summaryrefslogtreecommitdiffstats
path: root/auth_mellon_handler.c
Commit message (Collapse)AuthorAgeFilesLines
* Add support for AssertionConsumerServiceURLwipSimo Sorce2014-08-151-0/+14
| | | | | | | | | Apperently some IdPs like PicketLink insist they reaaaally want to see AssertionConsumerServiceURL as part of the Authentication Request. Provide it if allowed by the SP metadata. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix memory leak of loaded IdPs.olavmrk2014-06-241-2/+6
| | | | | | | | | | | We free the first element of a linked list, but not the data nor the subsequent elements. Fix that by first iterating through the list freeing the elements and then freeing the list using g_list_free(). We could have used g_list_free_full, but that requires version 2.28 of GLib, which is still slightly too recent. git-svn-id: https://modmellon.googlecode.com/svn/trunk@237 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Add a helper to redirect on unauthorized errorolavmrk2014-04-251-0/+8
| | | | | | | | | | In case we are going to return a HTTP_UNAUTHORIZED error we can also redirect the client to an admin chosen page to let the application handle the error on its own. Signed-off-by: Simo Sorce <simo@redhat.com> git-svn-id: https://modmellon.googlecode.com/svn/trunk@227 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Handle non successful status posted by the Idpolavmrk2014-04-251-1/+9
| | | | | | | | | | | | | | | | Idps may decide to deny authentication for a variety of reasons. In such a case they will post to the application with an unsuccessful status error code. Handle the case by returning a more appropriate 401 Unauthorized HTTP error code. iDo this using an extensible mechanism to map arbitrary lasso errors to HTTP errors. Signed-off-by: Simo Sorce <simo@redhat.com> git-svn-id: https://modmellon.googlecode.com/svn/trunk@226 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Silence warningolavmrk2014-04-251-1/+4
| | | | | | | | | | The -Wunused-but-set-variable option will cause a warning that idp_public_key_file is set but never used when HAVE_lasso_server_load_metadata is defined. Signed-off-by: Simo Sorce <simo@redhat.com> git-svn-id: https://modmellon.googlecode.com/svn/trunk@225 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Simplify cache disabling headers.olavmrk2014-02-131-2/+2
| | | | | | | | | | | | | | | | | | This patch changes the headers sent to prevent errornous caching of the responses sent to only use a single header: Cache-Control: private, must-revalidate This single header should ensure that the data isn't shared between multiple users, and that the browser checks that the content is still valid for each request (enabling logout to work as expected). This drops the Exires-header, which should be unnecessary since all modern browsers support the Cache-Control-header. Thanks to Arthur Müller for providing this patch. git-svn-id: https://modmellon.googlecode.com/svn/trunk@223 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Properly release sessions during logout.olavmrk2013-10-281-4/+9
| | | | | | | | | | In the case where the error "LASSO_PROFILE_ERROR_SESSION_NOT_FOUND" occurs during lasso_logout_validate_request(), we weren't releasing the session mutex, which will lead to a deadlock in the next request that needs to access a session. This patch makes sure we properly release session in that case. git-svn-id: https://modmellon.googlecode.com/svn/trunk@221 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Add support for reciving HTTP-Artifact responses over POST.olavmrk2013-06-111-12/+46
| | | | | | | | | The HTTP-Artifact response is also allowed to be sent as a POST request. This patch adds support for loading those responses. Thanks to Nikola Ivačič for implementing this! git-svn-id: https://modmellon.googlecode.com/svn/trunk@217 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Handle empty RelayState the same as missing RelayState.olavmrk2013-05-081-1/+1
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@209 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Compatibility helpers for Apache 2.4.olavmrk2013-05-081-2/+2
| | | | | | | Thansk to Thijs Kinkhorst for identifying the changes that were necessary! git-svn-id: https://modmellon.googlecode.com/svn/trunk@208 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Add MellonSPentityId to control entityId in autogenerated metadatamanu@netbsd.org2013-04-151-2/+6
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@205 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Redirect the user when missing repost data.olavmrk2013-03-221-4/+7
