| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.ObjectModel; |
| | | 6 | | using System.Globalization; |
| | | 7 | | using System.Text; |
| | | 8 | | using System.Xml; |
| | | 9 | | using CoreWCF.Channels; |
| | | 10 | | using CoreWCF.IdentityModel; |
| | | 11 | | using CoreWCF.IdentityModel.Selectors; |
| | | 12 | | using CoreWCF.IdentityModel.Tokens; |
| | | 13 | | using CoreWCF.Runtime; |
| | | 14 | | |
| | | 15 | | namespace CoreWCF.Security.Tokens |
| | | 16 | | { |
| | | 17 | | public class IssuedSecurityTokenParameters : SecurityTokenParameters |
| | | 18 | | { |
| | | 19 | | private const string WsidPrefix = "wsid"; |
| | | 20 | | private const string WsidNamespace = "http://schemas.xmlsoap.org/ws/2005/05/identity"; |
| | 0 | 21 | | private static readonly string s_wsidPPIClaim = string.Format(CultureInfo.InvariantCulture, "{0}/claims/privatep |
| | | 22 | | internal const SecurityKeyType DefaultKeyType = SecurityKeyType.SymmetricKey; |
| | | 23 | | internal const bool DefaultUseStrTransform = false; |
| | | 24 | | private int _keySize; |
| | | 25 | | private SecurityKeyType _keyType = DefaultKeyType; |
| | | 26 | | |
| | | 27 | | protected IssuedSecurityTokenParameters(IssuedSecurityTokenParameters other) |
| | 70 | 28 | | : base(other) |
| | | 29 | | { |
| | 70 | 30 | | DefaultMessageSecurityVersion = other.DefaultMessageSecurityVersion; |
| | 70 | 31 | | IssuerAddress = other.IssuerAddress; |
| | 70 | 32 | | _keyType = other._keyType; |
| | 70 | 33 | | TokenType = other.TokenType; |
| | 70 | 34 | | _keySize = other._keySize; |
| | 70 | 35 | | UseStrTransform = other.UseStrTransform; |
| | | 36 | | |
| | 420 | 37 | | foreach (XmlElement parameter in other.AdditionalRequestParameters) |
| | | 38 | | { |
| | 140 | 39 | | AdditionalRequestParameters.Add((XmlElement)parameter.Clone()); |
| | | 40 | | } |
| | 140 | 41 | | foreach (ClaimTypeRequirement c in other.ClaimTypeRequirements) |
| | | 42 | | { |
| | 0 | 43 | | ClaimTypeRequirements.Add(c); |
| | | 44 | | } |
| | 70 | 45 | | if (other.IssuerBinding != null) |
| | | 46 | | { |
| | 0 | 47 | | IssuerBinding = new CustomBinding(other.IssuerBinding); |
| | | 48 | | } |
| | 70 | 49 | | IssuerMetadataAddress = other.IssuerMetadataAddress; |
| | 70 | 50 | | } |
| | | 51 | | |
| | | 52 | | public IssuedSecurityTokenParameters() |
| | 2 | 53 | | : this(null, null, null) |
| | | 54 | | { |
| | | 55 | | // empty |
| | 2 | 56 | | } |
| | | 57 | | |
| | | 58 | | public IssuedSecurityTokenParameters(string tokenType) |
| | 0 | 59 | | : this(tokenType, null, null) |
| | | 60 | | { |
| | | 61 | | // empty |
| | 0 | 62 | | } |
| | | 63 | | |
| | | 64 | | public IssuedSecurityTokenParameters(string tokenType, EndpointAddress issuerAddress) |
| | 0 | 65 | | : this(tokenType, issuerAddress, null) |
| | | 66 | | { |
| | | 67 | | // empty |
| | 0 | 68 | | } |
| | | 69 | | |
| | | 70 | | public IssuedSecurityTokenParameters(string tokenType, EndpointAddress issuerAddress, Binding issuerBinding) |
| | 52 | 71 | | : base() |
| | | 72 | | { |
| | 52 | 73 | | TokenType = tokenType; |
| | 52 | 74 | | IssuerAddress = issuerAddress; |
| | 52 | 75 | | IssuerBinding = issuerBinding; |
