[cpp-sp] branch main updated: Free-hand quick port of IIS code for now.
Scott Cantor
cantor.2 at osu.edu
Tue Jan 14 20:19:41 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=cfb0bba56ed274966f593a95c758cbd799386042
The following commit(s) were added to refs/heads/main by this push:
new cfb0bba5 Free-hand quick port of IIS code for now.
cfb0bba5 is described below
commit cfb0bba56ed274966f593a95c758cbd799386042
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 14 15:19:37 2025 -0500
Free-hand quick port of IIS code for now.
---
iis7_shib/IIS7Request.cpp | 113 ++++++++++++++--------------
iis7_shib/ShibHttpModule.cpp | 27 ++++---
iis7_shib/headers/IIS7Request.hpp | 5 +-
iis7_shib/headers/IIS7_shib.hpp | 69 +++--------------
iis7_shib/register.cpp | 139 +++++++++--------------------------
shibsp/platform/iis/ModuleConfig.cpp | 1 +
shibsp/platform/iis/ModuleConfig.h | 1 +
7 files changed, 124 insertions(+), 231 deletions(-)
diff --git a/iis7_shib/IIS7Request.cpp b/iis7_shib/IIS7Request.cpp
index a6336683..7f0191fd 100644
--- a/iis7_shib/IIS7Request.cpp
+++ b/iis7_shib/IIS7Request.cpp
@@ -21,11 +21,11 @@
#include "IIS7_shib.hpp"
#include <boost/algorithm/string.hpp>
+#include <boost/lexical_cast.hpp>
#include <boost/tokenizer.hpp>
-#include <xercesc/util/Base64.hpp>
-
#include <shibsp/exceptions.h>
+#include <shibsp/util/Misc.h>
#include <codecvt> // 16 bit to 8 bit chars
#include "IIS7Request.hpp"
@@ -33,11 +33,10 @@
#include "ShibUser.hpp"
using namespace Config;
-using xmltooling::logging::Priority;
-IIS7Request::IIS7Request(IHttpContext *pHttpContext, IHttpEventProvider *pEventProvider, bool checkUser, const site_t& site)
- : AbstractSPRequest(SHIBSP_LOGCAT ".IISNative"),
- m_ctx(pHttpContext), m_request(pHttpContext->GetRequest()), m_response(pHttpContext->GetResponse()),
+IIS7Request::IIS7Request(IHttpContext *pHttpContext, IHttpEventProvider *pEventProvider, bool checkUser, const PropertySet& site)
+ : AbstractSPRequest(SHIBSP_LOGCAT ".IIS"),
+ m_ctx(pHttpContext), m_request(pHttpContext->GetRequest()), m_response(pHttpContext->GetResponse()), m_site(site)
m_firsttime(true), m_port(0), m_gotBody(false), m_event(pEventProvider)
{
DWORD len;
@@ -50,11 +49,11 @@ IIS7Request::IIS7Request(IHttpContext *pHttpContext, IHttpEventProvider *pEventP
if (SUCCEEDED(hr)) {
if (len) {
try {
- int secure = lexical_cast<int>(var);
+ int secure = boost::lexical_cast<int>(var);
bSSL = (0 != secure) ? true : false;
}
- catch (const bad_lexical_cast&) {
- log(SPRequest::SPError, "exception converting SERVER_PORT_SECURE value to int");
+ catch (const boost::bad_lexical_cast&) {
+ log(Priority::SHIB_ERROR, "exception converting SERVER_PORT_SECURE value to int");
bSSL = (nullptr != m_request->GetRawHttpRequest()->pSslInfo);
}
}
@@ -66,17 +65,26 @@ IIS7Request::IIS7Request(IHttpContext *pHttpContext, IHttpEventProvider *pEventP
throwError("Get Server Secure", hr);
}
- m_useHeaders = site.m_useHeaders;
- m_useVariables = site.m_useVariables;
+ m_useHeaders = site.getBool(ModuleConfig::USE_HEADERS_PROP_NAME, false);
+ m_safeHeaderNames = site.getBool(ModuleConfig::SAFE_HEADER_NAMES_PROP_NAME, m_useHeaders);
+ m_useVariables = site.getBool(ModuleConfig::USE_VARIABLES_PROP_NAME, true);
+
+ string prop(site.getString(ModuleConfig::ROLE_ATTRIBUTES_PROP_NAME, "");
+ split_to_container(m_roleAttributeNames, prop);
- // Port may come from IIS or from site def.
