/* $Id$ * * Lasso - A free implementation of the Liberty Alliance specifications. * * Copyright (C) 2004-2007 Entr'ouvert * http://lasso.entrouvert.org * * Authors: See AUTHORS file in top-level directory. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ /** * SECTION:provider * @short_description: Service or identity provider * * The #LassoProvider object holds metadata about a provider. Metadata are sorted into descriptors, * each descriptor being assigned a role. We refer you to Liberty Metadata Description * and Discovery Specification and Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0. Roles are represented by the enumeration #LassoProviderRole, you can access descriptors content using lasso_provider_get_metadata_list_by_role() and lasso_provider_get_metadata_by_role(). Descriptors resources are flattened inside a simple hashtable. For example to get the URL(s) for the SAML 2.0 single logout response endpoint using binding HTTP-POST of the SP descriptor of a provider called x, you would call: GList *urls = lasso_provider_get_metadata_list_by_role(x, LASSO_PROVIDER_ROLE_SP, "SingleLogoutService HTTP-POST ResponseLocation"); A provider usually possess a default role stored in the #LassoProvider.role field, which is initialized by the lasso_server_add_provider() method when registering a new remote provider to our current provider. The methods lasso_provider_get_metadata() and lasso_provider_get_metadata_list() use this default role to access descriptors. **/ #include "../xml/private.h" #include #include #include #include #include #include #include #include "provider.h" #include "providerprivate.h" #include "../saml-2.0/providerprivate.h" #include #include "../utils.h" #include "../debug.h" static char *protocol_uris[LASSO_MD_PROTOCOL_TYPE_LAST] = { "http://projectliberty.org/profiles/fedterm", "http://projectliberty.org/profiles/nim", "http://projectliberty.org/profiles/rni", "http://projectliberty.org/profiles/slo", NULL /* none for single sign on */ }; static char *protocol_md_nodename[LASSO_MD_PROTOCOL_TYPE_LAST] = { "FederationTerminationNotificationProtocolProfile", "NameIdentifierMappingProtocolProfile", "RegisterNameIdentifierProtocolProfile", "SingleLogoutProtocolProfile", "SingleSignOnProtocolProfile" }; static char *protocol_roles[LASSO_PROVIDER_ROLE_LAST] = { NULL, "idp", "sp", "authn-authority", "pdp", "attribute-authority" }; char *protocol_methods[LASSO_HTTP_METHOD_LAST] = { "", "", "", "", "", "-http", "-soap" }; static gboolean _lasso_provider_load_metadata_from_doc(LassoProvider *provider, xmlDoc *doc); static int _lasso_provider_get_role_index(LassoProviderRole role); void _lasso_provider_add_metadata_value_for_role(LassoProvider *provider, LassoProviderRole role, const char *name, const char *value); typedef int LassoProviderRoleIndex; /*****************************************************************************/ /* public methods */ /*****************************************************************************/ /** * lasso_provider_get_assertion_consumer_service_url: * @provider: a #LassoProvider * @service_id:(allow-none): the AssertionConsumerServiceID, NULL for default * * Extracts the AssertionConsumerServiceURL from the provider metadata * descriptor. * * Return value:(allow-none)(transfer full): the element value, NULL if the element was not found. This * string must be freed by the caller. **/ gchar* lasso_provider_get_assertion_consumer_service_url(LassoProvider *provider, const char *service_id) { char *name = NULL; char *assertion_consumer_service_url = NULL; if (service_id == NULL) service_id = provider->private_data->default_assertion_consumer; name = g_strdup_printf("AssertionConsumerServiceURL %s", service_id); assertion_consumer_service_url = lasso_provider_get_metadata_one_for_role(provider, LASSO_PROVIDER_ROLE_SP, name); g_free(name); return assertion_consumer_service_url; } static LassoProviderRoleIndex _lasso_provider_get_role_index(LassoProviderRole role) { switch (role) { case LASSO_PROVIDER_ROLE_IDP: return 1; case LASSO_PROVIDER_ROLE_SP: return 2; case LASSO_PROVIDER_ROLE_AUTHN_AUTHORITY: return 3; case LASSO_PROVIDER_ROLE_AUTHZ_AUTHORITY: return 4; case LASSO_PROVIDER_ROLE_ATTRIBUTE_AUTHORITY: return 5; default: return 0; } } void _lasso_provider_add_metadata_value_for_role(LassoProvider *provider, LassoProviderRole role, const char *name, const char *value) { GList *l; GHashTable *descriptor; char *symbol; LassoProviderRoleIndex role_index; g_return_if_fail(LASSO_IS_PROVIDER(provider) && name && value); role_index = _lasso_provider_get_role_index(role); g_return_if_fail ( role_index); descriptor = provider->private_data->Descriptors; /* default to SP */ g_return_if_fail (descriptor); l = (GList*)lasso_provider_get_metadata_list_for_role(provider, role, name); lasso_list_add_string(l, value); symbol = g_strdup_printf("%s %s", protocol_roles[role_index], name); g_hash_table_insert(descriptor, symbol, l); } /** * lasso_provider_get_metadata_list_for_role: * @provider: a #LassoProvider * @role: a #LassoProviderRole value * @name: the element name * * Extracts zero to many elements from the @provider descriptor for the given @role. * * Return value:(transfer none)(element-type string): a #GList with the elements. This GList is internally * allocated and points to internally allocated strings. It must * not be freed, modified or stored. **/ GList* lasso_provider_get_metadata_list_for_role(const LassoProvider *provider, LassoProviderRole role, const char *name) { GList *l; GHashTable *descriptor; char *symbol; LassoProviderRoleIndex role_index; g_return_val_if_fail(LASSO_IS_PROVIDER(provider) && name, NULL); role_index = _lasso_provider_get_role_index(role); if (! role_index) return NULL; descriptor = provider->private_data->Descriptors; /* default to SP */ if (descriptor == NULL) return NULL; symbol = g_strdup_printf("%s %s", protocol_roles[role_index], name); l = g_hash_table_lookup(descriptor, symbol); g_free(symbol); return l; } /** * lasso_provider_get_metadata_one_for_role: * @provider: a #LassoProvider object * @role: a #LassoProviderRole value * @name: a metadata information name * * Return the given