[cpp-sp] 01/02: Remove stale code.
Scott Cantor
cantor.2 at osu.edu
Tue Jun 24 18:58:40 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=34facef6a2f0ce41dd6a00f217d644d7ee6d6dc9
commit 34facef6a2f0ce41dd6a00f217d644d7ee6d6dc9
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 24 14:43:07 2025 -0400
Remove stale code.
---
shibsp/handler/impl/AssertionConsumerService.cpp | 205 ------------
shibsp/handler/impl/SAML2Consumer.cpp | 404 -----------------------
2 files changed, 609 deletions(-)
diff --git a/shibsp/handler/impl/AssertionConsumerService.cpp b/shibsp/handler/impl/AssertionConsumerService.cpp
deleted file mode 100644
index 8f5462d2..00000000
--- a/shibsp/handler/impl/AssertionConsumerService.cpp
+++ /dev/null
@@ -1,205 +0,0 @@
-/**
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * handler/impl/AssertionConsumerService.cpp
- *
- * Base class for handlers that create sessions by consuming SSO protocol responses.
- */
-
-#include "internal.h"
-#include "exceptions.h"
-#include "SPRequest.h"
-#include "handler/AssertionConsumerService.h"
-#include "logging/Category.h"
-#include "util/CGIParser.h"
-
-#include <ctime>
-
-using namespace shibsp;
-using namespace boost::property_tree;
-using namespace std;
-
-AssertionConsumerService::AssertionConsumerService(const ptree& pt, Category& log)
- : AbstractHandler(pt, log)
-{
-}
-
-AssertionConsumerService::~AssertionConsumerService()
-{
-}
-
-pair<bool,long> AssertionConsumerService::run(SPRequest& request, bool isHandler) const
-{
- // Check for a message back to the ACS from a post-session hook.
- if (request.getQueryString() && strstr(request.getQueryString(), "hook=1")) {
- // Parse the query string only to preserve any POST data.
- CGIParser cgi(request, true);
- pair<CGIParser::walker,CGIParser::walker> param = cgi.getParameters("hook");
- if (param.first != param.second && param.first->second && !strcmp(param.first->second, "1")) {
- string target;
- param = cgi.getParameters("target");
- if (param.first != param.second && param.first->second)
- target = param.first->second;
- return finalizeResponse(request, target);
- }
- }
-
-#ifndef SHIBSP_LITE
- // Locate policy key.
- pair<bool,const char*> prop = getString("policyId", shibspconstants::ASCII_SHIBSPCONFIG_NS); // may be namespace-qualified if inside handler element
- if (!prop.first)
- prop = getString("policyId"); // try unqualified
- if (!prop.first)
- prop = application.getString("policyId"); // unqualified in Application(s) element
-
- // Lock metadata for use by policy.
- Locker metadataLocker(application.getMetadataProvider());
-
- // Create the policy.
- scoped_ptr<opensaml::SecurityPolicy> policy(
- application.getServiceProvider().getSecurityPolicyProvider()->createSecurityPolicy(
- getProfile(), application, &IDPSSODescriptor::ELEMENT_QNAME, prop.second
- )
- );
-
- string relayState;
- scoped_ptr<XMLObject> msg;
- try {
- // Decode the message and process it in a protocol-specific way.
- msg.reset(m_decoder->decode(relayState, httpRequest, &httpResponse, *(policy.get())));
- if (!msg)
- throw BindingException("Failed to decode an SSO protocol response.");
- implementProtocol(application, httpRequest, httpResponse, *policy, nullptr, *msg);
-
- // History cookie.
- auto_ptr_char issuer(policy->getIssuer() ? policy->getIssuer()->getName() : nullptr);
- if (issuer.get() && *issuer.get())
- maintainHistory(application, httpRequest, httpResponse, issuer.get());
-
- const EntityDescriptor* entity =
- dynamic_cast<const EntityDescriptor*>(policy->getIssuerMetadata() ? policy->getIssuerMetadata()->getParent() : nullptr);
- prop = application.getRelyingParty(entity)->getString("sessionHook");
- if (prop.first) {
- string hook(prop.second);
- httpRequest.absolutize(hook);
-
- // Compute the return URL. We use a self-referential link plus a hook indicator to break the cycle
- // and the relay state.
