view release on metacpan or  search on metacpan

lib/Authen/NZRealMe/ICMSResolutionRequest.pm  view on Meta::CPAN

    my $x = XML::Generator->new(
        escape => 'unescaped',  # So we can insert other document bits usefully
    );

    my $soap_request = $x->Envelope($ns_soap,
        $x->Header($ns_soap,
            $x->Action( [@$ns_wsa, @$ns_wsu], {'wsu:Id' => $part_id{Action}}, $method_data->{operation}),
            $x->MessageID( [@$ns_wsa, @$ns_wsu], {'wsu:Id' => $part_id{MessageID}}, $self->request_id),
            $x->To( [@$ns_wsa, @$ns_wsu], {'wsu:Id' => $part_id{To}}, $method_data->{url}),
            $x->ReplyTo( [@$ns_wsa, @$ns_wsu], {'wsu:Id' => $part_id{ReplyTo}},
                $x->Address( $ns_wsa, $wsa_anon ),
            ),
            $x->Security( [@$ns_wsse, @$ns_wsu], {'soap:mustUnderstand' => 'true'},  # Populated by signing method
                $x->Timestamp( $ns_wsu, {'wsu:Id' => $part_id{Timestamp}},
                    $x->Created ( $ns_wsu, strftime "%FT%TZ", gmtime() ),
                    $x->Expires ( $ns_wsu, strftime "%FT%TZ", gmtime( time() + 300) ),
                ),
            )
        ),
        $x->Body($ns_soap, {'wsu:Id' => $part_id{Body}},
            $x->RequestSecurityToken($ns_wst,
                $x->RequestType( $ns_wst, $wst_validate ),
                $x->TokenType( $ns_wst, $wss_saml2 ),
                $x->ValidateTarget( $ns_wst, \$self->icms_token ),
                $x->AllowCreateFLT( $ns_icms),
            ),
        ),
    ) . "";

    my @refs = map {
        my $ref = { ref_id => $_->{id} };
        $ref->{namespaces} = $_->{namespaces} if $_->{namespaces};
        $ref;
    } @signed_parts;
    $soap_request = $self->_sign_xml( $soap_request, \@refs );

    $self->{request_data} = $soap_request;
    return $soap_request;
}

sub _sign_xml {
    my($self, $xml, $refs) = @_;

    # Just ask the signer to return the signature block
    my $signer = $self->_signer;
    my $sig_xml = $signer->sign(
        $xml,
        undef,    # refs in options
        return_signature_xml    => 1,
        references              => $refs,
        reference_transforms    => [ 'ec14n' ],
        reference_digest_method => 'sha256',
        namespaces              => [ @$ns_soap ],
    );

    my $parser = XML::LibXML->new();
    my $doc    = $parser->parse_string($xml);
    my $xc     = XML::LibXML::XPathContext->new($doc->documentElement);
    $xc->registerNs( @$_ ) foreach @all_ns;

    my $sig_frag = $parser->parse_string($sig_xml)->documentElement();
    $sig_frag->{Id} = 'SIG-4';  # Add Id attr for backwards compatibility

    # Generate a cert fingerprint and append to the signature block
    my $x509 = Crypt::OpenSSL::X509->new_from_string($signer->pub_cert_text);
    my $fingerprint = $x509->fingerprint_sha1() =~ s/://gr;
    my $fingerprint_sha1 = encode_base64(pack("H*", $fingerprint), '');

    my $x = XML::Generator->new();
    my $keyinfo_block = $x->KeyInfo( $ns_ds, { Id => "KI-${fingerprint}1" },
        $x->SecurityTokenReference( $ns_wsse, { Id => "STR-${fingerprint}2" },
            $x->KeyIdentifier( $ns_wsse, { EncodingType => URI('wss_b64'), ValueType => URI('wss_sha1') },
                $fingerprint_sha1,
            ),
        ),
    ).'';
    my $x509_frag = $parser->parse_string($keyinfo_block)->documentElement();
    $sig_frag->appendChild($x509_frag);

    # Insert signature block as last element in soap:Header/wsse:Security section
    my($sec_node) = $xc->findnodes("/soap:Envelope/soap:Header/wsse:Security");
    $sec_node->appendChild($sig_frag);
    return $doc->toString(0);
}


1;

__END__

=head1 NAME

Authen::NZRealMe::ICMSResolutionRequest - Generate a WS-Trust request
for resolving an opaque token to a RealMe FLT.

=head1 DESCRIPTION

This package is used by the L<Authen::NZRealMe::ServiceProvider> to generate a
properly formatted WS-Trust Request containing an opaque token to
resolve to an FLT.

=head1 METHODS

=head2 new

Constructor.  Should not be called directly.  Instead, call the
C<resolve_artifact> method on the service provider with the 'resolve_flt'
option set to a true value.

=head2 icms_token

Accessor method to return the XML opaque token string as provided by the
assertion service

=head2 request_id

Accessor for the generated unique ID for this request.

=head2 request_data

Accessor for the entity ID of the Service Provider which generated the request.

=head2 request_time

Accessor for the request creation time formatted as an ISO date/time string.

=head2 destination_url

Accessor for the URL of the FLT resolution service, to which this request
will be sent.

=head2 request_data

Accessor for the XML document which will be sent as a SOAP request to the
context mapping service (ICMS).


=head1 SEE ALSO

See L<Authen::NZRealMe> for documentation index.