| | 52 | 76 | | } |
| | | 77 | | |
| | 0 | 78 | | protected internal override bool HasAsymmetricKey { get { return KeyType == SecurityKeyType.AsymmetricKey; } } |
| | | 79 | | |
| | 432 | 80 | | public Collection<XmlElement> AdditionalRequestParameters { get; } = new Collection<XmlElement>(); |
| | | 81 | | |
| | 144 | 82 | | public MessageSecurityVersion DefaultMessageSecurityVersion { get; set; } |
| | | 83 | | |
| | 194 | 84 | | public EndpointAddress IssuerAddress { get; set; } |
| | | 85 | | |
| | 190 | 86 | | public EndpointAddress IssuerMetadataAddress { get; set; } |
| | | 87 | | |
| | 124 | 88 | | public Binding IssuerBinding { get; set; } |
| | | 89 | | |
| | | 90 | | public SecurityKeyType KeyType |
| | | 91 | | { |
| | | 92 | | get |
| | | 93 | | { |
| | 52 | 94 | | return _keyType; |
| | | 95 | | } |
| | | 96 | | set |
| | | 97 | | { |
| | 52 | 98 | | SecurityKeyTypeHelper.Validate(value); |
| | 52 | 99 | | _keyType = value; |
| | 52 | 100 | | } |
| | | 101 | | } |
| | | 102 | | |
| | | 103 | | public int KeySize |
| | | 104 | | { |
| | | 105 | | get |
| | | 106 | | { |
| | 2 | 107 | | return _keySize; |
| | | 108 | | } |
| | | 109 | | set |
| | | 110 | | { |
| | 52 | 111 | | if (value < 0) |
| | | 112 | | { |
| | 0 | 113 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof(val |
| | | 114 | | } |
| | | 115 | | |
| | 52 | 116 | | _keySize = value; |
| | 52 | 117 | | } |
| | | 118 | | } |
| | | 119 | | |
| | 142 | 120 | | public bool UseStrTransform { get; set; } = DefaultUseStrTransform; |
| | | 121 | | |
| | 192 | 122 | | public Collection<ClaimTypeRequirement> ClaimTypeRequirements { get; } = new Collection<ClaimTypeRequirement>(); |
| | | 123 | | |
| | 194 | 124 | | public string TokenType { get; set; } |
| | | 125 | | |
| | 0 | 126 | | protected internal override bool SupportsClientAuthentication { get { return true; } } |
| | 0 | 127 | | protected internal override bool SupportsServerAuthentication { get { return true; } } |
| | 0 | 128 | | protected internal override bool SupportsClientWindowsIdentity { get { return false; } } |
| | | 129 | | |
| | | 130 | | protected override SecurityTokenParameters CloneCore() |
| | | 131 | | { |
| | 70 | 132 | | return new IssuedSecurityTokenParameters(this); |
| | | 133 | | } |
| | | 134 | | |
| | | 135 | | protected internal override SecurityKeyIdentifierClause CreateKeyIdentifierClause(SecurityToken token, SecurityT |
| | | 136 | | { |
| | 0 | 137 | | if (token is GenericXmlSecurityToken) |
| | | 138 | | { |
| | 0 | 139 | | return CreateGenericXmlTokenKeyIdentifierClause(token, referenceStyle); |
| | | 140 | | } |
| | | 141 | | else |
| | | 142 | | { |
| | 0 | 143 | | throw new NotImplementedException(); |
| | | 144 | | } |
| | | 145 | | //TODO |
| | | 146 | | // return this.CreateKeyIdentifierClause<SamlAssertionKeyIdentifierClause, SamlAssertionKeyIdentifierClause |
| | | 147 | | } |
| | | 148 | | |
| | | 149 | | internal void SetRequestParameters(Collection<XmlElement> requestParameters, TrustDriver trustDriver) |
| | | 150 | | { |
| | 0 | 151 | | if (requestParameters == null) |
| | | 152 | | { |
| | 0 | 153 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(requestParameters)); |