information extracted from the metadata of the given #LassoProvider for the * given @role descriptor. * * Retun value: a newly allocated string or NULL. If non-NULL must be freed by the caller. */ char* lasso_provider_get_metadata_one_for_role(LassoProvider *provider, LassoProviderRole role, const char *name) { const GList *l; l = lasso_provider_get_metadata_list_for_role(provider, role, name); if (l) return g_strdup(l->data); return NULL; } /** * lasso_provider_get_metadata_one: * @provider: a #LassoProvider * @name: the element name * * Extracts the element @name from the provider metadata descriptor. * * Return value:(transfer full)(allow-none): the element value, NULL if the element was not found. This * string must be freed by the caller. **/ gchar* lasso_provider_get_metadata_one(LassoProvider *provider, const char *name) { return lasso_provider_get_metadata_one_for_role(provider, provider->role, name); } /** * lasso_provider_get_metadata_list: * @provider: a #LassoProvider * @name: the element name * * Extracts zero to many elements from the provider metadata descriptor. * * Return value:(transfer none)(element-type string): a #GList with the elements. This GList is internally * allocated and points to internally allocated strings. It must * not be freed, modified or stored. **/ GList* lasso_provider_get_metadata_list(LassoProvider *provider, const char *name) { return lasso_provider_get_metadata_list_for_role(provider, provider->role, name); } /** * lasso_provider_get_first_http_method: * @provider: (transfer none): a #LassoProvider * @remote_provider: a #LassoProvider depicting the remote provider * @protocol_type: a Liberty profile * * Looks up and returns a #LassoHttpMethod appropriate for performing the * @protocol_type between @provider and @remote_provider. * * Return value: the #LassoHttpMethod **/ LassoHttpMethod lasso_provider_get_first_http_method(LassoProvider *provider, LassoProvider *remote_provider, LassoMdProtocolType protocol_type) { char *protocol_profile_prefix; const GList *local_supported_profiles; const GList *remote_supported_profiles; const GList *t1, *t2 = NULL; gboolean found; g_return_val_if_fail(LASSO_IS_PROVIDER(provider), LASSO_HTTP_METHOD_NONE); if (provider->private_data->conformance == LASSO_PROTOCOL_SAML_2_0) { return lasso_saml20_provider_get_first_http_method( provider, remote_provider, protocol_type); } if (remote_provider->role == LASSO_PROVIDER_ROLE_SP) provider->role = LASSO_PROVIDER_ROLE_IDP; if (remote_provider->role == LASSO_PROVIDER_ROLE_IDP) provider->role = LASSO_PROVIDER_ROLE_SP; protocol_profile_prefix = g_strdup_printf("%s-%s", protocol_uris[protocol_type], protocol_roles[provider->role]); local_supported_profiles = lasso_provider_get_metadata_list( provider, protocol_md_nodename[protocol_type]); remote_supported_profiles = lasso_provider_get_metadata_list( remote_provider, protocol_md_nodename[protocol_type]); found = FALSE; t1 = local_supported_profiles; while (t1 && !found) { if (g_str_has_prefix(t1->data, protocol_profile_prefix)) { t2 = remote_supported_profiles; while (t2 && !found) { if (strcmp(t1->data, t2->data) == 0) { found = TRUE; break; /* avoid the g_list_next */ } t2 = g_list_next(t2); } } t1 = g_list_next(t1); } g_free(protocol_profile_prefix); if (found) { if (g_str_has_suffix(t2->data, "http")) return LASSO_HTTP_METHOD_REDIRECT; if (g_str_has_suffix(t2->data, "soap")) return LASSO_HTTP_METHOD_SOAP; g_assert_not_reached(); } return LASSO_HTTP_METHOD_NONE; } /** * lasso_provider_accept_http_method: * @provider: a #LassoProvider * @remote_provider: a #LassoProvider depicting the remote provider * @protocol_type: a Liberty profile type * @http_method: an HTTP method * @initiate_profile: whether @provider initiates the profile * * Gets if @http_method is an appropriate method for the @protocol_type profile * between @provider and @remote_provider. * * Return value: %TRUE if it is appropriate **/ gboolean lasso_provider_accept_http_method(LassoProvider *provider, LassoProvider *remote_provider, LassoMdProtocolType protocol_type, LassoHttpMethod http_method, gboolean initiate_profile) { LassoProviderRole initiating_role; char *protocol_profile; g_return_val_if_fail(LASSO_IS_PROVIDER(provider), FALSE); /* Be conservative */ if (provider->private_data->conformance == LASSO_PROTOCOL_SAML_2_0) { return lasso_saml20_provider_accept_http_method( provider, remote_provider, protocol_type, http_method, initiate_profile); } initiating_role = remote_provider->role; if (remote_provider->role == LASSO_PROVIDER_ROLE_SP) { provider->role = LASSO_PROVIDER_ROLE_IDP; } if (remote_provider->role == LASSO_PROVIDER_ROLE_IDP) { provider->role = LASSO_PROVIDER_ROLE_SP; } if (initiate_profile) initiating_role = provider->role; protocol_profile = g_strdup_printf("%s-%s%s", protocol_uris[protocol_type], protocol_roles[initiating_role], protocol_methods[http_method+1]); if (lasso_provider_has_protocol_profile(provider, protocol_type, protocol_profile) == FALSE) { g_free(protocol_profile); return FALSE; } if (lasso_provider_has_protocol_profile(remote_provider, protocol_type, protocol_profile) == FALSE) { g_free(protocol_profile); return FALSE; } g_free(protocol_profile); return TRUE; } /** * lasso_provider_has_protocol_profile: * @provider: a #LassoProvider * @protocol_type: a Liberty profile type * @protocol_profile: a fully-qualified Liberty profile * * Gets if @provider supports @protocol_profile. * * Return value: %TRUE if it is supported **/ gboolean lasso_provider_has_protocol_profile(LassoProvider *provider, LassoMdProtocolType protocol_type, const char *protocol_profile) { const GList *supported; g_return_val_if_fail(LASSO_IS_PROVIDER(provider), FALSE); /* Be conservative */ supported = lasso_provider_get_metadata_list( provider, protocol_md_nodename[protocol_type]); if (g_list_find_custom((GList*)supported, protocol_profile, (GCompareFunc)strcmp) == NULL) return FALSE; return TRUE; } /** * lasso_provider_get_base64_succinct_id: * @provider: a #LassoProvider * * Computes and returns the base64-encoded provider succinct ID. * * Return value:(transfer full)(allow-none): the provider succinct ID. This string must be freed by