| | | | | | | | | In the case where we are missing the repost data, we currently display a 400 Bad Request error. This patch changes the code to redirect to the end URL instead, which at least has a chance to work. git-svn-id: https://modmellon.googlecode.com/svn/trunk@202 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Use discovery service with "login" endpoint.olavmrk2013-03-061-4/+16
| | | | | | | | | | | | | Accessing the "login"-endpoint with multiple IdPs configured would bypass the discovery service. This patch changes the behaviour so that we send a discovery service request instead. This breaks backwardscompatibility slightly, but hopefully it should not be a problem. This fixes issue 13: https://code.google.com/p/modmellon/issues/detail?id=13 git-svn-id: https://modmellon.googlecode.com/svn/trunk@186 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Fix incorrect use of const-keyword in login handler.olavmrk2013-03-061-3/+5
| | | | | | This doesn't fix any bugs, it just makes the code cleaner. git-svn-id: https://modmellon.googlecode.com/svn/trunk@185 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Do not mark a session as logged in before all processing is completed.olavmrk2013-03-061-3/+3
| | | | | | | | | | | If we mark the session as logged in before all processing is completed, a failure during login processing (e.g. too big attribute values) can cause a user to receive a "half-authenticated" session. This patch changes the code so that the last task before releaseing the session is to mark it as logged in. git-svn-id: https://modmellon.googlecode.com/svn/trunk@184 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Avoid locking and unlocking the session multiple times during login.olavmrk2013-03-061-21/+14
| | | | | | | | We currently release the session lock only to grab it again a few instructions later. This patch changes this so that we initialize the session in one operation. git-svn-id: https://modmellon.googlecode.com/svn/trunk@183 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Fix missing session release in error path during login.olavmrk2013-03-061-0/+1
| | | | | | | | | We had forgotten to release the session object in one of the error paths during login. This could result in us hanging onto the session mutex after the request has finished, this deadlocking the server. This patch fixes that error. git-svn-id: https://modmellon.googlecode.com/svn/trunk@182 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Disable automatic creation of MellonPostDirectory.olavmrk2013-03-061-1/+8
| | | | | | | | Now that the POST replay functionality has been disabled by default, we can force the administrator to create this directory manually. This saves us from worrying about temp file/directory vulnerabilities. git-svn-id: https://modmellon.googlecode.com/svn/trunk@178 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Disable replay of POST request by default.olavmrk2013-03-061-2/+8
| | | | | | | | | Since we are going to disable autocreation of the POST data directory, we will need to disable POST replay by default. This patch adds the MellonPostReplay option, which can be used to enable and disable the POST replay functionality on a per-location basis. git-svn-id: https://modmellon.googlecode.com/svn/trunk@177 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Remove duplicate endpoint handlers.olavmrk2013-03-061-4/+0
| | | | | | | | The "metadata" and "repost" handlers were tested twice in the endpoint handler. This patch removes the last occurence, since they are never reached. git-svn-id: https://modmellon.googlecode.com/svn/trunk@174 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Fix SP-initiated logout.olavmrk2013-03-061-0/+1
| | | | | | | | | | | We need to restore the profile state when creating a logout request, so that Lasso has the information it requires for logging out. If we do not do this, every logout "fail" with the log message: User attempted to initiate logout without being loggged in. git-svn-id: https://modmellon.googlecode.com/svn/trunk@172 a716ebb1-153a-0410-b759-cfb97c6a1b53
* replace all assignment to r->content_type by calls to ap_set_content_typebenjamin.dauvergne2012-10-091-7/+6
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@169 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Add configuration directive MellonDoNotVerifyLogoutSignaturebenjamin.dauvergne2012-10-091-0/+24
| | | | | | | This directive allows to list IdP entityID for which the signature of their logout request must not be verified. git-svn-id: https://modmellon.googlecode.com/svn/trunk@168 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Add a local logout only possibility when IdP does not support logoutbenjamin.dauvergne2012-10-091-14/+17