| | | 154 | | } |
| | | 155 | | |
| | 0 | 156 | | if (trustDriver == null) |
| | | 157 | | { |
| | 0 | 158 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(trustDriver)); |
| | | 159 | | } |
| | | 160 | | |
| | 0 | 161 | | Collection<XmlElement> unknownRequestParameters = new Collection<XmlElement>(); |
| | | 162 | | |
| | 0 | 163 | | foreach (XmlElement element in requestParameters) |
| | | 164 | | { |
| | 0 | 165 | | if (trustDriver.TryParseKeySizeElement(element, out int keySize)) |
| | | 166 | | { |
| | 0 | 167 | | _keySize = keySize; |
| | | 168 | | } |
| | 0 | 169 | | else if (trustDriver.TryParseKeyTypeElement(element, out SecurityKeyType keyType)) |
| | | 170 | | { |
| | 0 | 171 | | KeyType = keyType; |
| | | 172 | | } |
| | 0 | 173 | | else if (trustDriver.TryParseTokenTypeElement(element, out string tokenType)) |
| | | 174 | | { |
| | 0 | 175 | | TokenType = tokenType; |
| | | 176 | | } |
| | | 177 | | // Only copy RP policy to client policy for TrustFeb2005 |
| | 0 | 178 | | else if (trustDriver.StandardsManager.TrustVersion == TrustVersion.WSTrustFeb2005) |
| | | 179 | | { |
| | 0 | 180 | | if (trustDriver.TryParseRequiredClaimsElement(element, out Collection<XmlElement> requiredClaims)) |
| | | 181 | | { |
| | 0 | 182 | | Collection<XmlElement> unrecognizedRequiredClaims = new Collection<XmlElement>(); |
| | 0 | 183 | | foreach (XmlElement claimRequirement in requiredClaims) |
| | | 184 | | { |
| | 0 | 185 | | if (claimRequirement.LocalName == "ClaimType" && claimRequirement.NamespaceURI == WsidNamesp |
| | | 186 | | { |
| | 0 | 187 | | string claimValue = claimRequirement.GetAttribute("Uri", string.Empty); |
| | 0 | 188 | | if (!string.IsNullOrEmpty(claimValue)) |
| | | 189 | | { |
| | | 190 | | ClaimTypeRequirement claimTypeRequirement; |
| | 0 | 191 | | string optional = claimRequirement.GetAttribute("Optional", string.Empty); |
| | 0 | 192 | | if (string.IsNullOrEmpty(optional)) |
| | | 193 | | { |
| | 0 | 194 | | claimTypeRequirement = new ClaimTypeRequirement(claimValue); |
| | | 195 | | } |
| | | 196 | | else |
| | | 197 | | { |
| | 0 | 198 | | claimTypeRequirement = new ClaimTypeRequirement(claimValue, XmlConvert.ToBoolean |
| | | 199 | | } |
| | | 200 | | |
| | 0 | 201 | | ClaimTypeRequirements.Add(claimTypeRequirement); |
| | | 202 | | } |
| | | 203 | | } |
| | | 204 | | else |
| | | 205 | | { |
| | 0 | 206 | | unrecognizedRequiredClaims.Add(claimRequirement); |
| | | 207 | | } |
| | | 208 | | } |
| | 0 | 209 | | if (unrecognizedRequiredClaims.Count > 0) |
| | | 210 | | { |
| | 0 | 211 | | unknownRequestParameters.Add(trustDriver.CreateRequiredClaimsElement(unrecognizedRequiredCla |
| | | 212 | | } |
| | | 213 | | } |
| | | 214 | | else |
| | | 215 | | { |
| | 0 | 216 | | unknownRequestParameters.Add(element); |
| | | 217 | | } |
| | | 218 | | } |
| | | 219 | | } |
| | | 220 | | |
| | 0 | 221 | | unknownRequestParameters = trustDriver.ProcessUnknownRequestParameters(unknownRequestParameters, requestPara |
| | 0 | 222 | | if (unknownRequestParameters.Count > 0) |
| | | 223 | | { |
| | 0 | 224 | | for (int i = 0; i < unknownRequestParameters.Count; ++i) |
| | | 225 | | { |
