#include <saml/binding/SecurityPolicy.h>
Inheritance diagram for opensaml::SecurityPolicy:
Public Member Functions | |
SecurityPolicy (const saml2md::MetadataProvider *metadataProvider=nullptr, const xmltooling::QName *role=nullptr, const xmltooling::TrustEngine *trustEngine=nullptr, bool validate=true) | |
Constructor for policy. | |
const saml2md::MetadataProvider * | getMetadataProvider () const |
Returns the locked MetadataProvider supplied to the policy. | |
virtual saml2md::MetadataProvider::Criteria & | getMetadataProviderCriteria () const |
Returns a reference to a MetadataProvider::Criteria instance suitable for use with the installed MetadataProvider. | |
const xmltooling::QName * | getRole () const |
Returns the peer role element/type supplied to the policy. | |
const xmltooling::TrustEngine * | getTrustEngine () const |
Returns the TrustEngine supplied to the policy. | |
bool | getValidating () const |
Returns XML message validation setting. | |
bool | requireEntityIssuer () const |
Returns flag controlling non-entity issuer support. | |
const std::vector< xmltooling::xstring > & | getAudiences () const |
Returns the SAML audiences that represent the receiving peer. | |
std::vector< xmltooling::xstring > & | getAudiences () |
Returns the SAML audiences that represent the receiving peer. | |
time_t | getTime () const |
Gets the effective time of message processing. | |
const XMLCh * | getCorrelationID () const |
Returns the message identifier to which the message being evaluated is a response. | |
std::vector< const SecurityPolicyRule * > & | getRules () |
Gets a mutable array of installed policy rules. | |
void | setMetadataProvider (const saml2md::MetadataProvider *metadata) |
Sets a locked MetadataProvider for the policy. | |
void | setMetadataProviderCriteria (saml2md::MetadataProvider::Criteria *criteria) |
Sets a MetadataProvider::Criteria instance suitable for use with the installed MetadataProvider. | |
void | setRole (const xmltooling::QName *role) |
Sets a peer role element/type for to the policy. | |
void | setTrustEngine (const xmltooling::TrustEngine *trust) |
Sets a TrustEngine for the policy. | |
void | setValidating (bool validate=true) |
Controls schema validation of incoming XML messages. | |
void | requireEntityIssuer (bool entityOnly=true) |
Sets flag controlling non-entity issuer support. | |
void | setTime (time_t ts) |
Sets effective time of message processing. | |
void | setCorrelationID (const XMLCh *correlationID) |
Sets the message identifier to which the message being evaluated is a response. | |
void | evaluate (const xmltooling::XMLObject &message, const xmltooling::GenericRequest *request=nullptr) |
Evaluates the policy against the given request and message, possibly populating message information in the policy object. | |
virtual void | reset (bool messageOnly=false) |
Resets the policy object and/or clears any per-message state. | |
void | _reset (bool messageOnly=false) |
Resets the policy object and/or clears any per-message state for only this specific class. | |
const XMLCh * | getMessageID () const |
Returns the message identifier as determined by the registered policies. | |
time_t | getIssueInstant () const |
Returns the message timestamp as determined by the registered policies. | |
const saml2::Issuer * | getIssuer () const |
Gets the issuer of the message as determined by the registered policies. | |
const saml2md::RoleDescriptor * | getIssuerMetadata () const |
Gets the metadata for the role the issuer is operating in. | |
bool | isAuthenticated () const |
Returns the authentication status of the message as determined by the registered policies. | |
void | setMessageID (const XMLCh *id) |
Sets the message identifier as determined by the registered policies. | |
void | setIssueInstant (time_t issueInstant) |
Sets the message timestamp as determined by the registered policies. | |
void | setIssuer (const saml2::Issuer *issuer) |
Sets the issuer of the message as determined by the registered policies. | |
void | setIssuer (const XMLCh *issuer) |
Sets the issuer of the message as determined by the registered policies. | |
void | setIssuerMetadata (const saml2md::RoleDescriptor *issuerRole) |
Sets the metadata for the role the issuer is operating in. | |
void | setAuthenticated (bool auth) |
Sets the authentication status of the message as determined by the registered policies. | |
const IssuerMatchingPolicy & | getIssuerMatchingPolicy () const |
Returns the IssuerMatchingPolicy in effect. | |
void | setIssuerMatchingPolicy (IssuerMatchingPolicy *matchingPolicy) |
Sets the IssuerMatchingPolicy in effect. | |
Protected Attributes | |
saml2md::MetadataProvider::Criteria * | m_metadataCriteria |
Manufactured MetadataProvider::Criteria instance. | |
Static Protected Attributes | |
static IssuerMatchingPolicy | m_defaultMatching |
A shared matching object that just supports the default matching rules. | |
Classes | |
class | IssuerMatchingPolicy |
Allows override of rules for comparing saml2:Issuer information. More... |
Its security mechanisms may be used to examine the transport layer (e.g client certificates and HTTP basic auth passwords) or to check the payload of a request to ensure it meets certain criteria (e.g. valid digital signature, freshness, replay).
