| | | 1 | | // // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using Confluent.Kafka; |
| | | 6 | | |
| | | 7 | | namespace CoreWCF.Channels; |
| | | 8 | | |
| | | 9 | | public sealed class KafkaTransportSecurity |
| | | 10 | | { |
| | | 11 | | private KafkaCredentialType _credentialType = KafkaCredentialType.None; |
| | | 12 | | |
| | | 13 | | public KafkaTransportSecurity() |
| | | 14 | | { |
| | | 15 | | |
| | | 16 | | } |
| | | 17 | | |
| | | 18 | | public KafkaCredentialType CredentialType |
| | | 19 | | { |
| | | 20 | | get => _credentialType; |
| | | 21 | | set |
| | | 22 | | { |
| | | 23 | | if (!KafkaCredentialTypeHelper.IsDefined(value)) |
| | | 24 | | { |
| | | 25 | | throw new ArgumentOutOfRangeException(nameof(value)); |
| | | 26 | | } |
| | | 27 | | |
| | | 28 | | if (!KafkaCredentialTypeHelper.IsSupported(value)) |
| | | 29 | | { |
| | | 30 | | throw new ArgumentException(SR.InvalidCredentialType); |
| | | 31 | | } |
| | | 32 | | |
| | | 33 | | _credentialType = value; |
| | | 34 | | } |
| | | 35 | | } |
| | | 36 | | |
| | | 37 | | internal void ConfigureTransportSecurityWithClientAuthentication(KafkaTransportBindingElement bindingElement) |
| | | 38 | | { |
| | | 39 | | if (_credentialType == KafkaCredentialType.None) |
| | | 40 | | { |
| | | 41 | | bindingElement.SecurityProtocol ??= SecurityProtocol.Ssl; |
| | | 42 | | bindingElement.SslCaPem ??= CaPem; |
| | | 43 | | } |
| | | 44 | | |
| | | 45 | | if (_credentialType == KafkaCredentialType.SslKeyPairCertificate) |
| | | 46 | | { |
| | | 47 | | if (SslKeyPairCredential is null) |
| | | 48 | | { |
| | | 49 | | throw new NotSupportedException(SR.MissingSslKeyPairCredential); |
| | | 50 | | } |
| | | 51 | | |
| | | 52 | | bindingElement.SecurityProtocol ??= SecurityProtocol.Ssl; |
| | | 53 | | bindingElement.SslCaPem ??= CaPem; |
| | | 54 | | bindingElement.SslKeyPem ??= SslKeyPairCredential.SslKeyPem; |
| | | 55 | | bindingElement.SslKeyPassword ??= SslKeyPairCredential.SslKeyPassword; |
| | | 56 | | bindingElement.SslCertificatePem ??= SslKeyPairCredential.SslCertificatePem; |
| | | 57 | | |
| | | 58 | | } |
| | | 59 | | |
| | | 60 | | if (_credentialType == KafkaCredentialType.SaslPlain) |
| | | 61 | | { |
| | | 62 | | if (SaslUsernamePasswordCredential is null) |
| | | 63 | | { |
| | | 64 | | throw new NotSupportedException(SR.MissingSaslUsernamePasswordCredential); |
| | | 65 | | } |
| | | 66 | | |
| | | 67 | | bindingElement.SslCaPem ??= CaPem; |
| | | 68 | | bindingElement.SaslMechanism ??= SaslMechanism.Plain; |
| | | 69 | | bindingElement.SecurityProtocol ??= SecurityProtocol.SaslSsl; |
| | | 70 | | bindingElement.SaslUsername ??= SaslUsernamePasswordCredential.SaslUsername; |
| | | 71 | | bindingElement.SaslPassword ??= SaslUsernamePasswordCredential.SaslPassword; |
| | | 72 | | } |
| | | 73 | | |
| | | 74 | | // TODO maps other transport security mechanism provided by Confluent.Kafka once requested. (Gssapi, Scram, OAut |
| | | 75 | | } |
| | | 76 | | |
| | | 77 | | internal void ConfigureClientAuthenticationOnly(KafkaTransportBindingElement bindingElement) |
| | | 78 | | { |
| | | 79 | | if (_credentialType == KafkaCredentialType.SaslPlain) |
| | | 80 | | { |
| | | 81 | | if (SaslUsernamePasswordCredential is null) |
| | | 82 | | { |
| | | 83 | | throw new NotSupportedException(SR.MissingSaslUsernamePasswordCredential); |
| | | 84 | | } |
| | | 85 | | |
| | | 86 | | bindingElement.SecurityProtocol ??= SecurityProtocol.SaslPlaintext; |
| | | 87 | | bindingElement.SaslMechanism ??= SaslMechanism.Plain; |
| | | 88 | | bindingElement.SaslUsername ??= SaslUsernamePasswordCredential.SaslUsername; |
| | | 89 | | bindingElement.SaslPassword ??= SaslUsernamePasswordCredential.SaslPassword; |
| | | 90 | | } |
| | | 91 | | |
| | | 92 | | // TODO maps other transport security mechanism provided by Confluent.Kafka once requested. (Gssapi, Scram, OAut |
| | | 93 | | } |
| | | 94 | | |
| | | 95 | | internal void ConfigureNoTransportSecurity(KafkaTransportBindingElement bindingElement) |
| | | 96 | | { |
| | | 97 | | bindingElement.SecurityProtocol ??= SecurityProtocol.Plaintext; |
| | | 98 | | } |
| | | 99 | | |
| | | 100 | | public string CaPem { get; set; } |
| | | 101 | | |
| | | 102 | | public SaslUsernamePasswordCredential SaslUsernamePasswordCredential { get; set; } |
| | | 103 | | |
| | | 104 | | public SslKeyPairCredential SslKeyPairCredential { get; set; } |
| | | 105 | | } |
| | | 106 | | |
| | | 107 | | public class SaslUsernamePasswordCredential |
| | | 108 | | { |
| | | 109 | | public SaslUsernamePasswordCredential(string saslUsername, string saslPassword) |
| | | 110 | | { |
| | | 111 | | SaslUsername = saslUsername; |
| | | 112 | | SaslPassword = saslPassword; |
| | | 113 | | } |
| | | 114 | | |
| | | 115 | | public string SaslUsername { get; } |
| | | 116 | | public string SaslPassword { get; } |
| | | 117 | | } |
| | | 118 | | |
| | | 119 | | public class SslKeyPairCredential |
| | | 120 | | { |
| | 4 | 121 | | public string SslCertificatePem { get; set; } |
| | 4 | 122 | | public string SslKeyPem { get; set; } |
| | 4 | 123 | | public string SslKeyPassword { get; set; } |
| | | 124 | | } |