- const URLEncoder* encoder = XMLToolingConfig::getConfig().getURLEncoder();
- string returnURL = httpRequest.getRequestURL();
- returnURL = returnURL.substr(0, returnURL.find('?')) + "?hook=1";
- if (!relayState.empty())
- returnURL += "&target=" + encoder->encode(relayState.c_str());
- if (hook.find('?') == string::npos)
- hook += '?';
- else
- hook += '&';
- hook += "return=" + encoder->encode(returnURL.c_str());
-
- // Add the translated target resource in case it's of interest.
- if (!relayState.empty()) {
- try {
- recoverRelayState(application, httpRequest, httpResponse, relayState, false);
- hook += "&target=" + encoder->encode(relayState.c_str());
- }
- catch (const std::exception& ex) {
- m_log.warn("error recovering relay state: %s", ex.what());
- }
- }
-
- return make_pair(true, httpResponse.sendRedirect(hook.c_str()));
- }
-
- return finalizeResponse(application, httpRequest, httpResponse, relayState);
- }
- catch (XMLToolingException& ex) {
- m_log.warn("error processing incoming assertion: %s", ex.what());
-
- // Recover relay state.
- if (!relayState.empty()) {
- try {
- recoverRelayState(application, httpRequest, httpResponse, relayState, false);
- }
- catch (const std::exception& rsex) {
- m_log.warn("error recovering relay state: %s", rsex.what());
- relayState.erase();
- recoverRelayState(application, httpRequest, httpResponse, relayState, false);
- }
- }
-
- // Check for isPassive error condition.
- const char* sc2 = ex.getProperty("statusCode2");
- if (sc2 && !strcmp(sc2, "urn:oasis:names:tc:SAML:2.0:status:NoPassive")) {
- pair<bool,bool> ignore = getBool("ignoreNoPassive", shibspconstants::ASCII_SHIBSPCONFIG_NS); // may be namespace-qualified inside handler element
- if (!ignore.first)
- ignore = getBool("ignoreNoPassive"); // try unqualified
- if (ignore.first && ignore.second && !relayState.empty()) {
- m_log.debug("ignoring SAML status of NoPassive and redirecting to resource...");
- return make_pair(true, httpResponse.sendRedirect(relayState.c_str()));
- }
- }
-
- if (!relayState.empty()) {
- ex.addProperty("RelayState", relayState.c_str());
- }
-
- // If no sign of annotation, try to annotate it now.
- if (!ex.getProperty("statusCode")) {
- annotateException(&ex, policy->getIssuerMetadata(), nullptr, false); // wait to throw it
- }
-
- throw;
- }
-#else
- throw ConfigurationException("Cannot process message using lite version of shibsp library.");
-#endif
-}
-
-pair<bool,long> AssertionConsumerService::finalizeResponse(SPRequest& request, string& relayState) const
-{
- DDF postData = recoverPostData(request, relayState.c_str());
- DDFJanitor postjan(postData);
- recoverRelayState(request, relayState);
- request.limitRedirect(relayState.c_str());
-
- // Now redirect to the state value. By now, it should be set to *something* usable.
- // First check for POST data.
- if (!postData.islist()) {
- m_log.debug("ACS returning via redirect to: %s", relayState.c_str());
- return make_pair(true, request.sendRedirect(relayState.c_str()));
- }
- else {
- m_log.debug("ACS returning via POST to: %s", relayState.c_str());
- return make_pair(true, sendPostResponse(request, relayState.c_str(), postData));
- }
-}
-
-void AssertionConsumerService::checkAddress(const SPRequest& request, const char* issuedTo) const
-{
- if (!issuedTo || !*issuedTo)
- return;
-
- if (request.getRequestSettings().first->getBool("checkAddress", true)) {
- m_log.debug("checking client address");
- if (request.getRemoteAddr() != issuedTo) {
- throw agent_exception(
- string("Your client's current address (") + request.getRemoteAddr() +
- ") differs from the one used when you authenticated to your home organization. "
- "To correct this problem, you may need to bypass a proxy server. "
- "Please contact your local support staff or help desk for assistance."
- );
- }
- }
-}
diff --git a/shibsp/handler/impl/SAML2Consumer.cpp b/shibsp/handler/impl/SAML2Consumer.cpp
deleted file mode 100644
index 089b56e4..00000000
--- a/shibsp/handler/impl/SAML2Consumer.cpp
+++ /dev/null
@@ -1,404 +0,0 @@
-/**
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * handler/impl/SAML2Consumer.cpp
- *
- * SAML 2.0 assertion consumer service.