| | 0 | 226 | | AdditionalRequestParameters.Add(unknownRequestParameters[i]); |
| | | 227 | | } |
| | | 228 | | } |
| | 0 | 229 | | } |
| | | 230 | | |
| | | 231 | | public Collection<XmlElement> CreateRequestParameters(MessageSecurityVersion messageSecurityVersion, SecurityTok |
| | | 232 | | { |
| | 0 | 233 | | return CreateRequestParameters(SecurityUtils.CreateSecurityStandardsManager(messageSecurityVersion, security |
| | | 234 | | } |
| | | 235 | | |
| | | 236 | | internal Collection<XmlElement> CreateRequestParameters(TrustDriver driver) |
| | | 237 | | { |
| | 0 | 238 | | if (driver == null) |
| | | 239 | | { |
| | 0 | 240 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(driver)); |
| | | 241 | | } |
| | | 242 | | |
| | 0 | 243 | | Collection<XmlElement> result = new Collection<XmlElement>(); |
| | | 244 | | |
| | 0 | 245 | | if (TokenType != null) |
| | | 246 | | { |
| | 0 | 247 | | result.Add(driver.CreateTokenTypeElement(TokenType)); |
| | | 248 | | } |
| | | 249 | | |
| | 0 | 250 | | result.Add(driver.CreateKeyTypeElement(_keyType)); |
| | | 251 | | |
| | 0 | 252 | | if (_keySize != 0) |
| | | 253 | | { |
| | 0 | 254 | | result.Add(driver.CreateKeySizeElement(_keySize)); |
| | | 255 | | } |
| | 0 | 256 | | if (ClaimTypeRequirements.Count > 0) |
| | | 257 | | { |
| | 0 | 258 | | Collection<XmlElement> claimsElements = new Collection<XmlElement>(); |
| | 0 | 259 | | XmlDocument doc = new XmlDocument(); |
| | 0 | 260 | | foreach (ClaimTypeRequirement claimType in ClaimTypeRequirements) |
| | | 261 | | { |
| | 0 | 262 | | XmlElement element = doc.CreateElement(WsidPrefix, "ClaimType", WsidNamespace); |
| | 0 | 263 | | XmlAttribute attr = doc.CreateAttribute("Uri"); |
| | 0 | 264 | | attr.Value = claimType.ClaimType; |
| | 0 | 265 | | element.Attributes.Append(attr); |
| | 0 | 266 | | if (claimType.IsOptional != ClaimTypeRequirement.DefaultIsOptional) |
| | | 267 | | { |
| | 0 | 268 | | attr = doc.CreateAttribute("Optional"); |
| | 0 | 269 | | attr.Value = XmlConvert.ToString(claimType.IsOptional); |
| | 0 | 270 | | element.Attributes.Append(attr); |
| | | 271 | | } |
| | 0 | 272 | | claimsElements.Add(element); |
| | | 273 | | } |
| | 0 | 274 | | result.Add(driver.CreateRequiredClaimsElement(claimsElements)); |
| | | 275 | | } |
| | | 276 | | |
| | 0 | 277 | | if (AdditionalRequestParameters.Count > 0) |
| | | 278 | | { |
| | 0 | 279 | | Collection<XmlElement> trustNormalizedParameters = NormalizeAdditionalParameters(AdditionalRequestParame |
| | 0 | 280 | | driver, |
| | 0 | 281 | | (ClaimTypeRequirements. |
| | | 282 | | |
| | 0 | 283 | | foreach (XmlElement parameter in trustNormalizedParameters) |
| | | 284 | | { |
| | 0 | 285 | | result.Add(parameter); |
| | | 286 | | } |
| | | 287 | | } |
| | | 288 | | |
| | 0 | 289 | | return result; |
| | | 290 | | } |
| | | 291 | | |
| | | 292 | | private Collection<XmlElement> NormalizeAdditionalParameters(Collection<XmlElement> additionalParameters, |
| | | 293 | | TrustDriver driver, |
| | | 294 | | bool clientSideClaimTypeRequirementsSpecified) |
| | | 295 | | { |
| | | 296 | | // Ensure STS trust version is one of the currently supported versions: Feb 05 / Trust 1.3 |
