IdP no longer sends xerces type hack unless specified in the relying party configuration.

git-svn-id: https://subversion.switch.ch/svn/shibboleth/java-idp/trunk@1418 ab3bd59b-922f-494d-bb5f-6f0a3c29deca

diff --git a/src/edu/internet2/middleware/shibboleth/aa/AAAttribute.java b/src/edu/internet2/middleware/shibboleth/aa/AAAttribute.java
index 7b82e13..5ce016b 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/aa/AAAttribute.java
+++ b/src/edu/internet2/middleware/shibboleth/aa/AAAttribute.java
@@ -60,10 +60,33 @@ public class AAAttribute extends SAMLAttribute implements ResolverAttribute, Arp
        private static long defaultLifetime = 1800; // 30 minutes
        private ValueHandler valueHandler = new StringValueHandler();
 
+       /**
+        * Constructs a skeleton attribute with no values.
+        * 
+        * @param name
+        *            the name of the attribute
+        * @param legacyCompat
+        *            boolean indicator of whether or not the legacy namespace hack should be used (this is required for SPs
+        *            running old versions of xerces)
+        * @throws SAMLException
+        */
+       public AAAttribute(String name, boolean legacyCompat) throws SAMLException {
+
+               super(name, SHIB_ATTRIBUTE_NAMESPACE_URI, legacyCompat ? new QName("urn:mace:shibboleth:1.0",
+                               "AttributeValueType") : null, defaultLifetime, null);
+       }
+
+       /**
+        * Constructs a skeleton attribute with no values.
+        * 
+        * @param name
+        *            the name of the attribute
+        * @throws SAMLException
+        *             if the attribute could not be created
+        */
        public AAAttribute(String name) throws SAMLException {
 
-               super(name, SHIB_ATTRIBUTE_NAMESPACE_URI, new QName("urn:mace:shibboleth:1.0", "AttributeValueType"),
-                               defaultLifetime, null);
+               super(name, SHIB_ATTRIBUTE_NAMESPACE_URI, null, defaultLifetime, null);
        }
 
        public AAAttribute(String name, Object[] values) throws SAMLException {

diff --git a/src/edu/internet2/middleware/shibboleth/common/RelyingParty.java b/src/edu/internet2/middleware/shibboleth/common/RelyingParty.java
index 6722399..7743825 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/common/RelyingParty.java
+++ b/src/edu/internet2/middleware/shibboleth/common/RelyingParty.java
@@ -119,4 +119,10 @@ public interface RelyingParty extends ServiceProvider {
         * Returns thhe default "TARGET" attribute to be used with the artifact profile or null if none is specified.
         */
        public String getDefaultTarget();
+
+       /**
+        * Boolean indicator of whether or not the legacy schema hack should be used. Older versions of xerces require
+        * (xsi:type="typens:AttributeValueType") on the attribute value to get around a validation bug.
+        */
+       public boolean wantsSchemaHack();
 }

diff --git a/src/edu/internet2/middleware/shibboleth/common/ServiceProviderMapper.java b/src/edu/internet2/middleware/shibboleth/common/ServiceProviderMapper.java
index 377a6d3..2d22268 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/common/ServiceProviderMapper.java
+++ b/src/edu/internet2/middleware/shibboleth/common/ServiceProviderMapper.java
@@ -229,6 +229,7 @@ public class ServiceProviderMapper {
                private boolean wantsAssertionsSigned = false;
                private int preferredArtifactType = 1;
                private String defaultTarget;
+               private boolean wantsSchemaHack = false;
 
                public RelyingPartyImpl(Element partyConfig, IdPConfig globalConfig, Credentials credentials,
                                NameMapper nameMapper) throws ServiceProviderMapperException {
@@ -301,6 +302,15 @@ public class ServiceProviderMapper {
                                log.debug("Relying party does not want SAML Assertions to be signed.");
                        }
 
+                       // Decide whether or not to use the schema hack for old xerces
+                       attribute = ((Element) partyConfig).getAttribute("schemaHack");
+                       if (attribute != null && !attribute.equals("")) {
+                               wantsSchemaHack = Boolean.valueOf(attribute).booleanValue();
+                       }
+                       if (wantsSchemaHack) {
+                               log.debug("XML schema hack enabled for this relying party.");
+                       }
+
                        // Set a default target for use in artifact redirects
                        defaultTarget = ((Element) partyConfig).getAttribute("defaultTarget");
 
@@ -467,6 +477,11 @@ public class ServiceProviderMapper {
                        return defaultTarget;
                }
 