- */
-
-#include "internal.h"
-#include "handler/AssertionConsumerService.h"
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace xercesc;
-using namespace std;
-
-namespace shibsp {
-
-#if defined (_MSC_VER)
- #pragma warning( push )
- #pragma warning( disable : 4250 )
-#endif
-
- class SHIBSP_DLLLOCAL SAML2Consumer : public AssertionConsumerService
- {
- public:
- SAML2Consumer(const DOMElement* e, const char* appId, bool deprecationSupport=true)
- : AssertionConsumerService(e, appId, Category::getInstance(SHIBSP_LOGCAT ".SSO.SAML2"), nullptr, nullptr, deprecationSupport) {
- }
- virtual ~SAML2Consumer() {}
- };
-
-#if defined (_MSC_VER)
- #pragma warning( pop )
-#endif
-
- Handler* SHIBSP_DLLLOCAL SAML2ConsumerFactory(const pair<const DOMElement*,const char*>& p, bool deprecationSupport)
- {
- return new SAML2Consumer(p.first, p.second, deprecationSupport);
- }
-};
-
-#ifndef SHIBSP_LITE
-
-void SAML2Consumer::implementProtocol(
- const Application& application,
- const HTTPRequest& httpRequest,
- HTTPResponse& httpResponse,
- SecurityPolicy& policy,
- const PropertySet*,
- const XMLObject& xmlObject
- ) const
-{
- // Implementation of SAML 2.0 SSO profile(s).
- m_log.debug("processing message against SAML 2.0 SSO profile");
-
- // Remember whether we already established trust.
- // None of the SAML 2 bindings require security at the protocol layer.
- bool alreadySecured = policy.isAuthenticated();
-
- // Check for errors...this will throw if it's not a successful message.
- checkError(&xmlObject, policy.getIssuerMetadata());
-
- const Response* response = dynamic_cast<const Response*>(&xmlObject);
- if (!response)
- throw FatalProfileException("Incoming message was not a samlp:Response.");
-
- const vector<saml2::Assertion*>& assertions = response->getAssertions();
- const vector<saml2::EncryptedAssertion*>& encassertions = response->getEncryptedAssertions();
- if (assertions.empty() && encassertions.empty())
- throw FatalProfileException("Incoming message contained no SAML assertions.");
-
- // Maintain list of "legit" tokens to feed to SP subsystems.
- const Subject* ssoSubject=nullptr;
- const AuthnStatement* ssoStatement=nullptr;
- vector<const opensaml::Assertion*> tokens;
-
- // Also track "bad" tokens that we'll cache but not use.
- // This is necessary because there may be valid tokens not aimed at us.
- vector<const opensaml::Assertion*> badtokens;
-
- // And also track "owned" tokens that we decrypt here.
- vector< boost::shared_ptr<saml2::Assertion> > ownedtokens;
-
- // With this flag on, we block unauthenticated ciphertext when decrypting,
- // unless the protocol was authenticated.
- pair<bool,bool> requireAuthenticatedEncryption = application.getBool("requireAuthenticatedEncryption");
- if (alreadySecured)
- requireAuthenticatedEncryption.second = false;
-
- // With this flag on, we ignore any unsigned assertions.
- const EntityDescriptor* entity = nullptr;
- pair<bool,bool> requireSignedAssertions = make_pair(false,false);
- if (alreadySecured && policy.getIssuerMetadata()) {
- entity = dynamic_cast<const EntityDescriptor*>(policy.getIssuerMetadata()->getParent());
- const PropertySet* rp = application.getRelyingParty(entity);
- requireSignedAssertions = rp->getBool("requireSignedAssertions");
- }
-
- // authnskew allows rejection of SSO if AuthnInstant is too old.
- const PropertySet* sessionProps = application.getPropertySet("Sessions");
- pair<bool,unsigned int> authnskew = sessionProps ? sessionProps->getUnsignedInt("maxTimeSinceAuthn") : pair<bool,unsigned int>(false,0);
-
- // Saves off error messages potentially helpful for users.
- string contextualError;
-
- // Ensure the Bearer rule is in the policy set.
- if (find_if(policy.getRules(), _rulenamed(BEARER_POLICY_RULE)) == nullptr)
- policy.getRules().push_back(m_ssoRule.get());
-
- // Populate recipient as audience.