| | | | | | | | Handle the case of an IdP not handling SLO as a normal situation, not an internal error, so that the HTTP flow can get back to the ReturnURL without interruption. git-svn-id: https://modmellon.googlecode.com/svn/trunk@167 a716ebb1-153a-0410-b759-cfb97c6a1b53
* rework logout handler to really handle SOAP requestsbenjamin.dauvergne2012-10-091-51/+45
| | | | | | | | | | | | - Change am_restore_lasso_profile_state to take an am_cache_entry_t* as parameter instead of looking at the current session (there is no session when you receive a SOAP request), - Restore the profile state after parsing the Logout request not before, - Always lookup the session through the NameID, as nothing in the spec forbid out-of-browser HTTP-Redirect requests, - Use the new helper function to return the LogoutResponse. git-svn-id: https://modmellon.googlecode.com/svn/trunk@166 a716ebb1-153a-0410-b759-cfb97c6a1b53
* add a new helper function to return SAML responsesbenjamin.dauvergne2012-10-091-0/+38
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@165 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Add directive MellonSubjectConfirmationDataAddressCheckbenjamin.dauvergne2012-02-171-1/+2
| | | | | | | | | MellonSubjectConfirmationDataAddressCheck allows to block client address checking as given in IdP assertion in the SubjectConfirmationData node, it can be necessary when client and IdP or SP are in a NAT-ed network or when the SP is behind a reverse proxy. git-svn-id: https://modmellon.googlecode.com/svn/trunk@152 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Support for HTTP-POST SingleSignOnService endpoint.olavmrk2012-01-121-31/+146
| | | | | | | This patch extends mod_mellon with support for sending authentication requests with the HTTP-POST binding. git-svn-id: https://modmellon.googlecode.com/svn/trunk@151 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Always redirect to the login URL when starting authentication.olavmrk2012-01-121-1/+13
| | | | | | | | We cannot display any pages from the am_start_auth()-function since it runs from the access checker. We therefore need to redirect to the login handler, which can then display web pages. git-svn-id: https://modmellon.googlecode.com/svn/trunk@150 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Split am_auth_new_ticket() into am_handle_auth() and am_start_auth().olavmrk2012-01-121-9/+42
| | | | | | | | | | | | | | | | | | | The code in am_auth_new_ticket() was shared between the "auth" endpoint and the code to start authentication from other requests. This results in the possibility of unpredictable interactions between those functions. For example, it was possible to select the IdP from a random page by adding the "IdP" parameter. The "ReturnTo" parameter could also affect where the user was sent after authentication. The result of this change is two new functions, one for starting authentication from other requests, and one for handling the "auth" endpoint. The "auth"-endpoint is no longer used by code, but may be used elsewhere. It is therefore included for backwards compatibility. git-svn-id: https://modmellon.googlecode.com/svn/trunk@149 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Extract am_start_disco() from am_auth_new_ticket().olavmrk2012-01-121-32/+49
| | | | | | | | In preparation of splitting am_auth_new_ticket() into two functions, extract the code to redirect to the discovery service into its own function. git-svn-id: https://modmellon.googlecode.com/svn/trunk@148 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Move discovery response endpoint to "login" instead of "auth".olavmrk2012-01-121-1/+1
| | | | | | | | We now have a "login" endpoint that can be used for triggering authentication. Make the discovery service send its response to that page. git-svn-id: https://modmellon.googlecode.com/svn/trunk@147 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Fix entityID sent to discovery service.olavmrk2012-01-121-2/+11
| | | | | | | | We assumed that the SP entityID was always the endpoint path followed by "metadata". This does not need to be the case. This patch changes it to fetch the SP entityID from the SP metadata. git-svn-id: https://modmellon.googlecode.com/svn/trunk@146 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Merge am_endpoint_handler() and am_handler().olavmrk2012-01-121-68/+33
| | | | | | | | | | | We currently handle requests to many endpoints from the access control hooks. This change bypasses access control in those cases, and handles the requests from the "handler" hook instead. This change is necessary to be able to do anything else than redirects from the handlers. As a side effect, it also simplifies the code. git-svn-id: https://modmellon.googlecode.com/svn/trunk@144 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Initialize AuthnRequest with asked AuthnContextClassRef if neededolavmrk2011-12-071-0/+24