+               public boolean wantsSchemaHack() {
+
+                       return wantsSchemaHack;
+               }
+
                /**
                 * Default identity provider implementation.
                 * 
@@ -587,6 +602,11 @@ public class ServiceProviderMapper {
 
                        return wrapped.getDefaultTarget();
                }
+
+               public boolean wantsSchemaHack() {
+
+                       return wrapped.wantsSchemaHack();
+               }
        }
 
        /**
@@ -674,6 +694,11 @@ public class ServiceProviderMapper {
 
                        return wrapped.getDefaultTarget();
                }
+
+               public boolean wantsSchemaHack() {
+
+                       return wrapped.wantsSchemaHack();
+               }
        }
 
        /**

diff --git a/src/edu/internet2/middleware/shibboleth/idp/IdPProtocolSupport.java b/src/edu/internet2/middleware/shibboleth/idp/IdPProtocolSupport.java
index cde7985..01a6872 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/IdPProtocolSupport.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/IdPProtocolSupport.java
@@ -212,11 +212,12 @@ public class IdPProtocolSupport implements Metadata {
                return null;
        }
 
-       public SAMLAttribute[] getReleaseAttributes(Principal principal, String requester, URL resource) throws AAException {
+       public SAMLAttribute[] getReleaseAttributes(Principal principal, RelyingParty relyingParty, String requester,
+                       URL resource) throws AAException {
 
                try {
                        URI[] potentialAttributes = arpEngine.listPossibleReleaseAttributes(principal, requester, resource);
-                       return getReleaseAttributes(principal, requester, resource, potentialAttributes);
+                       return getReleaseAttributes(principal, relyingParty, requester, resource, potentialAttributes);
 
                } catch (ArpProcessingException e) {
                        log.error("An error occurred while processing the ARPs for principal (" + principal.getName() + ") :"
@@ -225,13 +226,20 @@ public class IdPProtocolSupport implements Metadata {
                }
        }
 
-       public SAMLAttribute[] getReleaseAttributes(Principal principal, String requester, URL resource,
-                       URI[] attributeNames) throws AAException {
+       public SAMLAttribute[] getReleaseAttributes(Principal principal, RelyingParty relyingParty, String requester,
+                       URL resource, URI[] attributeNames) throws AAException {
 
                try {
                        AAAttributeSet attributeSet = new AAAttributeSet();
                        for (int i = 0; i < attributeNames.length; i++) {
-                               AAAttribute attribute = new AAAttribute(attributeNames[i].toString());
+
+                               AAAttribute attribute = null;
+                               if (relyingParty.wantsSchemaHack()) {
+                                       attribute = new AAAttribute(attributeNames[i].toString(), true);
+                               } else {
+                                       attribute = new AAAttribute(attributeNames[i].toString(), false);
+                               }
+
                                attributeSet.add(attribute);
                        }
 

diff --git a/src/edu/internet2/middleware/shibboleth/idp/provider/E_AuthSSOHandler.java b/src/edu/internet2/middleware/shibboleth/idp/provider/E_AuthSSOHandler.java
index 385a2a4..4d5f1c4 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/provider/E_AuthSSOHandler.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/provider/E_AuthSSOHandler.java
@@ -228,7 +228,7 @@ public class E_AuthSSOHandler extends SSOHandler implements IdPProtocolHandler {
                log.info("Resolving attributes.");
                List attributes = null;
                try {
-                       attributes = Arrays.asList(support.getReleaseAttributes(principal, relyingParty.getProviderId(), null));
+                       attributes = Arrays.asList(support.getReleaseAttributes(principal, relyingParty, relyingParty.getProviderId(), null));
                } catch (AAException e1) {
                        log.error("Error resolving attributes: " + e1);
                        eAuthError(response, 90, remoteProviderId, csid);

diff --git a/src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_AttributeQueryHandler.java b/src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_AttributeQueryHandler.java
index ac071a1..7c98ee3 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_AttributeQueryHandler.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_AttributeQueryHandler.java
@@ -64,7 +64,6 @@ import edu.internet2.middleware.shibboleth.common.ShibbolethConfigurationExcepti
 import edu.internet2.middleware.shibboleth.idp.IdPProtocolHandler;
 import edu.internet2.middleware.shibboleth.idp.IdPProtocolSupport;
 import edu.internet2.middleware.shibboleth.metadata.EntityDescriptor;
-import edu.internet2.middleware.shibboleth.metadata.KeyDescriptor;
 import edu.internet2.middleware.shibboleth.metadata.RoleDescriptor;
 import edu.internet2.middleware.shibboleth.metadata.SPSSODescriptor;
 
