| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.Generic; |
| | | 6 | | using System.Collections.ObjectModel; |
| | | 7 | | using System.ComponentModel; |
| | | 8 | | using System.Configuration; |
| | | 9 | | using System.Linq; |
| | | 10 | | using System.Xml; |
| | | 11 | | using CoreWCF.Channels; |
| | | 12 | | using CoreWCF.IdentityModel.Tokens; |
| | | 13 | | using CoreWCF.Runtime; |
| | | 14 | | using CoreWCF.Security; |
| | | 15 | | using CoreWCF.Security.Tokens; |
| | | 16 | | |
| | | 17 | | namespace CoreWCF.Configuration |
| | | 18 | | { |
| | | 19 | | public class SecurityElementBase : BindingElementExtensionElement |
| | | 20 | | { |
| | | 21 | | // if you add another variable, make sure to adjust: CopyFrom and UnMerge methods. |
| | | 22 | | private SecurityBindingElement _failedSecurityBindingElement; |
| | | 23 | | private bool _willX509IssuerReferenceAssertionBeWritten; |
| | | 24 | | private SecurityKeyType _templateKeyType = SecurityBindingDefaults.DefaultKeyType; |
| | | 25 | | |
| | 6 | 26 | | internal SecurityElementBase() |
| | | 27 | | { |
| | 6 | 28 | | } |
| | | 29 | | |
| | 0 | 30 | | internal bool HasImportFailed { get { return _failedSecurityBindingElement != null; } } |
| | | 31 | | |
| | 3 | 32 | | internal bool IsSecurityElementBootstrap { get; set; } // Used in serialization path to optimize Xml representat |
| | | 33 | | |
| | | 34 | | [ConfigurationProperty(ConfigurationStrings.DefaultAlgorithmSuite, DefaultValue = SecurityBindingDefaults.Defaul |
| | | 35 | | [TypeConverter(typeof(SecurityAlgorithmSuiteConverter))] |
| | | 36 | | public SecurityAlgorithmSuite DefaultAlgorithmSuite |
| | | 37 | | { |
| | 1 | 38 | | get { return (SecurityAlgorithmSuite)base[ConfigurationStrings.DefaultAlgorithmSuite]; } |
| | 0 | 39 | | set { base[ConfigurationStrings.DefaultAlgorithmSuite] = value; } |
| | | 40 | | } |
| | | 41 | | |
| | | 42 | | //TODO If AsymmetricSecurityBindingElement is added |
| | | 43 | | //[ConfigurationProperty(ConfigurationStrings.AllowSerializedSigningTokenOnReply, DefaultValue = SecurityBinding |
| | | 44 | | //public bool AllowSerializedSigningTokenOnReply |
| | | 45 | | //{ |
| | | 46 | | // get { return (bool)base[ConfigurationStrings.AllowSerializedSigningTokenOnReply]; } |
| | | 47 | | // set { base[ConfigurationStrings.AllowSerializedSigningTokenOnReply] = value; } |
| | | 48 | | //} |
| | | 49 | | |
| | | 50 | | [ConfigurationProperty(ConfigurationStrings.EnableUnsecuredResponse, DefaultValue = SecurityBindingDefaults.Defa |
| | | 51 | | public bool EnableUnsecuredResponse |
| | | 52 | | { |
| | 1 | 53 | | get { return (bool)base[ConfigurationStrings.EnableUnsecuredResponse]; } |
| | 0 | 54 | | set { base[ConfigurationStrings.EnableUnsecuredResponse] = value; } |
| | | 55 | | } |
| | | 56 | | |
| | | 57 | | [ConfigurationProperty(ConfigurationStrings.AuthenticationMode, DefaultValue = SecurityBindingDefaults.DefaultAu |
| | | 58 | | public AuthenticationMode AuthenticationMode |
| | | 59 | | { |
| | 7 | 60 | | get { return (AuthenticationMode)base[ConfigurationStrings.AuthenticationMode]; } |
| | 0 | 61 | | set { base[ConfigurationStrings.AuthenticationMode] = value; } |
| | | 62 | | } |
| | | 63 | | |
| | | 64 | | public override Type BindingElementType |
| | | 65 | | { |
| | 18 | 66 | | get { return typeof(SecurityBindingElement); } |
| | | 67 | | } |
| | | 68 | | |
| | | 69 | | [ConfigurationProperty(ConfigurationStrings.RequireDerivedKeys, DefaultValue = SecurityBindingDefaults.DefaultRe |
| | | 70 | | public bool RequireDerivedKeys |
| | | 71 | | { |
| | 1 | 72 | | get { return (bool)base[ConfigurationStrings.RequireDerivedKeys]; } |
| | 0 | 73 | | set { base[ConfigurationStrings.RequireDerivedKeys] = value; } |
| | | 74 | | } |
| | | 75 | | |
| | | 76 | | [ConfigurationProperty(ConfigurationStrings.SecurityHeaderLayout, DefaultValue = SecurityBindingDefaults.Default |
| | | 77 | | public SecurityHeaderLayout SecurityHeaderLayout |
| | | 78 | | { |
| | 1 | 79 | | get { return (SecurityHeaderLayout)base[ConfigurationStrings.SecurityHeaderLayout]; } |
| | 0 | 80 | | set { base[ConfigurationStrings.SecurityHeaderLayout] = value; } |
| | | 81 | | } |
| | | 82 | | |
| | | 83 | | [ConfigurationProperty(ConfigurationStrings.IncludeTimestamp, DefaultValue = SecurityBindingDefaults.DefaultIncl |
| | | 84 | | public bool IncludeTimestamp |
| | | 85 | | { |
| | 1 | 86 | | get { return (bool)base[ConfigurationStrings.IncludeTimestamp]; } |
| | 0 | 87 | | set { base[ConfigurationStrings.IncludeTimestamp] = value; } |
| | | 88 | | } |
| | | 89 | | |
| | | 90 | | [ConfigurationProperty(ConfigurationStrings.AllowInsecureTransport, DefaultValue = SecurityBindingDefaults.Defau |
| | | 91 | | public bool AllowInsecureTransport |
| | | 92 | | { |
| | 1 | 93 | | get { return (bool)base[ConfigurationStrings.AllowInsecureTransport]; } |
| | 0 | 94 | | set { base[ConfigurationStrings.AllowInsecureTransport] = value; } |
| | | 95 | | } |
| | | 96 | | |
| | | 97 | | [ConfigurationProperty(ConfigurationStrings.KeyEntropyMode, DefaultValue = SecurityBindingDefaults.DefaultKeyEnt |
| | | 98 | | public SecurityKeyEntropyMode KeyEntropyMode |
| | | 99 | | { |
| | 1 | 100 | | get { return (SecurityKeyEntropyMode)base[ConfigurationStrings.KeyEntropyMode]; } |
| | 0 | 101 | | set { base[ConfigurationStrings.KeyEntropyMode] = value; } |
| | | 102 | | } |
| | | 103 | | |
| | | 104 | | [ConfigurationProperty(ConfigurationStrings.IssuedTokenParameters)] |
| | | 105 | | public IssuedTokenParametersElement IssuedTokenParameters |
| | | 106 | | { |
| | 2 | 107 | | get { return (IssuedTokenParametersElement)base[ConfigurationStrings.IssuedTokenParameters]; } |
| | | 108 | | } |
| | | 109 | | |
| | | 110 | | [ConfigurationProperty(ConfigurationStrings.LocalServiceSettings)] |
