* lasso/saml-2.0/login.c:
I'm not sure that most IdP really make the semantic distinction
between those two first level status codes, so just conflate them.
* lasso/saml-2.0/login.c:
in lasso_saml20_process_federation:
- if no name id format can be found by the request, use the default from
the metadata file (first declared NameIDFormat)
- instead of checking if format is TRANSIENT, check if it is PERSISTENT,
and proceed with the federation, if not just return 0.
- return LASSO_PROFILE_ERROR_UNKNOWN_PROVIDER instead of
LASSO_SERVER_ERROR_PROVIDER_NOT_FOUND.
- in any case, check for consent.
* lasso/id-ff/profile.h:
- add end symbol for enum LassoProfileSignatureVerifyHint
* lasso/id-ff/profile.c:
- fix documentation of lasso_profile_set_signature_verify_hint
- do not allow to set or return invalid value for the
signature_verify_hint attribute.
* lasso/saml-2.0/login.c:
- handle new enum value
* lasso/saml-2.0/profile.c:
- handle new enum value
- fix missing catch of signature error reporting when
signature_verify_hint is IGNORE.
* docs/reference/lasso/lasso-sections.txt:
- export enums LassoProfileSignatureHint and
LassoProfileSignatureVerifyHint
* tests/metadata_tests.c:
- fix test of all Role enumerations
* lasso/saml-2.0/login.c:
in lasso_saml20_login_process_response_status_and_assertion, extract assertion
decryption, and issuer checking into their own function.
* lasso/saml-2.0/login.c:
- in lasso_saml20_login_process_authn_response_msg keep around all error
codes returned by intermediary steps. At the end report the first one.
* lasso/saml-2.0/login.c: check that the URL is know before using it
* lasso/saml-2.0/provider.c lasso/saml-2.0/providerprivate.h:
add a function to check that an URL corresponds to a know
AssertionConsumer of the given provider.
* docs/reference/lasso/lasso-sections.txt:
declare new function
* lasso/id-ff/login.c lasso/id-ff/login.h:
add new function lasso_login_get_assertion.
* lasso/saml-2.0/login.c:
store created assertions
* lasso/id-ff/login.h:
make assertion field private for bindings.
* lasso/id-ff/provider.c lasso/id-ff/provider.h:
add a method giving the SPNameQualifier for a provider (its entity id
or its affiliation id).
* lasso/id-ff/profile.c:
* lasso/saml-2.0/login.c:
update use sites.
* lasso/saml-2.0/profile.c:
* lasso/saml-2.0/profileprivate.h:
make lasso_saml20_profile_set_response_status2 the new implementation
of lasso_saml20_profile_set_response_status.
add helper macros to set success, responder and requester first level
status code.
* saml-2.0/assertion_query.c:
* saml-2.0/login.c:
* saml-2.0/logout.c:
* saml-2.0/name_id_management.c:
adapt consumers to the new signature.
* client of LassoServer should use lasso_server_get_provider.
* LASSO_PROFILE_ERRROR_UNKNOWN_PROVIDER was a mistake, it is
superfluous, use LASSO_SERVER_ERROR_PROVIDER_NOT_FOUND.
* saml-2.0/login.c:
in lasso_saml20_login_init_authn_request,
lasso_saml20_login_init_idp_initiated_authn_request, if the service
provider provided a list of supported name id formats, use the first
one as default for new AuthnRequest.
* id-ff/login.c:
modify documentation to report the new way of choosing a default.
* lasso/id-wsf-2.0/data_service.c: fix uninitialized res variable in
lasso_idwsf2_data_service_process_query_response_soap_fault_msg.
* lasso/xml/saml-2.0/saml2_assertion.c: fix uninitialized rc variable
in get_xmlNode.
* lasso/saml-2.0/login.c:
in lasso_saml20_login_accept_sso check for ni and ni->Format
null-ness before dereferencing, remove idp_ni which is not used
anymore.
remote all use of federation->remote_nameIdentifier, SAML 2.0 only
need one NameID, and it will be local_nameIdentifier.
* lasso/xml/xml.c:
in lasso_node_traversal, check null-ness of node before dereferencing
it, add check for class null-ness also.
* lasso/id-ff/provider.c:
in lasso_provider_get_first_http_method, remove useless check for t2
null-ness -- if found is TRUE, t1 and t2 cannot be null.
* lasso/xml/tools.c:
in lasso_sign_node, add documentation, check for private_key_file and
xmlnode null-ness.
in lasso_get_public_key_from_private_key_file, add a cleanup phase,
check for cert variabl null-ness befor appending, count the number of
certificates added.
in lasso_query_verify_signature, check that URL unescaping and base64
decoding are succesfull before using the decoded strings.
* lasso/saml-2.0/name_id_management.c:
in lasso_name_id_management_validate_request, fix mis-handling of
federation, if federation does not match request name_id, return
UNKNOWN_PRINCIPAL.
* lasso/saml-2.0/login.c:
profile->msg_url is released before being used ;( Restore the code
copying the URL before passing it to
lasso_saml20_profile_build_http_redirect, to free it after.
* lasso/Makefile.am:
distribute extract_sections.py
* docs/references/lasso/lasso.types.in: add missing class (mainly SAML2
and ID-WSF 1.0/2.0) from docs/references/lasso.types.in
* lasso/xml/strings.h:
add lots of documentation, or at least documentation template to
strings constants.