- if (!g_bNormalizeRequest || (bSSL && site.m_sslport.empty()) || (!bSSL && site.m_port.empty())) {
+ bool normalizeRequest = site.getBool(ModuleConfig::NORMALIZE_REQUEST_PROP_NAME, true);
+ unsigned int site_port = site.getUnsignedInt(ModuleConfig::SITE_PORT_PROP_NAME, 0);
+ unsigned int site_sslport = site.getUnsignedInt(ModuleConfig::SITE_SSLPORT_PROP_NAME, 0);
+ const char* site_name = site.getString(ModuleConfig::SITE_NAME_PROP_NAME, "");
+
+ // Port may come from IIS or from site config.
+ if (!normalizeRequest || (bSSL && !site_sslport) || (!bSSL && !site_port)) {
hr = m_ctx->GetServerVariable("SERVER_PORT", &var, &len);
if (SUCCEEDED(hr)) {
try {
- m_port = lexical_cast<int>(var);
+ m_port = boost::lexical_cast<int>(var);
}
- catch (const bad_lexical_cast&) {
+ catch (const boost::bad_lexical_cast&) {
throwError("Get Port", hr);
}
}
@@ -84,42 +92,41 @@ IIS7Request::IIS7Request(IHttpContext *pHttpContext, IHttpEventProvider *pEventP
throwError("Get Port", hr);
}
}
- else if (bSSL) {
- m_port = atoi(site.m_sslport.c_str());
- }
else {
- m_port = atoi(site.m_port.c_str());
+ m_port = bSSL ? site_sslport : site_port;
}
- // Scheme may come from site def or be derived from IIS.
- m_scheme=site.m_scheme;
- if (m_scheme.empty() || !g_bNormalizeRequest)
+ // Scheme may come from site config or be derived from IIS.
+ m_scheme = site.getString(ModuleConfig::SITE_SCHEME_PROP_NAME, "");
+ if (m_scheme.empty() || !normalizeRequest) {
m_scheme = bSSL ? "https" : "http";
+ }
hr = m_ctx->GetServerVariable("SERVER_NAME", &var, &len);
if (SUCCEEDED(hr)) {
// Make sure SERVER_NAME is "authorized" for use on this site. If not, or empty, set to canonical name.
if (!len) {
- m_hostname = site.m_name;
+ m_hostname = site_name;
}
else {
m_hostname = var;
- if (site.m_name != m_hostname && site.m_aliases.find(m_hostname) == site.m_aliases.end())
- m_hostname = site.m_name;
+ if (site_name != m_hostname && site.m_aliases.find(m_hostname) == site.m_aliases.end()) {
+ vector<string> aliases;
+ string s = site.getString(ModuleConfig::SITE_ALIASES_PROP_NAME, "");
+ split_to_container(aliases, s);
+ if (aliases.find(m_hostname) == aliases.end()) {
+ m_hostname = site_name;
+ }
+ }
}
}
else {
- m_hostname = site.m_name;
+ m_hostname = site_name;
}
hr = m_ctx->GetServerVariable("REMOTE_USER", &var, &len);
if (SUCCEEDED(hr)) {
- if (len) {
- m_remoteUser = var;
- }
- else {
- m_remoteUser = "";
- }
+ m_remoteUser = len ? var : "";
}
else {
throwError("Get remote user", hr);
@@ -131,7 +138,7 @@ IIS7Request::IIS7Request(IHttpContext *pHttpContext, IHttpEventProvider *pEventP
m_firsttime = false;
}
if (!m_firsttime) {
- log(SPDebug, "IIS filter running more than once");