| | | 111 | | public LocalServiceSecuritySettingsElement LocalServiceSettings |
| | | 112 | | { |
| | 1 | 113 | | get { return (LocalServiceSecuritySettingsElement)base[ConfigurationStrings.LocalServiceSettings]; } |
| | | 114 | | } |
| | | 115 | | |
| | | 116 | | [ConfigurationProperty(ConfigurationStrings.MessageProtectionOrder, DefaultValue = SecurityBindingDefaults.Defau |
| | | 117 | | public MessageProtectionOrder MessageProtectionOrder |
| | | 118 | | { |
| | 0 | 119 | | get { return (MessageProtectionOrder)base[ConfigurationStrings.MessageProtectionOrder]; } |
| | 0 | 120 | | set { base[ConfigurationStrings.MessageProtectionOrder] = value; } |
| | | 121 | | } |
| | | 122 | | |
| | | 123 | | [ConfigurationProperty(ConfigurationStrings.ProtectTokens, DefaultValue = false)] |
| | | 124 | | public bool ProtectTokens |
| | | 125 | | { |
| | 1 | 126 | | get { return (bool)base[ConfigurationStrings.ProtectTokens]; } |
| | 0 | 127 | | set { base[ConfigurationStrings.ProtectTokens] = value; } |
| | | 128 | | } |
| | | 129 | | |
| | | 130 | | [ConfigurationProperty(ConfigurationStrings.MessageSecurityVersion, DefaultValue = ConfigurationStrings.Default) |
| | | 131 | | [TypeConverter(typeof(MessageSecurityVersionConverter))] |
| | | 132 | | public MessageSecurityVersion MessageSecurityVersion |
| | | 133 | | { |
| | 1 | 134 | | get { return (MessageSecurityVersion)base[ConfigurationStrings.MessageSecurityVersion]; } |
| | 0 | 135 | | set { base[ConfigurationStrings.MessageSecurityVersion] = value; } |
| | | 136 | | } |
| | | 137 | | |
| | | 138 | | [ConfigurationProperty(ConfigurationStrings.RequireSecurityContextCancellation, DefaultValue = SecurityBindingDe |
| | | 139 | | public bool RequireSecurityContextCancellation |
| | | 140 | | { |
| | 2 | 141 | | get { return (bool)base[ConfigurationStrings.RequireSecurityContextCancellation]; } |
| | 0 | 142 | | set { base[ConfigurationStrings.RequireSecurityContextCancellation] = value; } |
| | | 143 | | } |
| | | 144 | | |
| | | 145 | | [ConfigurationProperty(ConfigurationStrings.RequireSignatureConfirmation, DefaultValue = SecurityBindingDefaults |
| | | 146 | | public bool RequireSignatureConfirmation |
| | | 147 | | { |
| | 0 | 148 | | get { return (bool)base[ConfigurationStrings.RequireSignatureConfirmation]; } |
| | 0 | 149 | | set { base[ConfigurationStrings.RequireSignatureConfirmation] = value; } |
| | | 150 | | } |
| | | 151 | | |
| | | 152 | | [ConfigurationProperty(ConfigurationStrings.CanRenewSecurityContextToken, DefaultValue = SecurityBindingDefaults |
| | | 153 | | public bool CanRenewSecurityContextToken |
| | | 154 | | { |
| | 1 | 155 | | get { return (bool)base[ConfigurationStrings.CanRenewSecurityContextToken]; } |
| | 0 | 156 | | set { base[ConfigurationStrings.CanRenewSecurityContextToken] = value; } |
| | | 157 | | } |
| | | 158 | | |
| | | 159 | | public override void ApplyConfiguration(BindingElement bindingElement) |
| | | 160 | | { |
| | 2 | 161 | | base.ApplyConfiguration(bindingElement); |
| | | 162 | | |
| | 2 | 163 | | SecurityBindingElement sbe = (SecurityBindingElement)bindingElement; |
| | | 164 | | |
| | 2 | 165 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.DefaultAlgorithmSuite] |
| | 1 | 166 | | sbe.DefaultAlgorithmSuite = DefaultAlgorithmSuite; |
| | 2 | 167 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.IncludeTimestamp].Valu |
| | 1 | 168 | | sbe.IncludeTimestamp = IncludeTimestamp; |
| | 2 | 169 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.MessageSecurityVersion |
| | 1 | 170 | | sbe.MessageSecurityVersion = MessageSecurityVersion; |
| | 2 | 171 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.KeyEntropyMode].ValueO |
| | 1 | 172 | | sbe.KeyEntropyMode = KeyEntropyMode; |
| | 2 | 173 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.SecurityHeaderLayout]. |
| | 1 | 174 | | sbe.SecurityHeaderLayout = SecurityHeaderLayout; |
| | 2 | 175 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.RequireDerivedKeys].Va |
| | 1 | 176 | | sbe.SetKeyDerivation(RequireDerivedKeys); |
| | 2 | 177 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.AllowInsecureTransport |
| | 1 | 178 | | sbe.AllowInsecureTransport = AllowInsecureTransport; |
| | 2 | 179 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.EnableUnsecuredRespons |
| | 1 | 180 | | sbe.EnableUnsecuredResponse = EnableUnsecuredResponse; |
| | 2 | 181 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.ProtectTokens].ValueOr |
| | 1 | 182 | | sbe.ProtectTokens = ProtectTokens; |
| | | 183 | | |
| | | 184 | | |
| | 2 | 185 | | SymmetricSecurityBindingElement ssbe = sbe as SymmetricSecurityBindingElement; |
| | | 186 | | |
| | 2 | 187 | | if (ssbe != null) |
| | | 188 | | { |
| | 0 | 189 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.MessageProtectionO |
| | 0 | 190 | | ssbe.MessageProtectionOrder = MessageProtectionOrder; |
| | 0 | 191 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.RequireSignatureCo |
| | 0 | 192 | | ssbe.RequireSignatureConfirmation = RequireSignatureConfirmation; |
| | 0 | 193 | | SecureConversationSecurityTokenParameters scParameters = ssbe.ProtectionTokenParameters as SecureConvers |
| | 0 | 194 | | if (scParameters != null) |
| | | 195 | | { |
| | 0 | 196 | | scParameters.CanRenewSession = CanRenewSecurityContextToken; |
| | | 197 | | } |
| | | 198 | | } |
| | | 199 | | |
| | | 200 | | //TODO If AsymmetricSecurityBindingElement is added |
| | | 201 | | //AsymmetricSecurityBindingElement asbe = sbe as AsymmetricSecurityBindingElement; |
| | | 202 | | |
| | | 203 | | //if (asbe != null) |
| | | 204 | | //{ |
| | | 205 | | // if (PropertyValueOrigin.Default != this.ElementInformation.Properties[ConfigurationStrings.MessageProt |
| | | 206 | | // asbe.MessageProtectionOrder = this.MessageProtectionOrder; |