| | | | | | Thanks to Benjamin Dauvergne for implementing this. git-svn-id: https://modmellon.googlecode.com/svn/trunk@142 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Add checking for AuthContextClassRefolavmrk2011-12-071-0/+60
| | | | | | | | | | | - If request miss needed elements AuthnStatement or AuthnContext, HTTP status BadRequest is returned. - If request does not match one of the required AuthnContextClassRef, HTTP status Forbidden is returned. Thanks to Benjamin Dauvergne for implementing this. git-svn-id: https://modmellon.googlecode.com/svn/trunk@141 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Honour MellonProbeDiscoveryIdP order when sending probesmanu@netbsd.org2011-12-051-51/+75
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@139 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Avoid dependency on GLib 2.16.olavmrk2011-09-231-7/+14
| | | | | | | | | | We used GHashTableIter, which wasn't introduced before version 2.16 of GLib. This patch changes the code to simply use g_hash_table_get_keys instead. (This means that we depend on GLib 2.14.) git-svn-id: https://modmellon.googlecode.com/svn/trunk@137 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Avoid using APR_ARRAY_IDX.olavmrk2011-05-181-1/+1
| | | | | | | APR_ARRAY_IDX is a relatively new macro in the APR package, so we should avoid using it. git-svn-id: https://modmellon.googlecode.com/svn/trunk@134 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Add support for inheriting lasso_server objects.olavmrk2011-05-181-3/+7
| | | | | | | | | | | Change configuration to inherit the lasso_server objects when nothing affecting the lasso_server object changes from the parent configuration object. This should speed up processing of requests where you have request-specific configuration changes, such as access control rules. git-svn-id: https://modmellon.googlecode.com/svn/trunk@130 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Add support for loading federation metadata files.olavmrk2011-05-181-14/+44
| | | | | | Patch originally created by Emmanuel Dreyfus, some changes by me. git-svn-id: https://modmellon.googlecode.com/svn/trunk@129 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Change am_server_add_providers to return number of providers from ↵olavmrk2011-05-181-5/+2
| | | | | | LassoServer object. git-svn-id: https://modmellon.googlecode.com/svn/trunk@127 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Change cfg->idp_metadata_files to an array instead of an hash.olavmrk2011-05-181-13/+7
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@126 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Change am_handle_probe_discovery() to use providers from LassoServer.olavmrk2011-05-181-8/+10
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@125 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Change am_get_idp() to use providers from LassoServer.olavmrk2011-05-181-8/+7
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@124 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Change am_first_idp() to retrieve the entityID from the LassoServer object.olavmrk2011-05-181-10/+10
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@123 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Move am_get_idp() and am_first_idp() to after am_get_lasso_server().olavmrk2011-05-181-84/+86
| | | | | | This is in preparation of using am_get_lasso_server from those functions. git-svn-id: https://modmellon.googlecode.com/svn/trunk@122 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Unbreak logout for lasso version >= 2.3.0benjamin.dauvergne2011-05-041-28/+31
| | | | | | | | | | | Lasso initializes the SessionIndex attribute of LogoutRequest message itself since release 2.3.4 and directly remove the related assertions since 2.3.0, so the old way to initialize the SessionIndex cannot work anymore. Between version 2.3.0 and 2.3.4 it just cannot work at all but it is better to send a broken logout request missing the SessionIndex attribute than to raise a segmentation fault. git-svn-id: https://modmellon.googlecode.com/svn/trunk@121 a716ebb1-153a-0410-b759-cfb97c6a1b53
* A /mellon/probeDisco endpoint replaces the builtin:get-metadata IdP manu@netbsd.org2011-03-091-73/+147
| | | | | | | | dicovery URL scheme. It is configured using the MellonProbeDiscoveryTimeout and MellonProbeDiscoveryIdP directives. git-svn-id: https://modmellon.googlecode.com/svn/trunk@113 a716ebb1-153a-0410-b759-cfb97c6a1b53
* Report the received Recipient for error on SubjectConfirmationDatabenjamin.dauvergne2010-09-281-2/+2
| | | | git-svn-id: https://modmellon.googlecode.com/svn/trunk@109 a716ebb1-153a-0410-b759-cfb97c6a1b53
generated by cgit (git 2.34.1) at 2024-04-28 00:11:08 +0000