| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.ObjectModel; |
| | | 6 | | using System.Runtime.CompilerServices; |
| | | 7 | | using System.Xml; |
| | | 8 | | using CoreWCF.Channels; |
| | | 9 | | using CoreWCF.IdentityModel.Tokens; |
| | | 10 | | using CoreWCF.Security.Tokens; |
| | | 11 | | |
| | | 12 | | namespace CoreWCF.Security |
| | | 13 | | { |
| | | 14 | | public sealed class FederatedMessageSecurityOverHttp |
| | | 15 | | { |
| | | 16 | | internal const bool DefaultNegotiateServiceCredential = true; |
| | | 17 | | internal const SecurityKeyType DefaultIssuedKeyType = SecurityKeyType.SymmetricKey; |
| | | 18 | | internal const bool DefaultEstablishSecurityContext = true; |
| | | 19 | | private SecurityAlgorithmSuite _algorithmSuite; |
| | | 20 | | private SecurityKeyType _issuedKeyType; |
| | | 21 | | |
| | 2 | 22 | | public FederatedMessageSecurityOverHttp() |
| | | 23 | | { |
| | 2 | 24 | | NegotiateServiceCredential = DefaultNegotiateServiceCredential; |
| | 2 | 25 | | _algorithmSuite = SecurityAlgorithmSuite.Default; |
| | 2 | 26 | | _issuedKeyType = DefaultIssuedKeyType; |
| | 2 | 27 | | ClaimTypeRequirements = new Collection<ClaimTypeRequirement>(); |
| | 2 | 28 | | TokenRequestParameters = new Collection<XmlElement>(); |
| | 2 | 29 | | EstablishSecurityContext = DefaultEstablishSecurityContext; |
| | 2 | 30 | | } |
| | | 31 | | |
| | 2 | 32 | | public bool NegotiateServiceCredential { get; set; } |
| | | 33 | | |
| | | 34 | | public SecurityAlgorithmSuite AlgorithmSuite |
| | | 35 | | { |
| | 150 | 36 | | get { return _algorithmSuite; } |
| | | 37 | | set |
| | | 38 | | { |
| | 0 | 39 | | _algorithmSuite = value ?? throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(value |
| | 0 | 40 | | } |
| | | 41 | | } |
| | | 42 | | |
| | 104 | 43 | | public bool EstablishSecurityContext { get; set; } |
| | | 44 | | |
| | 50 | 45 | | public EndpointAddress IssuerAddress { get; set; } |
| | | 46 | | |
| | 50 | 47 | | public EndpointAddress IssuerMetadataAddress { get; set; } |
| | | 48 | | |
| | 50 | 49 | | public Binding IssuerBinding { get; set; } |
| | | 50 | | |
| | 50 | 51 | | public string IssuedTokenType { get; set; } |
| | | 52 | | |
| | | 53 | | public SecurityKeyType IssuedKeyType |
| | | 54 | | { |
| | 150 | 55 | | get { return _issuedKeyType; } |
| | | 56 | | set |
| | | 57 | | { |
| | 2 | 58 | | if (!SecurityKeyTypeHelper.IsDefined(value)) |
| | | 59 | | { |
| | 0 | 60 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new System.ArgumentOutOfRangeException(nam |
| | | 61 | | } |
| | 2 | 62 | | _issuedKeyType = value; |
| | 2 | 63 | | } |
| | | 64 | | } |
| | | 65 | | |
| | 50 | 66 | | public Collection<ClaimTypeRequirement> ClaimTypeRequirements { get; } |
| | | 67 | | |
| | 50 | 68 | | public Collection<XmlElement> TokenRequestParameters { get; } |
| | | 69 | | |
| | | 70 | | [MethodImpl(MethodImplOptions.NoInlining)] |
| | | 71 | | public SecurityBindingElement CreateSecurityBindingElement(bool isSecureTransportMode, |
| | | 72 | | bool isReliableSession, |
| | | 73 | | MessageSecurityVersion version) |
| | | 74 | | { |
| | 50 | 75 | | if ((IssuedKeyType == SecurityKeyType.BearerKey) && |
| | 50 | 76 | | (version.TrustVersion == TrustVersion.WSTrustFeb2005)) |
| | | 77 | | { |
| | 0 | 78 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR.Bea |
| | | 79 | | } |
| | | 80 | | |
| | 50 | 81 | | if (isReliableSession && !EstablishSecurityContext) |
| | | 82 | | { |
| | 0 | 83 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR.Sec |
| | | 84 | | } |
| | | 85 | | |
| | | 86 | | SecurityBindingElement result; |
| | 50 | 87 | | bool emitBspAttributes = true; |
| | 50 | 88 | | IssuedSecurityTokenParameters issuedParameters = new IssuedSecurityTokenParameters(IssuedTokenType, IssuerAd |
