[cpp-sp] 01/02: Remove some low hanging SHIBSP_LITE code
Rod Widdowson
rdw at steadingsoftware.com
Thu Jan 9 16:44:48 UTC 2025
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=d26b0e582f028c87416efa2fc45254777e5e9da8
commit d26b0e582f028c87416efa2fc45254777e5e9da8
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Jan 9 16:34:22 2025 +0000
Remove some low hanging SHIBSP_LITE code
The rest is all in the handlers which will be getting more attention
---
shibsp/handler/AssertionConsumerService.h | 72 --------
shibsp/handler/impl/AdminLogoutInitiator.cpp | 68 -------
shibsp/handler/impl/AssertionConsumerService.cpp | 225 -----------------------
shibsp/handler/impl/LogoutHandler.cpp | 32 ----
shibsp/handler/impl/RemotedHandler.cpp | 41 -----
shibsp/impl/XMLApplication.h | 14 +-
6 files changed, 1 insertion(+), 451 deletions(-)
diff --git a/shibsp/handler/AssertionConsumerService.h b/shibsp/handler/AssertionConsumerService.h
index b26b5ad1..d0f637f3 100644
--- a/shibsp/handler/AssertionConsumerService.h
+++ b/shibsp/handler/AssertionConsumerService.h
@@ -77,78 +77,6 @@ namespace shibsp {
*/
virtual std::pair<bool,long> finalizeResponse(SPRequest& httpRequest, std::string& relayState) const;
-#ifndef SHIBSP_LITE
- /**
- * Returns a profile identifier to inject into the SecurityPolicy created
- * by the base class.
- *
- * @return profile identifier if any
- */
- virtual const char* getProfile() const;
-
- /**
- * Implement protocol-specific handling of the incoming decoded message.
- *
- * <p>The result of implementing the protocol should be an exception or
- * modifications to the request/response objects to reflect processing
- * of the message.</p>
- *
- * @param request client request that included message
- * @param policy the SecurityPolicy in effect, after having evaluated the message
- * @param reserved ignore this parameter
- * @param xmlObject a protocol-specific message object
- */
- virtual void implementProtocol(
- SPRequest& httpRequest,
- opensaml::SecurityPolicy& policy,
- const PropertySet* reserved,
- const xmltooling::XMLObject& xmlObject
- ) const=0;
-
- /**
- * Extracts policy-relevant assertion details.
- *
- * @param assertion the incoming assertion
- * @param protocol the protocol family in use
- * @param policy SecurityPolicy to provide various components and track message data
- */
- virtual void extractMessageDetails(
- const opensaml::Assertion& assertion, const XMLCh* protocol, opensaml::SecurityPolicy& policy
- ) const;
-
- /**
- * Attempt SSO-initiated attribute resolution using the supplied information,
- * including NameID and token extraction and filtering followed by
- * secondary resolution.
- *
- * <p>The caller must free the returned context handle.</p>
- *
- * @param request request delivering message, if any
- * @param issuer source of SSO tokens
- * @param protocol SSO protocol used
- * @param protmsg SSO protocol message, if any
- * @param v1nameid identifier of principal in SAML 1.x form, if any
- * @param v1statement SAML 1.x authentication statement, if any
- * @param nameid identifier of principal in SAML 2.0 form
- * @param statement SAML 2.0 authentication statement, if any
- * @param authncontext_class method/category of authentication event, if known
- * @param authncontext_decl specifics of authentication event, if known
- * @param tokens available assertions, if any
- */
- ResolutionContext* resolveAttributes(
- const SPRequest* request=nullptr,
- const opensaml::saml2md::RoleDescriptor* issuer=nullptr,
- const XMLCh* protocol=nullptr,
- const xmltooling::XMLObject* protmsg=nullptr,
- const opensaml::saml1::NameIdentifier* v1nameid=nullptr,
- const opensaml::saml1::AuthenticationStatement* v1statement=nullptr,
- const opensaml::saml2::NameID* nameid=nullptr,
- const opensaml::saml2::AuthnStatement* statement=nullptr,
- const XMLCh* authncontext_class=nullptr,
- const XMLCh* authncontext_decl=nullptr,
- const std::vector<const opensaml::Assertion*>* tokens=nullptr
- ) const;
-#endif
private:
std::pair<bool,long> sendRedirect(
SPRequest& request,
diff --git a/shibsp/handler/impl/AdminLogoutInitiator.cpp b/shibsp/handler/impl/AdminLogoutInitiator.cpp
