| /* | |
| * Copyright 2003-2004 The Apache Software Foundation. | |
| * | |
| * Licensed under the Apache License, Version 2.0 (the "License"); | |
| * you may not use this file except in compliance with the License. | |
| * You may obtain a copy of the License at | |
| * | |
| * http://www.apache.org/licenses/LICENSE-2.0 | |
| * | |
| * Unless required by applicable law or agreed to in writing, software | |
| * distributed under the License is distributed on an "AS IS" BASIS, | |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| * See the License for the specific language governing permissions and | |
| * limitations under the License. | |
| */ | |
| #include <axis2_util.h> | |
| #include <rampart_saml.h> | |
| #include <oxs_constants.h> | |
| #include <rp_property.h> | |
| #include <oxs_xml_signature.h> | |
| #include <oxs_transform.h> | |
| #include <oxs_utility.h> | |
| #include <oxs_transforms_factory.h> | |
| #include <rp_includes.h> | |
| #include <rp_secpolicy.h> | |
| oxs_sign_part_t * AXIS2_CALL | |
| rampart_saml_token_create_sign_part(const axutil_env_t *env, | |
| rampart_context_t *rampart_context, | |
| rampart_saml_token_t *saml, | |
| axiom_node_t *str); | |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL | |
| rampart_saml_token_validate(const axutil_env_t *env, | |
| rampart_context_t *rampart_context, | |
| axiom_node_t *assertion); | |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL | |
| rampart_saml_supporting_token_build(const axutil_env_t *env, | |
| rampart_context_t *rampart_context, | |
| axiom_node_t *sec_node, | |
| axutil_array_list_t *sign_parts) | |
| { | |
| axiom_node_t *strn = NULL, *assertion = NULL; | |
| oxs_sign_part_t *sign_part = NULL; | |
| rampart_saml_token_t *saml = rampart_context_get_saml_token(rampart_context, env, RAMPART_ST_TYPE_SIGNED_SUPPORTING_TOKEN); | |
| if (!saml) | |
| { | |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, | |
| "[rampart][rs] SAML token not set in the rampart context. ERROR"); | |
| return AXIS2_FAILURE; | |
| } | |
| assertion = rampart_saml_token_get_assertion(saml, env); | |
| if (!assertion) | |
| { | |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, | |
| "[rampart][rs] SAML assertion not set in the rampart_saml_token. ERROR"); | |
| return AXIS2_FAILURE; | |
| } | |
| axiom_node_add_child(sec_node, env, assertion); | |
| strn = rampart_saml_token_get_str(saml, env); | |
| if (!strn) | |
| { | |
| strn = oxs_saml_token_build_key_identifier_reference_local(env, NULL, assertion); | |
| /*rampart_saml_token_set_str(saml, env, strn);*/ | |
| } | |
| axiom_node_add_child(sec_node, env, strn); | |
| sign_part = rampart_saml_token_create_sign_part(env, rampart_context, saml, strn); | |
| if (!sign_part) | |
| { | |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, | |
| "[rampart][rs] Sign part creation failed. ERROR"); | |
| return AXIS2_FAILURE; | |
| } | |
| axutil_array_list_add(sign_parts, env, sign_part); | |
| return AXIS2_SUCCESS; | |
| } | |
| oxs_sign_part_t * AXIS2_CALL | |
| rampart_saml_token_create_sign_part(const axutil_env_t *env, | |
| rampart_context_t *rampart_context, | |
| rampart_saml_token_t *saml, | |
| axiom_node_t *strn) | |
| { | |
| axiom_element_t *stre = NULL; | |
| /*axiom_node_t *strn = NULL;*/ | |
| axutil_qname_t *qname = NULL; | |
| axis2_char_t *id = NULL; | |
| oxs_sign_part_t *sign_part = NULL; | |
| oxs_transform_t *tr = NULL; | |
| axutil_array_list_t *tr_list = NULL; | |