- policy.getAudiences().push_back(application.getRelyingParty(entity)->getXMLString("entityID").second);
-
- time_t now = time(nullptr);
- for (indirect_iterator<vector<saml2::Assertion*>::const_iterator> a = make_indirect_iterator(assertions.begin());
- a != make_indirect_iterator(assertions.end()); ++a) {
- try {
- // Skip unsigned assertion?
- if (!a->getSignature() && requireSignedAssertions.first && requireSignedAssertions.second)
- throw SecurityPolicyException("The incoming assertion was unsigned, violating local security policy.");
-
- // We clear the security flag, so we can tell whether the token was secured on its own.
- policy.setAuthenticated(false);
- policy.reset(true);
-
- // Extract message bits and re-verify Issuer information.
- extractMessageDetails(*a, samlconstants::SAML20P_NS, policy);
-
- // Run the policy over the assertion. Handles replay, freshness, and
- // signature verification, assuming the relevant rules are configured,
- // along with condition and profile enforcement.
- policy.evaluate(*a, &httpRequest);
-
- // If no security is in place now, we kick it.
- if (!alreadySecured && !policy.isAuthenticated())
- throw SecurityPolicyException("Unable to establish security of incoming assertion.");
-
- // If we hadn't established Issuer yet, redo the signedAssertions check.
- if (!entity && policy.getIssuerMetadata()) {
- entity = dynamic_cast<const EntityDescriptor*>(policy.getIssuerMetadata()->getParent());
- requireSignedAssertions = application.getRelyingParty(entity)->getBool("requireSignedAssertions");
- if (!a->getSignature() && requireSignedAssertions.first && requireSignedAssertions.second)
- throw SecurityPolicyException("The incoming assertion was unsigned, violating local security policy.");
- }
-
- // Address checking.
- SubjectConfirmationData* subcondata = dynamic_cast<SubjectConfirmationData*>(
- dynamic_cast<SAML2AssertionPolicy&>(policy).getSubjectConfirmation()->getSubjectConfirmationData()
- );
- if (subcondata && subcondata->getAddress()) {
- auto_ptr_char boundip(subcondata->getAddress());
- checkAddress(application, httpRequest, boundip.get());
- }
-
- // Track it as a valid token.
- tokens.push_back(&(*a));
-
- // Save off the first valid SSO statement, but favor the "soonest" session expiration.
- const vector<AuthnStatement*>& statements = const_cast<const saml2::Assertion&>(*a).getAuthnStatements();
- for (indirect_iterator<vector<AuthnStatement*>::const_iterator> s = make_indirect_iterator(statements.begin());
- s != make_indirect_iterator(statements.end()); ++s) {
- if (s->getAuthnInstant() && s->getAuthnInstantEpoch() - XMLToolingConfig::getConfig().clock_skew_secs > now) {
- contextualError = "The login time at your identity provider was future-dated.";
- }
- else if (authnskew.first && authnskew.second && s->getAuthnInstant() &&
- s->getAuthnInstantEpoch() <= now && (now - s->getAuthnInstantEpoch() > authnskew.second)) {
- contextualError = "The gap between now and the time you logged into your identity provider exceeds the allowed limit.";
- }
- else if (authnskew.first && authnskew.second && s->getAuthnInstant() == nullptr) {
- contextualError = "Your identity provider did not supply a time of login, violating local policy.";
- }
- else if (!ssoStatement || s->getSessionNotOnOrAfterEpoch() < ssoStatement->getSessionNotOnOrAfterEpoch()) {
- ssoStatement = &(*s);
- }
- }
-
- // Save off the first valid Subject, but favor an unencrypted NameID over anything else.
- if (!ssoSubject || (!ssoSubject->getNameID() && a->getSubject()->getNameID()))
- ssoSubject = a->getSubject();
- }
- catch (std::exception& ex) {
- m_log.warn("detected a problem with assertion: %s", ex.what());
- if (!ssoStatement)
- contextualError = ex.what();
- badtokens.push_back(&(*a));
- }
- }
-
- // In case we need decryption...
- CredentialResolver* cr = application.getCredentialResolver();
- if (!cr && !encassertions.empty())
- m_log.warn("found encrypted assertions, but no CredentialResolver was available");
-
- for (indirect_iterator<vector<saml2::EncryptedAssertion*>::const_iterator> ea = make_indirect_iterator(encassertions.begin());
- ea != make_indirect_iterator(encassertions.end()); ++ea) {
- // Attempt to decrypt it.