| | | 207 | | // if (PropertyValueOrigin.Default != this.ElementInformation.Properties[ConfigurationStrings.RequireSign |
| | | 208 | | // asbe.RequireSignatureConfirmation = this.RequireSignatureConfirmation; |
| | | 209 | | // if (PropertyValueOrigin.Default != this.ElementInformation.Properties[ConfigurationStrings.AllowSerial |
| | | 210 | | // asbe.AllowSerializedSigningTokenOnReply = this.AllowSerializedSigningTokenOnReply; |
| | | 211 | | //} |
| | | 212 | | |
| | 2 | 213 | | TransportSecurityBindingElement tsbe = sbe as TransportSecurityBindingElement; |
| | | 214 | | |
| | 2 | 215 | | if (tsbe != null) |
| | | 216 | | { |
| | 2 | 217 | | if (tsbe.EndpointSupportingTokenParameters.Endorsing.Count == 1) |
| | | 218 | | { |
| | 2 | 219 | | SecureConversationSecurityTokenParameters scParameters = tsbe.EndpointSupportingTokenParameters.Endo |
| | 2 | 220 | | if (scParameters != null) |
| | | 221 | | { |
| | 1 | 222 | | scParameters.CanRenewSession = CanRenewSecurityContextToken; |
| | | 223 | | } |
| | | 224 | | } |
| | | 225 | | } |
| | | 226 | | |
| | 2 | 227 | | if (PropertyValueOrigin.Default != ElementInformation.Properties[ConfigurationStrings.LocalServiceSettings]. |
| | | 228 | | { |
| | 1 | 229 | | LocalServiceSettings.ApplyConfiguration(sbe.LocalServiceSettings); |
| | | 230 | | } |
| | 2 | 231 | | } |
| | | 232 | | |
| | | 233 | | public override void CopyFrom(ServiceModelExtensionElement from) |
| | | 234 | | { |
| | 0 | 235 | | base.CopyFrom(from); |
| | | 236 | | |
| | 0 | 237 | | SecurityElementBase source = (SecurityElementBase)from; |
| | | 238 | | |
| | | 239 | | //TODO If AsymmetricSecurityBindingElement is added |
| | | 240 | | //if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.AllowSerializ |
| | | 241 | | // this.AllowSerializedSigningTokenOnReply = source.AllowSerializedSigningTokenOnReply; |
| | 0 | 242 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.DefaultAlgorith |
| | 0 | 243 | | DefaultAlgorithmSuite = source.DefaultAlgorithmSuite; |
| | 0 | 244 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.EnableUnsecured |
| | 0 | 245 | | EnableUnsecuredResponse = source.EnableUnsecuredResponse; |
| | 0 | 246 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.AllowInsecureTr |
| | 0 | 247 | | AllowInsecureTransport = source.AllowInsecureTransport; |
| | 0 | 248 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.RequireDerivedK |
| | 0 | 249 | | RequireDerivedKeys = source.RequireDerivedKeys; |
| | 0 | 250 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.IncludeTimestam |
| | 0 | 251 | | IncludeTimestamp = source.IncludeTimestamp; |
| | 0 | 252 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.IssuedTokenPara |
| | 0 | 253 | | this.IssuedTokenParameters.Copy(source.IssuedTokenParameters); |
| | 0 | 254 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.MessageProtecti |
| | 0 | 255 | | MessageProtectionOrder = source.MessageProtectionOrder; |
| | 0 | 256 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.ProtectTokens]. |
| | 0 | 257 | | ProtectTokens = source.ProtectTokens; |
| | 0 | 258 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.MessageSecurity |
| | 0 | 259 | | MessageSecurityVersion = source.MessageSecurityVersion; |
| | 0 | 260 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.RequireSignatur |
| | 0 | 261 | | RequireSignatureConfirmation = source.RequireSignatureConfirmation; |
| | 0 | 262 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.RequireSecurity |
| | 0 | 263 | | RequireSecurityContextCancellation = source.RequireSecurityContextCancellation; |
| | 0 | 264 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.CanRenewSecurit |
| | 0 | 265 | | CanRenewSecurityContextToken = source.CanRenewSecurityContextToken; |
| | 0 | 266 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.KeyEntropyMode] |
| | 0 | 267 | | KeyEntropyMode = source.KeyEntropyMode; |
| | 0 | 268 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.SecurityHeaderL |
| | 0 | 269 | | SecurityHeaderLayout = source.SecurityHeaderLayout; |
| | 0 | 270 | | if (PropertyValueOrigin.Default != source.ElementInformation.Properties[ConfigurationStrings.LocalServiceSet |
| | 0 | 271 | | LocalServiceSettings.CopyFrom(source.LocalServiceSettings); |
| | | 272 | | |
| | 0 | 273 | | _failedSecurityBindingElement = source._failedSecurityBindingElement; |
| | 0 | 274 | | _willX509IssuerReferenceAssertionBeWritten = source._willX509IssuerReferenceAssertionBeWritten; |
| | 0 | 275 | | } |
| | | 276 | | |
| | | 277 | | protected internal override BindingElement CreateBindingElement() |
| | | 278 | | { |
| | 3 | 279 | | return CreateBindingElement(false); |
| | | 280 | | } |
| | | 281 | | |
| | | 282 | | protected internal virtual BindingElement CreateBindingElement(bool createTemplateOnly) |
| | | 283 | | { |
| | | 284 | | SecurityBindingElement result; |
| | 3 | 285 | | switch (AuthenticationMode) |
| | | 286 | | { |
| | | 287 | | //case AuthenticationMode.AnonymousForCertificate: |
| | | 288 | | // result = SecurityBindingElement.CreateAnonymousForCertificateBindingElement(); |
| | | 289 | | // break; |
| | | 290 | | //case AuthenticationMode.AnonymousForSslNegotiated: |
| | | 291 | | // result = SecurityBindingElement.CreateSslNegotiationBindingElement(false, this.RequireSecurityCont |
| | | 292 | | // break; |
| | | 293 | | case AuthenticationMode.CertificateOverTransport: |
| | 0 | 294 | | result = SecurityBindingElement.CreateCertificateOverTransportBindingElement(MessageSecurityVersion) |
| | 0 | 295 | | break; |
| | | 296 | | //case AuthenticationMode.IssuedToken: |
| | | 297 | | // result = SecurityBindingElement.CreateIssuedTokenBindingElement(this.IssuedTokenParameters.Create( |
| | | 298 | | // break; |
| | | 299 | | case AuthenticationMode.IssuedTokenForCertificate: |
