| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using Confluent.Kafka; |
| | | 6 | | |
| | | 7 | | namespace CoreWCF.ServiceModel.Channels; |
| | | 8 | | |
| | | 9 | | public sealed class KafkaTransportSecurity |
| | | 10 | | { |
| | | 11 | | private KafkaCredentialType _credentialType = KafkaCredentialType.None; |
| | | 12 | | |
| | 49 | 13 | | public KafkaTransportSecurity() |
| | | 14 | | { |
| | | 15 | | |
| | 49 | 16 | | } |
| | | 17 | | |
| | | 18 | | public KafkaCredentialType CredentialType |
| | | 19 | | { |
| | 0 | 20 | | get => _credentialType; |
| | | 21 | | set |
| | | 22 | | { |
| | 5 | 23 | | if (!KafkaCredentialTypeHelper.IsDefined(value)) |
| | | 24 | | { |
| | 0 | 25 | | throw new ArgumentOutOfRangeException(nameof(value)); |
| | | 26 | | } |
| | | 27 | | |
| | 5 | 28 | | if (!KafkaCredentialTypeHelper.IsSupported(value)) |
| | | 29 | | { |
| | 0 | 30 | | throw new ArgumentException(SR.InvalidCredentialType); |
| | | 31 | | } |
| | | 32 | | |
| | 5 | 33 | | _credentialType = value; |
| | 5 | 34 | | } |
| | | 35 | | } |
| | | 36 | | |
| | | 37 | | internal void ConfigureTransportSecurityWithClientAuthentication(KafkaTransportBindingElement bindingElement) |
| | | 38 | | { |
| | | 39 | | |
| | 30 | 40 | | if (_credentialType == KafkaCredentialType.None) |
| | | 41 | | { |
| | 10 | 42 | | bindingElement.SecurityProtocol ??= SecurityProtocol.Ssl; |
| | 10 | 43 | | bindingElement.SslCaPem ??= CaPem; |
| | | 44 | | } |
| | | 45 | | |
| | 30 | 46 | | if (_credentialType == KafkaCredentialType.SslKeyPairCertificate) |
| | | 47 | | { |
| | 10 | 48 | | if (SslKeyPairCredential is null) |
| | | 49 | | { |
| | 0 | 50 | | throw new NotSupportedException(SR.MissingSslKeyPairCredential); |
| | | 51 | | } |
| | | 52 | | |
| | 10 | 53 | | bindingElement.SecurityProtocol ??= SecurityProtocol.Ssl; |
| | 10 | 54 | | bindingElement.SslCaPem ??= CaPem; |
| | 10 | 55 | | bindingElement.SslKeyPem ??= SslKeyPairCredential.SslKeyPem; |
| | 10 | 56 | | bindingElement.SslKeyPassword ??= SslKeyPairCredential.SslKeyPassword; |
| | 10 | 57 | | bindingElement.SslCertificatePem ??= SslKeyPairCredential.SslCertificatePem; |
| | | 58 | | |
| | | 59 | | } |
| | | 60 | | |
| | 30 | 61 | | if (_credentialType == KafkaCredentialType.SaslPlain) |
| | | 62 | | { |
| | 10 | 63 | | if (SaslUsernamePasswordCredential is null) |
| | | 64 | | { |
| | 0 | 65 | | throw new NotSupportedException(SR.MissingSaslUsernamePasswordCredential); |
| | | 66 | | } |
| | | 67 | | |
| | 10 | 68 | | bindingElement.SslCaPem ??= CaPem; |
| | 10 | 69 | | bindingElement.SaslMechanism ??= SaslMechanism.Plain; |
| | 10 | 70 | | bindingElement.SecurityProtocol ??= SecurityProtocol.SaslSsl; |
| | 10 | 71 | | bindingElement.SaslUsername ??= SaslUsernamePasswordCredential.SaslUsername; |
| | 10 | 72 | | bindingElement.SaslPassword ??= SaslUsernamePasswordCredential.SaslPassword; |
| | | 73 | | } |
| | | 74 | | |
| | | 75 | | // TODO maps other security mechanism once requested. (Gssapi, Scram, OAuth..) |
| | 30 | 76 | | } |
| | | 77 | | |
| | | 78 | | internal void ConfigureClientAuthenticationOnly(KafkaTransportBindingElement bindingElement) |
| | | 79 | | { |
| | 10 | 80 | | if (_credentialType == KafkaCredentialType.SaslPlain) |
| | | 81 | | { |
| | 10 | 82 | | if (SaslUsernamePasswordCredential is null) |
| | | 83 | | { |
| | 0 | 84 | | throw new NotSupportedException(SR.MissingSaslUsernamePasswordCredential); |
| | | 85 | | } |
| | | 86 | | |
| | 10 | 87 | | bindingElement.SecurityProtocol ??= SecurityProtocol.SaslPlaintext; |
| | 10 | 88 | | bindingElement.SaslMechanism ??= SaslMechanism.Plain; |
| | 10 | 89 | | bindingElement.SaslUsername ??= SaslUsernamePasswordCredential.SaslUsername; |
| | 10 | 90 | | bindingElement.SaslPassword ??= SaslUsernamePasswordCredential.SaslPassword; |
| | | 91 | | } |
| | | 92 | | |
| | | 93 | | // TODO maps other security mechanism once requested. (Gssapi, Scram, OAuth..) |
| | 10 | 94 | | } |
| | | 95 | | |
| | | 96 | | internal void ConfigureNoTransportSecurity(KafkaTransportBindingElement bindingElement) |
| | | 97 | | { |
| | 291 | 98 | | bindingElement.SecurityProtocol ??= SecurityProtocol.Plaintext; |
| | 291 | 99 | | } |
| | | 100 | | |
| | 6 | 101 | | public string CaPem { get; set; } |
| | | 102 | | |
| | 26 | 103 | | public SaslUsernamePasswordCredential SaslUsernamePasswordCredential { get; set; } |
| | | 104 | | |
| | 14 | 105 | | public SslKeyPairCredential SslKeyPairCredential { get; set; } |
| | | 106 | | } |
| | | 107 | | |
| | | 108 | | public class SaslUsernamePasswordCredential |
| | | 109 | | { |
| | | 110 | | public SaslUsernamePasswordCredential(string saslUsername, string saslPassword) |
| | | 111 | | { |
| | | 112 | | SaslUsername = saslUsername; |
| | | 113 | | SaslPassword = saslPassword; |
| | | 114 | | } |
| | | 115 | | |
| | | 116 | | public string SaslUsername { get; } |
| | | 117 | | public string SaslPassword { get; } |
| | | 118 | | } |
| | | 119 | | |
| | | 120 | | public class SslKeyPairCredential |
| | | 121 | | { |
| | | 122 | | public string SslCertificatePem { get; set; } |
| | | 123 | | public string SslKeyPem { get; set; } |
| | | 124 | | public string SslKeyPassword { get; set; } |
| | | 125 | | } |