[cpp-sp] branch main updated: Fix some ifdefs and start implementing auth cache.
Scott Cantor
cantor.2 at osu.edu
Wed Jan 22 21:54:43 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=a1c01db4a96d74157cba9080362fd49d3753e2f3
The following commit(s) were added to refs/heads/main by this push:
new a1c01db4 Fix some ifdefs and start implementing auth cache.
a1c01db4 is described below
commit a1c01db4a96d74157cba9080362fd49d3753e2f3
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jan 22 16:54:39 2025 -0500
Fix some ifdefs and start implementing auth cache.
---
.../remoting/impl/AbstractHTTPRemotingService.cpp | 51 +++++++++++++++++++++-
shibsp/remoting/impl/AbstractHTTPRemotingService.h | 15 +++++++
shibsp/remoting/impl/CurlHTTPRemotingService.cpp | 21 ++++++++-
shibsp/util/ReloadableXMLFile.cpp | 4 +-
shibsp/util/ReloadableXMLFile.h | 4 +-
5 files changed, 88 insertions(+), 7 deletions(-)
diff --git a/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp b/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp
index 82c3cbf6..ac8fd98f 100644
--- a/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp
@@ -21,6 +21,7 @@
#include "internal.h"
#include "exceptions.h"
#include "AgentConfig.h"
+#include "logging/Category.h"
#include "remoting/SecretSource.h"
#include "remoting/impl/AbstractHTTPRemotingService.h"
#include "util/BoostPropertySet.h"
@@ -69,7 +70,6 @@ AbstractHTTPRemotingService::AbstractHTTPRemotingService(ptree& pt)
m_userAgent = props.getString(USER_AGENT_PROP_NAME, "");
m_baseURL = props.getString(BASE_URL_PROP_NAME, BASE_URL_PROP_DEFAULT);
m_authMethod = getAuthMethod(props.getString(AUTH_METHOD_PROP_NAME, AUTH_METHOD_PROP_DEFAULT));
- m_authCachingCookie = props.getString(AUTH_CACHING_COOKIE_PROP_NAME, AUTH_CACHING_COOKIE_PROP_DEFAULT);
m_connectTimeout = props.getUnsignedInt(CONNECT_TIMEOUT_PROP_NAME, CONNECT_TIMEOUT_PROP_DEFAULT);
m_timeout = props.getUnsignedInt(TIMEOUT_PROP_NAME, TIMEOUT_PROP_DEFAULT);
@@ -77,7 +77,45 @@ AbstractHTTPRemotingService::AbstractHTTPRemotingService(ptree& pt)
if (!m_caFile.empty()) {
AgentConfig::getConfig().getPathResolver().resolve(m_caFile, PathResolver::SHIBSP_CFG_FILE);
}
+
+ m_authCachingCookie = props.getString(AUTH_CACHING_COOKIE_PROP_NAME, AUTH_CACHING_COOKIE_PROP_DEFAULT);
+ if (!m_authCachingCookie.empty()) {
+#if defined(HAVE_CXX17)
+ m_authcachelock.reset(new shared_mutex());
+#elif defined(HAVE_CXX14)
+ m_lock.reset(new shared_timed_mutex());
+#else
+ Category::getInstance(SHIBSP_LOGCAT ".RemotingService.HTTP").warn(
+ "disabling agent authentication caching due to older C++ compiler");
+ m_authCachingCookie.clear();
+#endif
+ }
+}
+
+#ifdef HAVE_CXX14
+DDF AbstractHTTPRemotingService::send(const DDF& in) const
+{
+ DDF output = AbstractRemotingService::send(in);
+ if (!m_authCachingCookie.empty()) {
+ // TODO: Check for auth cache cookie value coming back and stash off using a write lock.
+ string latestValue;
+ if (!latestValue.empty()) {
+ m_authcachelock->lock_shared();
+ if (m_authCachingValue != latestValue) {
+ m_authcachelock->unlock_shared();
+#if defined(HAVE_CXX17)
+ lock_guard<shared_mutex> locker(*m_authcachelock);
+#elif defined(HAVE_CXX14)
+ lock_guard<shared_timed_mutex> locker(*m_authcachelock);
+#endif
+ m_authCachingValue = latestValue;
+ }
+ }
+ }
+
+ return output;
}
+#endif
const SecretSource* AbstractHTTPRemotingService::getSecretSource(bool required) const
{
@@ -113,6 +151,17 @@ const char* AbstractHTTPRemotingService::getAuthCachingCookie() const
return m_authCachingCookie.c_str();
}
+string AbstractHTTPRemotingService::getAuthCachingCookieValue() const
+{
+#if defined(HAVE_CXX14)
+ if (!m_authCachingCookie.empty()) {
+ shared_lock<shared_mutex> locker(*m_authcachelock);
+ return m_authCachingValue;
+ }
+#endif
+ return "";
+}
+
AbstractHTTPRemotingService::auth_t AbstractHTTPRemotingService::getAuthMethod() const
{
return m_authMethod;
diff --git a/shibsp/remoting/impl/AbstractHTTPRemotingService.h b/shibsp/remoting/impl/AbstractHTTPRemotingService.h
index 272a460e..c6a9905a 100644
--- a/shibsp/remoting/impl/AbstractHTTPRemotingService.h
+++ b/shibsp/remoting/impl/AbstractHTTPRemotingService.h
@@ -24,6 +24,9 @@
#include "remoting/impl/AbstractRemotingService.h"
#include <memory>
+#ifdef HAVE_CXX14
+# include <shared_mutex>
+#endif
namespace shibsp {
@@ -37,6 +40,10 @@ namespace shibsp {
public:
virtual ~AbstractHTTPRemotingService();
+#ifdef HAVE_CXX14
+ DDF send(const DDF& in) const;
+#endif
+
/**
* Common types of authentication that may be supported.