| | 2 | 300 | | result = SecurityBindingElement.CreateIssuedTokenForCertificateBindingElement(this.IssuedTokenParame |
| | 0 | 301 | | break; |
| | | 302 | | case AuthenticationMode.IssuedTokenForSslNegotiated: |
| | 0 | 303 | | result = SecurityBindingElement.CreateIssuedTokenForSslBindingElement(this.IssuedTokenParameters.Cre |
| | 0 | 304 | | break; |
| | | 305 | | case AuthenticationMode.IssuedTokenOverTransport: |
| | 0 | 306 | | result = SecurityBindingElement.CreateIssuedTokenOverTransportBindingElement(this.IssuedTokenParamet |
| | 0 | 307 | | break; |
| | | 308 | | //case AuthenticationMode.Kerberos: |
| | | 309 | | // result = SecurityBindingElement.CreateKerberosBindingElement(); |
| | | 310 | | // break; |
| | | 311 | | //case AuthenticationMode.KerberosOverTransport: |
| | | 312 | | // result = SecurityBindingElement.CreateKerberosOverTransportBindingElement(); |
| | | 313 | | // break; |
| | | 314 | | //case AuthenticationMode.MutualCertificateDuplex: |
| | | 315 | | // result = SecurityBindingElement.CreateMutualCertificateDuplexBindingElement(this.MessageSecurityVe |
| | | 316 | | // break; |
| | | 317 | | //case AuthenticationMode.MutualCertificate: |
| | | 318 | | // result = SecurityBindingElement.CreateMutualCertificateBindingElement(this.MessageSecurityVersion) |
| | | 319 | | // break; |
| | | 320 | | //case AuthenticationMode.MutualSslNegotiated: |
| | | 321 | | // result = SecurityBindingElement.CreateSslNegotiationBindingElement(true, this.RequireSecurityConte |
| | | 322 | | // break; |
| | | 323 | | //case AuthenticationMode.SspiNegotiated: |
| | | 324 | | // result = SecurityBindingElement.CreateSspiNegotiationBindingElement(this.RequireSecurityContextCan |
| | | 325 | | // break; |
| | | 326 | | //case AuthenticationMode.UserNameForCertificate: |
| | | 327 | | // result = SecurityBindingElement.CreateUserNameForCertificateBindingElement(); |
| | | 328 | | // break; |
| | | 329 | | //case AuthenticationMode.UserNameForSslNegotiated: |
| | | 330 | | // result = SecurityBindingElement.CreateUserNameForSslBindingElement(this.RequireSecurityContextCanc |
| | | 331 | | // break; |
| | | 332 | | case AuthenticationMode.UserNameOverTransport: |
| | 0 | 333 | | result = SecurityBindingElement.CreateUserNameOverTransportBindingElement(); |
| | 0 | 334 | | break; |
| | | 335 | | case AuthenticationMode.SspiNegotiatedOverTransport: |
| | 1 | 336 | | result = SecurityBindingElement.CreateSspiNegotiationOverTransportBindingElement(RequireSecurityCont |
| | 1 | 337 | | break; |
| | | 338 | | default: |
| | 0 | 339 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidEnumArgumentException(nameof(Au |
| | | 340 | | } |
| | | 341 | | |
| | 1 | 342 | | ApplyConfiguration(result); |
| | | 343 | | |
| | 1 | 344 | | return result; |
| | | 345 | | } |
| | | 346 | | |
| | | 347 | | protected void AddBindingTemplate(Dictionary<AuthenticationMode, SecurityBindingElement> bindingTemplates, Authe |
| | | 348 | | { |
| | 0 | 349 | | AuthenticationMode = mode; |
| | | 350 | | try |
| | | 351 | | { |
| | 0 | 352 | | bindingTemplates[mode] = (SecurityBindingElement)CreateBindingElement(true); |
| | 0 | 353 | | } |
| | | 354 | | catch (Exception e) |
| | | 355 | | { |
| | 0 | 356 | | if (Fx.IsFatal(e)) |
| | | 357 | | { |
| | 0 | 358 | | throw; |
| | | 359 | | } |
| | 0 | 360 | | } |
| | 0 | 361 | | } |
| | | 362 | | |
| | | 363 | | private static bool AreTokenParametersMatching(SecurityTokenParameters p1, SecurityTokenParameters p2, bool skip |
| | | 364 | | { |
| | 0 | 365 | | if (p1 == null || p2 == null) |
| | 0 | 366 | | return false; |
| | | 367 | | |
| | 0 | 368 | | if (p1.GetType() != p2.GetType()) |
| | 0 | 369 | | return false; |
| | | 370 | | |
| | 0 | 371 | | if (p1.InclusionMode != p2.InclusionMode) |
| | 0 | 372 | | return false; |
| | | 373 | | |
| | 0 | 374 | | if (skipRequireDerivedKeysComparison == false && p1.RequireDerivedKeys != p2.RequireDerivedKeys) |
| | 0 | 375 | | return false; |
| | | 376 | | |
| | 0 | 377 | | if (p1.ReferenceStyle != p2.ReferenceStyle) |
| | 0 | 378 | | return false; |
| | | 379 | | |
| | | 380 | | // mutual ssl and anonymous ssl differ in the client cert requirement |
| | 0 | 381 | | if (p1 is SslSecurityTokenParameters) |
| | | 382 | | { |
| | 0 | 383 | | if (((SslSecurityTokenParameters)p1).RequireClientCertificate != ((SslSecurityTokenParameters)p2).Requir |
| | 0 | 384 | | return false; |
| | | 385 | | } |
| | 0 | 386 | | else if (p1 is SecureConversationSecurityTokenParameters) |
| | | 387 | | { |
| | 0 | 388 | | SecureConversationSecurityTokenParameters sc1 = (SecureConversationSecurityTokenParameters)p1; |
| | 0 | 389 | | SecureConversationSecurityTokenParameters sc2 = (SecureConversationSecurityTokenParameters)p2; |
| | | 390 | | |
| | 0 | 391 | | if (sc1.RequireCancellation != sc2.RequireCancellation) |
| | 0 | 392 | | return false; |
| | | 393 | | |
| | 0 | 394 | | if (sc1.CanRenewSession != sc2.CanRenewSession) |
| | 0 | 395 | | return false; |
| | | 396 | | |
| | | 397 | | |
| | 0 | 398 | | if (!AreBindingsMatching(sc1.BootstrapSecurityBindingElement, sc2.BootstrapSecurityBindingElement, exact |
| | 0 | 399 | | return false; |
| | | 400 | | } |
| | 0 | 401 | | else if (p1 is IssuedSecurityTokenParameters) |
| | | 402 | | { |
| | 0 | 403 | | if (((IssuedSecurityTokenParameters)p1).KeyType != ((IssuedSecurityTokenParameters)p2).KeyType) |
| | 0 | 404 | | return false; |
| | | 405 | | } |
| | | 406 | | |
| | 0 | 407 | | return true; |
| | | 408 | | } |
| | | 409 | | |
| | | 410 | | private static bool AreTokenParameterCollectionsMatching(Collection<SecurityTokenParameters> c1, Collection<Secu |
| | | 411 | | { |
| | 0 | 412 | | if (c1.Count != c2.Count) |
| | 0 | 413 | | return false; |
| | | 414 | | |