| | | 297 | | Fx.Assert(((driver.StandardsManager.TrustVersion == TrustVersion.WSTrustFeb2005) || |
| | | 298 | | (driver.StandardsManager.TrustVersion == TrustVersion.WSTrust13)), |
| | | 299 | | "Unsupported trust version specified for the STS."); |
| | | 300 | | |
| | | 301 | | // We have a mismatch. Make a local copy of additionalParameters for making any potential modifications |
| | | 302 | | // as part of normalization |
| | 0 | 303 | | Collection<XmlElement> tmpCollection = new Collection<XmlElement>(); |
| | 0 | 304 | | foreach (XmlElement e in additionalParameters) |
| | | 305 | | { |
| | 0 | 306 | | tmpCollection.Add(e); |
| | | 307 | | } |
| | | 308 | | |
| | | 309 | | |
| | | 310 | | // 1. For Trust 1.3 EncryptionAlgorithm, CanonicalizationAlgorithm and KeyWrapAlgorithm should not be |
| | | 311 | | // specified as top-level element if "SecondaryParameters" element already specifies this. |
| | 0 | 312 | | if (driver.StandardsManager.TrustVersion == TrustVersion.WSTrust13) |
| | | 313 | | { |
| | | 314 | | Fx.Assert(driver.GetType() == typeof(WSTrustDec2005.DriverDec2005), "Invalid Trust Driver specified for |
| | | 315 | | |
| | 0 | 316 | | XmlElement encryptionAlgorithmElement = null; |
| | 0 | 317 | | XmlElement canonicalizationAlgorithmElement = null; |
| | 0 | 318 | | XmlElement keyWrapAlgorithmElement = null; |
| | 0 | 319 | | XmlElement secondaryParameter = null; |
| | | 320 | | |
| | 0 | 321 | | for (int i = 0; i < tmpCollection.Count; ++i) |
| | | 322 | | { |
| | 0 | 323 | | if (driver.IsEncryptionAlgorithmElement(tmpCollection[i], out string algorithm)) |
| | | 324 | | { |
| | 0 | 325 | | encryptionAlgorithmElement = tmpCollection[i]; |
| | | 326 | | } |
| | 0 | 327 | | else if (driver.IsCanonicalizationAlgorithmElement(tmpCollection[i], out algorithm)) |
| | | 328 | | { |
| | 0 | 329 | | canonicalizationAlgorithmElement = tmpCollection[i]; |
| | | 330 | | } |
| | 0 | 331 | | else if (driver.IsKeyWrapAlgorithmElement(tmpCollection[i], out algorithm)) |
| | | 332 | | { |
| | 0 | 333 | | keyWrapAlgorithmElement = tmpCollection[i]; |
| | | 334 | | } |
| | 0 | 335 | | else if (((WSTrustDec2005.DriverDec2005)driver).IsSecondaryParametersElement(tmpCollection[i])) |
| | | 336 | | { |
| | 0 | 337 | | secondaryParameter = tmpCollection[i]; |
| | | 338 | | } |
| | | 339 | | } |
| | | 340 | | |
| | 0 | 341 | | if (secondaryParameter != null) |
| | | 342 | | { |
| | 0 | 343 | | foreach (XmlNode node in secondaryParameter.ChildNodes) |
| | | 344 | | { |
| | 0 | 345 | | if (node is XmlElement child) |
| | | 346 | | { |
| | 0 | 347 | | if (driver.IsEncryptionAlgorithmElement(child, out string algorithm) && (encryptionAlgorithm |
| | | 348 | | { |
| | 0 | 349 | | tmpCollection.Remove(encryptionAlgorithmElement); |
| | | 350 | | } |
| | 0 | 351 | | else if (driver.IsCanonicalizationAlgorithmElement(child, out algorithm) && (canonicalizatio |
| | | 352 | | { |
| | 0 | 353 | | tmpCollection.Remove(canonicalizationAlgorithmElement); |
| | | 354 | | } |
| | 0 | 355 | | else if (driver.IsKeyWrapAlgorithmElement(child, out algorithm) && (keyWrapAlgorithmElement |
| | | 356 | | { |
| | 0 | 357 | | tmpCollection.Remove(keyWrapAlgorithmElement); |
