func acsService(w http.ResponseWriter, r *http.Request) (err error) {
defer r.Body.Close()
birk, err := r.Cookie("BIRK")
if err != nil {
return err
}
// to-do: check hmac
// we checked the request when we received in birkService - we can use it without fear
request, err := gosaml.DecodeSAMLMsg(birk.Value, true)
sp_md, err := hub_ops.MDQ(request.Query1(nil, "/samlp:AuthnRequest/saml:Issuer"))
// spmd, _, err := edugain.MDQ(request.Query1(nil, "/samlp:AuthnRequest/saml:Issuer"))
//http.SetCookie(w, &http.Cookie{Name: "BIRK", Value: "", MaxAge: -1, Domain: config["HYBRID_DOMAIN"], Path: "/", Secure: true, HttpOnly: true})
response, idp_md, _, err := gosaml.GetSAMLMsg(r, "SAMLResponse", hub_ops, hub, hubmd)
if err != nil {
return
}
hub_md := gosaml.NewXp(Wayfrequestedattributes)
err = WayfAttributeHandler(idp_md, hub_md, sp_md, response)
if err != nil {
return
}
birkmd, err := edugain.MDQ(request.Query1(nil, "@Destination"))
nameid := response.Query(nil, "./saml:Assertion/saml:Subject/saml:NameID")[0]
// respect nameID in req, give persistent id + all computed attributes + nameformat conversion
nameidformat := sp_md.Query1(nil, "./md:SPSSODescriptor/md:NameIDFormat")
if nameidformat == persistent {
response.QueryDashP(nameid, "@Format", persistent, nil)
eptid := response.Query1(nil, `./saml:Assertion/saml:AttributeStatement/saml:Attribute[@FriendlyName="eduPersonTargetedID"]/saml:AttributeValue`)
response.QueryDashP(nameid, ".", eptid, nil)
} else if nameidformat == transient {
response.QueryDashP(nameid, ".", gosaml.Id(), nil)
}
newresponse := gosaml.NewResponse(stdtiming.Refresh(), birkmd, sp_md, request, response)
for _, q := range elementsToSign {
err = gosaml.SignResponse(newresponse, q, birkmd)
if err != nil {
return
}
}
// when consent as a service is ready - we will post to that
acs := newresponse.Query1(nil, "@Destination")
data := formdata{Acs: acs, Samlresponse: base64.StdEncoding.EncodeToString([]byte(newresponse.X2s()))}
postform.Execute(w, data)
return
}
func kribService(w http.ResponseWriter, r *http.Request) (err error) {
defer r.Body.Close()
response, _, _, err := gosaml.GetSAMLMsg(r, "SAMLResponse", edugain, edugain, nil)
if err != nil {
return
}
destination := debify.ReplaceAllString(response.Query1(nil, "@Destination"), "$1$2")
response.QueryDashP(nil, "@Destination", destination, nil)
response.QueryDashP(nil, "./saml:Assertion/saml:Subject/saml:SubjectConfirmation/saml:SubjectConfirmationData/@Recipient", destination, nil)
issuer := config["HYBRID_HUB"]
response.QueryDashP(nil, "./saml:Issuer", issuer, nil)
response.QueryDashP(nil, "./saml:Assertion/saml:Issuer", issuer, nil)
// Krib always receives attributes with nameformat=urn. Before sending to the real SP we need to look into
// the metadata for SP to determine the actual nameformat - as WAYF supports both for internal SPs.
mdsp, err := hub_ops.MDQ(destination)
if err != nil {
return
}
requestedattributes := mdsp.Query(nil, "./md:SPSSODescriptor/md:AttributeConsumingService/md:RequestedAttribute")
attributestatement := response.Query(nil, "./saml:Assertion/saml:AttributeStatement")[0]
for _, attr := range requestedattributes {
if attr.GetAttr("NameFormat") == basic {
basicname := attr.GetAttr("Name")
uriname := basic2uri[basicname]
responseattribute := response.Query(attributestatement, "saml:Attribute[@Name='"+uriname+"']")
if len(responseattribute) > 0 {
responseattribute[0].SetAttr("Name", basicname)
responseattribute[0].SetAttr("NameFormat", basic)
}
}
}
mdhub, err := hub.MDQ(config["HYBRID_HUB"])
if err != nil {
return
}
for _, q := range elementsToSign {
err = gosaml.SignResponse(response, q, mdhub)
if err != nil {
return
}
}
data := formdata{Acs: destination, Samlresponse: base64.StdEncoding.EncodeToString([]byte(response.X2s()))}
postform.Execute(w, data)
return
}