| axis2_char_t * digest_method = rampart_context_get_digest_mtd(rampart_context, env); | |
| stre = axiom_node_get_data_element(strn, env); | |
| qname = axutil_qname_create(env, OXS_NODE_SECURITY_TOKEN_REFRENCE, OXS_WSSE_XMLNS, NULL); | |
| sign_part = oxs_sign_part_create(env); | |
| tr_list = axutil_array_list_create(env, 0); | |
| /* If ID is not present we add it */ | |
| id = axiom_element_get_attribute_value(stre, env, qname); | |
| if (!id) | |
| { | |
| id = oxs_util_generate_id(env, (axis2_char_t*)OXS_SIG_ID); | |
| oxs_axiom_add_attribute(env, strn, | |
| RAMPART_WSU, RAMPART_WSU_XMLNS, OXS_ATTR_ID, id); | |
| } | |
| oxs_sign_part_set_id(sign_part, env, id); | |
| tr = oxs_transforms_factory_produce_transform(env, | |
| OXS_HREF_TRANSFORM_STR_TRANSFORM); | |
| axutil_array_list_add(tr_list, env, tr); | |
| oxs_sign_part_set_transforms(sign_part, env, tr_list); | |
| /* Sign the assertion, not the securitytokenreference */ | |
| oxs_sign_part_set_node(sign_part, env, strn); | |
| oxs_sign_part_set_digest_mtd(sign_part, env, digest_method); | |
| axutil_qname_free(qname, env); | |
| AXIS2_FREE(env->allocator, id); | |
| return sign_part; | |
| } | |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL | |
| rampart_saml_token_validate(const axutil_env_t *env, | |
| rampart_context_t *rampart_context, | |
| axiom_node_t *assertion) | |
| { | |
| axis2_status_t status = AXIS2_FAILURE; | |
| oxs_sign_ctx_t *sign_ctx = NULL; | |
| oxs_x509_cert_t *certificate = NULL; | |
| axiom_node_t *sig_node = NULL; | |
| rp_rampart_config_t *rampart_config = NULL; | |
| rp_secpolicy_t *secpolicy; | |
| axis2_char_t *cert_file = NULL; | |
| secpolicy = rampart_context_get_secpolicy(rampart_context, env); | |
| if (!secpolicy) | |
| { | |
| return AXIS2_SUCCESS; | |
| } | |
| rampart_config = rp_secpolicy_get_rampart_config(secpolicy, env); | |
| if(!rampart_config) | |
| { | |
| return AXIS2_SUCCESS; | |
| } | |
| /* Still we don't have a mechanism to get the SAML signing key */ | |
| /* cert_file = rp_rampart_config_get_sts_certificate_file(rampart_config, env); */ | |
| if (!cert_file) | |
| { | |
| return AXIS2_SUCCESS; | |
| } | |
| certificate = oxs_key_mgr_load_x509_cert_from_pem_file(env, cert_file); | |
| /* Need to get the certificate of the STS */ | |
| if (!certificate) | |
| { | |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, | |
| "[rampart][rs] Certificate cannot be found for the STS"); | |
| return AXIS2_FAILURE; | |
| } | |
| /*Create sign context*/ | |
| sign_ctx = oxs_sign_ctx_create(env); | |
| /*Set the Certificate*/ | |
| oxs_sign_ctx_set_certificate(sign_ctx, env, certificate); | |
| sig_node = oxs_axiom_get_node_by_local_name(env, assertion, OXS_NODE_SIGNATURE); | |
| if (!sig_node) | |
| { | |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, | |
| "[rampart][rs] No Signature node in the SAML Assertion"); | |
| return AXIS2_FAILURE; | |
| } | |
| status = oxs_xml_sig_verify(env, sign_ctx, sig_node, assertion); | |
| if (status == AXIS2_SUCCESS) | |
| { | |
| AXIS2_LOG_INFO(env->log, "SAML Signature Verification Successfull"); | |
| } | |
| return status; | |
| } | |
| AXIS2_EXTERN rampart_saml_token_t * AXIS2_CALL | |
| rampart_saml_add_token(rampart_context_t *rampart_context, | |
| const axutil_env_t *env, | |
| axiom_node_t *assertion, | |
| axiom_node_t *str, | |
| rampart_st_type_t type) | |
| { | |
| rampart_saml_token_t *saml = NULL; | |
| rp_property_t *binding = NULL; | |
| rp_secpolicy_t *secpolicy = NULL; | |
