src/edu/internet2/middleware/shibboleth/aa/AAServlet.java

   1 /*
   2  * The Shibboleth License, Version 1.
   3  * Copyright (c) 2002
   4  * University Corporation for Advanced Internet Development, Inc.
   5  * All rights reserved
   6  *
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * Redistributions of source code must retain the above copyright notice, this
  12  * list of conditions and the following disclaimer.
  13  *
  14  * Redistributions in binary form must reproduce the above copyright notice,
  15  * this list of conditions and the following disclaimer in the documentation
  16  * and/or other materials provided with the distribution, if any, must include
  17  * the following acknowledgment: "This product includes software developed by
  18  * the University Corporation for Advanced Internet Development
  19  * <http://www.ucaid.edu>Internet2 Project. Alternately, this acknowledegement
  20  * may appear in the software itself, if and wherever such third-party
  21  * acknowledgments normally appear.
  22  *
  23  * Neither the name of Shibboleth nor the names of its contributors, nor
  24  * Internet2, nor the University Corporation for Advanced Internet Development,
  25  * Inc., nor UCAID may be used to endorse or promote products derived from this
  26  * software without specific prior written permission. For written permission,
  27  * please contact shibboleth@shibboleth.org
  28  *
  29  * Products derived from this software may not be called Shibboleth, Internet2,
  30  * UCAID, or the University Corporation for Advanced Internet Development, nor
  31  * may Shibboleth appear in their name, without prior written permission of the
  32  * University Corporation for Advanced Internet Development.
  33  *
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  36  * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  37  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
  38  * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK
  39  * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE.
  40  * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY
  41  * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT,
  42  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  43  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  44  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  45  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  46  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  47  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  48  */
  49
  50 package edu.internet2.middleware.shibboleth.aa;
  51
  52 import java.io.ByteArrayOutputStream;
  53 import java.io.IOException;
  54 import java.io.PrintStream;
  55 import java.net.MalformedURLException;
  56 import java.net.URI;
  57 import java.net.URISyntaxException;
  58 import java.net.URL;
  59 import java.security.Principal;
  60 import java.util.ArrayList;
  61 import java.util.Arrays;
  62 import java.util.Iterator;
  63 import java.util.List;
  64 import java.util.Properties;
  65
  66 import javax.servlet.ServletException;
  67 import javax.servlet.UnavailableException;
  68 import javax.servlet.http.HttpServlet;
  69 import javax.servlet.http.HttpServletRequest;
  70 import javax.servlet.http.HttpServletResponse;
  71
  72 import org.apache.log4j.Logger;
  73 import org.apache.log4j.MDC;
  74 import org.opensaml.QName;
  75 import org.opensaml.SAMLAttribute;
  76 import org.opensaml.SAMLException;
  77 import org.opensaml.SAMLIdentifier;
  78
  79 import edu.internet2.middleware.shibboleth.aa.arp.ArpEngine;
  80 import edu.internet2.middleware.shibboleth.aa.arp.ArpException;
  81 import edu.internet2.middleware.shibboleth.aa.attrresolv.AttributeResolver;
  82 import edu.internet2.middleware.shibboleth.aa.attrresolv.AttributeResolverException;
  83 import edu.internet2.middleware.shibboleth.common.AuthNPrincipal;
  84 import edu.internet2.middleware.shibboleth.common.ShibResource;
  85 import edu.internet2.middleware.shibboleth.hs.HandleRepository;
  86 import edu.internet2.middleware.shibboleth.hs.HandleRepositoryException;
  87 import edu.internet2.middleware.shibboleth.hs.HandleRepositoryFactory;
  88 import edu.internet2.middleware.shibboleth.hs.InvalidHandleException;
  89
  90 /**
  91  *  Attribute Authority & Release Policy
  92  *  Handles Initialization and incoming requests to AA
  93  *
  94  * @author Parviz Dousti (dousti@cmu.edu)
  95  * @author      Walter Hoehn (wassa@columbia.edu)
  96  */
  97
  98 public class AAServlet extends HttpServlet {
  99
 100     protected AAResponder responder;
 101     protected HandleRepository handleRepository;
 102     protected Properties configuration;
 103     private static Logger log = Logger.getLogger(AAServlet.class.getName());
 104
 105         public void init() throws ServletException {
 106                 super.init();
 107
 108                 MDC.put("serviceId", "[AA] Core");
 109                 log.info("Initializing Attribute Authority.");
 110
 111                 try {
 112
 113                         configuration = loadConfiguration();
 114
 115                         ArpEngine arpEngine = new ArpEngine(configuration);
 116                         AttributeResolver resolver = new AttributeResolver(configuration);
 117
 118                         handleRepository = HandleRepositoryFactory.getInstance(configuration);
 119
 120                         responder = new AAResponder(arpEngine, resolver);
 121
 122                         log.info("Attribute Authority initialization complete.");
 123
 124                 } catch (ArpException ae) {
 125                         log.fatal("The AA could not be initialized due to a problem with the ARP Engine configuration: " + ae);
 126                         throw new UnavailableException("Attribute Authority failed to initialize.");
 127                 } catch (AttributeResolverException ne) {
 128                         log.fatal("The AA could not be initialized due to a problem with the Attribute Resolver configuration: " + ne);
 129                         throw new UnavailableException("Attribute Authority failed to initialize.");
 130                 } catch (AAException ae) {
 131                         log.fatal("The AA could not be initialized: " + ae);
 132                         throw new UnavailableException("Attribute Authority failed to initialize.");
 133                 } catch (HandleRepositoryException he) {
 134                         log.fatal(
 135                                 "The AA could not be initialized due to a problem with the Handle Repository configuration: " + he);
