Commit Graph

191 Commits

Author SHA1 Message Date
Benjamin Dauvergne 8be7b0414d [core] add flags parameter to lasso_server_load_metadata to tune signature checking on metadata files
The flags parameter allows to control the checking of digital signature
upon EntityDescriptor and EntitiesDescriptor nodes in SAML 2.0 metadata
files.

The default behaviour is to check all found signatures and to inherit
signature from EntitiesDescriptor to their children.

By only enabling checking of EntityDescrtiptor node signatures it's also
possible to only check signature at the EntityDescriptor level and so
only trust individual entities and not the aggregating provider.
2011-04-14 16:45:43 +02:00
Benjamin Dauvergne 1171ee2e8b [core] update documentation of lasso_server_load_metadata 2011-04-04 18:52:00 +02:00
Benjamin Dauvergne cad3d305a9 [core] make lasso_server_load_metadata load any metadata file
The new code can load metadata file with a EntityDescriptor root node,
and with nested EntitiesDescriptor.

Idea and prototype by Olav Morken.
2011-04-04 18:34:06 +02:00
Benjamin Dauvergne 31a623aeee [server] in lasso_server_load_metadata do not duplicate checks already made by lasso_verify_signature
lasso_verify_signature already checks that reference is to the given
signed node, be it referenced through an ID or through an empty
reference.
2011-04-04 15:57:55 +02:00
Benjamin Dauvergne 345c3b50f8 [core] rename lasso_server_load_federation to lasso_server_load_metadata
The aim of this function is now to load any metadata file, and to
replace completely the use of lasso_server_add_provider.
The metadata content argument is replaced by a metadata file path to
more closely match other APIs.
2011-04-04 15:57:07 +02:00
Benjamin Dauvergne a9f9b3d9a2 [core] add a loaded_entity_ids output parameter to lasso_server_load_federation
It allows to know which entity has been loaded from the metadata file.
It must be freed by the caller.
2011-03-30 14:20:45 +02:00
Benjamin Dauvergne a0aba29273 [core] add a blacklisted_entity_ids parameter to lasso_server_load_federation
The goal is to prevent loading of provider known to have problems.
2011-03-30 11:15:39 +02:00
Benjamin Dauvergne f289edb534 [core] add a lasso_server_load_federation method
This method allows to load providers in bulk from what is called a
federation file, i.e a SAML metadata file containing declarations for
more than one provider. Those file are usually signed to bind some trust
to its content, so lasso_server_load_federation can take an optional
file path to a certificate chain file used to check the signature on the
given XML content. Only same document signature is accepted (i.e. there
must be only one XML signature reference and it should be to the empty
string meaning the « current » document).
2011-03-29 18:43:48 +02:00
Benjamin Dauvergne 346071a630 [wsf] fix wsf preprocessor conditionals 2011-01-04 16:43:06 +01:00
Benjamin Dauvergne 4a970453de [Core] add missing annotation to lasso_*_dump functions
The string returned by these functions is newly allocated and must be
freed by the caller.
2010-09-27 16:18:57 +02:00
Benjamin Dauvergne c1902b7d7e Core: when reloading a dump, use the signing private key password for loading the encryption private key
We currently do not store the encryption private key, instead on reload
of a dump, we try to use the signing private key as the encryption
private key. But we forgot to use the stored private key password.
That's now fixed.