index 77d8a9ab..06916ac4 100644
--- a/shibsp/handler/impl/AdminLogoutInitiator.cpp
+++ b/shibsp/handler/impl/AdminLogoutInitiator.cpp
@@ -234,71 +234,3 @@ pair<bool,long> AdminLogoutInitiator::run(SPRequest& request, bool isHandler) co
#endif
}
-#ifndef SHIBSP_LITE
-
-auto_ptr<LogoutRequest> AdminLogoutInitiator::buildRequest(
- const Application& application,
- const Session& session,
- const RoleDescriptor& role,
- const XMLCh* endpoint) const
-{
- const PropertySet* relyingParty = application.getRelyingParty(dynamic_cast<EntityDescriptor*>(role.getParent()));
-
- auto_ptr<LogoutRequest> msg(LogoutRequestBuilder::buildLogoutRequest());
- msg->setReason(LogoutRequest::REASON_ADMIN);
- Issuer* issuer = IssuerBuilder::buildIssuer();
- msg->setIssuer(issuer);
- issuer->setName(relyingParty->getXMLString("entityID").second);
- auto_ptr_XMLCh index(session.getSessionIndex());
- if (index.get() && *index.get()) {
- SessionIndex* si = SessionIndexBuilder::buildSessionIndex();
- msg->getSessionIndexs().push_back(si);
- si->setSessionIndex(index.get());
- }
-
- const NameID* nameid = session.getNameID();
- pair<bool, const char*> flag = getString("encryption");
- if (!flag.first)
- flag = relyingParty->getString("encryption");
- auto_ptr_char dest(endpoint);
- if (SPConfig::shouldSignOrEncrypt(flag.first ? flag.second : "conditional", dest.get(), false)) {
- try {
- auto_ptr<EncryptedID> encrypted(EncryptedIDBuilder::buildEncryptedID());
- MetadataCredentialCriteria mcc(role);
- encrypted->encrypt(
- *nameid,
- *(application.getMetadataProvider()),
- mcc,
- false,
- relyingParty->getXMLString("encryptionAlg").second
- );
- msg->setEncryptedID(encrypted.get());
- encrypted.release();
- }
- catch (const std::exception& ex) {
- // If we're encrypting deliberately, failure should be fatal.
- if (flag.first && strcmp(flag.second, "conditional")) {
- throw;
- }
- // If opportunistically, just log and move on.
- m_log.info("Conditional encryption of NameID in LogoutRequest failed: %s", ex.what());
- auto_ptr<NameID> namewrapper(nameid->cloneNameID());
- msg->setNameID(namewrapper.get());
- namewrapper.release();
- }
- }
- else {
- auto_ptr<NameID> namewrapper(nameid->cloneNameID());
- msg->setNameID(namewrapper.get());
- namewrapper.release();
- }
-
- XMLCh* msgid = SAMLConfig::getConfig().generateIdentifier();
- msg->setID(msgid);
- XMLString::release(&msgid);
- msg->setIssueInstant(time(nullptr));
-
- return msg;
-}
-
-#endif
diff --git a/shibsp/handler/impl/AssertionConsumerService.cpp b/shibsp/handler/impl/AssertionConsumerService.cpp
index d3ad998f..8f5462d2 100644
--- a/shibsp/handler/impl/AssertionConsumerService.cpp
+++ b/shibsp/handler/impl/AssertionConsumerService.cpp
@@ -203,228 +203,3 @@ void AssertionConsumerService::checkAddress(const SPRequest& request, const char
}
}
}
-
-#ifndef SHIBSP_LITE
-
-namespace {
- class SHIBSP_DLLLOCAL DummyContext : public ResolutionContext
- {
- public:
- DummyContext(const vector<Attribute*>& attributes) : m_attributes(attributes) {
- }
-
- virtual ~DummyContext() {
- for_each(m_attributes.begin(), m_attributes.end(), xmltooling::cleanup<Attribute>());
- }
-
- vector<Attribute*>& getResolvedAttributes() {
- return m_attributes;
- }
- vector<Assertion*>& getResolvedAssertions() {
- return m_tokens;
- }
-
- private:
- vector<Attribute*> m_attributes;
- static vector<Assertion*> m_tokens; // never any tokens, so just share an empty vector
- };
-};
-
-vector<Assertion*> DummyContext::m_tokens;
-
-ResolutionContext* AssertionConsumerService::resolveAttributes(
- const Application& application,
- const GenericRequest* request,
- const RoleDescriptor* issuer,
- const XMLCh* protocol,
- const xmltooling::XMLObject* protmsg,
- const saml1::NameIdentifier* v1nameid,
- const saml1::AuthenticationStatement* v1statement,
- const saml2::NameID* nameid,
- const saml2::AuthnStatement* statement,
- const XMLCh* authncontext_class,
- const XMLCh* authncontext_decl,
- const vector<const Assertion*>* tokens
- ) const
-{
- // First we do the extraction of any pushed information, including from metadata.
