/*
* @copyright
* Copyright © Microsoft Open Technologies, Inc.
*
* All Rights Reserved
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http: *www.apache.org/licenses/LICENSE-2.0
*
* THIS CODE IS PROVIDED *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS
* OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
* ANY IMPLIED WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A
* PARTICULAR PURPOSE, MERCHANTABILITY OR NON-INFRINGEMENT.
*
* See the Apache License, Version 2.0 for the specific language
* governing permissions and limitations under the License.
*/
'use strict';
var xmldom = require('xmldom');
var xmlutil = require('./xmlutil');
var Logger = require('./log').Logger;
var select = xmlutil.xpathSelect;
var DOMParser = xmldom.DOMParser;
// A regular expression for finding the SAML Assertion in an RSTR. Used to remove the SAML
// assertion when logging the RSTR.
var assertionRegEx = /RequestedSecurityToken.*?((<.*?:Assertion.*?>).*<\/.*?Assertion>).*?/;
/**
* Creates a log message that contains the RSTR scrubbed of the actual SAML assertion.
* @private
* @return {string} A log message.
*/
function scrubRSTRLogMessage(RSTR) {
var scrubbedRSTR = null;
var singleLineRSTR = RSTR.replace(/(\r\n|\n|\r)/gm,'');
var matchResult = assertionRegEx.exec(singleLineRSTR);
Iif (null === matchResult) {
// No Assertion was matched so just return the RSTR as is.
scrubbedRSTR = singleLineRSTR;
} else {
var samlAssertion = matchResult[1];
var samlAssertionStartTag = matchResult[2];
scrubbedRSTR = singleLineRSTR.replace(samlAssertion, samlAssertionStartTag + 'ASSERTION CONTENTS REDACTED</saml:Assertion>');
}
return 'RSTR Response: ' + scrubbedRSTR;
}
/**
* Creates a new WSTrustResponse instance.
* @constructor
* @private
* @param {object} callContext Contains any context information that applies to the request.
* @param {string} response A soap response from a WS-Trust request.
*/
function WSTrustResponse(callContext, response) {
this._log = new Logger('WSTrustResponse', callContext._logContext);
this._callContext = callContext;
this._response = response;
this._dom = null;
this._errorCode = null;
this._faultMessage = null;
this._tokenType = null;
this._token = null;
this._log.verbose(function(){return scrubRSTRLogMessage(response);});
}
/**
* If the soap response contained a soap fault then this property will contain the fault
* error code. Otherwise it will return null
* @instance
* @type {string}
* @memberOf WSTrustResponse
* @name errorCode
*/
Object.defineProperty(WSTrustResponse.prototype, 'errorCode', {
get: function() {
return this._errorCode;
}
});
/**
* @property {string} FaultMessage If the soap resopnse contained a soap fault with a fault message then it will
* be returned by this property.
* @instance
* @type {string}
* @memberOf WSTrustResponse
* @name faultMessage
*/
Object.defineProperty(WSTrustResponse.prototype, 'faultMessage', {
get: function() {
return this._faultMessage;
}
});
/**
* @property {string} TokenType If the soap resonse contained a token then this property will contain
* the token type uri
* @instance
* @type {string}
* @memberOf WSTrustResponse
* @name tokenType
*/
Object.defineProperty(WSTrustResponse.prototype, 'tokenType', {
get: function() {
return this._tokenType;
}
});
/**
* @property {string} Token If the soap response contained a token then this property will hold that token.
* @instance
* @type {string}
* @memberOf WSTrustResponse
* @name token
*/
Object.defineProperty(WSTrustResponse.prototype, 'token', {
get: function() {
return this._token;
}
});
// Sample error message
//<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
// <s:Header>
// <a:Action s:mustUnderstand="1">http://www.w3.org/2005/08/addressing/soap/fault</a:Action>
// - <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
// <u:Timestamp u:Id="_0">
// <u:Created>2013-07-30T00:32:21.989Z</u:Created>
// <u:Expires>2013-07-30T00:37:21.989Z</u:Expires>
// </u:Timestamp>
// </o:Security>
// </s:Header>
// <s:Body>
// <s:Fault>
// <s:Code>
// <s:Value>s:Sender</s:Value>
// <s:Subcode>
// <s:Value xmlns:a="http://docs.oasis-open.org/ws-sx/ws-trust/200512">a:RequestFailed</s:Value>
// </s:Subcode>
// </s:Code>
// <s:Reason>
// <s:Text xml:lang="en-US">MSIS3127: The specified request failed.</s:Text>
// </s:Reason>
// </s:Fault>
// </s:Body>
//</s:Envelope>
/**
* Attempts to parse an error from the soap response. If there is one then it
* will fill in the error related properties. Otherwsie it will do nothing.