+ log(Priority::SHIB_DEBUG, "IIS filter running more than once");
}
}
}
@@ -139,7 +146,7 @@ IIS7Request::IIS7Request(IHttpContext *pHttpContext, IHttpEventProvider *pEventP
void IIS7Request::setHeader(const char* name, const char* value)
{
if (m_useHeaders) {
- const HRESULT hr (m_request->SetHeader(g_bSafeHeaderNames ? makeSafeHeader(name).c_str() : name, value, static_cast<USHORT>(strlen(value)), TRUE));
+ const HRESULT hr (m_request->SetHeader(m_safeHeaderNames ? makeSafeHeader(name).c_str() : name, value, static_cast<USHORT>(strlen(value)), TRUE));
if (FAILED(hr)) {
throwError("setHeader (Header)", hr);
}
@@ -152,13 +159,11 @@ void IIS7Request::setHeader(const char* name, const char* value)
throwError("setHeader (Variable)", hr);
}
- for (vector<string>::iterator roleAttribute = g_RoleAttributeNames.begin(); roleAttribute != g_RoleAttributeNames.end(); ++roleAttribute) {
- if (*roleAttribute == name) {
- const string str(value);
- tokenizer<escaped_list_separator<char>> tok(str, escaped_list_separator<char>('\\', ';', '"'));
- for (tokenizer<escaped_list_separator<char>>::iterator it = tok.begin(); it != tok.end(); ++it) {
- m_roles.insert(converter.from_bytes(*it));
- }
+ if (m_roleAttributeNames.find(name) != m_roleAttributeNames.end()) {
+ const string str(value);
+ boost::tokenizer<boost::escaped_list_separator<char>> tok(str, boost::escaped_list_separator<char>('\\', ';', '"'));
+ for (tokenizer<escaped_list_separator<char>>::iterator it = tok.begin(); it != tok.end(); ++it) {
+ m_roles.insert(converter.from_bytes(*it));
}
}
}
@@ -170,17 +175,16 @@ void IIS7Request::setRemoteUser(const char* user)
// Setting the variable REMOTE_USER fails, so set the Principal if we are called appropriately.
// Getting REMOTE_USER goes via the Principal.
- auto_ptr_XMLCh widen(user);
IAuthenticationProvider *auth = dynamic_cast<IAuthenticationProvider*>(m_event);
if (auth) {
- if (!g_authNRole.empty()) {
- m_roles.insert(g_authNRole);
- }
+ string authnRole(m_site.getString(ModuleConfig::AUTHENTICATED_ROLE_PROP_NAME, "ShibbolethAuthnN"));
+ std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
+ m_roles.insert(converter.from_bytes(authnRole));
auth->SetUser(new ShibUser(user, m_roles));
}
else {
- log(SPError, "attempt to set REMOTE_USER in an inappropriate context");
+ log(Priority::SHIB_ERROR, "attempt to set REMOTE_USER in an inappropriate context");
}
}
@@ -203,14 +207,15 @@ void IIS7Request::clearHeader(const char* rawname, const char* cginame)
m_allhttp = (nullptr == val) ? "" : val;
}
if (!m_allhttp.empty()) {
- string hdr = (g_bSafeHeaderNames ? ("HTTP_" + makeSafeHeader(cginame + 5)) : string(cginame)) + ':';