Policy objects can be reused, but are not thread-safe.
|
Constructor for policy.
|
|
Resets the policy object and/or clears any per-message state for only this specific class. Resets can be complete (the default) or merely clear the previous message ID and timestamp when evaluating multiple layers of a message.
Reimplemented in opensaml::saml2::SAML2AssertionPolicy. |
|
Evaluates the policy against the given request and message, possibly populating message information in the policy object.
|
|
Returns the SAML audiences that represent the receiving peer.
|
|
Returns the SAML audiences that represent the receiving peer.
|
|
Returns the message identifier to which the message being evaluated is a response.
|
|
Returns the message timestamp as determined by the registered policies.
|
|
Gets the issuer of the message as determined by the registered policies.
|
|
Returns the IssuerMatchingPolicy in effect.
|
|
Gets the metadata for the role the issuer is operating in.
|
|
Returns the message identifier as determined by the registered policies.
|
|
Returns the locked MetadataProvider supplied to the policy.
|
|
Returns a reference to a MetadataProvider::Criteria instance suitable for use with the installed MetadataProvider. The object will be cleared/reset when returned, so do not mutate it and then call the method again before using it.
|
|
Returns the peer role element/type supplied to the policy.
|
|
Gets a mutable array of installed policy rules. If adding rules, their lifetime must be at least as long as the policy object.
|
|
Gets the effective time of message processing.
|
|
Returns the TrustEngine supplied to the policy.
|
|
Returns XML message validation setting.
|
|
Returns the authentication status of the message as determined by the registered policies.
|
|
Sets flag controlling non-entity issuer support.
|
|
Returns flag controlling non-entity issuer support.
|
|
Resets the policy object and/or clears any per-message state. Resets can be complete (the default) or merely clear the previous message ID and timestamp when evaluating multiple layers of a message.
Reimplemented in opensaml::saml2::SAML2AssertionPolicy. |
|
Sets the authentication status of the message as determined by the registered policies.
|
|
Sets the message identifier to which the message being evaluated is a response.
|
|
Sets the message timestamp as determined by the registered policies.
|
|
Sets the issuer of the message as determined by the registered policies.
|
|
Sets the issuer of the message as determined by the registered policies.
|
|
Sets the IssuerMatchingPolicy in effect. Setting no policy will cause the simple, default approach to be used. The matching object will be freed by the SecurityPolicy.
|
|
Sets the metadata for the role the issuer is operating in.
|
|
Sets the message identifier as determined by the registered policies.
|
|
Sets a locked MetadataProvider for the policy.
|
|
Sets a MetadataProvider::Criteria instance suitable for use with the installed MetadataProvider. The policy will take ownership of the criteria object when this method completes.
|
|
Sets a peer role element/type for to the policy.
|
|
Sets effective time of message processing. Assumed to be the time of policy instantiation, can be adjusted to pre- or post-date message processing.
|
|
Sets a TrustEngine for the policy.
|
|
Controls schema validation of incoming XML messages. This is separate from other forms of programmatic validation of objects, but can detect a much wider range of syntax errors.
|