- vector<Attribute*> resolvedAttributes;
- AttributeExtractor* extractor = application.getAttributeExtractor();
- if (extractor) {
- Locker extlocker(extractor);
- if (issuer) {
- pair<bool,const char*> mprefix = application.getString("metadataAttributePrefix");
- if (mprefix.first) {
- m_log.debug("extracting metadata-derived attributes...");
- try {
- // We pass nullptr for "issuer" because the IdP isn't the one asserting metadata-based attributes.
- extractor->extractAttributes(application, request, nullptr, *issuer, resolvedAttributes);
- for (indirect_iterator<vector<Attribute*>::iterator> a = make_indirect_iterator(resolvedAttributes.begin());
- a != make_indirect_iterator(resolvedAttributes.end()); ++a) {
- vector<string>& ids = a->getAliases();
- for (vector<string>::iterator id = ids.begin(); id != ids.end(); ++id)
- *id = mprefix.second + *id;
- }
- }
- catch (const std::exception& ex) {
- m_log.error("caught exception extracting attributes: %s", ex.what());
- }
- }
- }
-
- m_log.debug("extracting pushed attributes...");
-
- if (protmsg) {
- try {
- extractor->extractAttributes(application, request, issuer, *protmsg, resolvedAttributes);
- }
- catch (const std::exception& ex) {
- m_log.error("caught exception extracting attributes: %s", ex.what());
- }
- }
-
- if (v1nameid || nameid) {
- try {
- if (v1nameid)
- extractor->extractAttributes(application, request, issuer, *v1nameid, resolvedAttributes);
- else
- extractor->extractAttributes(application, request, issuer, *nameid, resolvedAttributes);
- }
- catch (const std::exception& ex) {
- m_log.error("caught exception extracting attributes: %s", ex.what());
- }
- }
-
- if (v1statement || statement) {
- try {
- if (v1statement)
- extractor->extractAttributes(application, request, issuer, *v1statement, resolvedAttributes);
- else
- extractor->extractAttributes(application, request, issuer, *statement, resolvedAttributes);
- }
- catch (const std::exception& ex) {
- m_log.error("caught exception extracting attributes: %s", ex.what());
- }
- }
-
- if (tokens) {
- for (indirect_iterator<vector<const Assertion*>::const_iterator> t = make_indirect_iterator(tokens->begin());
- t != make_indirect_iterator(tokens->end()); ++t) {
- try {
- extractor->extractAttributes(application, request, issuer, *t, resolvedAttributes);
- }
- catch (const std::exception& ex) {
- m_log.error("caught exception extracting attributes: %s", ex.what());
- }
- }
- }
-
- AttributeFilter* filter = application.getAttributeFilter();
- if (filter && !resolvedAttributes.empty()) {
- BasicFilteringContext fc(application, resolvedAttributes, issuer, authncontext_class, authncontext_decl);
- Locker filtlocker(filter);
- try {
- filter->filterAttributes(fc, resolvedAttributes);
- }
- catch (const std::exception& ex) {
- m_log.error("caught exception filtering attributes: %s", ex.what());
- m_log.error("dumping extracted attributes due to filtering exception");
- for_each(resolvedAttributes.begin(), resolvedAttributes.end(), xmltooling::cleanup<shibsp::Attribute>());
- resolvedAttributes.clear();
- }
- }
- }
- else {
- m_log.warn("no AttributeExtractor plugin installed, check log during startup");
- }
-
- try {
- AttributeResolver* resolver = application.getAttributeResolver();
- if (resolver) {
- m_log.debug("resolving attributes...");
-
- Locker locker(resolver);
- auto_ptr<ResolutionContext> ctx(
- resolver->createResolutionContext(
- application,
- request,
- issuer ? dynamic_cast<const saml2md::EntityDescriptor*>(issuer->getParent()) : nullptr,
- protocol,
- nameid,
- authncontext_class,
- authncontext_decl,
- tokens,
- &resolvedAttributes
- )
- );
- resolver->resolveAttributes(*ctx);
- // Copy over any pushed attributes.