+ string hdr = (m_safeHeaderNames ? ("HTTP_" + makeSafeHeader(cginame + 5)) : string(cginame)) + ':';
if (strstr(m_allhttp.c_str(), hdr.c_str())) {
- throw opensaml::SecurityPolicyException("Attempt to spoof header ($1) was detected.", params(1, hdr.c_str()));
+ throw SessionException(string("Attempt to spoof header (") + hdr + ") was detected.");
}
}
}
- HRESULT hr = m_request->SetHeader(g_bSafeHeaderNames ? makeSafeHeader(rawname).c_str() : rawname,
- g_unsetHeaderValue.c_str(), static_cast<USHORT>(g_unsetHeaderValue.length()), TRUE);
+ string unsetHeaderValue(g_Config->getAgent().getString("unsetHeaderValue", ""));
+ HRESULT hr = m_request->SetHeader(m_safeHeaderNames ? makeSafeHeader(rawname).c_str() : rawname,
+ unsetHeaderValue.c_str(), static_cast<USHORT>(unsetHeaderValue.length()), TRUE);
if (FAILED(hr)) {
throwError("clearHeader", hr);
}
@@ -253,12 +258,10 @@ string IIS7Request::getSecureHeader(const char* name) const
}
return "";
}
- PCSTR p = m_request->GetHeader(g_bSafeHeaderNames ? makeSafeHeader(name).c_str() : name);
+ PCSTR p = m_request->GetHeader(m_safeHeaderNames ? makeSafeHeader(name).c_str() : name);
return (nullptr == p) ? "" : p;
}
-//
-// XMLTooling::GenericRequest
-//
+
const char* IIS7Request::getScheme() const
{
return m_scheme.c_str();
@@ -438,7 +441,7 @@ string IIS7Request::makeSafeHeader(const char* rawname) const
void IIS7Request::logFatal(const string& operation, HRESULT hr) const
{
string msg(operation + " failed: " + lexical_cast<string>(hr));
- log(SPRequest::SPCrit, msg.c_str());
+ log(Priority::SHIB_CRIT, msg.c_str());
if (m_response) {
m_response->SetStatus(static_cast<USHORT>(SHIBSP_HTTP_STATUS_ERROR), "Fatal Server Error", 0, hr);
}
diff --git a/iis7_shib/ShibHttpModule.cpp b/iis7_shib/ShibHttpModule.cpp
index e83636bc..10b71793 100644
--- a/iis7_shib/ShibHttpModule.cpp
+++ b/iis7_shib/ShibHttpModule.cpp
@@ -30,6 +30,7 @@
#include <winreg.h>
#include <boost/algorithm/string.hpp>
+#include <boost/lexical_cast.hpp>
using namespace Config;
using namespace std;
@@ -40,19 +41,24 @@ ShibHttpModule::DoHandler(
_In_ IHttpEventProvider * pProvider
)
{
+ const PropertySet* site = g_ModuleConfig->getSiteConfig(
+ boost::lexical_cast<string>(pHttpContext->GetSite()->GetSiteId()).c_str());
+ if (!site)
+ return RQ_NOTIFICATION_CONTINUE;
+
+ string prefix(site->getString(ModuleConfig::HANDLER_PREFIX_PROP_NAME, "/Shibboleth.sso"));
+ std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
+ wstring handlerPrefix = converter.from_bytes(prefix);
+
// Quickly check the URL.
// Calling GetScriptName is safe here since we don't care about "visible to other filters" paths, just our path.