* @private
* @returns {bool} true if an error was found and parsed in the response.
*/
WSTrustResponse.prototype._parseError = function() {
var errorFound = false;
var faultNode = select(this._dom, '//s:Envelope/s:Body/s:Fault/s:Reason');
if (faultNode.length) {
this._faultMessage = xmlutil.serializeNodeChildren(faultNode[0]);
Eif (this._faultMessage) {
errorFound = true;
}
}
// Subcode has minoccurs=0 and maxoccurs=1(default) according to the http://www.w3.org/2003/05/soap-envelope
// Subcode may have another subcode as well. This is only targetting at top level subcode.
// Subcode value may have different messages not always uses http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd.
// text inside the value is not possible to select without prefix, so substring is necessary
var subcodeNode = select(this._dom, '//s:Envelope/s:Body/s:Fault/s:Code/s:Subcode/s:Value');
Iif (1 < subcodeNode.length) {
throw this._log.createError('Found too many fault code values:' + subcodeNode.length);
}
if (subcodeNode.length) {
var errorCode = subcodeNode[0].firstChild.data;
this._errorCode = (errorCode.split(':'))[1];
errorFound = true;
}
return errorFound;
};
/**
* Attempts to parse a token from the soap response. If there is one then it will fill in the
* token related properties. Otherwise it does nothing.
* @private
* @throws {Error} If the response is not parseable, or too many tokens are found.
*/
WSTrustResponse.prototype._parseToken = function() {
var tokenTypeNodes = select(this._dom, '//s:Envelope/s:Body/wst:RequestSecurityTokenResponseCollection/wst:RequestSecurityTokenResponse/wst:TokenType');
if (!tokenTypeNodes.length) {
this._log.warn('No TokenType elements found in RSTR');
}
for (var i = 0, length = tokenTypeNodes.length; i < length; i++) {
Iif (this._token) {
this._log.warn('Found more than one returned token. Using the first.');
break;
}
var tokenTypeNode = tokenTypeNodes[i];
var tokenType = xmlutil.findElementText(tokenTypeNode);
Iif (!tokenType) {
this._log.warn('Could not find token type in RSTR token');
}
var requestedTokenNode = select(tokenTypeNode.parentNode, 'wst:RequestedSecurityToken');
Iif (1 < requestedTokenNode) {
throw this._log.createError('Found too many RequestedSecurityToken nodes for token type: ' + tokenType);
}
Iif (!requestedTokenNode.length) {
this._log.warn('Unable to find RequestsSecurityToken element associated with TokenType element: ' + tokenType);
continue;
}
var token = xmlutil.serializeNodeChildren(requestedTokenNode[0]);
Iif (!token) {
this._log.warn('Unable to find token associated with TokenType element: ' + tokenType);
continue;
}
this._token = token;
this._tokenType = tokenType;
this._log.info('Found token of type: ' + this._tokenType);
}
if (!this._token) {
throw this._log.createError('Unable to find any tokens in RSTR.');
}
};
/**
* This method parses the soap response that was passed in at construction.
* @throws {Error} If the server returned an error, or there was any failure to parse the response.
*/
WSTrustResponse.prototype.parse = function() {
if (!this._response) {
throw this._log.createError('Received empty RSTR response body.');
}
try {
try {
var options = {
errorHandler : this._log.error
};
this._dom = new DOMParser(options).parseFromString(this._response);
} catch (err) {
throw this._log.createError('Failed to parse RSTR in to DOM', err);
}
var errorFound = this._parseError();
if (errorFound) {
var stringErrorCode = this.ErrorCode || 'NONE';
var stringFaultMessage = this.FaultMessage || 'NONE';
throw this._log.createError('Server returned error in RSTR - ErrorCode: ' + stringErrorCode + ' : FaultMessage: ' + stringFaultMessage);
}
this._parseToken();
} catch (err) {
delete this._dom;
throw err;
}
};
module.exports = WSTrustResponse; |