| | 0 | 415 | | for (int i = 0; i < c1.Count; i++) |
| | 0 | 416 | | if (!AreTokenParametersMatching(c1[i], c2[i], true, exactMessageSecurityVersion)) |
| | 0 | 417 | | return false; |
| | | 418 | | |
| | 0 | 419 | | return true; |
| | | 420 | | } |
| | | 421 | | |
| | | 422 | | internal static bool AreBindingsMatching(SecurityBindingElement b1, SecurityBindingElement b2) |
| | | 423 | | { |
| | 0 | 424 | | return AreBindingsMatching(b1, b2, true); |
| | | 425 | | } |
| | | 426 | | |
| | | 427 | | internal static bool AreBindingsMatching(SecurityBindingElement b1, SecurityBindingElement b2, bool exactMessage |
| | | 428 | | { |
| | 0 | 429 | | if (b1 == null || b2 == null) |
| | 0 | 430 | | return b1 == b2; |
| | | 431 | | |
| | 0 | 432 | | if (b1.GetType() != b2.GetType()) |
| | 0 | 433 | | return false; |
| | | 434 | | |
| | 0 | 435 | | if (b1.MessageSecurityVersion != b2.MessageSecurityVersion) |
| | | 436 | | { |
| | | 437 | | // exactMessageSecurityVersion meant that BSP mismatch could be ignored |
| | 0 | 438 | | if (exactMessageSecurityVersion) |
| | 0 | 439 | | return false; |
| | | 440 | | |
| | 0 | 441 | | if (b1.MessageSecurityVersion.SecurityVersion != b2.MessageSecurityVersion.SecurityVersion |
| | 0 | 442 | | || b1.MessageSecurityVersion.TrustVersion != b2.MessageSecurityVersion.TrustVersion |
| | 0 | 443 | | || b1.MessageSecurityVersion.SecureConversationVersion != b2.MessageSecurityVersion.SecureConversationV |
| | 0 | 444 | | || b1.MessageSecurityVersion.SecurityPolicyVersion != b2.MessageSecurityVersion.SecurityPolicyVersion) |
| | | 445 | | { |
| | 0 | 446 | | return false; |
| | | 447 | | } |
| | | 448 | | } |
| | | 449 | | |
| | 0 | 450 | | if (b1.SecurityHeaderLayout != b2.SecurityHeaderLayout) |
| | 0 | 451 | | return false; |
| | | 452 | | |
| | 0 | 453 | | if (b1.DefaultAlgorithmSuite != b2.DefaultAlgorithmSuite) |
| | 0 | 454 | | return false; |
| | | 455 | | |
| | 0 | 456 | | if (b1.IncludeTimestamp != b2.IncludeTimestamp) |
| | 0 | 457 | | return false; |
| | | 458 | | |
| | 0 | 459 | | if (b1.SecurityHeaderLayout != b2.SecurityHeaderLayout) |
| | 0 | 460 | | return false; |
| | | 461 | | |
| | 0 | 462 | | if (b1.KeyEntropyMode != b2.KeyEntropyMode) |
| | 0 | 463 | | return false; |
| | | 464 | | |
| | 0 | 465 | | if (!AreTokenParameterCollectionsMatching(b1.EndpointSupportingTokenParameters.Endorsing, b2.EndpointSupport |
| | 0 | 466 | | return false; |
| | | 467 | | |
| | 0 | 468 | | if (!AreTokenParameterCollectionsMatching(b1.EndpointSupportingTokenParameters.SignedEncrypted, b2.EndpointS |
| | 0 | 469 | | return false; |
| | | 470 | | |
| | 0 | 471 | | if (!AreTokenParameterCollectionsMatching(b1.EndpointSupportingTokenParameters.Signed, b2.EndpointSupporting |
| | 0 | 472 | | return false; |
| | | 473 | | |
| | 0 | 474 | | if (!AreTokenParameterCollectionsMatching(b1.EndpointSupportingTokenParameters.SignedEndorsing, b2.EndpointS |
| | 0 | 475 | | return false; |
| | | 476 | | |
| | 0 | 477 | | if (b1.OperationSupportingTokenParameters.Count != b2.OperationSupportingTokenParameters.Count) |
| | 0 | 478 | | return false; |
| | | 479 | | |
| | 0 | 480 | | foreach (KeyValuePair<string, SupportingTokenParameters> operation1 in b1.OperationSupportingTokenParameters |
| | | 481 | | { |
| | 0 | 482 | | if (!b2.OperationSupportingTokenParameters.ContainsKey(operation1.Key)) |
| | 0 | 483 | | return false; |
| | | 484 | | |
| | 0 | 485 | | SupportingTokenParameters stp2 = b2.OperationSupportingTokenParameters[operation1.Key]; |
| | | 486 | | |
| | 0 | 487 | | if (!AreTokenParameterCollectionsMatching(operation1.Value.Endorsing, stp2.Endorsing, exactMessageSecuri |
| | 0 | 488 | | return false; |
| | | 489 | | |
| | 0 | 490 | | if (!AreTokenParameterCollectionsMatching(operation1.Value.SignedEncrypted, stp2.SignedEncrypted, exactM |
| | 0 | 491 | | return false; |
| | | 492 | | |
| | 0 | 493 | | if (!AreTokenParameterCollectionsMatching(operation1.Value.Signed, stp2.Signed, exactMessageSecurityVers |
| | 0 | 494 | | return false; |
| | | 495 | | |
| | 0 | 496 | | if (!AreTokenParameterCollectionsMatching(operation1.Value.SignedEndorsing, stp2.SignedEndorsing, exactM |
| | 0 | 497 | | return false; |
| | | 498 | | } |
| | | 499 | | |
| | 0 | 500 | | SymmetricSecurityBindingElement ssbe1 = b1 as SymmetricSecurityBindingElement; |
| | 0 | 501 | | if (ssbe1 != null) |
| | | 502 | | { |
| | 0 | 503 | | SymmetricSecurityBindingElement ssbe2 = (SymmetricSecurityBindingElement)b2; |
| | | 504 | | |
| | 0 | 505 | | if (ssbe1.MessageProtectionOrder != ssbe2.MessageProtectionOrder) |
| | 0 | 506 | | return false; |
| | | 507 | | |
| | 0 | 508 | | if (!AreTokenParametersMatching(ssbe1.ProtectionTokenParameters, ssbe2.ProtectionTokenParameters, false, |
| | 0 | 509 | | return false; |
| | | 510 | | } |
| | | 511 | | |
| | | 512 | | //TODO If AsymmetricKey is supported |
| | | 513 | | //AsymmetricSecurityBindingElement asbe1 = b1 as AsymmetricSecurityBindingElement; |
| | | 514 | | //if (asbe1 != null) |
| | | 515 | | //{ |
| | | 516 | | // AsymmetricSecurityBindingElement asbe2 = (AsymmetricSecurityBindingElement)b2; |
| | | 517 | | |
| | | 518 | | // if (asbe1.MessageProtectionOrder != asbe2.MessageProtectionOrder) |
| | | 519 | | // return false; |
| | | 520 | | |
| | | 521 | | // if (asbe1.RequireSignatureConfirmation != asbe2.RequireSignatureConfirmation) |
| | | 522 | | // return false; |
| | | 523 | | |
| | | 524 | | // if (!AreTokenParametersMatching(asbe1.InitiatorTokenParameters, asbe2.InitiatorTokenParameters, true, |
| | | 525 | | // || !AreTokenParametersMatching(asbe1.RecipientTokenParameters, asbe2.RecipientTokenParameters, tru |
| | | 526 | | // return false; |
| | | 527 | | //} |
| | | 528 | | |
| | 0 | 529 | | return true; |
| | 0 | 530 | | } |
| | | 531 | | |