- while (!resolvedAttributes.empty()) {
- ctx->getResolvedAttributes().push_back(resolvedAttributes.back());
- resolvedAttributes.pop_back();
- }
- return ctx.release();
- }
- }
- catch (const std::exception&) {
- // Logging should be handled by the resolver plugin at whatever level is appropriate.
- }
-
- if (!resolvedAttributes.empty()) {
- try {
- return new DummyContext(resolvedAttributes);
- }
- catch (...) {
- for_each(resolvedAttributes.begin(), resolvedAttributes.end(), xmltooling::cleanup<shibsp::Attribute>());
- throw;
- }
- }
- return nullptr;
-}
-
-void AssertionConsumerService::extractMessageDetails(const Assertion& assertion, const XMLCh* protocol, opensaml::SecurityPolicy& policy) const
-{
- policy.setMessageID(assertion.getID());
- policy.setIssueInstant(assertion.getIssueInstantEpoch());
-
- if (XMLString::equals(assertion.getElementQName().getNamespaceURI(), samlconstants::SAML20_NS)) {
- const saml2::Assertion* a2 = dynamic_cast<const saml2::Assertion*>(&assertion);
- if (a2) {
- m_log.debug("extracting issuer from SAML 2.0 assertion");
- policy.setIssuer(a2->getIssuer());
- }
- }
- else {
- const saml1::Assertion* a1 = dynamic_cast<const saml1::Assertion*>(&assertion);
- if (a1) {
- m_log.debug("extracting issuer from SAML 1.x assertion");
- policy.setIssuer(a1->getIssuer());
- }
- }
-
- if (policy.getIssuer() && !policy.getIssuerMetadata() && policy.getMetadataProvider()) {
- if (policy.getIssuer()->getFormat() && !XMLString::equals(policy.getIssuer()->getFormat(), saml2::NameIDType::ENTITY)) {
- m_log.warn("non-system entity issuer, skipping metadata lookup");
- return;
- }
- m_log.debug("searching metadata for assertion issuer...");
- pair<const EntityDescriptor*,const RoleDescriptor*> entity;
- MetadataProvider::Criteria& mc = policy.getMetadataProviderCriteria();
- mc.entityID_unicode = policy.getIssuer()->getName();
- mc.role = &IDPSSODescriptor::ELEMENT_QNAME;
- mc.protocol = protocol;
- entity = policy.getMetadataProvider()->getEntityDescriptor(mc);
- if (!entity.first) {
- auto_ptr_char iname(policy.getIssuer()->getName());
- m_log.warn("no metadata found, can't establish identity of issuer (%s)", iname.get());
- }
- else if (!entity.second) {
- m_log.warn("unable to find compatible IdP role in metadata");
- }
- else {
- policy.setIssuerMetadata(entity.second);
- }
- }
-}
-
-#endif
diff --git a/shibsp/handler/impl/LogoutHandler.cpp b/shibsp/handler/impl/LogoutHandler.cpp
index 9197cc54..06fa7a4a 100644
--- a/shibsp/handler/impl/LogoutHandler.cpp
+++ b/shibsp/handler/impl/LogoutHandler.cpp
@@ -129,38 +129,6 @@ pair<bool,long> LogoutHandler::notifyFrontChannel(
return make_pair(true, request.sendRedirect(loc.c_str()));
}
-#ifndef SHIBSP_LITE
-#include "util/SPConstants.h"
-#include <xmltooling/impl/AnyElement.h>
-#include <xmltooling/soap/SOAP.h>
-#include <xmltooling/soap/SOAPClient.h>
-#include <xmltooling/soap/HTTPSOAPTransport.h>
-using namespace soap11;
-namespace {
- static const XMLCh LogoutNotification[] = UNICODE_LITERAL_18(L,o,g,o,u,t,N,o,t,i,f,i,c,a,t,i,o,n);
- static const XMLCh SessionID[] = UNICODE_LITERAL_9(S,e,s,s,i,o,n,I,D);
- static const XMLCh _type[] = UNICODE_LITERAL_4(t,y,p,e);
- static const XMLCh _local[] = UNICODE_LITERAL_5(l,o,c,a,l);
- static const XMLCh _global[] = UNICODE_LITERAL_6(g,l,o,b,a,l);
-
- class SHIBSP_DLLLOCAL SOAPNotifier : public soap11::SOAPClient
- {
- public:
- SOAPNotifier() {}