| | 50 | 89 | | issuedParameters.IssuerMetadataAddress = IssuerMetadataAddress; |
| | 50 | 90 | | issuedParameters.KeyType = IssuedKeyType; |
| | 50 | 91 | | if (IssuedKeyType == SecurityKeyType.SymmetricKey) |
| | | 92 | | { |
| | 0 | 93 | | issuedParameters.KeySize = AlgorithmSuite.DefaultSymmetricKeyLength; |
| | | 94 | | } |
| | | 95 | | else |
| | | 96 | | { |
| | 50 | 97 | | issuedParameters.KeySize = 0; |
| | | 98 | | } |
| | 100 | 99 | | foreach (ClaimTypeRequirement c in ClaimTypeRequirements) |
| | | 100 | | { |
| | 0 | 101 | | issuedParameters.ClaimTypeRequirements.Add(c); |
| | | 102 | | } |
| | 100 | 103 | | foreach (XmlElement p in TokenRequestParameters) |
| | | 104 | | { |
| | 0 | 105 | | issuedParameters.AdditionalRequestParameters.Add(p); |
| | | 106 | | } |
| | 50 | 107 | | WSSecurityTokenSerializer versionSpecificSerializer = new WSSecurityTokenSerializer(version.SecurityVersion, |
| | 50 | 108 | | version.TrustVersion, |
| | 50 | 109 | | version.SecureConversati |
| | 50 | 110 | | emitBspAttributes, |
| | 50 | 111 | | null, null, null); |
| | 50 | 112 | | SecurityStandardsManager versionSpecificStandardsManager = new SecurityStandardsManager(version, versionSpec |
| | 50 | 113 | | issuedParameters.AddAlgorithmParameters(AlgorithmSuite, versionSpecificStandardsManager, _issuedKeyType); |
| | | 114 | | |
| | | 115 | | SecurityBindingElement issuedTokenSecurity; |
| | 50 | 116 | | if (isSecureTransportMode) |
| | | 117 | | { |
| | 50 | 118 | | issuedTokenSecurity = SecurityBindingElement.CreateIssuedTokenOverTransportBindingElement(issuedParamete |
| | | 119 | | } |
| | | 120 | | else |
| | | 121 | | { |
| | 0 | 122 | | if (NegotiateServiceCredential) |
| | | 123 | | { |
| | | 124 | | // We should have passed 'true' as RequireCancelation to be consistent with other standard bindings. |
| | | 125 | | // However, to limit the change for Orcas, we scope down to just newer version of WSSecurityPolicy. |
| | 0 | 126 | | issuedTokenSecurity = SecurityBindingElement.CreateIssuedTokenForSslBindingElement(issuedParameters, |
| | | 127 | | } |
| | | 128 | | else |
| | | 129 | | { |
| | 0 | 130 | | issuedTokenSecurity = SecurityBindingElement.CreateIssuedTokenForCertificateBindingElement(issuedPar |
| | | 131 | | } |
| | | 132 | | } |
| | | 133 | | |
| | 50 | 134 | | issuedTokenSecurity.MessageSecurityVersion = version; |
| | 50 | 135 | | issuedTokenSecurity.DefaultAlgorithmSuite = AlgorithmSuite; |
| | | 136 | | |
| | 50 | 137 | | if (EstablishSecurityContext) |
| | | 138 | | { |
| | 0 | 139 | | result = SecurityBindingElement.CreateSecureConversationBindingElement(issuedTokenSecurity, true); |
| | | 140 | | } |
| | | 141 | | else |
| | | 142 | | { |
| | 50 | 143 | | result = issuedTokenSecurity; |
| | | 144 | | } |
| | | 145 | | |
| | 50 | 146 | | result.MessageSecurityVersion = version; |
| | 50 | 147 | | result.DefaultAlgorithmSuite = AlgorithmSuite; |
| | 50 | 148 | | result.IncludeTimestamp = true; |
| | | 149 | | |
| | 50 | 150 | | if (!isReliableSession) |
| | | 151 | | { |
| | 50 | 152 | | result.LocalServiceSettings.ReconnectTransportOnFailure = false; |
| | | 153 | | } |
| | | 154 | | else |
| | | 155 | | { |
| | 0 | 156 | | result.LocalServiceSettings.ReconnectTransportOnFailure = true; |
| | | 157 | | } |
| | | 158 | | |
| | 50 | 159 | | if (EstablishSecurityContext) |
| | | 160 | | { |
| | | 161 | | // issue the transition SCT for a short duration only |
| | 0 | 162 | | issuedTokenSecurity.LocalServiceSettings.IssuedCookieLifetime = SpnegoTokenAuthenticator.s_defaultServer |
| | | 163 | | } |
| | | 164 | | |
| | 50 | 165 | | return result; |
| | | 166 | | } |
| | | 167 | | |
| | | 168 | | } |
| | | 169 | | } |