| | | 532 | | protected virtual void AddBindingTemplates(Dictionary<AuthenticationMode, SecurityBindingElement> bindingTemplat |
| | | 533 | | { |
| | | 534 | | //TODO As Authentication Modes are added |
| | | 535 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.AnonymousForCertificate); |
| | | 536 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.AnonymousForSslNegotiated); |
| | 0 | 537 | | AddBindingTemplate(bindingTemplates, AuthenticationMode.CertificateOverTransport); |
| | | 538 | | //if (_templateKeyType == SecurityKeyType.SymmetricKey) |
| | | 539 | | //{ |
| | | 540 | | // AddBindingTemplate(bindingTemplates, AuthenticationMode.IssuedToken); |
| | | 541 | | //} |
| | | 542 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.IssuedTokenForCertificate); |
| | | 543 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.IssuedTokenForSslNegotiated); |
| | | 544 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.IssuedTokenOverTransport); |
| | | 545 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.Kerberos); |
| | | 546 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.KerberosOverTransport); |
| | | 547 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.MutualCertificate); |
| | | 548 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.MutualCertificateDuplex); |
| | | 549 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.MutualSslNegotiated); |
| | | 550 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.SspiNegotiated); |
| | | 551 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.UserNameForCertificate); |
| | | 552 | | //AddBindingTemplate(bindingTemplates, AuthenticationMode.UserNameForSslNegotiated); |
| | 0 | 553 | | AddBindingTemplate(bindingTemplates, AuthenticationMode.UserNameOverTransport); |
| | 0 | 554 | | AddBindingTemplate(bindingTemplates, AuthenticationMode.SspiNegotiatedOverTransport); |
| | 0 | 555 | | } |
| | | 556 | | |
| | | 557 | | private bool TryInitializeAuthenticationMode(SecurityBindingElement sbe) |
| | | 558 | | { |
| | | 559 | | bool result; |
| | | 560 | | |
| | 0 | 561 | | if (sbe.OperationSupportingTokenParameters.Count > 0) |
| | 0 | 562 | | result = false; |
| | | 563 | | else |
| | | 564 | | { |
| | 0 | 565 | | SetIssuedTokenKeyType(sbe); |
| | | 566 | | |
| | 0 | 567 | | Dictionary<AuthenticationMode, SecurityBindingElement> bindingTemplates = new Dictionary<AuthenticationM |
| | 0 | 568 | | AddBindingTemplates(bindingTemplates); |
| | | 569 | | |
| | 0 | 570 | | result = false; |
| | 0 | 571 | | foreach (AuthenticationMode mode in bindingTemplates.Keys) |
| | | 572 | | { |
| | 0 | 573 | | SecurityBindingElement candidate = bindingTemplates[mode]; |
| | 0 | 574 | | if (AreBindingsMatching(sbe, candidate)) |
| | | 575 | | { |
| | 0 | 576 | | AuthenticationMode = mode; |
| | 0 | 577 | | result = true; |
| | 0 | 578 | | break; |
| | | 579 | | } |
| | | 580 | | } |
| | | 581 | | } |
| | | 582 | | |
| | 0 | 583 | | return result; |
| | | 584 | | } |
| | | 585 | | |
| | | 586 | | private void SetIssuedTokenKeyType(SecurityBindingElement sbe) |
| | | 587 | | { |
| | | 588 | | // Set the keyType for building the template for IssuedToken binding. |
| | | 589 | | // The reason is the different supporting token is defined depending on keyType. |
| | 0 | 590 | | if (sbe.EndpointSupportingTokenParameters.Endorsing.Count > 0 && |
| | 0 | 591 | | sbe.EndpointSupportingTokenParameters.Endorsing[0] is IssuedSecurityTokenParameters) |
| | | 592 | | { |
| | 0 | 593 | | _templateKeyType = ((IssuedSecurityTokenParameters)sbe.EndpointSupportingTokenParameters.Endorsing[0]).K |
| | | 594 | | } |
| | 0 | 595 | | else if (sbe.EndpointSupportingTokenParameters.Signed.Count > 0 && |
| | 0 | 596 | | sbe.EndpointSupportingTokenParameters.Signed[0] is IssuedSecurityTokenParameters) |
| | | 597 | | { |
| | 0 | 598 | | _templateKeyType = ((IssuedSecurityTokenParameters)sbe.EndpointSupportingTokenParameters.Signed[0]).KeyT |
| | | 599 | | } |
| | 0 | 600 | | else if (sbe.EndpointSupportingTokenParameters.SignedEncrypted.Count > 0 && |
| | 0 | 601 | | sbe.EndpointSupportingTokenParameters.SignedEncrypted[0] is IssuedSecurityTokenParameters) |
| | | 602 | | { |
| | 0 | 603 | | _templateKeyType = ((IssuedSecurityTokenParameters)sbe.EndpointSupportingTokenParameters.SignedEncrypted |
| | | 604 | | } |
| | | 605 | | else |
| | | 606 | | { |
| | 0 | 607 | | _templateKeyType = SecurityBindingDefaults.DefaultKeyType; |
| | | 608 | | } |
| | 0 | 609 | | } |
| | | 610 | | |
| | | 611 | | protected virtual void InitializeNestedTokenParameterSettings(SecurityTokenParameters sp, bool initializeNestedB |
| | | 612 | | { |
| | 0 | 613 | | if (sp is SspiSecurityTokenParameters) |
| | 0 | 614 | | SetPropertyValueIfNotDefaultValue(ConfigurationStrings.RequireSecurityContextCancellation, ((SspiSecurit |
| | 0 | 615 | | else if (sp is SslSecurityTokenParameters) |
| | 0 | 616 | | SetPropertyValueIfNotDefaultValue(ConfigurationStrings.RequireSecurityContextCancellation, ((SslSecurity |
| | | 617 | | //TODO: Implement IssuedTokenParameters |
| | | 618 | | //else if (sp is IssuedSecurityTokenParameters) |
| | | 619 | | // this.IssuedTokenParameters.InitializeFrom((IssuedSecurityTokenParameters)sp, initializeNestedBindings) |
| | 0 | 620 | | } |
| | | 621 | | |
| | | 622 | | internal void InitializeFrom(BindingElement bindingElement, bool initializeNestedBindings) |
| | | 623 | | { |
| | 0 | 624 | | if (bindingElement == null) |
| | | 625 | | { |
| | 0 | 626 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(bindingElement)); |
| | | 627 | | } |
| | 0 | 628 | | SecurityBindingElement sbe = (SecurityBindingElement)bindingElement; |
| | | 629 | | |
| | | 630 | | // Can't apply default value optimization to properties like DefaultAlgorithmSuite because the defaults are |
