/usr/include/shibsp/handler/AssertionConsumerService.h is in libshibsp-dev 2.6.1+dfsg1-2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 | /**
* Licensed to the University Corporation for Advanced Internet
* Development, Inc. (UCAID) under one or more contributor license
* agreements. See the NOTICE file distributed with this work for
* additional information regarding copyright ownership.
*
* UCAID licenses this file to you under the Apache License,
* Version 2.0 (the "License"); you may not use this file except
* in compliance with the License. You may obtain a copy of the
* License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
* either express or implied. See the License for the specific
* language governing permissions and limitations under the License.
*/
/**
* @file shibsp/handler/AssertionConsumerService.h
*
* Base class for handlers that create sessions by consuming SSO protocol responses.
*/
#ifndef __shibsp_acshandler_h__
#define __shibsp_acshandler_h__
#include <shibsp/handler/AbstractHandler.h>
#include <shibsp/handler/RemotedHandler.h>
#include <boost/scoped_ptr.hpp>
#ifndef SHIBSP_LITE
namespace opensaml {
class SAML_API Assertion;
class SAML_API MessageDecoder;
namespace saml1 {
class SAML_API AuthenticationStatement;
class SAML_API NameIdentifier;
};
namespace saml2 {
class SAML_API AuthnStatement;
class SAML_API NameID;
};
namespace saml2md {
class SAML_API SPSSODescriptor;
};
};
#endif
namespace shibsp {
class SHIBSP_API Attribute;
class SHIBSP_API LoginEvent;
class SHIBSP_API ResolutionContext;
#if defined (_MSC_VER)
#pragma warning( push )
#pragma warning( disable : 4250 )
#endif
/**
* Base class for handlers that create sessions by consuming SSO protocol responses.
*/
class SHIBSP_API AssertionConsumerService : public AbstractHandler, public RemotedHandler
{
public:
virtual ~AssertionConsumerService();
std::pair<bool,long> run(SPRequest& request, bool isHandler=true) const;
void receive(DDF& in, std::ostream& out);
protected:
/**
* Constructor
*
* @param e root of DOM configuration
* @param appId ID of application that "owns" the handler
* @param log a logging object to use
* @param filter optional filter controls what child elements to include as nested PropertySets
* @param remapper optional map of property rename rules for legacy property support
*/
AssertionConsumerService(
const xercesc::DOMElement* e,
const char* appId,
xmltooling::logging::Category& log,
xercesc::DOMNodeFilter* filter=nullptr,
const std::map<std::string,std::string>* remapper=nullptr
);
/**
* Enforce address checking requirements.
*
* @param application reference to application receiving message
* @param httpRequest client request that initiated session
* @param issuedTo address for which security assertion was issued
*/
void checkAddress(const Application& application, const xmltooling::HTTPRequest& httpRequest, const char* issuedTo) const;
/**
* Complete the client's transition back to the expected resource.
*
* @param application reference to application receiving message
* @param httpRequest client request that included message
* @param httpResponse response to client
* @param relayState relay state token
*/
virtual std::pair<bool,long> finalizeResponse(
const Application& application,
const xmltooling::HTTPRequest& httpRequest,
xmltooling::HTTPResponse& httpResponse,
std::string& relayState
) const;
#ifndef SHIBSP_LITE
void generateMetadata(opensaml::saml2md::SPSSODescriptor& role, const char* handlerURL) const;
/**
* @deprecated
* Returns a SecurityPolicy instance to use for an incoming request.
*
* <p>Allows handlers to customize the type of policy object their policy rules might require.
* <p>The caller <strong>MUST</strong> lock the application's MetadataProvider for the life
* of the returned object.
*
* @param application reference to application receiving message
* @param role identifies the role (generally IdP or SP) of the policy peer
* @param validate true iff XML parsing should be done with validation
* @param policyId identifies policy rules to auto-attach, defaults to the application's set
* @return a new policy instance, which the caller is responsible for freeing
*/
virtual opensaml::SecurityPolicy* createSecurityPolicy(
const Application& application, const xmltooling::QName* role, bool validate, const char* policyId
) const;
/**
* Implement protocol-specific handling of the incoming decoded message.
*
* <p>The result of implementing the protocol should be an exception or
* modifications to the request/response objects to reflect processing
* of the message.