- boost::shared_ptr<saml2::Assertion> decrypted;
- try {
- Locker credlocker(cr);
- scoped_ptr<MetadataCredentialCriteria> mcc(
- policy.getIssuerMetadata() ? new MetadataCredentialCriteria(*policy.getIssuerMetadata()) : nullptr
- );
- boost::shared_ptr<XMLObject> wrapper(
- ea->decrypt(
- *cr,
- application.getRelyingParty(entity)->getXMLString("entityID").second,
- mcc.get(),
- requireAuthenticatedEncryption.first && requireAuthenticatedEncryption.second
- )
- );
- decrypted = dynamic_pointer_cast<saml2::Assertion>(wrapper);
- if (decrypted) {
- ownedtokens.push_back(decrypted);
- if (m_log.isDebugEnabled())
- m_log.debugStream() << "decrypted Assertion: " << *decrypted << logging::eol;
- }
- }
- catch (std::exception& ex) {
- m_log.error("failed to decrypt assertion: %s", ex.what());
- }
- if (!decrypted)
- continue;
-
- try {
- // Skip unsigned assertion?
- if (!decrypted->getSignature() && requireSignedAssertions.first && requireSignedAssertions.second)
- throw SecurityPolicyException("The incoming assertion was unsigned, violating local security policy.");
-
- // Run the schema validators against the assertion, since it was hidden by encryption.
- SchemaValidators.validate(decrypted.get());
-
- // We clear the security flag, so we can tell whether the token was secured on its own.
- policy.setAuthenticated(false);
- policy.reset(true);
-
- // Extract message bits and re-verify Issuer information.
- extractMessageDetails(*decrypted, samlconstants::SAML20P_NS, policy);
-
- // Run the policy over the assertion. Handles replay, freshness, and
- // signature verification, assuming the relevant rules are configured,
- // along with condition and profile enforcement.
- // We have to marshall the object first to ensure signatures can be checked.
- if (!decrypted->getDOM())
- decrypted->marshall();
- policy.evaluate(*decrypted, &httpRequest);
-
- // If no security is in place now, we kick it.
- if (!alreadySecured && !policy.isAuthenticated())
- throw SecurityPolicyException("Unable to establish security of incoming assertion.");
-
- // If we hadn't established Issuer yet, redo the signedAssertions check.
- if (!entity && policy.getIssuerMetadata()) {
- entity = dynamic_cast<const EntityDescriptor*>(policy.getIssuerMetadata()->getParent());
- requireSignedAssertions = application.getRelyingParty(entity)->getBool("requireSignedAssertions");
- if (!decrypted->getSignature() && requireSignedAssertions.first && requireSignedAssertions.second)
- throw SecurityPolicyException("The decrypted assertion was unsigned, violating local security policy.");
- }
-
- // Address checking.
- SubjectConfirmationData* subcondata = dynamic_cast<SubjectConfirmationData*>(
- dynamic_cast<SAML2AssertionPolicy&>(policy).getSubjectConfirmation()->getSubjectConfirmationData()
- );
- if (subcondata && subcondata->getAddress()) {
- auto_ptr_char boundip(subcondata->getAddress());
- checkAddress(application, httpRequest, boundip.get());
- }
-
- // Track it as a valid token.
- tokens.push_back(decrypted.get());
-
- // Save off the first valid SSO statement, but favor the "soonest" session expiration.
- const vector<AuthnStatement*>& statements = const_cast<const saml2::Assertion*>(decrypted.get())->getAuthnStatements();
- for (indirect_iterator<vector<AuthnStatement*>::const_iterator> s = make_indirect_iterator(statements.begin());
- s != make_indirect_iterator(statements.end()); ++s) {
- if (authnskew.first && authnskew.second && s->getAuthnInstant() && (now - s->getAuthnInstantEpoch() > authnskew.second))
- contextualError = "The gap between now and the time you logged into your identity provider exceeds the limit.";
- else if (!ssoStatement || s->getSessionNotOnOrAfterEpoch() < ssoStatement->getSessionNotOnOrAfterEpoch())
- ssoStatement = &(*s);
- }
-
- // Save off the first valid Subject, but favor an unencrypted NameID over anything else.