| | 0 | 631 | | DefaultAlgorithmSuite = sbe.DefaultAlgorithmSuite; |
| | 0 | 632 | | IncludeTimestamp = sbe.IncludeTimestamp; |
| | 0 | 633 | | if (sbe.MessageSecurityVersion != MessageSecurityVersion.Default) |
| | | 634 | | { |
| | 0 | 635 | | MessageSecurityVersion = sbe.MessageSecurityVersion; |
| | | 636 | | } |
| | | 637 | | // Still safe to apply the optimization here because the runtime defaults are the same as config defaults in |
| | 0 | 638 | | SetPropertyValueIfNotDefaultValue(ConfigurationStrings.KeyEntropyMode, sbe.KeyEntropyMode); |
| | 0 | 639 | | SetPropertyValueIfNotDefaultValue(ConfigurationStrings.SecurityHeaderLayout, sbe.SecurityHeaderLayout); |
| | 0 | 640 | | SetPropertyValueIfNotDefaultValue(ConfigurationStrings.ProtectTokens, sbe.ProtectTokens); |
| | 0 | 641 | | SetPropertyValueIfNotDefaultValue(ConfigurationStrings.AllowInsecureTransport, sbe.AllowInsecureTransport); |
| | 0 | 642 | | SetPropertyValueIfNotDefaultValue(ConfigurationStrings.EnableUnsecuredResponse, sbe.EnableUnsecuredResponse) |
| | | 643 | | |
| | | 644 | | |
| | 0 | 645 | | bool? requireDerivedKeys = new bool?(); |
| | | 646 | | |
| | 0 | 647 | | if (sbe.EndpointSupportingTokenParameters.Endorsing.Count == 1) |
| | | 648 | | { |
| | 0 | 649 | | InitializeNestedTokenParameterSettings(sbe.EndpointSupportingTokenParameters.Endorsing[0], initializeNes |
| | | 650 | | } |
| | 0 | 651 | | else if (sbe.EndpointSupportingTokenParameters.SignedEncrypted.Count == 1) |
| | | 652 | | { |
| | 0 | 653 | | InitializeNestedTokenParameterSettings(sbe.EndpointSupportingTokenParameters.SignedEncrypted[0], initial |
| | | 654 | | } |
| | 0 | 655 | | else if (sbe.EndpointSupportingTokenParameters.Signed.Count == 1) |
| | | 656 | | { |
| | 0 | 657 | | InitializeNestedTokenParameterSettings(sbe.EndpointSupportingTokenParameters.Signed[0], initializeNested |
| | | 658 | | } |
| | | 659 | | |
| | 0 | 660 | | bool initializationFailure = false; |
| | | 661 | | |
| | 0 | 662 | | foreach (SecurityTokenParameters t in sbe.EndpointSupportingTokenParameters.Endorsing) |
| | | 663 | | { |
| | | 664 | | //if (t.HasAsymmetricKey == false)//TODO If AsymmetricKey is supported |
| | | 665 | | { |
| | 0 | 666 | | if (requireDerivedKeys.HasValue && requireDerivedKeys.Value != t.RequireDerivedKeys) |
| | 0 | 667 | | initializationFailure = true; |
| | | 668 | | else |
| | 0 | 669 | | requireDerivedKeys = t.RequireDerivedKeys; |
| | | 670 | | } |
| | | 671 | | } |
| | | 672 | | |
| | 0 | 673 | | SymmetricSecurityBindingElement ssbe = sbe as SymmetricSecurityBindingElement; |
| | 0 | 674 | | if (ssbe != null) |
| | | 675 | | { |
| | 0 | 676 | | SetPropertyValueIfNotDefaultValue(ConfigurationStrings.MessageProtectionOrder, ssbe.MessageProtectionOrd |
| | 0 | 677 | | RequireSignatureConfirmation = ssbe.RequireSignatureConfirmation; |
| | 0 | 678 | | if (ssbe.ProtectionTokenParameters != null) |
| | | 679 | | { |
| | 0 | 680 | | InitializeNestedTokenParameterSettings(ssbe.ProtectionTokenParameters, initializeNestedBindings); |
| | 0 | 681 | | if (requireDerivedKeys.HasValue && requireDerivedKeys.Value != ssbe.ProtectionTokenParameters.Requir |
| | 0 | 682 | | initializationFailure = true; |
| | | 683 | | else |
| | 0 | 684 | | requireDerivedKeys = ssbe.ProtectionTokenParameters.RequireDerivedKeys; |
| | | 685 | | } |
| | | 686 | | } |
| | | 687 | | else |
| | | 688 | | { |
| | | 689 | | //TODO If AsymmetricKey is supported |
| | | 690 | | //AsymmetricSecurityBindingElement asbe = sbe as AsymmetricSecurityBindingElement; |
| | | 691 | | //if (asbe != null) |
| | | 692 | | //{ |
| | | 693 | | // SetPropertyValueIfNotDefaultValue(ConfigurationStrings.MessageProtectionOrder, asbe.MessageProtect |
| | | 694 | | // this.RequireSignatureConfirmation = asbe.RequireSignatureConfirmation; |
| | | 695 | | // if (asbe.InitiatorTokenParameters != null) |
| | | 696 | | // { |
| | | 697 | | // this.InitializeNestedTokenParameterSettings(asbe.InitiatorTokenParameters, initializeNestedBin |
| | | 698 | | |
| | | 699 | | // // |
| | | 700 | | // // Copy the derived key token bool flag from the token parameters. The token parameter was set |
| | | 701 | | // // importing WSDL during SecurityBindingElementImporter.ImportPolicy time |
| | | 702 | | // // |
| | | 703 | | // if (requireDerivedKeys.HasValue && requireDerivedKeys.Value != asbe.InitiatorTokenParameters.R |
| | | 704 | | // initializationFailure = true; |
| | | 705 | | // else |
| | | 706 | | // requireDerivedKeys = asbe.InitiatorTokenParameters.RequireDerivedKeys; |
| | | 707 | | // } |
| | | 708 | | //} |
| | | 709 | | } |
| | | 710 | | |
| | 0 | 711 | | _willX509IssuerReferenceAssertionBeWritten = DoesSecurityBindingElementContainClauseTypeofIssuerSerial(sbe); |
| | 0 | 712 | | RequireDerivedKeys = requireDerivedKeys.GetValueOrDefault(SecurityBindingDefaults.DefaultRequireDerivedKeys) |
| | 0 | 713 | | LocalServiceSettings.InitializeFrom(sbe.LocalServiceSettings); |
| | | 714 | | |
| | 0 | 715 | | if (!initializationFailure) |
| | 0 | 716 | | initializationFailure = !TryInitializeAuthenticationMode(sbe); |
| | | 717 | | |
| | 0 | 718 | | if (initializationFailure) |
| | 0 | 719 | | _failedSecurityBindingElement = sbe; |
| | 0 | 720 | | } |
| | | 721 | | |
| | | 722 | | protected internal override void InitializeFrom(BindingElement bindingElement) |
| | | 723 | | { |
| | 0 | 724 | | InitializeFrom(bindingElement, true); |
| | 0 | 725 | | } |
| | | 726 | | |
| | | 727 | | /// <summary> |
| | | 728 | | /// returns true if one of the xxxSupportingTokenParameters.yyy is of type IssuerSerial |
| | | 729 | | /// </summary> |
| | | 730 | | /// <param name="sbe"></param> |
| | | 731 | | /// <returns></returns> |
| | | 732 | | private bool DoesSecurityBindingElementContainClauseTypeofIssuerSerial(SecurityBindingElement sbe) |