// This saves us converting from 8 bit ascii up to 16 bit for the compare against something which was only in 16
// bits to speed this path. In V4 we can look at the local request
const wstring url(pHttpContext->GetScriptName());
- if (url.length() < g_handlerPrefix.length() || !starts_with(url, g_handlerPrefix))
+ if (url.length() < handlerPrefix.length() || !starts_with(url, handlerPrefix))
return RQ_NOTIFICATION_CONTINUE;
- map<string,site_t>::const_iterator map_i = g_Sites.find(lexical_cast<string>(pHttpContext->GetSite()->GetSiteId()));
- if (map_i == g_Sites.end())
- return RQ_NOTIFICATION_CONTINUE;
-
- IIS7Request handler(pHttpContext, pProvider, false, map_i->second);
+ IIS7Request handler(pHttpContext, pProvider, false, *site);
pair<bool, long> res = handler.getServiceProvider().doHandler(handler);
@@ -64,17 +70,18 @@ ShibHttpModule::DoHandler(
REQUEST_NOTIFICATION_STATUS
ShibHttpModule::DoFilter(
- _In_ IHttpContext * pHttpContext,
+ _In_ IHttpContext * pHttpContext,
_In_ IHttpEventProvider * pProvider
)
{
const IHttpRequest* req = pHttpContext->GetRequest();
- map<string,site_t>::const_iterator map_i = g_Sites.find(lexical_cast<string>(pHttpContext->GetSite()->GetSiteId()));
- if (map_i == g_Sites.end())
+ const PropertySet* site = g_ModuleConfig->getSiteConfig(
+ boost::lexical_cast<string>(pHttpContext->GetSite()->GetSiteId()).c_str());
+ if (!site)
return RQ_NOTIFICATION_CONTINUE;
- IIS7Request filter(pHttpContext, pProvider, true, map_i->second);
+ IIS7Request filter(pHttpContext, pProvider, true, *site);
pair<bool, long> res = filter.getServiceProvider().doAuthentication(filter, true);
if (res.first) {
diff --git a/iis7_shib/headers/IIS7Request.hpp b/iis7_shib/headers/IIS7Request.hpp
index e844b67d..6be45597 100644
--- a/iis7_shib/headers/IIS7Request.hpp
+++ b/iis7_shib/headers/IIS7Request.hpp
@@ -28,16 +28,19 @@ private:
IHttpRequest* m_request;
IHttpResponse* m_response;
IHttpEventProvider* m_event;
+ const PropertySet& m_site;
bool m_firsttime;
int m_port;
string m_hostname, m_scheme;
bool m_useVariables;
bool m_useHeaders;
+ bool m_safeHeaderNames;
mutable string m_remoteUser;
mutable vector<string> m_certs;
mutable string m_body;
mutable bool m_gotBody;
string m_allhttp;
+ set<string> m_roleAttributeNames;
set<wstring> m_roles;
public:
@@ -45,7 +48,7 @@ public:
_In_ IHttpContext *pHttpContext,
_In_ IHttpEventProvider *pEventProvider,
_In_ bool checkUser,
- _In_ const Config::site_t& site
+ _In_ const PropertySet& site
);
string makeSafeHeader(const char* rawname) const;
bool isUseHeaders() { return m_useHeaders; }
diff --git a/iis7_shib/headers/IIS7_shib.hpp b/iis7_shib/headers/IIS7_shib.hpp
index da2690ba..22edaa04 100644
--- a/iis7_shib/headers/IIS7_shib.hpp
+++ b/iis7_shib/headers/IIS7_shib.hpp
@@ -31,83 +31,32 @@
#include <shibsp/AgentConfig.h>
#include <shibsp/exceptions.h>
#include <shibsp/logging/Priority.h>
+#include <shibsp/platform/iis/ModuleConfig.h>
#include <shibsp/util/PropertySet.h>
-#include <xmltooling/Lockable.h>
-#include <xmltooling/util/XMLHelper.h>
-
//
// Miscelanea
//
-#include <set>
-#include <list>
-#include <boost/lexical_cast.hpp>
+#include <memory>
#include <string>
+using namespace shibsp::iis;
using namespace shibsp;
-using namespace xmltooling;
-using namespace xercesc;
-using namespace boost;
using namespace std;
-// globals
-namespace Config {
- static const XMLCh path[] = UNICODE_LITERAL_4(p, a, t, h);
- static const XMLCh validate[] = UNICODE_LITERAL_8(v, a, l, i, d, a, t, e);
- static const XMLCh name[] = UNICODE_LITERAL_4(n, a, m, e);
- static const XMLCh port[] = UNICODE_LITERAL_4(p, o, r, t);
- static const XMLCh sslport[] = UNICODE_LITERAL_7(s, s, l, p, o, r, t);
- static const XMLCh scheme[] = UNICODE_LITERAL_6(s, c, h, e, m, e);
- static const XMLCh id[] = UNICODE_LITERAL_2(i, d);
- static const XMLCh useHeaders[] = UNICODE_LITERAL_10(u, s, e, H, e, a, d, e, r, s);
- static const XMLCh useVariables[] = UNICODE_LITERAL_12(u, s, e, V, a, r, i, a, b, l, e, s);
- static const XMLCh handlerPrefix[] = UNICODE_LITERAL_13(h, a, n, d, l, e, r, P, r, e, f, i, x);
- static const XMLCh Alias[] = UNICODE_LITERAL_5(A, l, i, a, s);
- static const XMLCh Site[] = UNICODE_LITERAL_4(S, i, t, e);
- static const XMLCh Role[] = UNICODE_LITERAL_4(R, o, l, e);
+// Globals.
