class Slh::Models::Site

Attributes

is_key_originator[RW]

This indicates the site is where all other sites get their encryption keys from and where the metadata X509Certificate comes from

name[R]
parent_host[R]
paths[R]
site_id[RW]

site_id is for hosts who’s host_type == :iis

Public Class Methods

new(site_name,parent_host,&block) click to toggle source
# File lib/slh/models/site.rb, line 23
def initialize(site_name,parent_host,&block)
  @parent_host = parent_host
  @name = site_name
  @paths = []
  self.is_key_originator = false
  if block_given?
    self.instance_eval(&block)
  end
  if self.paths.empty?
    raise "No protect statements for site #{site_name}, you must protect at least 1 path for every site.  Adding a \"protect\" statement should make this error go away"
  end
end

Public Instance Methods

config_dir() click to toggle source
# File lib/slh/models/site.rb, line 122
def config_dir
  File.join(self.parent_host.config_dir,self.name.to_s)
end
fetched_metadata_path() click to toggle source
# File lib/slh/models/site.rb, line 126
def fetched_metadata_path
  File.join(self.config_dir,'fetched_metadata.xml')
end
metadata() click to toggle source
# File lib/slh/models/site.rb, line 36
def metadata
  if @metadata.blank?
    url = URI.parse(self.metadata_url)
    http = Net::HTTP.new(url.host, url.port)
    http.use_ssl = true
    http.verify_mode = OpenSSL::SSL::VERIFY_NONE
    http.open_timeout = 5
    http.read_timeout = 5
    begin
      the_metadata_for_site = http.get(url.path)
    rescue
      raise CouldNotGetMetadata.new("Could not https GET #{self.metadata_url}, have you deployed your generated shib config files to this machine and restarted shibd?")
    end
    case the_metadata_for_site
    when Net::HTTPSuccess
      @metadata = the_metadata_for_site.body
    else
      raise CouldNotGetMetadata.new("Got a non-200 http status code (actual=#{the_metadata_for_site.code}) from #{self.metadata_url}")
    end
  end
  @metadata
end
metadata_nokogiri() click to toggle source
# File lib/slh/models/site.rb, line 59
def metadata_nokogiri
  if @metadata_nokogiri.blank?
    @metadata_nokogiri = Nokogiri::XML(self.metadata)
  end
  @metadata_nokogiri
end
metadata_url() click to toggle source
# File lib/slh/models/site.rb, line 66
def metadata_url
  "#{self.to_https_prefixed_name}/Shibboleth.sso/Metadata"
end
protect(site_path, &block) click to toggle source

CORE API METHODS BEGIN #

# File lib/slh/models/site.rb, line 5
def protect(site_path, &block)
  if site_path == '/' && !@paths.empty?
    raise "If you want to protect the entire site, you must specify \"protect '/'\" before all other site path rules"
  end
  @paths << Slh::Models::SitePath.new(site_path, self, &block)
end
to_auth_request_map_directive() click to toggle source

See these for specs wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapPath wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapPathRegex

# File lib/slh/models/site.rb, line 91
  def to_auth_request_map_directive
    common_host_begin = "<Host name=\"#{self.name}\" redirectToSSL=\"443\" applicationId=\"#{self.name}\" "
    host_end = '</Host>'
    path_strings = []
    if self.paths.first.name == '/'
      host_begin = common_host_begin + " #{self.auth_request_map_xml_payload_for_flavor(self.paths.first.flavor)}>"
    else
      host_begin =  common_host_begin + ">" # just close the tag, we all good
    end
    self.paths.each do |p|
      next if p.name == '/' # Already dealt with/baked into the <Host> Xml
      if p.flavor == :authentication_required_for_specific_users
        path_strings << <<-EOS
          <!-- Shibboleths Lil Helper flavor=#{p.flavor} -->
          <Path name="#{p.name}" #{self.auth_request_map_xml_payload_for_flavor(p.flavor)}>
            <AccessControl>
              <Rule require="user">#{p.specific_users.join(' ')}</Rule>
            </AccessControl>
          </Path>
        EOS
      else
        path_strings << "<Path name=\"#{p.name}\" #{self.auth_request_map_xml_payload_for_flavor(p.flavor)} />"
      end
    end
    return "#{host_begin}\n#{path_strings.join("\n")}\n#{host_end}"
  end
to_https_prefixed_name() click to toggle source
# File lib/slh/models/site.rb, line 118
def to_https_prefixed_name
  "https://#{self.name}"
end
x509_certificate_string() click to toggle source

Gets interpolated into the

sp_metadata_for_entity_id_to_give_to_idp.xml.erb # file
# File lib/slh/models/site.rb, line 73
def x509_certificate_string
  t=self.metadata_nokogiri.clone
  t.remove_namespaces!
  the_xpath = "//KeyDescriptor/KeyInfo/X509Data/X509Certificate"
  node = t.xpath(the_xpath)
  if node.blank?
    raise "Could not extract X509Certificate from #{site.name}"
  else
    node.inner_text
  end
end

Protected Instance Methods

auth_request_map_xml_payload_for_flavor(flavor) click to toggle source

Internal helper, used in <RequestMapper> returned strings are interpoleted into <Host> or <Path>

# File lib/slh/models/site.rb, line 134
def auth_request_map_xml_payload_for_flavor(flavor)
  if flavor == :authentication_optional
    'authType="shibboleth" requireSession="false"'
  elsif [:authentication_required,:authentication_required_for_specific_users].include?(flavor)
    'authType="shibboleth" requireSession="true"'
  else 
    raise "No auth_request_map_xml_payload_for_flavor flavor=#{flavor}"
  end
end