Next step would be to keep the encryption private key around also.
2010-06-14 21:21:27 +00:00
Benjamin Dauvergne 2f7723348d Fix long lines in lasso/id-ff/server.c 2010-06-10 13:38:05 +00:00
Benjamin Dauvergne 0986fa439a Core: add method lasso_server_set_encryption_private_key_with_password
* fixes #91.
2010-06-10 13:38:02 +00:00
Benjamin Dauvergne 0e8441afe3 Improve safety by replacing all g_hash_table_destroy use by lasso_release_ghashtable 2010-04-22 00:45:02 +00:00
Benjamin Dauvergne 0a169eda51 Improve safety by replacing all g_free use by lasso_release 2010-04-22 00:44:45 +00:00
Benjamin Dauvergne f5442dc84b SAML 2.0: add support for attribute, authentication and authorization authorities metadata
* server.c,serverprivate.h: add new private method
   lasso_server_get_firs_providerID_by_role(server, role)w
 * defederation.c: use new private method
   lasso_server_get_first_providerID_by_role for find providerID
   when the argument remote_providerID is null in
   lasso_defederation_init_notification.
 * lasso/id-ff/login.c (lasso_login_init_authn_request): use new private
   method lasso_server_get_first_providerID_by_role.
 * provider.h: add thre new provider role (authn,pdp,attribute) and
    four new services (authn,assertionid,attribute,authz) and also
    a ROLE_ANY value (-1) for catchall purpose and a ROLE_LAST for
    array sizing.
 * provider.h: add a LAST member to LassoMdProtocolType enum.
  * providerprivate.h,provider.c:
   - removes separate hashtable for descriptors depending on provider role,
     use only one table named Descriptors.
   - use the LAST members of enumerations to dimention static string arrays.
  * provider.h: add a LAST member to the e
2010-03-27 16:51:43 +00:00
Benjamin Dauvergne 95f5d99be6 Core: add missing return value owner semantic annotations to getters
* lasso/id-ff/provider.c:
   fix lasso_provider_get_base64_succinct_id, it returned a libxml
   string, copy it with g_strdup before releasing it to stay with GLib
   allocated string in return values.
2010-02-17 10:14:59 +00:00
Benjamin Dauvergne b4c6e69ee1 in server.c, fix missing loading of public keys in constructors
* lasso/id-ff/server.c:
   constructor for LassoProvider load public keys but they are not
   called by LassoServer constructors, so we have to explicitely
   duplicate calls to lasso_provider_load_public_keys.
2010-02-15 10:37:36 +00:00
Benjamin Dauvergne 1da63271d9 Add internal methods to LassoServer to get the signature and encryption private keys
* lasso/id-ff/server.c lasso/id-ff/serverprivate.h:
   add methods lasso_server_get_private_key and lasso_server_get_encryption_private_key.
2010-02-10 00:34:14 +00:00
Benjamin Dauvergne b564a3b618 Core: in LassoServer constructors, test if private_key is loadable
* lasso/id-ff/server.c:
   mark private_key as not mandatory as regression tests expect it to
   not be mandatory.
   test if loading of private key to encryption_private_key private
   field worked, if not abort the constructor and return NULL.
 * lasso/id-ff/server.h:
   fix name of constructors argument to corresponds with comments
   (binding generator use this correspondance to apply annotation from
   comments to the model obtained by parsing the headers).
2010-02-08 09:34:11 +00:00
Benjamin Dauvergne 5efe4e238f Core: use lasso_xml_parse_file to load affiliation file 2010-02-04 00:02:21 +00:00
Benjamin Dauvergne f520348197 Core: use lasso_node_new_from_dump to implement _new_from_dump methods
* provider.c:
   add annotation for nullable arguments (necessary for bindings of
   new_from_buffer).
 * server.c: add annotations, allow to set encryption_private_key from
   buffers
2010-02-04 00:02:12 +00:00
Benjamin Dauvergne 4382a57d69 fix typo (transfer-none) -> (transfer none) 2010-01-18 10:03:43 +00:00