- if (!ssoSubject || (!ssoSubject->getNameID() && decrypted->getSubject()->getNameID()))
- ssoSubject = decrypted->getSubject();
- }
- catch (std::exception& ex) {
- m_log.warn("detected a problem with assertion: %s", ex.what());
- if (!ssoStatement)
- contextualError = ex.what();
- badtokens.push_back(decrypted.get());
- }
- }
-
- if (!ssoStatement) {
- if (contextualError.empty())
- throw FatalProfileException("A valid authentication statement was not found in the incoming message.");
- throw FatalProfileException(contextualError.c_str());
- }
-
- // May need to decrypt NameID.
- scoped_ptr<XMLObject> decryptedID;
- NameID* ssoName = ssoSubject->getNameID();
- if (!ssoName) {
- EncryptedID* encname = ssoSubject->getEncryptedID();
- if (encname) {
- if (!cr)
- m_log.warn("found encrypted NameID, but no decryption credential was available");
- else {
- Locker credlocker(cr);
- scoped_ptr<MetadataCredentialCriteria> mcc(
- policy.getIssuerMetadata() ? new MetadataCredentialCriteria(*policy.getIssuerMetadata()) : nullptr
- );
- try {
- decryptedID.reset(encname->decrypt(*cr, application.getRelyingParty(entity)->getXMLString("entityID").second, mcc.get()));
- ssoName = dynamic_cast<NameID*>(decryptedID.get());
- if (ssoName) {
- if (m_log.isDebugEnabled())
- m_log.debugStream() << "decrypted NameID: " << *ssoName << logging::eol;
- }
- }
- catch (std::exception& ex) {
- m_log.error("failed to decrypt NameID: %s", ex.what());
- }
- }
- }
- }
-
- m_log.debug("SSO profile processing completed successfully");
-
- // We've successfully "accepted" at least one SSO token, along with any additional valid tokens.
- // To complete processing, we need to extract and resolve attributes and then create the session.
-
- // Now we have to extract the authentication details for session setup.
-
- // Session expiration for SAML 2.0 is jointly IdP- and SP-driven.
- time_t sessionExp = ssoStatement->getSessionNotOnOrAfter() ?
- (ssoStatement->getSessionNotOnOrAfterEpoch() + XMLToolingConfig::getConfig().clock_skew_secs) : 0;
- pair<bool,unsigned int> lifetime = sessionProps ? sessionProps->getUnsignedInt("lifetime") : pair<bool,unsigned int>(true,28800);
- if (!lifetime.first || lifetime.second == 0)
- lifetime.second = 28800;
- if (sessionExp == 0)
- sessionExp = now + lifetime.second; // IdP says nothing, calulate based on SP.
- else
- sessionExp = min(sessionExp, now + lifetime.second); // Use the lowest.
-
- const AuthnContext* authnContext = ssoStatement->getAuthnContext();
-
- // The context will handle deleting attributes and new tokens.
- scoped_ptr<ResolutionContext> ctx(
- resolveAttributes(
- application,
- &httpRequest,
- policy.getIssuerMetadata(),
- samlconstants::SAML20P_NS,
- response,
- nullptr,
- nullptr,
- ssoName,
- ssoStatement,
- (authnContext && authnContext->getAuthnContextClassRef()) ? authnContext->getAuthnContextClassRef()->getReference() : nullptr,
- (authnContext && authnContext->getAuthnContextDeclRef()) ? authnContext->getAuthnContextDeclRef()->getReference() : nullptr,
- &tokens
- )
- );
-
- if (ctx) {
- // Copy over any new tokens, but leave them in the context for cleanup.
- tokens.insert(tokens.end(), ctx->getResolvedAssertions().begin(), ctx->getResolvedAssertions().end());
- }
-
- // Now merge in bad tokens for caching.
- tokens.insert(tokens.end(), badtokens.begin(), badtokens.end());
-
- string session_id;
- application.getServiceProvider().getSessionCache()->insert(
- session_id,
- application,
- httpRequest,
- httpResponse,
- sessionExp,
- entity,
- samlconstants::SAML20P_NS,
- ssoName,
- ssoStatement->getAuthnInstant() ? ssoStatement->getAuthnInstant()->getRawData() : nullptr,
- ssoStatement->getSessionIndex(),
- (authnContext && authnContext->getAuthnContextClassRef()) ? authnContext->getAuthnContextClassRef()->getReference() : nullptr,
- (authnContext && authnContext->getAuthnContextDeclRef()) ? authnContext->getAuthnContextDeclRef()->getReference() : nullptr,
- &tokens,
- ctx ? &ctx->getResolvedAttributes() : nullptr
- );
-}
-
-#endif
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list