@@ -131,8 +130,8 @@ public class SAMLv1_AttributeQueryHandler extends BaseServiceHandler implements
 
                                // Make sure that the suppplied credential is valid for the
                                // selected relying party
-                X509Certificate[] chain = (X509Certificate[])req.getAttribute("javax.servlet.request.X509Certificate");
-                if (support.getTrust().validate((chain != null && chain.length > 0) ? chain[0] : null, chain, role)) {
+                               X509Certificate[] chain = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
+                               if (support.getTrust().validate((chain != null && chain.length > 0) ? chain[0] : null, chain, role)) {
                                        log.info("Supplied credential validated for this provider.");
                                        log.info("Request from service provider: (" + relyingParty.getProviderId() + ").");
                                        return relyingParty.getProviderId();
@@ -205,8 +204,8 @@ public class SAMLv1_AttributeQueryHandler extends BaseServiceHandler implements
                // Map Subject to local principal
                Principal principal;
                try {
-                       principal = support.getNameMapper().getPrincipal(attributeQuery.getSubject().getNameIdentifier(), relyingParty,
-                                       relyingParty.getIdentityProvider());
+                       principal = support.getNameMapper().getPrincipal(attributeQuery.getSubject().getNameIdentifier(),
+                                       relyingParty, relyingParty.getIdentityProvider());
 
                        log.info("Request is for principal (" + principal.getName() + ").");
 
@@ -226,11 +225,11 @@ public class SAMLv1_AttributeQueryHandler extends BaseServiceHandler implements
                                        }
                                }
 
-                               attrs = support.getReleaseAttributes(principal, effectiveName, null, (URI[]) requestedAttrs
-                                               .toArray(new URI[0]));
+                               attrs = support.getReleaseAttributes(principal, relyingParty, effectiveName, null,
+                                               (URI[]) requestedAttrs.toArray(new URI[0]));
                        } else {
                                log.info("Request does not designate specific attributes, resolving all available.");
-                               attrs = support.getReleaseAttributes(principal, effectiveName, null);
+                               attrs = support.getReleaseAttributes(principal, relyingParty, effectiveName, null);
                        }
 
                        log.info("Found " + attrs.length + " attribute(s) for " + principal.getName());

diff --git a/src/edu/internet2/middleware/shibboleth/idp/provider/ShibbolethV1SSOHandler.java b/src/edu/internet2/middleware/shibboleth/idp/provider/ShibbolethV1SSOHandler.java
index 44b03de..ed4b87b 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/provider/ShibbolethV1SSOHandler.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/provider/ShibbolethV1SSOHandler.java
@@ -326,7 +326,8 @@ public class ShibbolethV1SSOHandler extends SSOHandler implements IdPProtocolHan
                        RelyingParty relyingParty, SAMLSubject authNSubject) throws SAMLException {
 
                try {
-                       SAMLAttribute[] attributes = support.getReleaseAttributes(principal, relyingParty.getProviderId(), null);
+                       SAMLAttribute[] attributes = support.getReleaseAttributes(principal, relyingParty, relyingParty
+                                       .getProviderId(), null);
                        log.info("Found " + attributes.length + " attribute(s) for " + principal.getName());
 
                        // Bail if we didn't get any attributes

diff --git a/src/schemas/shibboleth-idpconfig-1.0.xsd b/src/schemas/shibboleth-idpconfig-1.0.xsd
index dbb84f4..a72cfef 100644 (file)
--- a/src/schemas/shibboleth-idpconfig-1.0.xsd
+++ b/src/schemas/shibboleth-idpconfig-1.0.xsd
@@ -60,6 +60,7 @@
                                                                <xs:attribute name="signAssertions" type="xs:boolean" use="optional"/>
                                                                <xs:attribute name="forceAttributeNoPush" type="xs:boolean" use="optional"/>
                                                                <xs:attribute name="defaultToPOSTProfile" type="xs:boolean" use="optional"/>
+                                                               <xs:attribute name="schemaHack" type="xs:boolean" use="optional"/>
                                                                <xs:attribute name="defaultAuthMethod" type="xs:string" use="optional"/>
                                                                <xs:attribute name="preferredArtifactType" type="xs:integer" use="optional"/>
                                                                <xs:attribute name="defaultTarget" type="xs:string" use="optional"/>