| if (AXIS2_FAILURE == rampart_saml_token_validate(env, rampart_context, assertion)) | |
| { | |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, | |
| "[rampart][rs] SAML Signature Verification Failed"); | |
| return NULL; | |
| } | |
| if (type == RAMPART_ST_TYPE_SIGNED_SUPPORTING_TOKEN) | |
| { | |
| saml = rampart_saml_token_create(env, assertion, RAMPART_ST_CONFIR_TYPE_SENDER_VOUCHES); | |
| rampart_saml_token_set_token_type(saml, env, RAMPART_ST_TYPE_SIGNED_SUPPORTING_TOKEN); | |
| if (str) | |
| rampart_saml_token_set_str(saml, env, str); | |
| rampart_context_add_saml_token(rampart_context, env, saml); | |
| return saml; | |
| } | |
| secpolicy = rampart_context_get_secpolicy(rampart_context, env); | |
| binding = rp_secpolicy_get_binding(secpolicy,env); | |
| if(rp_property_get_type(binding,env) == RP_PROPERTY_SYMMETRIC_BINDING) | |
| { | |
| rp_symmetric_binding_t *sym_binding = NULL; | |
| sym_binding = (rp_symmetric_binding_t *)rp_property_get_value(binding,env); | |
| if(sym_binding) | |
| { | |
| /*First check protection tokens have being specified.*/ | |
| if(rp_symmetric_binding_get_protection_token(sym_binding,env)) | |
| { | |
| saml = rampart_context_get_saml_token(rampart_context, env, RAMPART_ST_TYPE_PROTECTION_TOKEN); | |
| if (!saml) | |
| { | |
| saml = rampart_saml_token_create(env, assertion, RAMPART_ST_CONFIR_TYPE_HOLDER_OF_KEY); | |
| rampart_saml_token_set_token_type(saml, env, RAMPART_ST_TYPE_PROTECTION_TOKEN); | |
| if (str) | |
| rampart_saml_token_set_str(saml, env, str); | |
| rampart_context_add_saml_token(rampart_context, env, saml); | |
| } | |
| return saml; | |
| } | |
| else if (type == RAMPART_ST_TYPE_ENCRYPTION_TOKEN && rp_symmetric_binding_get_encryption_token(sym_binding,env)) | |
| { | |
| saml = rampart_context_get_saml_token(rampart_context, env, RAMPART_ST_TYPE_ENCRYPTION_TOKEN); | |
| if (!saml) | |
| { | |
| saml = rampart_saml_token_create(env, assertion, RAMPART_ST_CONFIR_TYPE_HOLDER_OF_KEY); | |
| rampart_saml_token_set_token_type(saml, env, RAMPART_ST_TYPE_ENCRYPTION_TOKEN); | |
| if (str) | |
| rampart_saml_token_set_str(saml, env, str); | |
| rampart_context_add_saml_token(rampart_context, env, saml); | |
| } | |
| return saml; | |
| } | |
| else if (type == RAMPART_ST_TYPE_SIGNATURE_TOKEN && rp_symmetric_binding_get_signature_token(sym_binding,env)) | |
| { | |
| saml = rampart_context_get_saml_token(rampart_context, env, RAMPART_ST_TYPE_SIGNATURE_TOKEN); | |
| if (!saml) | |
| { | |
| saml = rampart_saml_token_create(env, assertion, RAMPART_ST_CONFIR_TYPE_HOLDER_OF_KEY); | |
| rampart_saml_token_set_token_type(saml, env, RAMPART_ST_TYPE_SIGNATURE_TOKEN); | |
| if (str) | |
| rampart_saml_token_set_str(saml, env, str); | |
| rampart_context_add_saml_token(rampart_context, env, saml); | |
| } | |
| return saml; | |
| } | |
| } | |
| else | |
| { | |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, | |
| "[rampart][rs] SAML tokens as protection tokens, supported only in symmetric binding"); | |
| return NULL; | |
| } | |
| } | |
| return NULL; | |
| } | |
| AXIS2_EXTERN char * AXIS2_CALL | |
| rampart_saml_token_get_subject_confirmation(const axutil_env_t *env, axiom_node_t *assertion) | |
| { | |
| axiom_node_t *node = oxs_axiom_get_node_by_local_name(env, assertion, OXS_NODE_SAML_SUBJECT_CONFIRMATION_METHOD); | |
| if (node) | |
| { | |
| return oxs_axiom_get_node_content(env, node); | |
| } | |
| return NULL; | |
| } | |
| /** Faults Defined by the specification **/ | |
| AXIS2_EXTERN int AXIS2_CALL | |