- virtual ~SOAPNotifier() {}
- private:
- void prepareTransport(SOAPTransport& transport) {
- transport.setVerifyHost(false);
- HTTPSOAPTransport* http = dynamic_cast<HTTPSOAPTransport*>(&transport);
- if (http) {
- http->useChunkedEncoding(false);
- http->setRequestHeader(PACKAGE_NAME, PACKAGE_VERSION);
- }
- }
- };
-};
-#endif
-
bool LogoutHandler::notifyBackChannel(const SPRequest& request, const vector<string>& sessions, bool local) const
{
if (sessions.empty()) {
diff --git a/shibsp/handler/impl/RemotedHandler.cpp b/shibsp/handler/impl/RemotedHandler.cpp
index bd2450f5..07d3efab 100644
--- a/shibsp/handler/impl/RemotedHandler.cpp
+++ b/shibsp/handler/impl/RemotedHandler.cpp
@@ -29,47 +29,6 @@
using namespace shibsp;
using namespace std;
-#ifndef SHIBSP_LITE
-
-void RemotedResponse::setCookie(const char* name, const char* value, time_t expires, samesite_t sameSite)
-{
- static const char* defProps="; path=/; HttpOnly";
- static const char* sslProps="; path=/; secure; HttpOnly";
-
- const char* cookieProps = defProps;
- pair<bool,bool> sameSiteFallback = pair<bool,bool>(false, false);
-
- const PropertySet* props = m_app ? m_app->getPropertySet("Sessions") : nullptr;
- if (props) {
- if (sameSite == SAMESITE_NONE) {
- sameSiteFallback = props->getBool("sameSiteFallback");
- }
-
- pair<bool, const char*> p = props->getString("cookieProps");
- if (p.first) {
- if (!strcmp(p.second, "https"))
- cookieProps = sslProps;
- else if (strcmp(p.second, "http"))
- cookieProps = p.second;
- }
- }
-
- if (cookieProps) {
- string decoratedValue(value ? value : "");
- if (!value) {
- decoratedValue += "; expires=Mon, 01 Jan 2001 00:00:00 GMT";
- }
- decoratedValue += cookieProps;
- HTTPResponse::setCookie(name, decoratedValue.c_str(), expires, sameSite,
- sameSiteFallback.first && sameSiteFallback.second);
- }
- else {
- HTTPResponse::setCookie(name, value, expires, sameSite,
- sameSiteFallback.first && sameSiteFallback.second);
- }
-}
-
-#endif
set<string> RemotedHandler::m_remotedHeaders;
diff --git a/shibsp/impl/XMLApplication.h b/shibsp/impl/XMLApplication.h
index 8ad8dc24..da0e3cee 100644
--- a/shibsp/impl/XMLApplication.h
+++ b/shibsp/impl/XMLApplication.h
@@ -69,14 +69,6 @@ namespace shibsp {
return m_hash.c_str();
}
-#ifndef SHIBSP_LITE
- const PropertySet* getRelyingParty(const opensaml::saml2md::EntityDescriptor* provider) const;
- const PropertySet* getRelyingParty(const XMLCh* entityID) const;
-
- // PropertySet overrides.
- std::pair<bool, const char*> getString(const char* name, const char* ns = nullptr) const;
- std::pair<bool, const XMLCh*> getXMLString(const char* name, const char* ns = nullptr) const;
-#endif
std::string getNotificationURL(const char* resource, bool front, unsigned int index) const;
const std::vector<std::string>& getRemoteUserAttributeIds() const {
@@ -118,11 +110,7 @@ namespace shibsp {
const XMLApplication* m_base;
std::string m_hash;
std::pair<std::string, std::string> m_attributePrefix;
-#ifndef SHIBSP_LITE
- // RelyingParty properties
- std::map< xmltooling::xstring, boost::shared_ptr<PropertySet> > m_partyMap; // name-based matching
- std::vector< std::pair< boost::shared_ptr<opensaml::saml2md::EntityMatcher>, boost::shared_ptr<PropertySet> > > m_partyVec; // plugin-based matching
-#endif
+
std::vector<std::string> m_remoteUsers, m_frontLogout, m_backLogout;
// manage handler objects
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list