 136                         throw new UnavailableException("Attribute Authority failed to initialize.");
 137                 }
 138         }
 139         protected Properties loadConfiguration() throws AAException {
 140
 141                 //Set defaults
 142                 Properties defaultProps = new Properties();
 143                 defaultProps.setProperty(
 144                         "edu.internet2.middleware.shibboleth.aa.arp.provider.FileSystemArpRepository.Path",
 145                         "/conf/arps/");
 146                 defaultProps.setProperty(
 147                                         "edu.internet2.middleware.shibboleth.aa.attrresolv.AttributeResolver.ResolverConfig",
 148                                         "/conf/resolver.xml");
 149                 defaultProps.setProperty(
 150                         "edu.internet2.middleware.shibboleth.aa.arp.ArpRepository.implementation",
 151                         "edu.internet2.middleware.shibboleth.aa.arp.provider.FileSystemArpRepository");
 152                 defaultProps.setProperty(
 153                         "edu.internet2.middleware.shibboleth.hs.provider.CryptoHandleRepository.keyStorePath",
 154                         "/conf/handle.jks");
 155                 defaultProps.setProperty("edu.internet2.middleware.shibboleth.audiences", "urn:mace:incommon:pilot:2003");
 156                 defaultProps.setProperty("edu.internet2.middleware.shibboleth.aa.AAServlet.passThruErrors", "false");
 157
 158                 //Load from file
 159                 Properties properties = new Properties(defaultProps);
 160                 String propertiesFileLocation = getInitParameter("OriginPropertiesFile");
 161                 if (propertiesFileLocation == null) {
 162                         propertiesFileLocation = "/conf/origin.properties";
 163                 }
 164                 try {
 165                         log.debug("Loading Configuration from (" + propertiesFileLocation + ").");
 166                         properties.load(new ShibResource(propertiesFileLocation, this.getClass()).getInputStream());
 167
 168                         //Make sure we have all required parameters
 169                         StringBuffer missingProperties = new StringBuffer();
 170                         String[] requiredProperties =
 171                                 {
 172                                         "edu.internet2.middleware.shibboleth.aa.AAServlet.authorityName",
 173                                         "edu.internet2.middleware.shibboleth.aa.arp.ArpRepository.implementation",
 174                                         "edu.internet2.middleware.shibboleth.audiences" };
 175
 176                         for (int i = 0; i < requiredProperties.length; i++) {
 177                                 if (properties.getProperty(requiredProperties[i]) == null) {
 178                                         missingProperties.append("\"");
 179                                         missingProperties.append(requiredProperties[i]);
 180                                         missingProperties.append("\" ");
 181                                 }
 182                         }
 183                         if (missingProperties.length() > 0) {
 184                                 log.error(
 185                                         "Missing configuration data.  The following configuration properites have not been set: "
 186                                                 + missingProperties.toString());
 187                                 throw new AAException("Missing configuration data.");
 188                         }
 189
 190                 } catch (IOException e) {
 191                         log.error("Could not load AA servlet configuration: " + e);
 192                         throw new AAException("Could not load AA servlet configuration.");
 193                 }
 194
 195                 if (log.isDebugEnabled()) {
 196                         ByteArrayOutputStream debugStream = new ByteArrayOutputStream();
 197                         PrintStream debugPrinter = new PrintStream(debugStream);
 198                         properties.list(debugPrinter);
 199                         log.debug(
 200                                 "Runtime configuration parameters: " + System.getProperty("line.separator") + debugStream.toString());
 201                         try {
 202                                 debugStream.close();
 203                         } catch (IOException e) {
 204                                 log.error("Encountered a problem cleaning up resources: could not close debug stream.");
 205                         }
 206                 }
 207
 208                 return properties;
 209         }
 210
 211         public void doPost(HttpServletRequest req, HttpServletResponse resp)
 212                 throws ServletException, IOException {
 213
 214                 MDC.put("serviceId", "[AA] " + new SAMLIdentifier().toString());
 215                 MDC.put("remoteAddr", req.getRemoteAddr());
 216                 log.info("Handling request.");
 217
 218                 AASaml saml = null;
 219
 220                 try {
 221                         saml =
 222                                 new AASaml(
 223                                         configuration.getProperty(
 224                                                 "edu.internet2.middleware.shibboleth.aa.AAServlet.authorityName"),
 225                                         configuration.getProperty("edu.internet2.middleware.shibboleth.audiences").replaceAll(
 226                                                 "\\s",
 227                                                 "").split(
 228                                                 ","));
 229                         saml.receive(req);
 230
 231                         log.info("Attribute Query Handle for this request: (" + saml.getHandle() + ").");
 232                         Principal principal = null;
 233                         if (saml.getHandle().equalsIgnoreCase("foo")) {
 234                                 // for testing
 235                                 principal = new AuthNPrincipal("test-handle");
 236                         } else {
 237                                 principal = handleRepository.getPrincipal(saml.getHandle());
 238                         }
 239
 240                         URL resource = null;
 241                         try {
 242                                 resource = new URL(saml.getResource());
 243                         } catch (MalformedURLException mue) {