+namespace Config {
static const char* SpoofHeaderName = "ShibSpoofCheck";
extern HINSTANCE g_hinstDLL;
- extern SPConfig* g_Config;
- extern bool g_bNormalizeRequest;
- extern string g_unsetHeaderValue, g_spoofKey;
+ extern AgentConfig* g_Config;
+ extern unique_ptr<ModuleConfig> g_ModuleConfig;
+ extern string g_spoofKey;
extern bool g_checkSpoofing;
extern bool g_catchAll;
- extern bool g_bSafeHeaderNames;
- extern bool g_bUseHeaders;
- extern bool g_bUseVariables;
- extern vector<string> g_NoCerts;
- extern wstring g_handlerPrefix;
-
- struct site_t {
- site_t(const DOMElement* e)
- : m_name(XMLHelper::getAttrString(e, "", name)),
- m_scheme(XMLHelper::getAttrString(e, "", scheme)),
- m_port(XMLHelper::getAttrString(e, "", port)),
- m_sslport(XMLHelper::getAttrString(e, "", sslport)),
- m_useHeaders(XMLHelper::getAttrBool(e, g_bUseHeaders, useHeaders)),
- m_useVariables(XMLHelper::getAttrBool(e, g_bUseVariables, useVariables))
- {
- e = XMLHelper::getFirstChildElement(e, Alias);
- while (e) {
- if (e->hasChildNodes()) {
- auto_ptr_char alias(e->getTextContent());
- m_aliases.insert(alias.get());
- }
- e = XMLHelper::getNextSiblingElement(e, Alias);
- }
- }
- string m_scheme, m_port, m_sslport, m_name;
- bool m_useHeaders, m_useVariables;
- set<string> m_aliases;
- };
-
- extern map<string, site_t> g_Sites;
-
- extern wstring g_authNRole;
- extern vector<string> g_RoleAttributeNames;
}
+// TODO: Replace with standard logging calls.
BOOL LogEvent(
WORD wType,
DWORD dwEventID,
diff --git a/iis7_shib/register.cpp b/iis7_shib/register.cpp
index 5dc54191..410602d5 100644
--- a/iis7_shib/register.cpp
+++ b/iis7_shib/register.cpp
@@ -26,28 +26,19 @@
// Project
#include "IIS7_shib.hpp"
#include "ShibHttpModule.hpp"
-#include <xmltooling/logging.h>
#pragma warning(disable: 4996)
#include <codecvt> // 16 bit to 8 bit and vice versa chars
#include <boost/algorithm/string.hpp>
-
-using xmltooling::logging::Category;
-using xmltooling::logging::Priority;
+#include <boost/lexical_cast.hpp>
namespace Config {
HINSTANCE g_hinstDLL;
- SPConfig* g_Config = nullptr;
- map<string, site_t> g_Sites;
+ AgentConfig* g_Config = nullptr;
+ unique_ptr<ModuleConfig> g_ModuleConfig;
bool g_bNormalizeRequest = true;
string g_unsetHeaderValue, g_spoofKey;
bool g_checkSpoofing = true;
bool g_catchAll = false;
- bool g_bSafeHeaderNames = false;
- bool g_bUseHeaders = false;
- wstring g_handlerPrefix(L"");
- bool g_bUseVariables = true;
- vector<string> g_NoCerts;
- vector<string> g_RoleAttributeNames;
wstring g_authNRole(L"ShibbolethAuthN");
}
@@ -94,113 +85,51 @@ RegisterModule(
IHttpServer * pHttpServer
)
{
- Category& log = Category::getInstance(SHIBSP_LOGCAT ".IISNative");
-
if (g_Config) {
- log.warn("reentrant IIS module initialization, ignoring...");
+ // Safe, since we're already init'd.
