[cpp-sp] branch main updated: Remove older source code.
Scott Cantor
cantor.2 at osu.edu
Thu Oct 23 17:47:08 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
https://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=b152b46461a8ca1b47d02d1209b3542638ba9919
The following commit(s) were added to refs/heads/main by this push:
new b152b464 Remove older source code.
b152b464 is described below
commit b152b46461a8ca1b47d02d1209b3542638ba9919
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Oct 23 13:47:05 2025 -0400
Remove older source code.
---
plugins/TimeAccessControl.cpp | 299 ------------------------------------------
1 file changed, 299 deletions(-)
diff --git a/plugins/TimeAccessControl.cpp b/plugins/TimeAccessControl.cpp
deleted file mode 100644
index 57250711..00000000
--- a/plugins/TimeAccessControl.cpp
+++ /dev/null
@@ -1,299 +0,0 @@
-/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
- *
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-/**
- * TimeAccessControl.cpp
- *
- * Access control plugin for time-based policies.
- */
-
-#include "internal.h"
-
-#include <shibsp/exceptions.h>
-#include <shibsp/AccessControl.h>
-#include <shibsp/SessionCache.h>
-#include <shibsp/SPRequest.h>
-
-#include <boost/lexical_cast.hpp>
-#include <boost/algorithm/string.hpp>
-#include <boost/ptr_container/ptr_vector.hpp>
-#include <xercesc/util/XMLDateTime.hpp>
-#include <xmltooling/unicode.h>
-#include <xmltooling/util/XMLHelper.h>
-#include <xercesc/util/XMLUniDefs.hpp>
-
-using namespace shibsp;
-using namespace xmltooling;
-using namespace xercesc;
-using namespace boost;
-using namespace std;
-
-namespace shibsp {
-
- class Rule : public AccessControl
- {
- public:
- Rule(const DOMElement* e);
- ~Rule() {}
-
- Lockable* lock() {return this;}
- void unlock() {}
-
- aclresult_t authorized(const SPRequest& request, const Session* session) const;
-
- private:
- enum { TM_AUTHN, TM_TIME, TM_YEAR, TM_MONTH, TM_DAY, TM_HOUR, TM_MINUTE, TM_SECOND, TM_WDAY } m_type;
- enum { OP_LT, OP_LE, OP_EQ, OP_GE, OP_GT } m_op;
- time_t m_value;
- };
-
- class TimeAccessControl : public AccessControl
- {
- public:
- TimeAccessControl(const DOMElement* e);
- ~TimeAccessControl() {}
-
- Lockable* lock() {
- return this;
- }
- void unlock() {
- }
-
- aclresult_t authorized(const SPRequest& request, const Session* session) const;
-
- private:
- enum { OP_AND, OP_OR } m_op;
- ptr_vector<Rule> m_rules;
- };
-
- AccessControl* SHIBSP_DLLLOCAL TimeAccessControlFactory(const DOMElement* const & e, bool)
- {
- return new TimeAccessControl(e);
- }
-
- static const XMLCh _operator[] = UNICODE_LITERAL_8(o,p,e,r,a,t,o,r);
- static const XMLCh AND[] = UNICODE_LITERAL_3(A,N,D);
- static const XMLCh OR[] = UNICODE_LITERAL_2(O,R);
- static const XMLCh Day[] = UNICODE_LITERAL_3(D,a,y);
- static const XMLCh DayOfWeek[] = UNICODE_LITERAL_9(D,a,y,O,f,W,e,e,k);
- static const XMLCh Hour[] = UNICODE_LITERAL_4(H,o,u,r);
- static const XMLCh Minute[] = UNICODE_LITERAL_6(M,i,n,u,t,e);
- static const XMLCh Month[] = UNICODE_LITERAL_5(M,o,n,t,h);
- static const XMLCh Second[] = UNICODE_LITERAL_6(S,e,c,o,n,d);
- static const XMLCh Time[] = UNICODE_LITERAL_4(T,i,m,e);
- static const XMLCh TimeSinceAuthn[] = UNICODE_LITERAL_14(T,i,m,e,S,i,n,c,e,A,u,t,h,n);
- static const XMLCh Year[] = UNICODE_LITERAL_4(Y,e,a,r);
-}
-
-Rule::Rule(const DOMElement* e)
-{