Benjamin Dauvergne 9caacc3bb6 Core Server: make default to load signing private key also as encryption private key 2010-01-12 15:40:04 +00:00
Benjamin Dauvergne c71822c7e0 Core: in server.c, change signature of lasso_server_get_provider, add anottations on return value
* lasso/id-ff/server.h lasso/id-ff/server.c:
   - constify first argument of lasso_server_get_provider
   - add annotation about caller owned return value
2010-01-04 09:14:05 +00:00
Benjamin Dauvergne c462bc3b2a Do not use g_new, use g_new0
* lasso/id-ff/federation.c:
 * lasso/id-ff/logout.c:
 * lasso/id-ff/profile.c:
 * lasso/id-ff/provider.c:
 * lasso/id-ff/server.c:
 * lasso/id-ff/session.c:
 * lasso/id-wsf/authentication.c:
 * lasso/saml-2.0/ecp.c:
 * lasso/xml/xml.c:
   even for private datas, use g_new0, it is safer.
2009-09-29 13:20:36 +00:00
Benjamin Dauvergne 7231771856 All: Rework include files handling, separated ID-WSF code from SAML2/ID-FF code
* nearly all C files: change includes for relative paths.
 * lasso/id-wsf/id_wsf.h, lasso/id-wsf-2.0/id_wsf_2.h: add top level
   public include files for ID-WSF 1.0 and ID-WSF 2.0.
 * lasso/id-ff/server.*, lasso/id-ff/session.*, lasso/id-ff/identity.*:
   remove most of the code related to ID-WSF and push into
   lasso/id-wsf/id_ff_extensions.* and lasso/id-wsf-2.0/identity.c,
   lasso/id-wsf-2.0/server.c, lasso/id-wsf-2.0/session.c.
 * lasso/id-wsf-2.0/saml2_login.c,
   lasso/id-wsf-2.0/saml2_login_private.h: same change but for ID-WSF
   2.0 support in SAML2 SSO profile.
2009-08-26 15:14:32 +00:00
Benjamin Dauvergne e3bdadf8f7 ID-FF 1.2: Fix leaks, reduce code
* id-ff/login.c:
 * id-ff/logout.c:
 * id-ff/profile.c:
 * id-ff/provider.c:
 * id-ff/server.c:
   fix leaks by using field setting macros which frees previous values,
   it also reduce code length sometimes.
2009-04-30 14:58:20 +00:00
Benjamin Dauvergne 52e60ecb09 Rework cleanup handling
* lasso/utils.h:
   change 'goto exit' for 'goto cleanup'. rename all goto_exit macros to
   goto_cleanup_.  rename goto_cleanup_if_fail to
   goto_cleanup_if_fail_with_rc and add a
   goto_cleanup_if_fail for function which do not return an integer
   value. add documentation for goto_cleanup macro family.
 * lasso/id-ff/login.c:
 * lasso/id-ff/provider.c:
 * lasso/id-ff/server.c:
 * lasso/id-ff/session.c:
 * lasso/id-wsf/discovery.c:
 * lasso/id-wsf/wsf_profile.c:
 * lasso/saml-2.0/profile.c:
 * lasso/utils.h:
 * lasso/xml/lib_logout_request.c:
 * lasso/xml/tools.c:
 * lasso/xml/xml.c:
   update name of goto_exit_if_fail macros. rename 'exit' labels to
   'cleanup'.
2009-04-22 23:49:29 +00:00
Benjamin Dauvergne a68c89f902 ID-FF 1.2: fix style fault
* lasso/id-ff/defederation.c:
 * lasso/id-ff/logout.c:
 * lasso/id-ff/profile.c:
 * lasso/id-ff/provider.c:
 * lasso/id-ff/server.c:
   add missings casts, remove useless wrappers
 * lasso/id-ff/logout.c:
   In lasso_logout_process_request_msg change sequence of "if" for a
   "switch".
2009-03-27 15:06:29 +00:00
Benjamin Dauvergne 3caee2835d ID-FF 1.2: fix some real and potential memory leaks
* lasso/id-ff/provider.c:
 * lasso/id-ff/server.c:
 * lasso/id-ff/session.c:
   use macros to release previous value when necessary,
   release object used as parameters to constructors,
   free the encryption key associated with a provider,
   release the key manager created for a saml signature
   verification.
2009-03-27 15:06:27 +00:00
Benjamin Dauvergne 22feecaffb SAML 2.0 NameIDManagement: use new generic methods
* lasso/saml-2.0/name_id_management.c:
   use new generic methods in lasso_name_id_management_init_request,
   lasso_name_id_management_build_request_msg,
   lasso_name_id_management_process_request_msg,
   lasso_name_id_management_validate_request,
   lasso_name_id_management_build_response_msg,
   lasso_name_id_management_process_response_msg.
   Remove useless boilerplate code.