* id-ff/login.h:
* saml-2.0/assertion_query.h:
* xml/xml.h:
document undocumented enumerations.
* lasso/errors.h:
add proper documentation about error codes.
* lasso/errors.c:
new version of the lasso_strerror function
* lasso/build_strerror.py:
update the script that generater lasso_strerror from the
documentation comments.
Remove usage of OFTYPE
* lasso/id-ff/session.c:
* lasso/id-ff/session.h:
remove usage of oftype, prefer gtk-introspection annotations instead.
* lasso/id-wsf/data_service.h:
* lasso/id-wsf/data_service.c:
do the same.
Add a script to build lasso-sections.txt
* lasso/extract_sections.py:
this script parses header files and generated lasso-sections.txt
content for GObject class descriptions.
Add a template file for the lasso-section.txt file
* docs/references/lasso-sections.txt.in:
this file serves as a base for the generation of lasso-sections.txt
Update docs/references/Makefile.am for generating lasso-sections.txt
* docs/references/Makefile.am:
always rebuild template, using out of source build directory is too
weird without it.
call new script extract_sections.py to regenerate lasso-sections.txt
if header files changed.
Update lasso.sgml file with all missing sections
* docs/reference/lasso.sgml:
add all missing sections, mainly objects from XML schemas.
* docs/reference/lasso-sections.txt: update it
* *.c: add section documentation to some files.
* lasso/xml/strings.h: fix bad usage or docbook markup
* nearly all C files: change includes for relative paths.
* lasso/id-wsf/id_wsf.h, lasso/id-wsf-2.0/id_wsf_2.h: add top level
public include files for ID-WSF 1.0 and ID-WSF 2.0.
* lasso/id-ff/server.*, lasso/id-ff/session.*, lasso/id-ff/identity.*:
remove most of the code related to ID-WSF and push into
lasso/id-wsf/id_ff_extensions.* and lasso/id-wsf-2.0/identity.c,
lasso/id-wsf-2.0/server.c, lasso/id-wsf-2.0/session.c.
* lasso/id-wsf-2.0/saml2_login.c,
lasso/id-wsf-2.0/saml2_login_private.h: same change but for ID-WSF
2.0 support in SAML2 SSO profile.
* id-ff/session.h: seal public fields.
* id-ff/session.c, id-ff/sessionprivate.h: add accessors for reading
the is_dirty flag and counting store assertions.
* id-ff/logout.c, id-ff/login.c, saml-2.0/login.c, saml-2.0/logout.c,
saml-2.0/profile.c: use the new accessors.
* id-ff/profile.c: include the private header file, use the new
accessors, and remove unnecessary setting of is_dirty to FALSE (it
should be false at instanciation).
* utils.h: add a macro to access private content, prepare for using
G_TYPE_INSTANCE_GET_PRIVATE and the GObject infrastructure for
private structures eventually.
* lasso/saml-2.0/login.c:
* lasso/saml-2.0/logout.c:
* lasso/saml-2.0/name_id_management.c:
* lasso/saml-2.0/profile.c:
* lasso/saml-2.0/provider.c:
do not mix g_malloc strings with libxml strings, use the
string/gobject handling macros as much as possible, be a good memory
citizen, don't put your elbows on the table.
* lasso/saml-2.0/profile.c:
in lasso_saml20_profile_process_any_request and
lasso_saml20_profile_process_any_response do not make signature
validation failure as call failure, just store the result in
profile->signature_status and let the upper level functions handle
what to do with it. also add documentation about those two functions.
* lasso/saml-2.0/logout.c:
* lasso/saml-2.0/name_id_management.c:
handle new signature_status semantic.
* lasso/saml-2.0/login.c:
add internal documentation for
lasso_saml20_login_process_authn_response_msg.
* lasso/saml-2.0/login.c:
lasso_saml20_login_check_assertion_signature() find the issuer of an
assertion, look it up in the server object and try to validate its
signature. It returns an error code if any of this step fails.
* lasso/saml-2.0/login.c: In
lasso_saml20_login_process_authn_request_msg change handling of
relayState do not rely upon parsing by the node object, but extract
directly from the query string. Use new function
lasso_get_relaystate_from_query.
* lasso/saml-2.0/logout.c: In lasso_saml20_logout_process_request_msg
change handling of relayState do not rely upon parsing by the node
object, but extract directly from the query string.
* lasso/saml-2.0/profile.c: In
lasso_saml20_profile_init_artifact_resolve, add handling of the
relayState transmitted to the assertion consumer URL.
* lasso/saml-2.0/name_id_management.c: In
lasso_name_id_management_process_request_msg change handling of
relayState do not rely upon parsing by the node
object, but extract directly from the query string.
* lasso/saml-2.0/login.c, lasso/saml-2.0/logout.c,
lasso/saml-2.0/name_id_management.c: simplify code path associated
with generation of the url for the HTTP-Redirect binding using the
rencently introduced function
lasso_saml20_profile_build_http_redirect.
* lasso/saml-2.0/login.c:
use new generic profile methods for saml 2.0 in
lasso_saml20_login_process_paos_response_msg,
lasso_saml20_login_process_authn_response_msg,
lasso_saml20_login_process_response_status_and_assertion.
Benjamin Dauvergne