 244                                 log.error(
 245                                         "Request contained an improperly formatted resource identifier.  Attempting to "
 246                                                 + "handle request without one.");
 247                         }
 248
 249                         if (saml.getShar() == null || saml.getShar().equals("")) {
 250                                 log.info("Request is from an unauthenticated SHAR.");
 251                         } else {
 252                                 log.info("Request is from SHAR: (" + saml.getShar() + ").");
 253                         }
 254
 255                         List attrs;
 256                         Iterator requestedAttrsIterator = saml.getDesignators();
 257                         if (requestedAttrsIterator.hasNext()) {
 258                                 log.info("Request designates specific attributes, resolving this set.");
 259                                 ArrayList requestedAttrs = new ArrayList();
 260                                 while (requestedAttrsIterator.hasNext()) {
 261                                         SAMLAttribute attribute = (SAMLAttribute) requestedAttrsIterator.next();
 262                                         try {
 263                                                 log.debug("Designated attribute: (" + attribute.getName() + ")");
 264                                                 requestedAttrs.add(new URI(attribute.getName()));
 265                                         } catch (URISyntaxException use) {
 266                                                 log.error(
 267                                                         "Request designated an attribute name that does not conform to the required URI syntax ("
 268                                                                 + attribute.getName()
 269                                                                 + ").  Ignoring this attribute");
 270                                         }
 271                                 }
 272                                 attrs =
 273                                         Arrays.asList(
 274                                                 responder.getReleaseAttributes(
 275                                                         principal,
 276                                                         saml.getShar(),
 277                                                         resource,
 278                                                         (URI[]) requestedAttrs.toArray(new URI[0])));
 279                         } else {
 280                                 log.info("Request does not designate specific attributes, resolving all available.");
 281                                 attrs = Arrays.asList(responder.getReleaseAttributes(principal, saml.getShar(), resource));
 282                         }
 283
 284                         log.info("Found " + attrs.size() + " attribute(s) for " + principal.getName());
 285                         saml.respond(resp, attrs, null);
 286                         log.info("Successfully responded about " + principal.getName());
 287
 288                 } catch (InvalidHandleException e) {
 289                         log.info("Could not associate the Attribute Query Handle with a principal: " + e);
 290                         try {
 291                                 QName[] codes =
 292                                         {
 293                                                 SAMLException.REQUESTER,
 294                                                 new QName(edu.internet2.middleware.shibboleth.common.XML.SHIB_NS, "InvalidHandle")};
 295                                 if (configuration
 296                                         .getProperty("edu.internet2.middleware.shibboleth.aa.AAServlet.passThruErrors", "false")
 297                                         .equals("true")) {
 298                                         saml.fail(
 299                                                 resp,
 300                                                 new SAMLException(
 301                                                         Arrays.asList(codes),
 302                                                         "The supplied Attribute Query Handle was unrecognized or expired.",
 303                                                         e));
 304
 305                                 } else {
 306                                         saml.fail(
 307                                                 resp,
 308                                                 new SAMLException(
 309                                                         Arrays.asList(codes),
 310                                                         "The supplied Attribute Query Handle was unrecognized or expired."));
 311                                 }
 312                                 return;
 313                         } catch (Exception ee) {
 314                                 log.fatal("Could not construct a SAML error response: " + ee);
 315                                 throw new ServletException("Attribute Authority response failure.");
 316                         }
 317
 318                 } catch (Exception e) {
 319                         log.error("Error while processing request: " + e);
 320                         try {
 321                                 if (configuration
 322                                         .getProperty("edu.internet2.middleware.shibboleth.aa.AAServlet.passThruErrors", "false")
 323                                         .equals("true")) {
 324                                         saml.fail(
 325                                                 resp,
 326                                                 new SAMLException(SAMLException.RESPONDER, "General error processing request.", e));
 327                                 } else {
 328                                         saml.fail(
 329                                                 resp,
 330                                                 new SAMLException(SAMLException.RESPONDER, "General error processing request."));
 331                                 }
 332                                 return;
 333                         } catch (Exception ee) {
 334                                 log.fatal("Could not construct a SAML error response: " + ee);
 335                                 throw new ServletException("Attribute Authority response failure.");
 336                         }
 337
 338                 }
 339         }
 340
 341
 342 }