summaryrefslogtreecommitdiffstats
path: root/lasso
Commit message (Collapse)AuthorAgeFilesLines
...
* [Core] fix leak of provider->private_data->endpointsBenjamin Dauvergne2010-09-171-9/+10
|
* [Core] fix leak of provider->private_data->endpointsBenjamin Dauvergne2010-09-171-1/+1
|
* [XML] fix memleak in lasso_node_export_to_soapBenjamin Dauvergne2010-09-171-0/+1
|
* [XML] fix memleak of xmlSecKeyMngr when loading a key from a KeyInfo nodeBenjamin Dauvergne2010-09-171-0/+1
|
* [XML] fix memleak in get_xmlNode for LassoSamlp2LogoutRequestBenjamin Dauvergne2010-09-171-0/+1
|
* [XML] fix memleak in get_xmlNode for LassoSamlp2ResponseBenjamin Dauvergne2010-09-171-2/+2
|
* [SAMLv2] add missing stack variable initializationBenjamin Dauvergne2010-09-171-2/+2
|
* [SAMLv2] fix unused variable warningBenjamin Dauvergne2010-09-171-1/+1
|
* [SAMLv2] in profile.c fix uncovered enumeration value in switchBenjamin Dauvergne2010-09-171-0/+6
|
* [XML] fix unused variable warningsBenjamin Dauvergne2010-09-171-2/+4
|
* [XML] fix mem leak whene releasing CustomElement structuresBenjamin Dauvergne2010-09-171-0/+3
|
* [SAMLv2] fix mem leaksBenjamin Dauvergne2010-09-171-4/+8
|
* [SAMLv2 NID management] report signature error in response, do not check ↵Benjamin Dauvergne2010-09-101-4/+14
| | | | | | | | | | | response signature if forbidden - build_response_msg will report signature error in response status code when called without an initialized response (without a call to validate_request) - process_response_msg now use lasso_saml20_profile_check_signature_status to check the signature status only if permitted.
* [SAMLv2] move check for signature status to lasso_saml20_build_response_msgBenjamin Dauvergne2010-09-101-10/+17
| | | | | | | | And also handle the signature verification hint. If process_msg fails, you must just call build_response_msg directly. Only check the signature on the response if asked, most applications should not care.
* [SAMLv2] apply the LassoProfileVerifySignatureHint when processing requestsBenjamin Dauvergne2010-09-095-52/+45
| | | | | | | | The check was missing for processing of logout requests, name id management request and assertion query responses. A new internal function lasso_saml20_profile_check_signature_status is added.
* [ID-WSFv1&ID-WSFv2] separate better strings for ID-WSF from other stringsBenjamin Dauvergne2010-09-09229-25/+260
| | | | | | Code in core source file which depend upon ID-WSF symbols have been conditionalized, and each id-wsf source file now include directly its need string header.
* [SAMLv2] when no artifact message is present, still return a success statusBenjamin Dauvergne2010-09-071-0/+4
| | | | It is mandated by the specification.
* Merge branch 'develop' into hotfixes-2.3.1Benjamin Dauvergne2010-09-038-27/+161
|\
| * [ID-FFv1.2&SAMLv2] add more warning for failure to load metadata fileBenjamin Dauvergne2010-09-032-0/+7
| | | | | | | | Report detailf of the failure through warning log.
| * [SAMLv2] when failing to recreate the content for the ArtefactResponse set a ↵Benjamin Dauvergne2010-09-032-1/+9
| | | | | | | | lasso specific status code
| * [SAMLv2] change the way content is stored and loaded for the HTTP-Artifact ↵Benjamin Dauvergne2010-09-031-18/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | binding Previously content was stored as the result of lasso_node_dump method then reloaded, and then serialized again as part of the ArtifactResponse message. lasso_node_dump was ignoring all hint to sign node, but keeping the needed parameters around. That's not what must be done, the signature should happen at the generation of the artifact and the result must manipulated as is (i.e. XML content) and never moved back to the land of LassoNode objects. Now the content is: - first removed of any signature at the message level, because the ArtifactResponse will take care of this, (any signature under this level (like at the assertion) is kept), - serialized using lasso_node_export_to_xml, - reloaded using lasso_xml_parse_memory, - and put into the ArtifactResponse using a lasso_misc_text_node_new_with_xml_node.