| | | 733 | | { |
| | 0 | 734 | | if (sbe == null) |
| | 0 | 735 | | return false; |
| | | 736 | | |
| | 0 | 737 | | if (sbe is SymmetricSecurityBindingElement) |
| | | 738 | | { |
| | 0 | 739 | | X509SecurityTokenParameters tokenParamameters = ((SymmetricSecurityBindingElement)sbe).ProtectionTokenPa |
| | 0 | 740 | | if (tokenParamameters != null && tokenParamameters.X509ReferenceStyle == X509KeyIdentifierClauseType.Iss |
| | 0 | 741 | | return true; |
| | | 742 | | } |
| | | 743 | | //TODO if AsymmetricSecurityBindingElement is added |
| | | 744 | | //else if (sbe is AsymmetricSecurityBindingElement) |
| | | 745 | | //{ |
| | | 746 | | // X509SecurityTokenParameters initiatorParamameters = ((AsymmetricSecurityBindingElement)sbe).InitiatorT |
| | | 747 | | // if (initiatorParamameters != null && initiatorParamameters.X509ReferenceStyle == X509KeyIdentifierClau |
| | | 748 | | // return true; |
| | | 749 | | |
| | | 750 | | // X509SecurityTokenParameters recepientParamameters = ((AsymmetricSecurityBindingElement)sbe).RecipientT |
| | | 751 | | // if (recepientParamameters != null && recepientParamameters.X509ReferenceStyle == X509KeyIdentifierClau |
| | | 752 | | // return true; |
| | | 753 | | //} |
| | | 754 | | |
| | 0 | 755 | | if (DoesX509TokenParametersContainClauseTypeofIssuerSerial(sbe.EndpointSupportingTokenParameters.Endorsing)) |
| | 0 | 756 | | return true; |
| | | 757 | | |
| | 0 | 758 | | if (DoesX509TokenParametersContainClauseTypeofIssuerSerial(sbe.EndpointSupportingTokenParameters.Signed)) |
| | 0 | 759 | | return true; |
| | | 760 | | |
| | 0 | 761 | | if (DoesX509TokenParametersContainClauseTypeofIssuerSerial(sbe.EndpointSupportingTokenParameters.SignedEncry |
| | 0 | 762 | | return true; |
| | | 763 | | |
| | 0 | 764 | | if (DoesX509TokenParametersContainClauseTypeofIssuerSerial(sbe.EndpointSupportingTokenParameters.SignedEndor |
| | 0 | 765 | | return true; |
| | | 766 | | |
| | 0 | 767 | | if (DoesX509TokenParametersContainClauseTypeofIssuerSerial(sbe.OptionalEndpointSupportingTokenParameters.End |
| | 0 | 768 | | return true; |
| | | 769 | | |
| | 0 | 770 | | if (DoesX509TokenParametersContainClauseTypeofIssuerSerial(sbe.OptionalEndpointSupportingTokenParameters.Sig |
| | 0 | 771 | | return true; |
| | | 772 | | |
| | 0 | 773 | | if (DoesX509TokenParametersContainClauseTypeofIssuerSerial(sbe.OptionalEndpointSupportingTokenParameters.Sig |
| | 0 | 774 | | return true; |
| | | 775 | | |
| | 0 | 776 | | if (DoesX509TokenParametersContainClauseTypeofIssuerSerial(sbe.OptionalEndpointSupportingTokenParameters.Sig |
| | 0 | 777 | | return true; |
| | | 778 | | |
| | 0 | 779 | | return false; |
| | | 780 | | } |
| | | 781 | | |
| | | 782 | | private bool DoesX509TokenParametersContainClauseTypeofIssuerSerial(Collection<SecurityTokenParameters> tokenPar |
| | | 783 | | { |
| | 0 | 784 | | foreach (SecurityTokenParameters tokenParameter in tokenParameters) |
| | | 785 | | { |
| | 0 | 786 | | X509SecurityTokenParameters x509TokenParameter = tokenParameter as X509SecurityTokenParameters; |
| | 0 | 787 | | if (x509TokenParameter != null) |
| | | 788 | | { |
| | 0 | 789 | | if (x509TokenParameter.X509ReferenceStyle == X509KeyIdentifierClauseType.IssuerSerial) |
| | 0 | 790 | | return true; |
| | | 791 | | } |
| | | 792 | | } |
| | | 793 | | |
| | 0 | 794 | | return false; |
| | 0 | 795 | | } |
| | | 796 | | |
| | | 797 | | protected override bool SerializeToXmlElement(XmlWriter writer, String elementName) |
| | | 798 | | { |
| | | 799 | | bool result; |
| | | 800 | | |
| | 0 | 801 | | if (_failedSecurityBindingElement != null && writer != null) |
| | | 802 | | { |
| | 0 | 803 | | writer.WriteComment(SR.Format(SR.ConfigurationSchemaInsuffientForSecurityBindingElementInstance)); |
| | 0 | 804 | | writer.WriteComment(_failedSecurityBindingElement.ToString()); |
| | 0 | 805 | | result = true; |
| | | 806 | | } |
| | | 807 | | else |
| | | 808 | | { |
| | 0 | 809 | | if (writer != null && _willX509IssuerReferenceAssertionBeWritten) |
| | 0 | 810 | | writer.WriteComment(SR.Format(SR.ConfigurationSchemaContainsX509IssuerSerialReference)); |
| | | 811 | | |
| | 0 | 812 | | result = base.SerializeToXmlElement(writer, elementName); |
| | | 813 | | } |
| | | 814 | | |
| | 0 | 815 | | return result; |
| | | 816 | | } |
| | | 817 | | |
| | | 818 | | protected override bool SerializeElement(XmlWriter writer, bool serializeCollectionKey) |
| | | 819 | | { |
| | 0 | 820 | | bool nontrivial = base.SerializeElement(writer, serializeCollectionKey); |
| | | 821 | | |
| | | 822 | | // A SecurityElement can copy properties from a "bootstrap" SecurityBaseElement. |
| | | 823 | | // In this case, a trivial bootstrap (no properties set) is equivalent to not having one at all so we can om |
| | 0 | 824 | | Func<PropertyInformation, bool> nontrivialProperty = property => property.ValueOrigin == PropertyValueOrigin |
| | 0 | 825 | | if (IsSecurityElementBootstrap && !ElementInformation.Properties.OfType<PropertyInformation>().Any(nontrivia |
| | | 826 | | { |
| | 0 | 827 | | nontrivial = false; |
| | | 828 | | } |
| | 0 | 829 | | return nontrivial; |
| | | 830 | | } |
| | | 831 | | |
| | | 832 | | |
| | | 833 | | protected override void Unmerge(ConfigurationElement sourceElement, ConfigurationElement parentElement, Configur |
| | | 834 | | { |
| | 0 | 835 | | if (sourceElement is SecurityElementBase) |
| | | 836 | | { |
| | 0 | 837 | | _failedSecurityBindingElement = ((SecurityElementBase)sourceElement)._failedSecurityBindingElement; |
| | 0 | 838 | | _willX509IssuerReferenceAssertionBeWritten = ((SecurityElementBase)sourceElement)._willX509IssuerReferen |
| | | 839 | | } |
| | | 840 | | |
| | 0 | 841 | | base.Unmerge(sourceElement, parentElement, saveMode); |
| | 0 | 842 | | } |
| | | 843 | | } |
| | | 844 | | } |