*/
@@ -55,6 +62,7 @@ namespace shibsp {
void setUserAgent(const char* ua);
auth_t getAuthMethod() const;
const char* getAuthCachingCookie() const;
+ std::string getAuthCachingCookieValue() const;
unsigned int getConnectTimeout() const;
unsigned int getTimeout() const;
const char* getCAFile() const;
@@ -89,10 +97,17 @@ namespace shibsp {
std::string m_agentID;
std::string m_userAgent;
std::string m_authCachingCookie;
+ mutable std::string m_authCachingValue;
std::string m_caFile;
auth_t m_authMethod;
unsigned int m_connectTimeout;
unsigned int m_timeout;
+ /** Shared lock for guarding auth cache value. */
+#if defined(HAVE_CXX17)
+ std::unique_ptr<std::shared_mutex> m_authcachelock;
+#elif defined(HAVE_CXX14)
+ std::unique_ptr<std::shared_timed_mutex> m_authcachelock;
+#endif
};
};
diff --git a/shibsp/remoting/impl/CurlHTTPRemotingService.cpp b/shibsp/remoting/impl/CurlHTTPRemotingService.cpp
index 84db6cb1..13d28376 100644
--- a/shibsp/remoting/impl/CurlHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/CurlHTTPRemotingService.cpp
@@ -69,6 +69,7 @@ namespace {
CURL* checkout() const;
void checkin(CURL* handle) const;
+ void attachCachedAuthentication(CURL* handle) const;
private:
Category& m_log;
@@ -217,12 +218,13 @@ CURL* CurlHTTPRemotingService::checkout() const
// If a free connection exists, return it.
if (!m_pool.empty()) {
- CURL* handle = m_pool.back();
+ CURL* m_handle = m_pool.back();
m_pool.pop_back();
m_poolsize--;
m_lock.unlock();
+ attachCachedAuthentication(m_handle);
m_log.debug("returning existing connection handle from pool");
- return handle;
+ return m_handle;
}
m_lock.unlock();
@@ -273,6 +275,8 @@ CURL* CurlHTTPRemotingService::checkout() const
// Password will be acquired during call.
SHIB_CURL_SET(CURLOPT_USERNAME, getAgentID());
+ attachCachedAuthentication(m_handle);
+
SHIB_CURL_SET(CURLOPT_WRITEFUNCTION, &curl_write_hook);
SHIB_CURL_SET(CURLOPT_DEBUGFUNCTION, &curl_debug_hook);
SHIB_CURL_SET(CURLOPT_DEBUGDATA, &m_curllog);
@@ -299,6 +303,19 @@ void CurlHTTPRemotingService::checkin(CURL* handle) const
}
}
+void CurlHTTPRemotingService::attachCachedAuthentication(CURL* m_handle) const
+{
+ const char* name = getAuthCachingCookie();
+ if (name) {
+ string val(getAuthCachingCookieValue());
+ if (!val.empty()) {
+ val = name + '=' + val;
+ SHIB_CURL_SET(CURLOPT_COOKIE, val.c_str());
+ }
+ }
+
+}
+
long CurlHTTPRemotingService::send(const char* path, istream& input, ostream& output) const
{
CurlOperation op(*this);
diff --git a/shibsp/util/ReloadableXMLFile.cpp b/shibsp/util/ReloadableXMLFile.cpp
index dd8e4deb..315d0b91 100644
--- a/shibsp/util/ReloadableXMLFile.cpp
+++ b/shibsp/util/ReloadableXMLFile.cpp
@@ -63,9 +63,9 @@ ReloadableXMLFile::ReloadableXMLFile(const string& rootElementName, ptree& pt, C
#endif
log.info("using path (%s), will %smonitor for changes", m_source.c_str(), reloadChanges ? "" : "not ");
if (reloadChanges) {
-#ifdef HAVE_CXX17
+#if defined(HAVE_CXX17)
m_lock.reset(new shared_mutex());
-#elif HAVE_CXX14
+#elif defined(HAVE_CXX14)
m_lock.reset(new shared_timed_mutex());
#endif
}
diff --git a/shibsp/util/ReloadableXMLFile.h b/shibsp/util/ReloadableXMLFile.h
index d6008db4..39cd72f2 100644
--- a/shibsp/util/ReloadableXMLFile.h
+++ b/shibsp/util/ReloadableXMLFile.h
@@ -171,9 +171,9 @@ namespace shibsp {
time_t m_filestamp;
/** Shared lock for guarding reloads. */
-#ifdef HAVE_CXX17
+#if defined(HAVE_CXX17)
std::unique_ptr<std::shared_mutex> m_lock;
-#elif HAVE_CXX14
+#elif defined(HAVE_CXX14)
std::unique_ptr<std::shared_timed_mutex> m_lock;
#endif
};
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list