- if (XMLString::equals(e->getLocalName(), TimeSinceAuthn)) {
- m_type = TM_AUTHN;
- try {
- XMLDateTime dur(XMLHelper::getTextContent(e));
- dur.parseDuration();
- m_value = dur.getEpoch(true);
- return;
- }
- catch (const XMLException& e) {
- auto_ptr_char temp(e.getMessage());
- throw ConfigurationException(temp.get() ? temp.get() : "XMLException parsing duration in TimeSinceAuthn rule");
- }
- }
-
- auto_ptr_char temp(XMLHelper::getTextContent(e));
- string s(temp.get() ? temp.get() : "");
- trim(s);
- vector<string> tokens;
- if (split(tokens, s, is_space(), algorithm::token_compress_on).size() != 2)
- throw ConfigurationException("Time-based rule requires element content of the form \"LT|LE|EQ|GE|GT value\".");
- string& op = tokens.front();
- if (op == "LT") m_op = OP_LT;
- else if (op == "LE") m_op = OP_LE;
- else if (op == "EQ") m_op = OP_EQ;
- else if (op == "GE") m_op = OP_GE;
- else if (op == "GT") m_op = OP_GT;
- else
- throw ConfigurationException("First component of time-based rule must be one of LT, LE, EQ, GE, GT.");
-
- if (XMLString::equals(e->getLocalName(), Time)) {
- m_type = TM_TIME;
- auto_ptr_XMLCh widen(tokens.back().c_str());
- try {
- XMLDateTime dt(widen.get());
- dt.parseDateTime();
- m_value = dt.getEpoch(false);
- return;
- }
- catch (const XMLException& e) {
- auto_ptr_char temp(e.getMessage());
- throw ConfigurationException(temp.get() ? temp.get() : "XMLException parsing duration in Time rule");
- }
- }
-
- m_value = lexical_cast<time_t>(tokens.back());
-
- if (XMLString::equals(e->getLocalName(), Year)) m_type = TM_YEAR;
- else if (XMLString::equals(e->getLocalName(), Month)) m_type = TM_MONTH;
- else if (XMLString::equals(e->getLocalName(), Day)) m_type = TM_DAY;
- else if (XMLString::equals(e->getLocalName(), Hour)) m_type = TM_HOUR;
- else if (XMLString::equals(e->getLocalName(), Minute)) m_type = TM_MINUTE;
- else if (XMLString::equals(e->getLocalName(), Second)) m_type = TM_SECOND;
- else if (XMLString::equals(e->getLocalName(), DayOfWeek)) m_type = TM_WDAY;
- else
- throw ConfigurationException("Unrecognized time-based rule.");
-}
-
-/*
-<AccessControlProvider type="Time" operator="AND|OR">
- <TimeSinceAuthn>PT1H</TimeSinceAuthn>
- <Time> LT|LE|EQ|GE|GT ISO </Time>
- <Year> LT|LE|EQ|GE|GT nn </Year>
- <Month> LT|LE|EQ|GE|GT nn </Month>
- <Day> LT|LE|EQ|GE|GT nn </Day>
- <Hour> LT|LE|EQ|GE|GT nn </Hour>
- <Minute> LT|LE|EQ|GE|GT nn </Minute>
- <Second> LT|LE|EQ|GE|GT nn </Second>
- <DayOfWeek> LT|LE|EQ|GE|GT 0-6 </DayOfWeek>
-</AccessControlProvider>
-*/
-
-AccessControl::aclresult_t Rule::authorized(const SPRequest& request, const Session* session) const
-{
- time_t operand = 0;
-
- if (m_type == TM_AUTHN) {
- if (session) {
- auto_ptr_XMLCh atime(session->getAuthnInstant());
- if (atime.get()) {
- try {
- XMLDateTime dt(atime.get());
- dt.parseDateTime();
- if (time(nullptr) - dt.getEpoch(false) <= m_value)
- return shib_acl_true;
- request.log(SPRequest::SPDebug, "elapsed time since authentication exceeds limit");
- return shib_acl_false;
- }
- catch (const XMLException& e) {
- auto_ptr_char temp(e.getMessage());
- request.log(SPRequest::SPError, temp.get() ? temp.get() : "XMLException parsing AuthnInstant from session");
- }
- }
- }
- request.log(SPRequest::SPDebug, "session or authentication time unavailable");
- return shib_acl_false;
- }
-
- // Extract value from tm struct or time directly.