+ Category::getInstance(SHIBSP_LOGCAT ".IIS").warn("reentrant IIS module initialization, ignoring...");
return S_OK;
}
- g_Config = &SPConfig::getConfig();
- g_Config->setFeatures(
- SPConfig::Listener |
- SPConfig::Caching |
- SPConfig::RequestMapping |
- SPConfig::InProcess |
- SPConfig::Logging |
- SPConfig::Handlers
- );
+ g_Config = &AgentConfig::getConfig();
if (!g_Config->init()) {
- g_Config = nullptr;
- log.fatal("IIS module failed during library initialization, check native log for help");
+ log.fatal("IIS module failed during library initialization, check log for detail");
+ g_Config=nullptr;
return E_FAIL;
}
+ Category& log = Category::getInstance(SHIBSP_LOGCAT ".IIS");
+
+ // Access implementation-specifics and create site mappings.
+ const Agent& agent = g_Config->getAgent();
+
try {
- if (!g_Config->instantiate(nullptr, true))
- throw runtime_error("unknown error");
- } catch (const std::exception& ex) {
- log.fatal("IIS module failed during library initialization: %s", ex.what());
- g_Config->term();
+ g_ModuleConfig.reset(iis::ModuleConfig::newNoduleConfig()));
+ } catch (const exception& ex) {
+ log.fatal("IIS module failed during module configuration installation: %s", ex.what());
g_Config=nullptr;
return E_FAIL;
}
- // Access implementation-specifics and site mappings.
- ServiceProvider* sp = g_Config->getServiceProvider();
- Locker locker(sp);
- const PropertySet* props = sp->getPropertySet("InProcess");
- if (props) {
- pair<bool, bool> flag = props->getBool("checkSpoofing");
- g_checkSpoofing = !flag.first || flag.second;
- flag = props->getBool("catchAll");
- g_catchAll = flag.first && flag.second;
-
- pair<bool, const char*> unsetValue = props->getString("unsetHeaderValue");
- if (unsetValue.first)
- g_unsetHeaderValue = unsetValue.second;
- if (g_checkSpoofing) {
- unsetValue = props->getString("spoofKey");
- if (unsetValue.first)
- g_spoofKey = unsetValue.second;
- else {
- _invalid_parameter_handler old = _set_invalid_parameter_handler(_my_invalid_parameter_handler);
- unsigned int randkey=0, randkey2=0, randkey3=0, randkey4=0;
- if (rand_s(&randkey) == 0 && rand_s(&randkey2) == 0 && rand_s(&randkey3) == 0 && rand_s(&randkey4) == 0) {
- _set_invalid_parameter_handler(old);
- g_spoofKey = lexical_cast<string>(randkey) + lexical_cast<string>(randkey2) +
- lexical_cast<string>(randkey3) + lexical_cast<string>(randkey4);
- }
- else {
- _set_invalid_parameter_handler(old);
- log.fatal("IIS module failed to generate a random anti-spoofing key");
- locker.assign(); // pops lock on SP config
- g_Config->term();
- g_Config = nullptr;
- return E_FAIL;
- }
+ g_checkSpoofing = agent.getBool("checkSpoofing", true(;
+ g_catchAll = agent.getBool("catchAll", true);
+
+ if (g_checkSpoofing) {
+ g_spoofKey = agent.getString("spoofKey", "");
+ if (g_spoofKey.empty()) {
+ _invalid_parameter_handler old = _set_invalid_parameter_handler(_my_invalid_parameter_handler);
+ unsigned int randkey=0, randkey2=0, randkey3=0, randkey4=0;
+ if (rand_s(&randkey) == 0 && rand_s(&randkey2) == 0 && rand_s(&randkey3) == 0 && rand_s(&randkey4) == 0) {
+ _set_invalid_parameter_handler(old);