the * caller. **/ char* lasso_provider_get_base64_succinct_id(const LassoProvider *provider) { char *succinct_id, *base64_succinct_id, *ret; g_return_val_if_fail(LASSO_IS_PROVIDER(provider), NULL); succinct_id = lasso_sha1(provider->ProviderID); base64_succinct_id = (char*)xmlSecBase64Encode((xmlChar*)succinct_id, 20, 0); xmlFree(succinct_id); ret = g_strdup(base64_succinct_id); xmlFree(base64_succinct_id); return ret; } /** * lasso_provider_get_organization * @provider: a #LassoProvider * * Returns the provider metadata <Organization> XML node. * * Return value:(transfer full)(allow-none): the <Organization/> node (libxml2 xmlNode*); or NULL if it is * not found. This xmlnode must be freed by the caller. **/ xmlNode* lasso_provider_get_organization(const LassoProvider *provider) { g_return_val_if_fail(LASSO_IS_PROVIDER(provider), NULL); if (provider->private_data->organization) { return xmlCopyNode(provider->private_data->organization, 1); } else { return NULL; } } /*****************************************************************************/ /* private methods */ /*****************************************************************************/ static struct XmlSnippet schema_snippets[] = { { "PublicKeyFilePath", SNIPPET_CONTENT, G_STRUCT_OFFSET(LassoProvider, public_key), NULL, NULL, NULL}, { "CaCertChainFilePath", SNIPPET_CONTENT, G_STRUCT_OFFSET(LassoProvider, ca_cert_chain), NULL, NULL, NULL}, { "MetadataFilePath", SNIPPET_CONTENT, G_STRUCT_OFFSET(LassoProvider, metadata_filename), NULL, NULL, NULL}, { "ProviderID", SNIPPET_ATTRIBUTE, G_STRUCT_OFFSET(LassoProvider, ProviderID), NULL, NULL, NULL}, {NULL, 0, 0, NULL, NULL, NULL} }; static LassoNodeClass *parent_class = NULL; /** * lasso_provider_get_public_key: * @provider: a #LassoProvider object * * Return the public key associated with this provider. * * Return value: an #xmlSecKey object. */ xmlSecKey* lasso_provider_get_public_key(const LassoProvider *provider) { g_return_val_if_fail(LASSO_IS_PROVIDER(provider), NULL); return provider->private_data->public_key; } /** * lasso_provider_get_encryption_public_key: * @provider: a #LassoProvider object. * * Return the #xmlSecKey public key to use for encrypting content target at @provider. * * Return value:(transfer none)(allow-none): an #xmlSecKey object, or NULL if no key is known or @provider is not a * #LassoProvider. */ xmlSecKey* lasso_provider_get_encryption_public_key(const LassoProvider *provider) { g_return_val_if_fail(LASSO_IS_PROVIDER(provider), NULL); if (provider->private_data->encryption_public_key) { return provider->private_data->encryption_public_key; } return lasso_provider_get_public_key(provider); } static void _lasso_provider_load_endpoint_type(LassoProvider *provider, xmlNode *endpoint, LassoProviderRole role) { char *name = (char*)endpoint->name; xmlChar *value = NULL; if (strcmp(name, "AssertionConsumerServiceURL") == 0) { char *isDefault = (char*)xmlGetProp(endpoint, (xmlChar*)"isDefault"); char *id = (char*)xmlGetProp(endpoint, (xmlChar*)"id"); name = g_strdup_printf("%s %s", name, id); if (isDefault) { if (strcmp(isDefault, "true") == 0 || strcmp(isDefault, "1") == 0) lasso_assign_string(provider->private_data->default_assertion_consumer, id); xmlFree(isDefault); } xmlFree(id); } else { name = g_strdup_printf("%s", (char*)name); } value = xmlNodeGetContent(endpoint); _lasso_provider_add_metadata_value_for_role(provider, role, name, (char*)value); lasso_release_string(name); xmlFree(value); } static void _lasso_provider_load_descriptor(LassoProvider *provider, xmlNode *xmlnode, LassoProviderRole role) { xmlNode *t; t = xmlSecGetNextElementNode(xmlnode->children); while (t) { if (xmlSecCheckNodeName(t, BAD_CAST "KeyDescriptor", BAD_CAST LASSO_METADATA_HREF)) { _lasso_provider_load_key_descriptor(provider, t); } else { _lasso_provider_load_endpoint_type(provider, t, role); } t = xmlSecGetNextElementNode(t->next); } } static xmlNode* get_xmlNode(LassoNode *node, gboolean lasso_dump) { xmlNode *xmlnode; LassoProvider *provider = LASSO_PROVIDER(node); char *roles[LASSO_PROVIDER_ROLE_LAST] = { "None", "SP", "IdP", "AuthnAuthority", "PDP", "AttributeAuthority" }; char *encryption_mode[] = { "None", "NameId", "Assertion", "Both" }; xmlnode = parent_class->get_xmlNode(node, lasso_dump); /* Save provider role */ xmlSetProp(xmlnode, (xmlChar*)"ProviderDumpVersion", (xmlChar*)"2"); if (provider->role) { xmlSetProp(xmlnode, (xmlChar*)"ProviderRole", (xmlChar*)roles[provider->role]); } /* Save encryption mode */ xmlSetProp(xmlnode, (xmlChar*)"EncryptionMode", (xmlChar*)encryption_mode[provider->private_data->encryption_mode]); return xmlnode; } void _lasso_provider_load_key_descriptor(LassoProvider *provider, xmlNode *key_descriptor) { LassoProviderPrivate *private_data; xmlChar *use; g_return_if_fail(LASSO_IS_PROVIDER(provider)); g_return_if_fail(provider->private_data); private_data = provider->private_data; use = xmlGetProp(key_descriptor, (xmlChar*)"use"); if (use == NULL || g_strcmp0((char*)use, "signing") == 0) { lasso_assign_xml_node(private_data->signing_key_descriptor, key_descriptor); } if (use == NULL || strcmp((char*)use, "encryption") == 0) { lasso_assign_xml_node(private_data->encryption_key_descriptor, key_descriptor); } lasso_release_xml_string(use); } static int init_from_xml(LassoNode *node, xmlNode *xmlnode) { LassoProvider *provider = LASSO_PROVIDER(node); static char * const roles[LASSO_PROVIDER_ROLE_LAST] = { "None", "SP", "IdP", "AuthnAuthority", "PDP", "AttributeAuthority" }; xmlChar *s; int i; parent_class->init_from_xml(node, xmlnode); if (xmlnode == NULL) { return LASSO_XML_ERROR_OBJECT_CONSTRUCTION_FAILED; } /* Load provider role */ s = xmlGetProp(xmlnode, (xmlChar*)"ProviderRole"); provider->role = LASSO_PROVIDER_ROLE_NONE; if (s) { i = LASSO_PROVIDER_ROLE_NONE; while (i < LASSO_PROVIDER_ROLE_LAST) { if (strcmp((char*)s, roles[i]) == 0) { provider->role = i; break; } i++; } lasso_release_xml_string(s); } /* Load encryption mode */ s = xmlGetProp(xmlnode, (xmlChar*)"EncryptionMode"); if (s != NULL && strcmp((char*)s, "NameId") == 0) { provider->private_data->encryption_mode = LASSO_ENCRYPTION_MODE_NAMEID; } else if (s != NULL && strcmp((char*)s, "Assertion") == 0) { provider->private_data->encryption_mode = LASSO_ENCRYPTION_MODE_ASSERTION; } else if (s != NULL && strcmp((char*)s, "Both") == 0) { provider->private_data->encryption_mode = LASSO_ENCRYPTION_MODE_NAMEID | LASSO_ENCRYPTION_MODE_ASSERTION; } if (s != NULL) { xmlFree(s); } /* Load metadata */ if (provider->metadata_filename) { if (! lasso_provider_load_metadata(provider, provider->metadata_filename)) { if (! lasso_provider_load_metadata_from_buffer(provider, provider->metadata_filename)) { message(G_LOG_LEVEL_WARNING, "Metadata unrecoverable from dump"); return 1; } } } /* Load signing and encryption public keys */ lasso_provider_load_public_key(provider, LASSO_PUBLIC_KEY_SIGNING); lasso_provider_load_public_key(provider, LASSO_PUBLIC_KEY_ENCRYPTION); return 0; } static void* _lasso_provider_get_pdata_thing(LassoProvider *provider, ptrdiff_t offset) { LassoProviderPrivate *pdata; lasso_return_val_if_fail(LASSO_IS_PROVIDER(provider), NULL); pdata = provider->private_data; if (pdata) return G_STRUCT_MEMBER_P(pdata, offset); return NULL; } /** * lasso_provider_get_idp_supported_attributes: * @provider: a #LassoProvider object * * If the provider supports the IDP SSO role, then return the list of Attribute definition that this * provider declared supporting. * * Return value:(transfer none)(element-type LassoNode): a list of #LassoSaml2Attribute or #LassoSamlAttribute */ GList* lasso_provider_get_idp_supported_attributes(LassoProvider *provider) { return _lasso_provider_get_pdata_thing(provider, G_STRUCT_OFFSET(LassoProviderPrivate, attributes)); } /** * lasso_provider_get_valid_until: * @provider: a #LassoProvider object * * Return the time after which the metadata for this provider will become invalid. This is an * ISO-8601 formatted string. * * Return value:(transfer none): an internally allocated string, you can copy it but not store it. */ char* lasso_provider_get_valid_until(LassoProvider *provider) { return _lasso_provider_get_pdata_thing(provider, G_STRUCT_OFFSET(LassoProviderPrivate, valid_until)); } /** * lasso_provider_get_cache_duration: * @provider: a #LassoProvider object * * Return the time during which the metadata for this provider can be kept. * * Return value:(transfer none): an internally allocated string, you can copy it but not store it. */ char* lasso_provider_get_cache_duration(LassoProvider *provider) { return _lasso_provider_get_pdata_thing(provider, G_STRUCT_OFFSET(LassoProviderPrivate, cache_duration)); } /*****************************************************************************/ /* overridden parent class methods */ /*****************************************************************************/ static void free_list_strings(G_GNUC_UNUSED gchar *key, GList *list, G_GNUC_UNUSED gpointer data) { g_list_foreach(list, (GFunc)g_free, NULL); g_list_free(list); } static void dispose(GObject *object) { LassoProvider *provider = LASSO_PROVIDER(object); if (provider->private_data->dispose_has_run) { return; } provider->private_data->dispose_has_run = TRUE; if (provider->private_data->Descriptors) { g_hash_table_foreach(provider->private_data->Descriptors, (GHFunc)free_list_strings, NULL); g_hash_table_destroy(provider->private_data->Descriptors); } provider->private_data->Descriptors = NULL; if (provider->private_data->organization) { xmlFreeNode(provider->private_data->organization); provider->private_data->organization = NULL; } if (provider->private_data->default_assertion_consumer) { g_free(provider->private_data->default_assertion_consumer); provider->private_data->default_assertion_consumer = NULL; } if (provider->private_data->public_key) { xmlSecKeyDestroy(provider->private_data->public_key); provider->private_data->public_key = NULL; } if (provider->private_data->signing_key_descriptor) { xmlFreeNode(provider->private_data->signing_key_descriptor); provider->private_data->signing_key_descriptor = NULL; } if (provider->private_data->encryption_key_descriptor) { xmlFreeNode(provider->private_data->encryption_key_descriptor); provider->private_data->encryption_key_descriptor = NULL; } if (provider->private_data->encryption_public_key_str) { g_free(provider->private_data->encryption_public_key_str); provider->private_data->encryption_public_key_str = NULL; } if (provider->private_data->encryption_public_key) { xmlSecKeyDestroy(provider->private_data->encryption_public_key); provider->private_data->encryption_public_key = NULL; } g_free(provider->private_data->affiliation_id); provider->private_data->affiliation_id = NULL; g_free(provider->private_data->affiliation_owner_id); provider->private_data->affiliation_owner_id = NULL; G_OBJECT_CLASS(parent_class)->dispose(G_OBJECT(provider)); } static void finalize(GObject *object) { LassoProvider *provider = LASSO_PROVIDER(object); g_free(provider->private_data); provider->private_data = NULL; G_OBJECT_CLASS(parent_class)->finalize(G_OBJECT(provider)); } /*****************************************************************************/ /* instance and class init functions */ /*****************************************************************************/ static void instance_init(LassoProvider *provider) { provider->role = LASSO_PROVIDER_ROLE_NONE; provider->ProviderID = NULL; provider->metadata_filename = NULL; provider->public_key = NULL; provider->ca_cert_chain = NULL; provider->private_data = g_new0(LassoProviderPrivate, 1); provider->private_data->dispose_has_run = FALSE; provider->private_data->default_assertion_consumer = NULL; provider->private_data->affiliation_id = NULL; provider->private_data->affiliation_owner_id = NULL; provider->private_data->organization = NULL; provider->private_data->public_key = NULL; provider->private_data->signing_key_descriptor = NULL; provider->private_data->encryption_key_descriptor = NULL; provider->private_data->encryption_public_key_str = NULL; provider->private_data->encryption_public_key = NULL; provider->private_data->encryption_mode = LASSO_ENCRYPTION_MODE_NONE; provider->private_data->encryption_sym_key_type = LASSO_ENCRYPTION_SYM_KEY_TYPE_AES_128; /* no value_destroy_func since it shouldn't destroy the GList on insert */ provider->private_data->Descriptors = g_hash_table_new_full( g_str_hash, g_str_equal, g_free, NULL); provider->private_data->attributes = NULL; } static void class_init(LassoProviderClass *klass) { LassoNodeClass *nclass = LASSO_NODE_CLASS(klass); parent_class = g_type_class_peek_parent(klass); nclass->node_data = g_new0(LassoNodeClassData, 1); lasso_node_class_set_nodename(nclass, "Provider"); lasso_node_class_set_ns(nclass, LASSO_LASSO_HREF, LASSO_LASSO_PREFIX); lasso_node_class_add_snippets(nclass, schema_snippets); nclass->get_xmlNode = get_xmlNode; nclass->init_from_xml = init_from_xml; G_OBJECT_CLASS(klass)->dispose = dispose; G_OBJECT_CLASS(klass)->finalize = finalize; } GType lasso_provider_get_type() { static GType this_type = 0; if (!this_type) { static const GTypeInfo this_info = { sizeof (LassoProviderClass), NULL, NULL, (GClassInitFunc) class_init, NULL, NULL, sizeof(LassoProvider), 0, (GInstanceInitFunc) instance_init, NULL }; this_type = g_type_register_static(LASSO_TYPE_NODE, "LassoProvider", &this_info, 0); } return this_type; } /** * lasso_provider_get_protocol_conformance: * @provider: a #LassoProvider object * * Return the protocol conformance of the given provider, it should allow to switch behaviour of SP * and IdP code toward a specific protocol. See also #LassoProtocolConformance. * * Return value: a value in the #LassoProtocolConformance enumeration. */ LassoProtocolConformance lasso_provider_get_protocol_conformance(const LassoProvider *provider) { g_return_val_if_fail(LASSO_IS_PROVIDER(provider), LASSO_PROTOCOL_NONE); return provider->private_data->conformance; } gboolean _lasso_provider_load_metadata_from_buffer(LassoProvider *provider, const gchar *metadata, int length) { xmlDoc *doc; gboolean rc = TRUE; lasso_return_val_if_fail(LASSO_IS_PROVIDER(provider), FALSE); if (length == -1) { length = strlen(metadata); } doc = lasso_xml_parse_memory(metadata, length); if (doc == NULL) { return FALSE; } goto_cleanup_if_fail_with_rc (_lasso_provider_load_metadata_from_doc(provider, doc), FALSE); lasso_assign_string(provider->metadata_filename, metadata); cleanup: lasso_release_doc(doc); return rc; } /** * lasso_provider_load_metadata_from_buffer: * @provider: a #LassProvider object * @metadata: a char* string containing a metadata XML file. * * Load metadata into this provider object using the given string buffer. * * Return value: TRUE if successfull, FALSE otherwise. **/ gboolean lasso_provider_load_metadata_from_buffer(LassoProvider *provider, const gchar *metadata) { return _lasso_provider_load_metadata_from_buffer(provider, metadata, -1); } /** * lasso_provider_load_metadata: * @provider: a #LassProvider object * @path: the path to a SAML 2.0 of ID-FF 1.2 metadata file. * * Load metadata into this provider object by reading them from the given file. * * Return value: TRUE if successfull, FALSE otherwise. **/ gboolean lasso_provider_load_metadata(LassoProvider *provider, const gchar *path) { char *file_content; size_t file_length; if (g_file_get_contents(path, &file_content, &file_length, NULL)) { gboolean ret; ret = _lasso_provider_load_metadata_from_buffer(provider, file_content, file_length); lasso_release(file_content); return ret; } return FALSE; } static gboolean _lasso_provider_load_metadata_from_doc(LassoProvider *provider, xmlDoc *doc) { xmlXPathContext *xpathCtx; xmlXPathObject *xpathObj; xmlNode *node; const char *xpath_idp = "/md:EntityDescriptor/md:IDPDescriptor"; const char *xpath_sp = "/md:EntityDescriptor/md:SPDescriptor"; const char *xpath_organization = "/md:EntityDescriptor/md:Organization"; xmlChar *providerID = NULL; g_return_val_if_fail(LASSO_IS_PROVIDER(provider), FALSE); if (doc == NULL) { return FALSE; } node = xmlDocGetRootElement(doc); if (node == NULL || node->ns == NULL) { message (G_LOG_LEVEL_CRITICAL, "lasso_provider_load_metadata_from_doc: no root element"); return FALSE; } if (strcmp((char*)node->ns->href, LASSO_SAML2_METADATA_HREF) == 0) { gboolean result; provider->private_data->conformance = LASSO_PROTOCOL_SAML_2_0; result = lasso_saml20_provider_load_metadata(provider, node); return result; } provider->private_data->conformance = LASSO_PROTOCOL_LIBERTY_1_2; xpathCtx = xmlXPathNewContext(doc); xmlXPathRegisterNs(xpathCtx, (xmlChar*)"md", (xmlChar*)LASSO_METADATA_HREF); xpathObj = xmlXPathEvalExpression((xmlChar*)"/md:EntityDescriptor", xpathCtx); /* if empty: not a ID-FF 1.2 metadata file -> bails out */ if (xpathObj->nodesetval == NULL || xpathObj->nodesetval->nodeNr == 0) { xmlXPathFreeObject(xpathObj); xmlXPathRegisterNs(xpathCtx, (xmlChar*)"md11", (xmlChar*)"http://projectliberty.org/schemas/core/2002/12"); xpathObj = xmlXPathEvalExpression( (xmlChar*)"/md11:SPDescriptor|/md11:IDPDescriptor", xpathCtx); if (xpathObj->nodesetval == NULL || xpathObj->nodesetval->nodeNr == 0) { message (G_LOG_LEVEL_CRITICAL, "lasso_saml20_provider_load_metadata_from_doc: no md12:EntityDescriptor or md11:SPDesriptor or md11:IDPDescriptor"); xmlXPathFreeObject(xpathObj); xmlXPathFreeContext(xpathCtx); return FALSE; } provider->private_data->conformance = LASSO_PROTOCOL_LIBERTY_1_1; xpath_idp = "/md11:IDPDescriptor"; xpath_sp = "/md11:SPDescriptor"; } node = xpathObj->nodesetval->nodeTab[0]; providerID = xmlGetProp(node, (xmlChar*)"providerID"); lasso_assign_string(provider->ProviderID, (char*)providerID); lasso_release_xml_string(providerID); xmlXPathFreeObject(xpathObj); xpathObj = xmlXPathEvalExpression((xmlChar*)xpath_idp, xpathCtx); if (xpathObj && xpathObj->nodesetval && xpathObj->nodesetval->nodeNr == 1) { _lasso_provider_load_descriptor(provider, xpathObj->nodesetval->nodeTab[0], LASSO_PROVIDER_ROLE_IDP); if (provider->private_data->conformance < LASSO_PROTOCOL_LIBERTY_1_2) { /* lookup ProviderID */ node = xpathObj->nodesetval->nodeTab[0]->children; while (node) { if (strcmp((char*)node->name, "ProviderID") == 0) { providerID = xmlNodeGetContent(node); lasso_assign_string(provider->ProviderID, (char*)providerID); lasso_release_xml_string(providerID); break; } node = node->next; } } } xmlXPathFreeObject(xpathObj); xpathObj = xmlXPathEvalExpression((xmlChar*)xpath_sp, xpathCtx); if (xpathObj && xpathObj->nodesetval && xpathObj->nodesetval->nodeNr == 1) { _lasso_provider_load_descriptor(provider, xpathObj->nodesetval->nodeTab[0], LASSO_PROVIDER_ROLE_SP); if (provider->private_data->conformance < LASSO_PROTOCOL_LIBERTY_1_2) { /* lookup ProviderID */ node = xpathObj->nodesetval->nodeTab[0]->children; while (node) { if (strcmp((char*)node->name, "ProviderID") == 0) { providerID = xmlNodeGetContent(node); lasso_assign_string(provider->ProviderID, (char*)providerID); lasso_release_xml_string(providerID); break; } node = node->next; } } } xmlXPathFreeObject(xpathObj); xpathObj = xmlXPathEvalExpression((xmlChar*)xpath_organization, xpathCtx); if (xpathObj && xpathObj->nodesetval && xpathObj->nodesetval->nodeNr == 1) { lasso_assign_xml_node(provider->private_data->organization, xpathObj->nodesetval->nodeTab[0]); } xmlXPathFreeObject(xpathObj); xmlXPathFreeContext(xpathCtx); return TRUE; } /** * lasso_provider_new_helper: * * Helper function for the two other constructors, lasso_provider_new and lasso_provider_new_from_buffer. * Help to factorize common code. */ static LassoProvider* _lasso_provider_new_helper(LassoProviderRole role, const char *metadata, const char *public_key, const char *ca_cert_chain, gboolean (*loader)( LassoProvider *provider, const gchar *metadata)) { LassoProvider *provider; provider = LASSO_PROVIDER(g_object_new(LASSO_TYPE_PROVIDER, NULL)); provider->role = role; if (loader(provider, metadata) == FALSE) { if (loader == lasso_provider_load_metadata) { message(G_LOG_LEVEL_WARNING, "Cannot load metadata from %s", metadata); } lasso_node_destroy(LASSO_NODE(provider)); return NULL; } provider->public_key = g_strdup(public_key); provider->ca_cert_chain = g_strdup(ca_cert_chain); if (lasso_provider_load_public_key(provider, LASSO_PUBLIC_KEY_SIGNING) == FALSE) { message(G_LOG_LEVEL_CRITICAL, "Failed to load signing public key for %s.", provider->ProviderID); lasso_node_destroy(LASSO_NODE(provider)); return NULL; } lasso_provider_load_public_key(provider, LASSO_PUBLIC_KEY_ENCRYPTION); provider->private_data->encryption_mode = LASSO_ENCRYPTION_MODE_NONE; return provider; } /** * lasso_provider_new: * @role: provider role, identity provider or service provider * @metadata: path to the provider metadata file * @public_key:(allow-none): path to the provider public key file (may be a certificate) or NULL * @ca_cert_chain:(allow-none): path to the provider CA certificate chain file or NULL * * Creates a new #LassoProvider. * * Return value: a newly created #LassoProvider; or NULL if an error occured */ LassoProvider* lasso_provider_new(LassoProviderRole role, const char *metadata, const char *public_key, const char *ca_cert_chain) { return _lasso_provider_new_helper(role, metadata, public_key, ca_cert_chain, lasso_provider_load_metadata); } /** * lasso_provider_new_from_buffer: * @role: provider role, identity provider or service provider * @metadata: string buffer containing a metadata file * @public_key:(allow-none): path to the provider public key file (may be a certificate) or NULL * @ca_cert_chain:(allow-none): path to the provider CA certificate chain file or NULL * * Creates a new #LassoProvider. * * Return value: a newly created #LassoProvider; or NULL if an error occured */ LassoProvider* lasso_provider_new_from_buffer(LassoProviderRole role, const char *metadata, const char *public_key, const char *ca_cert_chain) { return _lasso_provider_new_helper(role, metadata, public_key, ca_cert_chain, lasso_provider_load_metadata_from_buffer); } /** * lasso_provider_load_public_key: * @provider: a #LassoProvider object * @public_key_type: the type of public key to load * * Load the public key from their transport format, a file or a KeyDescriptor #xmlNode. * * Return value: TRUE if loading was succesfull, FALSE otherwise. */ gboolean lasso_provider_load_public_key(LassoProvider *provider, LassoPublicKeyType public_key_type) { gchar *public_key = NULL; xmlNode *key_descriptor = NULL; xmlSecKey *pub_key = NULL; g_return_val_if_fail(LASSO_IS_PROVIDER(provider), FALSE); if (public_key_type == LASSO_PUBLIC_KEY_SIGNING) { public_key = provider->public_key; key_descriptor = provider->private_data->signing_key_descriptor; } else { key_descriptor = provider->private_data->encryption_key_descriptor; } if (public_key == NULL && key_descriptor == NULL) { return FALSE; } if (public_key == NULL) { pub_key = lasso_xmlsec_load_key_info(key_descriptor); if (! pub_key) { message(G_LOG_LEVEL_WARNING, "Could not read KeyInfo from %s KeyDescriptor", public_key_type == LASSO_PUBLIC_KEY_SIGNING ? "signing" : "encryption"); } } else { pub_key = lasso_xmlsec_load_private_key(public_key, NULL); } if (pub_key) { switch (public_key_type) { case LASSO_PUBLIC_KEY_SIGNING: lasso_assign_new_sec_key(provider->private_data->public_key, pub_key); break; case LASSO_PUBLIC_KEY_ENCRYPTION: lasso_assign_new_sec_key(provider->private_data->encryption_public_key, pub_key); break; default: xmlSecKeyDestroy(pub_key); } } return (pub_key != NULL); } /** * lasso_provider_new_from_dump: * @dump: XML provider dump * * Restores the @dump to a new #LassoProvider. * * Return value: a newly created #LassoProvider; or NULL if an error occured. **/ LassoProvider* lasso_provider_new_from_dump(const gchar *dump) { LassoProvider *provider; provider = (LassoProvider*)lasso_node_new_from_dump(dump); if (! LASSO_IS_PROVIDER(provider)) { lasso_release_gobject(provider); } return provider; } int lasso_provider_verify_saml_signature(LassoProvider *provider, xmlNode *signed_node, xmlDoc *doc) { const char *id_attribute_name = NULL; const xmlChar *node_ns = NULL; xmlSecKey *public_key = NULL; xmlSecKeysMngr *keys_manager = NULL; int rc = 0; lasso_bad_param(PROVIDER, provider); lasso_null_param(signed_node); g_return_val_if_fail((signed_node->doc && doc) || ! signed_node->doc, LASSO_PARAM_ERROR_INVALID_VALUE); /* ID-FF 1.2 Signatures case */ if (xmlSecCheckNodeName(signed_node, (xmlChar*)"Request", (xmlChar*)LASSO_SAML_PROTOCOL_HREF)) { id_attribute_name = "RequestID"; } if (xmlSecCheckNodeName(signed_node, (xmlChar*)"Response", (xmlChar*)LASSO_SAML_PROTOCOL_HREF)) { id_attribute_name = "ResponseID"; } if (xmlSecCheckNodeName(signed_node, (xmlChar*)"Assertion", (xmlChar*)LASSO_SAML_ASSERTION_HREF)) { id_attribute_name = "AssertionID"; } /* SAML 2.0 signature case */ node_ns = xmlSecGetNodeNsHref(signed_node); if ((strcmp((char*)node_ns, LASSO_SAML2_PROTOCOL_HREF) == 0) || (strcmp((char*)node_ns, LASSO_SAML2_ASSERTION_HREF) == 0)) { id_attribute_name = "ID"; } goto_cleanup_if_fail_with_rc(id_attribute_name, LASSO_PARAM_ERROR_INVALID_VALUE); /* Get provider credentials */ public_key = lasso_provider_get_public_key(provider); keys_manager = lasso_load_certs_from_pem_certs_chain_file(provider->ca_cert_chain); goto_cleanup_if_fail_with_rc_with_warning(public_key || keys_manager, LASSO_DS_ERROR_PUBLIC_KEY_LOAD_FAILED); rc = lasso_verify_signature(signed_node, doc, id_attribute_name, keys_manager, public_key, NO_OPTION, NULL); lasso_release_key_manager(keys_manager); cleanup: lasso_release_key_manager(keys_manager); return rc; } int lasso_provider_verify_signature(LassoProvider *provider, const char *message, const char *id_attr_name, LassoMessageFormat format) { /* this duplicates some code from lasso_node_init_from_message; * reflection about code reuse is under way... */ char *msg = NULL; xmlDoc *doc = NULL; xmlNode *xmlnode = NULL, *sign = NULL, *x509data = NULL; xmlSecKeysMngr *keys_mngr = NULL; xmlSecDSigCtx *dsigCtx = NULL; int rc = 0; xmlXPathContext *xpathCtx = NULL; xmlXPathObject *xpathObj = NULL; g_return_val_if_fail(LASSO_IS_PROVIDER(provider), LASSO_PARAM_ERROR_BAD_TYPE_OR_NULL_OBJ); if (lasso_flag_verify_signature == FALSE) return 0; msg = (char*)message; if (message == NULL) return LASSO_PROFILE_ERROR_INVALID_MSG; if (format == LASSO_MESSAGE_FORMAT_ERROR) return LASSO_PROFILE_ERROR_INVALID_MSG; if (format == LASSO_MESSAGE_FORMAT_UNKNOWN) return LASSO_PROFILE_ERROR_INVALID_MSG; if (format == LASSO_MESSAGE_FORMAT_QUERY) { switch (lasso_provider_get_protocol_conformance(provider)) { case LASSO_PROTOCOL_LIBERTY_1_0: case LASSO_PROTOCOL_LIBERTY_1_1: case LASSO_PROTOCOL_LIBERTY_1_2: return lasso_query_verify_signature(message, lasso_provider_get_public_key(provider)); case LASSO_PROTOCOL_SAML_2_0: return lasso_saml2_query_verify_signature(message, lasso_provider_get_public_key(provider)); default: return LASSO_PROFILE_ERROR_CANNOT_VERIFY_SIGNATURE; } } if (format == LASSO_MESSAGE_FORMAT_BASE64) { int len; msg = g_malloc(strlen(message)); len = xmlSecBase64Decode((xmlChar*)message, (xmlChar*)msg, strlen(message)); if (len < 0) { goto_cleanup_with_rc(LASSO_PROFILE_ERROR_INVALID_MSG); } doc = lasso_xml_parse_memory(msg, strlen(msg)); } else { doc = lasso_xml_parse_memory(msg, strlen(msg)); msg = NULL; } if (format == LASSO_MESSAGE_FORMAT_SOAP) { xpathCtx = xmlXPathNewContext(doc); xmlXPathRegisterNs(xpathCtx, (xmlChar*)"s", (xmlChar*)LASSO_SOAP_ENV_HREF); xpathObj = xmlXPathEvalExpression((xmlChar*)"//s:Body/*", xpathCtx); if (xpathObj->nodesetval && xpathObj->nodesetval->nodeNr ) { xmlnode = xpathObj->nodesetval->nodeTab[0]; } goto_cleanup_if_fail_with_rc (xmlnode != NULL, LASSO_PROFILE_ERROR_INVALID_MSG); } else { xmlnode = xmlDocGetRootElement(doc); } sign = NULL; for (sign = xmlnode->children; sign; sign = sign->next) { if (strcmp((char*)sign->name, "Signature") == 0) break; } /* If no signature was found, look for one in assertion */ if (sign == NULL) { for (sign = xmlnode->children; sign; sign = sign->next) { if (strcmp((char*)sign->name, "Assertion") == 0) break; } if (sign != NULL) { xmlnode = sign; for (sign = xmlnode->children; sign; sign = sign->next) { if (strcmp((char*)sign->name, "Signature") == 0) break; } } } goto_cleanup_if_fail_with_rc (sign != NULL, LASSO_DS_ERROR_SIGNATURE_NOT_FOUND); if (id_attr_name) { xmlChar *id_value = xmlGetProp(xmlnode, (xmlChar*)id_attr_name); xmlAttr *id_attr = xmlHasProp(xmlnode, (xmlChar*)id_attr_name); if (id_value != NULL) { xmlAddID(NULL, doc, id_value, id_attr); xmlFree(id_value); } } x509data = xmlSecFindNode(xmlnode, xmlSecNodeX509Data, xmlSecDSigNs); if (x509data != NULL && provider->ca_cert_chain != NULL) { keys_mngr = lasso_load_certs_from_pem_certs_chain_file( provider->ca_cert_chain); goto_cleanup_if_fail_with_rc (keys_mngr != NULL, LASSO_DS_ERROR_CA_CERT_CHAIN_LOAD_FAILED); } dsigCtx = xmlSecDSigCtxCreate(keys_mngr); if (keys_mngr == NULL) { dsigCtx->signKey = xmlSecKeyDuplicate(lasso_provider_get_public_key(provider)); goto_cleanup_if_fail_with_rc (dsigCtx->signKey != NULL, LASSO_DS_ERROR_PUBLIC_KEY_LOAD_FAILED); } goto_cleanup_if_fail_with_rc (xmlSecDSigCtxVerify(dsigCtx, sign) >= 0, LASSO_DS_ERROR_SIGNATURE_VERIFICATION_FAILED); if (dsigCtx->status != xmlSecDSigStatusSucceeded) { rc = LASSO_DS_ERROR_INVALID_SIGNATURE; goto cleanup; } cleanup: lasso_release_string(msg); lasso_release_key_manager(keys_mngr); lasso_release_signature_context(dsigCtx); if (xpathCtx) xmlXPathFreeContext(xpathCtx); if (xpathObj) xmlXPathFreeObject(xpathObj); lasso_release_doc(doc); return rc; } /** * lasso_provider_set_encryption_mode: * @provider: provider to set encryption for * @encryption_mode: TRUE to activate, FALSE to desactivate * * Activate or desactivate encryption **/ void lasso_provider_set_encryption_mode(LassoProvider *provider, LassoEncryptionMode encryption_mode) { g_return_if_fail(LASSO_IS_PROVIDER(provider)); provider->private_data->encryption_mode = encryption_mode; } /** * lasso_provider_get_encryption_mode: * @provider: a #LassoProvider object * * Return the current encryption mode. * * Return value: a value in the #LassoEncryptionMode enumeration. */ LassoEncryptionMode lasso_provider_get_encryption_mode(LassoProvider *provider) { if (! LASSO_IS_PROVIDER(provider) || ! provider->private_data) return LASSO_ENCRYPTION_MODE_NONE; return provider->private_data->encryption_mode; } /** * lasso_provider_set_encryption_sym_key_type: * @provider: provider to set encryption for * @encryption_sym_key_type: enum type for generated symetric key * * Set the type of the generated encryption symetric key **/ void lasso_provider_set_encryption_sym_key_type(LassoProvider *provider, LassoEncryptionSymKeyType encryption_sym_key_type) { g_return_if_fail(LASSO_IS_PROVIDER(provider)); provider->private_data->encryption_sym_key_type = encryption_sym_key_type; } /** * lasso_provider_get_encryption_sym_key_type: * @provider: a #LassoProvider object * * Return the encryption sym key type for this provider. * * Return value: a #LassoEncryptionSymKeyType value. */ LassoEncryptionSymKeyType lasso_provider_get_encryption_sym_key_type(const LassoProvider *provider) { if (LASSO_IS_PROVIDER(provider) && provider->private_data) return provider->private_data->encryption_sym_key_type; return LASSO_ENCRYPTION_SYM_KEY_TYPE_DEFAULT; } /** * lasso_provider_verify_query_signature: * @provider: the #LassoProvider for the the provider issuing the query * @message: the URL query string UTF-8 encoded * * Retrieve the public key of the given provider and verify the signature of the query string. * * Return value: 0 if succesfull, * * #LASSO_PROVIDER_ERROR_MISSING_PUBLIC_KEY if no public key is set for this provider, * #LASSO_DS_ERROR_INVALID_SIGNATURE if signature is invalid, * #LASSO_DS_ERROR_SIGNATURE_NOT_FOUND if no signature is found, * #LASSO_DS_ERROR_PUBLIC_KEY_LOAD_FAILED if the key cannot be loaded, * #LASSO_ERROR_UNIMPLEMENTED if the protocol profile of the provider is invalid or not supported. * */ int lasso_provider_verify_query_signature(LassoProvider *provider, const char *message) { const xmlSecKey *provider_public_key; lasso_bad_param(PROVIDER, provider); provider_public_key = lasso_provider_get_public_key(provider); g_return_val_if_fail(provider_public_key, LASSO_PROVIDER_ERROR_MISSING_PUBLIC_KEY); switch (lasso_provider_get_protocol_conformance(provider)) { case LASSO_PROTOCOL_LIBERTY_1_0: case LASSO_PROTOCOL_LIBERTY_1_1: case LASSO_PROTOCOL_LIBERTY_1_2: return lasso_query_verify_signature(message, lasso_provider_get_public_key(provider)); case LASSO_PROTOCOL_SAML_2_0: return lasso_saml2_query_verify_signature(message, lasso_provider_get_public_key(provider)); default: return LASSO_ERROR_UNIMPLEMENTED; } } /** * lasso_provider_get_default_name_id_format: * @provider: a #LassoProvider object * * If the provider has a list of supported name id formats in its metadatas, return the first one. * * Return value:(transfer full)(allow-none): a NameIDFormat URI or NULL, the returned value must be freed by the caller. */ gchar* lasso_provider_get_default_name_id_format(LassoProvider *provider) { return lasso_provider_get_metadata_one(provider, "NameIDFormat"); } /** * lasso_provider_get_sp_name_qualifier: * @provider: a #LassoPRovider object * * Return the entityID to use for qualifying NameIdentifier. * * Return value:(transfer none)(allow-none): a private string or NULL. Do not keep a reference on this string or * free it. */ const char* lasso_provider_get_sp_name_qualifier(LassoProvider *provider) { const char *sp_name_qualifier; g_return_val_if_fail(LASSO_IS_PROVIDER(provider), NULL); /* should not happen ! */ g_return_val_if_fail(provider->private_data != NULL, NULL); if (provider->private_data->affiliation_id) { sp_name_qualifier = provider->private_data->affiliation_id; } else { sp_name_qualifier = provider->ProviderID; } if (sp_name_qualifier) { return sp_name_qualifier; } else { return NULL; } } /** * lasso_provider_verify_single_node_signature: * @provider: a #LassoProvider object * @node: a #LassoNode object, still having its originalXmlnode content, and containing an XML * signature. * @id_attr_name: the name of the ID attribute to lookup. * * Return wheter the provider signed this node. * * Return value: 0 if the node is signed by this provider, an error code otherwise. */ int lasso_provider_verify_single_node_signature (LassoProvider *provider, LassoNode *node, const char *id_attr_name) { xmlNode *xmlnode = NULL; xmlSecKey *xmlseckey = NULL; xmlnode = lasso_node_get_original_xmlnode (node); if (xmlnode == NULL) { return LASSO_DS_ERROR_SIGNATURE_VERIFICATION_FAILED; } xmlseckey = lasso_provider_get_public_key (provider); if (xmlseckey == NULL) { return LASSO_DS_ERROR_PUBLIC_KEY_LOAD_FAILED; } return lasso_verify_signature(xmlnode, NULL, id_attr_name, NULL, xmlseckey, NO_SINGLE_REFERENCE, NULL); } struct AddForRoleHelper { GList *l; LassoProviderRole role; }; static void _add_for_role(gpointer key, G_GNUC_UNUSED gpointer data, struct AddForRoleHelper *helper) { char role_prefix[64]; int l; l = sprintf(role_prefix, "%s ", protocol_roles[helper->role]); if (key && strncmp(key, role_prefix, l) == 0) { lasso_list_add_string(helper->l, ((char*)key) + l); } } /** * lasso_provider_get_metadata_keys_for_role: * @provider: a #LassoProvider object * @role: a #LassoProviderRole value * * Returns the list of metadata keys existing for the given provider. * * Return value:(element-type utf8)(transfer full): a newly allocated list of strings */ GList* lasso_provider_get_metadata_keys_for_role(LassoProvider *provider, LassoProviderRole role) { struct AddForRoleHelper helper = { NULL, role }; lasso_return_val_if_fail(LASSO_IS_PROVIDER(provider), NULL); lasso_return_val_if_fail(provider->private_data != NULL, NULL); lasso_return_val_if_fail(role > LASSO_PROVIDER_ROLE_NONE && role < LASSO_PROVIDER_ROLE_LAST, NULL); g_hash_table_foreach(provider->private_data->Descriptors, (GHFunc)_add_for_role, &helper); return helper.l; } /** * lasso_provider_get_roles: * @provider: a #LassoProvider object * * Return the bitmask of the supported roles. * * Return value: a #LassoProviderRole enumeration value. */ LassoProviderRole lasso_provider_get_roles(LassoProvider *provider) { lasso_return_val_if_fail(LASSO_IS_PROVIDER(provider) && provider->private_data, LASSO_PROVIDER_ROLE_NONE); return provider->private_data->roles; } /** * lasso_provider_match_conformance: * @provider: a #LassoProvider object * @another_provider: a #LassoProvider object * * Return whether the two provider support a same protocol. * See also #LassoProtocolConformance. * * Return value: TRUE or FALSE. */ gboolean lasso_provider_match_conformance(LassoProvider *provider, LassoProvider *another_provider) { lasso_return_val_if_fail(LASSO_IS_PROVIDER(provider) && LASSO_IS_PROVIDER(another_provider), FALSE); int conformance1 = lasso_provider_get_protocol_conformance(provider); int conformance2 = lasso_provider_get_protocol_conformance(another_provider); return (conformance1 & conformance2) != 0; }