| | | 358 | | } |
| | | 359 | | } |
| | | 360 | | } |
| | | 361 | | } |
| | | 362 | | } |
| | | 363 | | |
| | | 364 | | // 2. Check for Mismatch. |
| | | 365 | | // a. Trust Feb 2005 -> Trust 1.3. do the following, |
| | | 366 | | // (i) Copy EncryptionAlgorithm and CanonicalizationAlgorithm as the top-level elements. |
| | | 367 | | // Note, this is in contradiction to step 1. But we don't have a choice here as we cannot say f |
| | | 368 | | // Additional Parameters section in the config what came from the service and what came from th |
| | | 369 | | // (ii) Convert SignWith and EncryptWith elements to Trust 1.3 namespace. |
| | | 370 | | // b. For Trust 1.3 -> Trust Feb 2005, do the following, |
| | | 371 | | // (i) Find EncryptionAlgorithm, CanonicalizationAlgorithm from inside the "SecondaryParameters" el |
| | | 372 | | // If found, then promote these as the top-level elements replacing the existing values. |
| | | 373 | | // (ii) Convert the SignWith and EncryptWith elements to the Trust Feb 2005 namespace and drop the |
| | | 374 | | // element. |
| | | 375 | | |
| | | 376 | | // make an optimistic check to detect mismatched trust-versions between STS and RP |
| | 0 | 377 | | bool mismatch = (((driver.StandardsManager.TrustVersion == TrustVersion.WSTrustFeb2005) && |
| | 0 | 378 | | !CollectionContainsElementsWithTrustNamespace(additionalParameters, TrustFeb2005Strings.Na |
| | 0 | 379 | | ((driver.StandardsManager.TrustVersion == TrustVersion.WSTrust13) && |
| | 0 | 380 | | !CollectionContainsElementsWithTrustNamespace(additionalParameters, TrustDec2005Strings.Na |
| | | 381 | | // if no mismatch, return unmodified collection |
| | 0 | 382 | | if (!mismatch) |
| | | 383 | | { |
| | 0 | 384 | | return tmpCollection; |
| | | 385 | | } |
| | | 386 | | |
| | | 387 | | // 2.a |
| | | 388 | | // If we are talking to a Trust 1.3 STS, replace any Feb '05 algorithm parameters with their Trust 1.3 count |
| | 0 | 389 | | if (driver.StandardsManager.TrustVersion == TrustVersion.WSTrust13) |
| | | 390 | | { |
| | 0 | 391 | | SecurityStandardsManager trustFeb2005StandardsManager = SecurityStandardsManager.DefaultInstance; |
| | | 392 | | // the following cast is guaranteed to succeed |
| | 0 | 393 | | WSTrustFeb2005.DriverFeb2005 trustFeb2005Driver = (WSTrustFeb2005.DriverFeb2005)trustFeb2005StandardsMan |
| | | 394 | | |
| | 0 | 395 | | for (int i = 0; i < tmpCollection.Count; i++) |
| | | 396 | | { |
| | 0 | 397 | | if (trustFeb2005Driver.IsSignWithElement(tmpCollection[i], out string algorithmParameter)) |
| | | 398 | | { |
| | 0 | 399 | | tmpCollection[i] = driver.CreateSignWithElement(algorithmParameter); |
| | | 400 | | } |
| | 0 | 401 | | else if (trustFeb2005Driver.IsEncryptWithElement(tmpCollection[i], out algorithmParameter)) |
| | | 402 | | { |
| | 0 | 403 | | tmpCollection[i] = driver.CreateEncryptWithElement(algorithmParameter); |
| | | 404 | | } |
| | 0 | 405 | | else if (trustFeb2005Driver.IsEncryptionAlgorithmElement(tmpCollection[i], out algorithmParameter)) |
| | | 406 | | { |
| | 0 | 407 | | tmpCollection[i] = driver.CreateEncryptionAlgorithmElement(algorithmParameter); |
| | | 408 | | } |