 * lasso/id-ff/server.c:
 * lasso/id-ff/serverprivate.h:
   last user of lasso_server_nameid_decrypt removed, so remove the code.
2009-03-27 15:05:17 +00:00
Benjamin Dauvergne 141c4a382e Core: add argument checking to lasso_server_get_provider
* lasso/id-ff/server.c:
   In lasso_server_get_provider, return NULL if provider server is not
   one, provider is null or 0-length.
2009-03-27 15:05:02 +00:00
Benjamin Dauvergne b09ef2e015 Core: do not mix public and private headers
* lots of files:
   explicitely load the internal header xml/private.h where needed.
2009-03-27 15:04:26 +00:00
Benjamin Dauvergne 95d27816ee Core: add a method to decrypt nameid, handling error cases
* lasso/id-dff/serverprivate.h:
 * lasso/id-ff/server.c:
   lasso_server_decrypt_nameid handle error case of NameID decryption,
   and update passed field pointers.
 * lasso/errors.h:
   add new error codes:
   LASSO_DS_ERROR_DECRYPTION_FAILED -118
    -  Decryption of an encrypted node failed
   LASSO_PROFILE_ERROR_MISSING_SERVER -438
    - No server object set in the profile
2009-03-09 14:05:31 +00:00
Benjamin Dauvergne 33bbf7a7de All: Fix missing field initializer problems
* lots of files: Explicitely set all field of initialized structures,
  in order to remove -Wno-missing-field-initilizers from needed
  compiler options when using -Wall -Wextra.
2009-01-24 09:33:40 +00:00
Benjamin Dauvergne d01eec1b57 Add missing intialization
- lasso/id-ff/provider.c,lasso/id-ff/server.c: add missing initialization
   of return code variable.
2008-11-05 23:38:26 +00:00
Benjamin Dauvergne 7103e81888 Change style of error and dellocation handling
- lasso/id-ff/provider.c:
   - in lasso_provider_verify_signature use standardised memory and
     error handling macros, and also standard return code variable name
     and exit label.
   - in lasso_providerl_load_metadata_from_buffer and
     lasso_provider_load_metadata use the standardised macros, exit
     labels and return code variable.
 - lasso/id-ff/server.c:
   - in lasso_server_load_affiliation use standardised allocation and
     error handling macros.
 - lasso/id-wsf/wsf_profile.c:
   - use standardised memory and error handling macros in
     lasso_wsf_profile_build_soap_request_msg.
2008-11-04 01:58:53 +00:00
Benjamin Dauvergne 0d66367f28 Remove use of xmlFreeDoc for lasso_release_doc
- bindings/java/wrapper_top.c, bindings/php4/lasso_php4_helper.c,
    bindings/php5/wrapper_source_top.c, bindings/python/wrapper_top.c,
    lasso/id-ff/identity.c, lasso/id-ff/lecp.c, lasso/id-ff/login.c,
    lasso/id-ff/logout.c, lasso/id-ff/name_registration.c,
    lasso/id-ff/profile.c, lasso/id-ff/provider.c, lasso/id-ff/server.c,
    lasso/id-ff/session.c, lasso/id-wsf-2.0/data_service.c,
    lasso/id-wsf/data_service.c, lasso/id-wsf/discovery.c,
    lasso/id-wsf/wsf_profile.c, lasso/saml-2.0/ecp.c,
    lasso/saml-2.0/login.c, lasso/saml-2.0/name_id_management.c,
    lasso/utils.h, lasso/xml/tools.c, lasso/xml/xml.c, swig/Lasso.i:
    Remove use of xmlFreeDoc. Use lasso_release_doc instead.
2008-11-04 01:58:49 +00:00
Benjamin Dauvergne 5f163bbffd Add new constructor lasso_server_new_from_buffers
* lasso/id-ff/server.c, lasso/id-ff/server.h: add new function to build
   a LassoServer object holding content of certificate and private key
   files intead of loading them everytime signing is needed. You must
   instead load them yourself the first time.
2008-11-02 11:49:56 +00:00
Damien Laniel 6b9a265102 fixed docstrings which fucked php5 binding 2008-09-17 08:32:01 +00:00
Damien Laniel a18ddb94e0 fixed various bugs with new compilation flags 2008-09-16 16:31:05 +00:00
Benjamin Dauvergne 9ed0670e48 * Remove ending blanks 2008-09-12 15:06:58 +00:00
Benjamin Dauvergne ae1f6a297c * Remove warnings:
- remove unused parameter from private function signatures
 - remove unused variable
 - initialize variable potentially accessed uninitialized
 - add G_GNUC_UNUSED if function is public or adhering to an interface, and a
   parameter is unused.
 - if ID-WSF is not compiled in, define stubs with G_GNUC_UNUSED on parameters.
 The goal is to compile with -Werror.
2008-09-12 13:57:22 +00:00
Benjamin Dauvergne 500480afbf Add public function lasso_server_add_provider_from_buffer, to add a provider
from an XML string of the metadatas (changed semantic of the second argument
compared to lasso_server_add_provider). To support this a new public
LassoProvider constructor was added: lasso_provider_new_from_buffer, where the
second argument is an XML string. It uses a new private function,
lasso_provider_load_metadata_from_buffer.
2008-08-26 12:48:58 +00:00
Benjamin Dauvergne 1a9b5ef5c9 Add documentation to lasso_server_add_service_from_dump. 2008-08-26 12:48:56 +00:00
Benjamin Dauvergne aca239da7a Complete documentation of lasso_server_add_service. 2008-08-26 12:48:54 +00:00
Benjamin Dauvergne 207891ff29 * Fix blanks mismatch (space in *.c and *h files or tabs in *.py files) and formatting 2008-08-05 14:53:29 +00:00
Benjamin Dauvergne 76d9fce5d5 forked lasso branch for adeline 2008-08-01 14:08:54 +00:00
Damien Laniel bfb243f398 unreference service node after adding it to the server 2008-05-21 12:35:54 +00:00