| rampart_saml_token_fault_securitytokenunavailable(axutil_env_t *env, | |
| axis2_msg_ctx_t *ctx) | |
| { | |
| axiom_soap_envelope_t *envelope = NULL; | |
| int soap_version = AXIOM_SOAP12; | |
| axutil_array_list_t *sub_codes = NULL; | |
| sub_codes = axutil_array_list_create(env, 1); | |
| axutil_array_list_add(sub_codes, env, axutil_strdup(env, RAMPART_ST_FAULT_SECURITYTOKENUNAVAILABLE_CODE)); | |
| envelope = axiom_soap_envelope_create_default_soap_fault_envelope(env, | |
| RAMPART_SAML_FAULT_CODE, | |
| RAMPART_ST_FAULT_SECURITYTOKENUNAVAILABLE_STR, | |
| soap_version, sub_codes, NULL); | |
| if (!envelope) | |
| { | |
| axutil_array_list_free(sub_codes, env); | |
| return AXIS2_FAILURE; | |
| } | |
| axis2_msg_ctx_set_fault_soap_envelope(ctx, env, envelope); | |
| axutil_array_list_free(sub_codes, env); | |
| return AXIS2_SUCCESS; | |
| } | |
| AXIS2_EXTERN int AXIS2_CALL | |
| rampart_saml_token_fault_unsupportedsecuritytoken(axutil_env_t *env, | |
| axis2_msg_ctx_t *ctx) | |
| { | |
| axiom_soap_envelope_t *envelope = NULL; | |
| int soap_version = AXIOM_SOAP12; | |
| axutil_array_list_t *sub_codes = NULL; | |
| sub_codes = axutil_array_list_create(env, 1); | |
| axutil_array_list_add(sub_codes, env, axutil_strdup(env, RAMPART_ST_FAULT_UNSUPPORTEDSECURITYTOKEN_CODE)); | |
| envelope = axiom_soap_envelope_create_default_soap_fault_envelope(env, | |
| RAMPART_SAML_FAULT_CODE, | |
| RAMPART_ST_FAULT_UNSUPPORTEDSECURITYTOKEN_STR, | |
| soap_version, sub_codes, NULL); | |
| if (!envelope) | |
| { | |
| axutil_array_list_free(sub_codes, env); | |
| return AXIS2_FAILURE; | |
| } | |
| axis2_msg_ctx_set_fault_soap_envelope(ctx, env, envelope); | |
| axutil_array_list_free(sub_codes, env); | |
| return AXIS2_SUCCESS; | |
| } | |
| AXIS2_EXTERN int AXIS2_CALL | |
| rampart_saml_token_fault_failedcheck(axutil_env_t *env, | |
| axis2_msg_ctx_t *ctx) | |
| { | |
| axiom_soap_envelope_t *envelope = NULL; | |
| int soap_version = AXIOM_SOAP12; | |
| axutil_array_list_t *sub_codes = NULL; | |
| sub_codes = axutil_array_list_create(env, 1); | |
| axutil_array_list_add(sub_codes, env, axutil_strdup(env, RAMPART_ST_FAULT_FAILEDCHECK_CODE)); | |
| envelope = axiom_soap_envelope_create_default_soap_fault_envelope(env, | |
| RAMPART_SAML_FAULT_CODE, | |
| RAMPART_ST_FAULT_FAILEDCHECK_STR, | |
| soap_version, sub_codes, NULL); | |
| if (!envelope) | |
| { | |
| axutil_array_list_free(sub_codes, env); | |
| return AXIS2_FAILURE; | |
| } | |
| axis2_msg_ctx_set_fault_soap_envelope(ctx, env, envelope); | |
| axutil_array_list_free(sub_codes, env); | |
| return AXIS2_SUCCESS; | |
| } | |
| AXIS2_EXTERN int AXIS2_CALL | |
| rampart_saml_token_fault_invalidsecuritytoken(axutil_env_t *env, | |
| axis2_msg_ctx_t *ctx) | |
| { | |
| axiom_soap_envelope_t *envelope = NULL; | |
| int soap_version = AXIOM_SOAP12; | |
| axutil_array_list_t *sub_codes = NULL; | |
| sub_codes = axutil_array_list_create(env, 1); | |
| axutil_array_list_add(sub_codes, env, axutil_strdup(env, RAMPART_ST_FAULT_INVALIDSECURITYTOKEN_CODE)); | |
| envelope = axiom_soap_envelope_create_default_soap_fault_envelope(env, | |
| RAMPART_SAML_FAULT_CODE, | |
| RAMPART_ST_FAULT_INVALIDSECURITYTOKEN_STR, | |
| soap_version, sub_codes, NULL); | |
| if (!envelope) | |
| { | |
| axutil_array_list_free(sub_codes, env); | |
| return AXIS2_FAILURE; | |
| } | |
| axis2_msg_ctx_set_fault_soap_envelope(ctx, env, envelope); | |
| axutil_array_list_free(sub_codes, env); | |
| return AXIS2_SUCCESS; | |
| } | |