClient").warn("no signing credential resolved, leaving message unsigned");
- }
- }
- else {
- Category::getInstance(SHIBSP_LOGCAT ".SOAPClient").warn("no CredentialResolver available, leaving unsigned");
- }
- }
-
- pair<bool,bool> flag = m_relyingParty->getBool("requireTransportAuth");
- if (flag.first) {
- forceTransportAuthentication(flag.second);
- }
- else {
- // If not set, toggle transport authentication requirement inversely to conditional signing/encryption.
- // That is, if we would force on signing, we probably expect the IdP to sign, and allow the transport layer
- // to be ignored. This allows us to ignore regular certificates on standard ports.
- forceTransportAuthentication(!SPConfig::shouldSignOrEncrypt("conditional", endpoint, false));
- }
-
- opensaml::SOAPClient::send(env, from, to, endpoint);
-}
-
-void SOAPClient::prepareTransport(SOAPTransport& transport)
-{
-#ifdef _DEBUG
- xmltooling::NDC("prepareTransport");
-#endif
- Category& log=Category::getInstance(SHIBSP_LOGCAT ".SOAPClient");
- log.debug("prepping SOAP transport for use by application (%s)", m_app.getId());
-
- pair<bool,bool> flag = m_relyingParty->getBool("requireConfidentiality");
- if ((!flag.first || flag.second) && !transport.isConfidential())
- throw opensaml::BindingException("Transport confidentiality required, but not available.");
-
- setValidating(getPolicy().getValidating());
-
- opensaml::SOAPClient::prepareTransport(transport);
-
- pair<bool,const char*> authType=m_relyingParty->getString("authType");
- if (!authType.first || !strcmp(authType.second,"TLS")) {
- if (!m_credResolver) {
- m_credResolver = m_app.getCredentialResolver();
- if (m_credResolver)
- m_credResolver->lock();
- }
- if (m_credResolver) {
- m_criteria->setUsage(Credential::TLS_CREDENTIAL);
- authType = m_relyingParty->getString("keyName");
- if (authType.first)
- m_criteria->getKeyNames().insert(authType.second);
- const Credential* cred = m_credResolver->resolve(m_criteria);
- m_criteria->getKeyNames().clear();
- if (cred) {
- if (!transport.setCredential(cred))
- log.error("failed to load Credential into SOAPTransport");
- }
- else {
- log.error("no TLS credential supplied");
- }
- }
- else {
- log.error("no CredentialResolver available for TLS");
- }
- }
- else {
- SOAPTransport::transport_auth_t type=SOAPTransport::transport_auth_none;
- pair<bool,const char*> username=m_relyingParty->getString("authUsername");
- pair<bool,const char*> password=m_relyingParty->getString("authPassword");
- if (!username.first || !password.first)
- log.error("transport authType (%s) specified but authUsername or authPassword was missing", authType.second);
- else if (!strcmp(authType.second,"basic"))
- type = SOAPTransport::transport_auth_basic;
- else if (!strcmp(authType.second,"digest"))
- type = SOAPTransport::transport_auth_digest;
- else if (!strcmp(authType.second,"ntlm"))
- type = SOAPTransport::transport_auth_ntlm;
- else if (!strcmp(authType.second,"gss"))
- type = SOAPTransport::transport_auth_gss;
- else if (strcmp(authType.second,"none"))
- log.error("unknown authType (%s) specified for RelyingParty", authType.second);
- if (type > SOAPTransport::transport_auth_none) {
- if (transport.setAuth(type,username.second,password.second))
- log.debug("configured for transport authentication (method=%s, username=%s)", authType.second, username.second);
- else
- log.error("failed to configure transport authentication (method=%s)", authType.second);
- }
- }
-
- pair<bool,unsigned int> timeout = m_relyingParty->getUnsignedInt("connectTimeout");
- transport.setConnectTimeout(timeout.first ? timeout.second : 10);
- timeout = m_relyingParty->getUnsignedInt("timeout");
- transport.setTimeout(timeout.first ? timeout.second : 20);
- m_app.getServiceProvider().setTransportOptions(transport);
-
- HTTPSOAPTransport* http = dynamic_cast<HTTPSOAPTransport*>(&transport);
- if (http) {
- flag = m_relyingParty->getBool("chunkedEncoding");
- http->useChunkedEncoding(flag.first && flag.second);
- http->setRequestHeader(PACKAGE_NAME, PACKAGE_VERSION);
- }
-
- OpenSSLSOAPTransport* openssl = dynamic_cast<OpenSSLSOAPTransport*>(&transport);
- if (openssl) {
- pair<bool, const char*> ciphers = m_relyingParty->getString("cipherSuites");
- if (ciphers.first) {
- openssl->setCipherSuites(ciphers.second);
- }
- }
-}
-
-void SOAPClient::reset()
-{
- m_relyingParty = nullptr;
- if (m_credResolver)
- m_credResolver->unlock();
- m_credResolver = nullptr;
- opensaml::SOAPClient::reset();
-}
-
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list