[cpp-sp] 02/03: Handle string and numeric authentication timestamps.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository cpp-sp.

View the commit online:
https://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=45fbf9d0af2dda31c2740d6e4f4284acd78f2ba3

commit 45fbf9d0af2dda31c2740d6e4f4284acd78f2ba3
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Oct 27 14:40:29 2025 -0400

    Handle string and numeric authentication timestamps.
---
 shibsp/impl/TimeAccessControl.cpp | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/shibsp/impl/TimeAccessControl.cpp b/shibsp/impl/TimeAccessControl.cpp
index 3ad0f9b1..fc34e584 100644
--- a/shibsp/impl/TimeAccessControl.cpp
+++ b/shibsp/impl/TimeAccessControl.cpp
@@ -99,9 +99,10 @@ Rule::Rule(const string& name, const ptree& pt)
 
     // The TimeSinceAuthn rule operates on a Duration inside the element body,
     // which should be the value of the tree.
+
     if (name == TimeSinceAuthn) {
         m_type = TM_AUTHN;
-        if (m_value = parseISODuration(pt.get_value("")) < 0) {
+        if ((m_value = parseISODuration(pt.get_value(""))) < 0) {
             throw ConfigurationException("Unable to parse duration in TimeSinceAuthn rule.");
         }
         return;
@@ -126,7 +127,7 @@ Rule::Rule(const string& name, const ptree& pt)
 
     if (name == Time) {
         m_type = TM_TIME;
-        if (m_value = parseISODateTime(tokens.back()) < 0) {
+        if ((m_value = parseISODateTime(tokens.back())) < 0) {
             throw ConfigurationException("Error parsing timestamp in Time rule.");
         }
         return;
@@ -162,15 +163,24 @@ AccessControl::aclresult_t Rule::authorized(const SPRequest& request, const Sess
                 return shib_acl_false;
             }
 
-            const char* authtime = const_cast<DDF&>(attr->second).first().string();
-            if (authtime) {
-                if (operand = parseISODateTime(authtime) < 0) {
-                    request.error("Error parsing authentication time from designated Attribute.");
+            DDF val = const_cast<DDF&>(attr->second).first();
+            if (val.isstring()) {
+                const char* authtime = const_cast<DDF&>(attr->second).first().string();
+                if (authtime) {
+                    if (operand = parseISODateTime(authtime) < 0) {
+                       request.error("Error parsing authentication time from designated Attribute.");
+                       return shib_acl_false;
+                    }
                 }
-
+            }
+            else if (val.islong()) {
+                operand = val.longinteger();
+            }
+            if (operand > 0) {
                 if (time(nullptr) - operand <= m_value) {
                     return shib_acl_true;
                 }
+
                 request.debug("elapsed time since authentication exceeds limit");
                 return shib_acl_false;
             }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.