| * [SAMLv2] make lasso_saml20_profile_generate_artifact a static functionBenjamin Dauvergne2010-09-032-2/+2
| | | | | | | | It is only used in lasso/saml-2.0/profile.c anyway.
| * [Core] load signature parametersBenjamin Dauvergne2010-09-031-5/+49
| | | | | | | | | | | | | | | | | | | | Generic signature parameters (attached as qdata to nodes) is now reloaded when initializing a node from XML for a node type with a signature snippet in its metadatas. It fixes the problematic usage of ciphered private keys with the HTTP-Artifact binding (which needs to keep a copy of the AuthnResponse around and to sign it later).
| * [Core] add private function to read an integer attributeBenjamin Dauvergne2010-09-031-0/+21
| | | | | | | | | | This function does integer parsing and range checks, it returns TRUE if all goes well.
| * [Core] add LAST enum values to LassoSignatureMethod and LassoSignatureType ↵Benjamin Dauvergne2010-09-032-2/+8
| | | | | | | | | | | | enumerations It helps making range checks.
| * [Strings] add string constant for the internal XML attributes used in dumpsBenjamin Dauvergne2010-09-031-0/+35
| | | | | | | | | | | | | | | | | | Add string constants for signature method, signature type, private key (file path or content), private key password and certificate (file path or content). Add cast for xmlChar constant strings definition in python bindings, it assumed all constant strings were char*.
* | [Core] fix memory leak in lasso_endpoint_freeBenjamin Dauvergne2010-09-031-0/+1
| |
* | [SAMLv2] mark Redirect binding as an invalid binding for return AuthnResponseBenjamin Dauvergne2010-08-251-0/+1
| | | | | | | | This is really not supported by the SAMLv2 protocol.
* | [SAMLv2] fix string in commentBenjamin Dauvergne2010-08-251-1/+1
| |
* | [SAMLv2] replace use of lasso_provider_get_default_name_id_format with ↵Benjamin Dauvergne2010-08-251-1/+2
| | | | | | | | | | | | | | | | | | direct use of lasso_provider_get_metadata_one_for_role The first is trying to use provider->role to know which kind of role descriptor to lookup, but for the server object this field is 0 and when building authn request we know that we want our default NameIDFormat for the SP sso descriptor.
* | [SAMLv2] rebuild specialized LassoProvider methods upon new endpoints storageBenjamin Dauvergne2010-08-251-278/+239
| | | | | | | | | | | | | | | | The new way of storing endpoints allows to keep ordering between endpoints with respect to the order of the index and isDefault field for indexed endpoint type, and to the XML node orders for other endpoints. It also simplifies the code.
* | [Core] add destroy code for new private field endpointsBenjamin Dauvergne2010-08-251-0/+8
| | | | | | | | The contained string must be disallocated if the object is destroyed.
* | [Core] add structure to store endpoints type for metadata filesBenjamin Dauvergne2010-08-251-1/+13
| | | | | | | | | | This new C structure will allow to filter ID-FFv1.2 and SAMLv2 endpoints more easily.
* | [XML] use strtol instead of atoi to parse XSchema integersBenjamin Dauvergne2010-08-251-2/+18
| | | | | | | | | | This commit also reject negative integers from being parsed (all integers in SAMLv2 and ID-FFv1.2 schemas are positive integers).
* | [SAMLv2] when AuthnRequest contains invalid attributes returns ↵Benjamin Dauvergne2010-08-251-1/+1
| | | | | | | | | | | | INVALID_REQUEST not NO_DEFAULT_ENDPOINT This is the right status to return.