+ g_spoofKey = boost::lexical_cast<string>(randkey) + boost::lexical_cast<string>(randkey2) +
+ boost::lexical_cast<string>(randkey3) + boost::lexical_cast<string>(randkey4);
}
- }
-
- props = props->getPropertySet("ISAPI");
- if (props) {
- flag = props->getBool("normalizeRequest");
- g_bNormalizeRequest = !flag.first || flag.second;
- flag = props->getBool("useHeaders");
- g_bUseHeaders = flag.first && flag.second;
- flag = props->getBool("useVariables");
- g_bUseVariables= !flag.first || flag.second;
- flag = props->getBool("safeHeaderNames");
- if (g_bUseHeaders)
- g_bSafeHeaderNames = !flag.first || flag.second;
- else
- g_bSafeHeaderNames = flag.first && flag.second;
-
- const string prefix(XMLHelper::getAttrString(nullptr, "/Shibboleth.sso", handlerPrefix));
- std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
- g_handlerPrefix = converter.from_bytes(prefix);
-
- const DOMElement* site = XMLHelper::getFirstChildElement(nullptr, Site);
- while (site) {
- string id(XMLHelper::getAttrString(site, "", id));
- if (!id.empty())
- g_Sites.insert(make_pair(id, site_t(site)));
- site = XMLHelper::getNextSiblingElement(site, Site);
- }
- const PropertySet* roles = props->getPropertySet("Roles");
- if (roles) {
- const pair<bool, const char*> authNRoleFlag = roles->getString("authNRole");
-
- if (authNRoleFlag.first) {
- wstring rolestr(converter.from_bytes(string(authNRoleFlag.second)));
-
- g_authNRole = rolestr;
- }
-
- const pair<bool, const char*> theRoles = roles->getString("roleAttributes");
- if (theRoles.first) {
- boost::split(g_RoleAttributeNames, theRoles.second, boost::algorithm::is_space(), boost::algorithm::token_compress_on);
- }
+ else {
+ _set_invalid_parameter_handler(old);
+ log.fatal("IIS module failed to generate a random anti-spoofing key");
+ g_Config->term();
+ g_Config = nullptr;
+ return E_FAIL;
}
}
}
diff --git a/shibsp/platform/iis/ModuleConfig.cpp b/shibsp/platform/iis/ModuleConfig.cpp
index e519081e..55017d7c 100644
--- a/shibsp/platform/iis/ModuleConfig.cpp
+++ b/shibsp/platform/iis/ModuleConfig.cpp
@@ -60,6 +60,7 @@ const char ModuleConfig::AUTHENTICATED_ROLE_PROP_NAME[] = "authenticatedRole";
const char ModuleConfig::ROLE_ATTRIBUTES_PROP_NAME[] = "roleAttributes";
const char ModuleConfig::NORMALIZE_REQUEST_PROP_NAME[] = "normalizeRequest";
const char ModuleConfig::SAFE_HEADER_NAMES_PROP_NAME[] = "safeHeaderNames";
+const char ModuleConfig::HANDLER_PREFIX_PROP_NAME[] = "handlerPrefix";
const char ModuleConfig::SITE_NAME_PROP_NAME[] = "name";
const char ModuleConfig::SITE_SCHEME_PROP_NAME[] = "scheme";
diff --git a/shibsp/platform/iis/ModuleConfig.h b/shibsp/platform/iis/ModuleConfig.h
index 19311440..60fd6a22 100644
--- a/shibsp/platform/iis/ModuleConfig.h
+++ b/shibsp/platform/iis/ModuleConfig.h
@@ -54,6 +54,7 @@ namespace shibsp {
static const char ROLE_ATTRIBUTES_PROP_NAME[];
static const char NORMALIZE_REQUEST_PROP_NAME[];
static const char SAFE_HEADER_NAMES_PROP_NAME[];
+ static const char HANDLER_PREFIX_PROP_NAME[];
// Site
static const char SITE_NAME_PROP_NAME[];
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list