- operand = time(nullptr);
- if (m_type != TM_TIME) {
-#ifndef HAVE_LOCALTIME_R
- struct tm* ptime = localtime(&operand);
-#else
- struct tm res;
- struct tm* ptime = localtime_r(&operand, &res);
-#endif
- switch (m_type) {
- case TM_YEAR:
- operand = ptime->tm_year + 1900;
- break;
- case TM_MONTH:
- operand = ptime->tm_mon + 1;
- break;
- case TM_DAY:
- operand = ptime->tm_mday;
- break;
- case TM_HOUR:
- operand = ptime->tm_hour;
- break;
- case TM_MINUTE:
- operand = ptime->tm_min;
- break;
- case TM_SECOND:
- operand = ptime->tm_sec;
- break;
- case TM_WDAY:
- operand = ptime->tm_wday;
- break;
- }
- }
-
- // Compare operand to test value in rule using rule operator.
- switch (m_op) {
- case OP_LT:
- return (operand < m_value) ? shib_acl_true : shib_acl_false;
- case OP_LE:
- return (operand <= m_value) ? shib_acl_true : shib_acl_false;
- case OP_EQ:
- return (operand == m_value) ? shib_acl_true : shib_acl_false;
- case OP_GE:
- return (operand >= m_value) ? shib_acl_true : shib_acl_false;
- case OP_GT:
- return (operand > m_value) ? shib_acl_true : shib_acl_false;
- }
- return shib_acl_false;
-}
-
-TimeAccessControl::TimeAccessControl(const DOMElement* e) : m_op(OP_AND)
-{
- const XMLCh* op = e ? e->getAttributeNS(nullptr, _operator) : nullptr;
- if (XMLString::equals(op, OR))
- m_op = OP_OR;
- else if (op && *op && !XMLString::equals(op, AND))
- throw ConfigurationException("Unrecognized operator in Time AccessControl configuration.");
-
- e = XMLHelper::getFirstChildElement(e);
- while (e) {
- auto_ptr<Rule> np(new Rule(e));
- m_rules.push_back(np.get());
- np.release();
- e = XMLHelper::getNextSiblingElement(e);
- }
- if (m_rules.empty())
- throw ConfigurationException("Time AccessControl plugin requires at least one rule.");
-}
-
-AccessControl::aclresult_t TimeAccessControl::authorized(const SPRequest& request, const Session* session) const
-{
- switch (m_op) {
- case OP_AND:
- {
- for (ptr_vector<Rule>::const_iterator i = m_rules.begin(); i != m_rules.end(); ++i) {
- if (i->authorized(request, session) != shib_acl_true) {
- request.log(SPRequest::SPDebug, "time-based rule unsuccessful, denying access");
- return shib_acl_false;
- }
- }
- return shib_acl_true;
- }
-
- case OP_OR:
- {
- for (ptr_vector<Rule>::const_iterator i = m_rules.begin(); i != m_rules.end(); ++i) {
- if (i->authorized(request,session) == shib_acl_true)
- return shib_acl_true;
- }
- request.log(SPRequest::SPDebug, "all time-based rules unsuccessful, denying access");
- return shib_acl_false;
- }
- }
- request.log(SPRequest::SPWarn, "unknown operator in access control policy, denying access");
- return shib_acl_false;
-}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list