* | [Core] fix change of enumeration valueBenjamin Dauvergne2010-08-051-2/+2
|/ | | | This change broke the API, revert it.
* [Core] remove now useless .cvsignore filesBenjamin Dauvergne2010-07-216-47/+0
|
* [Core] add errors.c to EXTRA_DISTBenjamin Dauvergne2010-07-211-1/+1
|
* [Core] remove unused build-strerror.plBenjamin Dauvergne2010-07-211-24/+0
|
* [SAMLv2] simplify logic for handling AuthnResponse with binding HTTP-PostBenjamin Dauvergne2010-07-201-60/+38
| | | | | | | | | | | | | | | | | | | | The logic is now simpler: - first lasso_saml20_profile_process_any_response check the signature on the message - then lasso_saml20_login_process_response_status_and_assertion traverse all the assertions: - if the message is signed all assertion from the same issuer are automatically accepted, - if the message is not signed, or the signature validation failed, or the assertion has a different issuer than the message, we check the signature directly on the assertion. If any of the assertions fails the signature check, the result will be LASSO_PROFILE_ERROR_CANNOT_VERIFY_SIGNATURE. The public field profile->signature_status will contain only the message level signature status, each assertion signature status is not accessible. That will change when signature and key handling is reworked.
* [SAMLv2] comment on SessionIndex support hackBenjamin Dauvergne2010-07-191-0/+8
|
* [SAMLv2] remove empty files, wrongly committedBenjamin Dauvergne2010-07-197-6/+0
|
* [SAMLv2/SSO] when processing AuthnResponse with binding HTTP-Post only the ↵Benjamin Dauvergne2010-07-191-9/+24
| | | | | | | | | | | | assertion need to be signed If the message is signed, the assertion is also covered, but if only the assertion is signed, there is no error to report. If the caller ask for forcing the validation of message signature, then we report an error. This commit also add checking for the binding used, if it is not HTTP-Post lasso_login_process_authn_response_msg will now report an error.
* [ID-FFv1.2] add missing namespace declarationsBenjamin Dauvergne2010-07-162-0/+2
|
* [SAMLv2] add support for encrypted private keysBenjamin Dauvergne2010-07-163-20/+58
| | | | | | | | | | | | | | | | | | | * support private key with new internal API in signature setting methods Plug lasso_node_set_signature into lasso_profile_saml20_setup_message_signature and lasso_server_saml2_assertion_setup_signature. * also use lasso_node_get_signature in has_signature * add forgottent LASSO_PROFILE_SIGNATURE_VERIFY_HINT_FORCE in switch cases For AuthnResponse checking the semantic is now that if HINT_FORCE is used we verify message signature *and* assertion signature. If HINT_MAYBE is used we check the assertion signature if its issuer differs from the message issuer.
* [ID-FFv1.2] move all user of lasso_node_export_to_query to ↵Benjamin Dauvergne2010-07-164-16/+23
| | | | lasso_node_export_to_query_with_password
* [Core] Change lasso_apply_signature to use quark stored annotated signature ↵Benjamin Dauvergne2010-07-161-2/+17
| | | | | | | | | | | | parameters The node containing signature do not handle the private keys passwords. As the fields for signature parameters are part of the public ABI we cannot add the password field to the public structure for those nodes. Instead we use the new quark annotation accessed through lasso_node_get/set_signature, and if the sign_type parameter is non-NULL we use it instead of the parameters stored in the public structure. This is a gross hack :( but at least it is documented.
* [Core] add password parameter to lasso_sign_nodeBenjamin Dauvergne2010-07-163-8/+16
|
* [Code] add a lasso_node_export_to_query_with_password methodBenjamin Dauvergne2010-07-162-0/+41
|
* [Core] add a password parameter to lasso_query_signBenjamin Dauvergne2010-07-164-6/+24
| | | | We force use of the password through a custom OpenSSL password callback.
generated by cgit (git 2.34.1) at 2025-09-26 04:35:40 +0000