*
* @param application reference to application receiving message
* @param httpRequest client request that included message
* @param httpResponse response to client
* @param policy the SecurityPolicy in effect, after having evaluated the message
* @param reserved ignore this parameter
* @param xmlObject a protocol-specific message object
*/
virtual void implementProtocol(
const Application& application,
const xmltooling::HTTPRequest& httpRequest,
xmltooling::HTTPResponse& httpResponse,
opensaml::SecurityPolicy& policy,
const PropertySet* reserved,
const xmltooling::XMLObject& xmlObject
) const=0;
/**
* Extracts policy-relevant assertion details.
*
* @param assertion the incoming assertion
* @param protocol the protocol family in use
* @param policy SecurityPolicy to provide various components and track message data
*/
virtual void extractMessageDetails(
const opensaml::Assertion& assertion, const XMLCh* protocol, opensaml::SecurityPolicy& policy
) const;
/**
* @deprecated
* Attempt SSO-initiated attribute resolution using the supplied information,
* including NameID and token extraction and filtering followed by
* secondary resolution.
*
* <p>The caller must free the returned context handle.
*
* @param application reference to application receiving message
* @param issuer source of SSO tokens
* @param protocol SSO protocol used
* @param v1nameid identifier of principal in SAML 1.x form, if any
* @param nameid identifier of principal in SAML 2.0 form
* @param authncontext_class method/category of authentication event, if known
* @param authncontext_decl specifics of authentication event, if known
* @param tokens available assertions, if any
*/
ResolutionContext* resolveAttributes(
const Application& application,
const opensaml::saml2md::RoleDescriptor* issuer=nullptr,
const XMLCh* protocol=nullptr,
const opensaml::saml1::NameIdentifier* v1nameid=nullptr,
const opensaml::saml2::NameID* nameid=nullptr,
const XMLCh* authncontext_class=nullptr,
const XMLCh* authncontext_decl=nullptr,
const std::vector<const opensaml::Assertion*>* tokens=nullptr
) const;
/**
* Attempt SSO-initiated attribute resolution using the supplied information,
* including NameID and token extraction and filtering followed by
* secondary resolution.
*
* <p>The caller must free the returned context handle.
*
* @param application reference to application receiving message
* @param request request delivering message, if any
* @param issuer source of SSO tokens
* @param protocol SSO protocol used
* @param protmsg SSO protocol message, if any
* @param v1nameid identifier of principal in SAML 1.x form, if any
* @param v1statement SAML 1.x authentication statement, if any
* @param nameid identifier of principal in SAML 2.0 form
* @param statement SAML 2.0 authentication statement, if any
* @param authncontext_class method/category of authentication event, if known
* @param authncontext_decl specifics of authentication event, if known
* @param tokens available assertions, if any
*/
ResolutionContext* resolveAttributes(
const Application& application,
const xmltooling::GenericRequest* request=nullptr,
const opensaml::saml2md::RoleDescriptor* issuer=nullptr,
const XMLCh* protocol=nullptr,
const xmltooling::XMLObject* protmsg=nullptr,
const opensaml::saml1::NameIdentifier* v1nameid=nullptr,
const opensaml::saml1::AuthenticationStatement* v1statement=nullptr,
const opensaml::saml2::NameID* nameid=nullptr,
const opensaml::saml2::AuthnStatement* statement=nullptr,
const XMLCh* authncontext_class=nullptr,
const XMLCh* authncontext_decl=nullptr,
const std::vector<const opensaml::Assertion*>* tokens=nullptr
) const;
/**
* Creates a new LoginEvent for the event log.
*
* @param application the Application associated with the event
* @param request the HTTP client request associated with the event
* @return a fresh LoginEvent, prepopulated by the input parameters, or nullptr if an error occurs
*/
virtual LoginEvent* newLoginEvent(const Application& application, const xmltooling::HTTPRequest& request) const;
public:
const char* getType() const;
const XMLCh* getProtocolFamily() const;
#endif
const char* getEventType() const;
private:
std::pair<bool,long> processMessage(
const Application& application, const xmltooling::HTTPRequest& httpRequest, xmltooling::HTTPResponse& httpResponse
) const;
std::pair<bool,long> sendRedirect(
const Application& application,
const xmltooling::HTTPRequest& request,
xmltooling::HTTPResponse& response,
const char* entityID,
const char* relayState
) const;
void maintainHistory(
const Application& application, const xmltooling::HTTPRequest& request, xmltooling::HTTPResponse& response, const char* entityID
) const;
#ifndef SHIBSP_LITE
boost::scoped_ptr<opensaml::MessageDecoder> m_decoder;
#endif
};
#if defined (_MSC_VER)
#pragma warning( pop )
#endif
};
#endif /* __shibsp_acshandler_h__ */
|