| | 0 | 409 | | else if (trustFeb2005Driver.IsCanonicalizationAlgorithmElement(tmpCollection[i], out algorithmParame |
| | | 410 | | { |
| | 0 | 411 | | tmpCollection[i] = driver.CreateCanonicalizationAlgorithmElement(algorithmParameter); |
| | | 412 | | } |
| | | 413 | | } |
| | | 414 | | } |
| | | 415 | | else |
| | | 416 | | { |
| | | 417 | | // 2.b |
| | | 418 | | // We are talking to a Feb 05 STS. Filter out any SecondaryParameters element. |
| | 0 | 419 | | Collection<XmlElement> childrenToPromote = null; |
| | 0 | 420 | | WSSecurityTokenSerializer trust13Serializer = new WSSecurityTokenSerializer(SecurityVersion.WSSecurity11 |
| | 0 | 421 | | TrustVersion.WSTrust13, |
| | 0 | 422 | | SecureConversationVersion.WS |
| | 0 | 423 | | true, null, null, null); |
| | 0 | 424 | | SecurityStandardsManager trust13StandardsManager = new SecurityStandardsManager(MessageSecurityVersion.W |
| | | 425 | | // the following cast is guaranteed to succeed |
| | 0 | 426 | | WSTrustDec2005.DriverDec2005 trust13Driver = (WSTrustDec2005.DriverDec2005)trust13StandardsManager.Trust |
| | | 427 | | |
| | 0 | 428 | | foreach (XmlElement parameter in tmpCollection) |
| | | 429 | | { |
| | | 430 | | // check if SecondaryParameters is present |
| | 0 | 431 | | if (trust13Driver.IsSecondaryParametersElement(parameter)) |
| | | 432 | | { |
| | 0 | 433 | | childrenToPromote = new Collection<XmlElement>(); |
| | | 434 | | // walk SecondaryParameters and collect any 'non-standard' children |
| | 0 | 435 | | foreach (XmlNode innerNode in parameter.ChildNodes) |
| | | 436 | | { |
| | 0 | 437 | | if ((innerNode is XmlElement innerElement) && CanPromoteToRoot(innerElement, trust13Driver, |
| | | 438 | | { |
| | 0 | 439 | | childrenToPromote.Add(innerElement); |
| | | 440 | | } |
| | | 441 | | } |
| | | 442 | | |
| | | 443 | | // remove SecondaryParameters element |
| | 0 | 444 | | tmpCollection.Remove(parameter); |
| | | 445 | | |
| | | 446 | | // we are done - break out of the loop |
| | 0 | 447 | | break; |
| | | 448 | | } |
| | | 449 | | } |
| | | 450 | | |
| | | 451 | | // Probe of standard Trust elements and remember them. |
| | 0 | 452 | | if ((childrenToPromote != null) && (childrenToPromote.Count > 0)) |
| | | 453 | | { |
| | 0 | 454 | | XmlElement encryptionElement = null; |
| | 0 | 455 | | XmlElement canonicalizationElement = null; |
| | 0 | 456 | | XmlElement requiredClaimsElement = null; |
| | 0 | 457 | | Collection<XmlElement> processedElements = new Collection<XmlElement>(); |
| | | 458 | | |
| | 0 | 459 | | foreach (XmlElement e in childrenToPromote) |
| | | 460 | | { |
| | 0 | 461 | | if ((encryptionElement == null) && trust13Driver.IsEncryptionAlgorithmElement(e, out string encr |
| | | 462 | | { |
| | 0 | 463 | | encryptionElement = driver.CreateEncryptionAlgorithmElement(encryptionAlgorithm); |
| | 0 | 464 | | processedElements.Add(e); |
| | | 465 | | } |
| | 0 | 466 | | else if ((canonicalizationElement == null) && trust13Driver.IsCanonicalizationAlgorithmElement(e |
| | | 467 | | { |
| | 0 | 468 | | canonicalizationElement = driver.CreateCanonicalizationAlgorithmElement(canonicalizationAlgo |
| | 0 | 469 | | processedElements.Add(e); |
| | | 470 | | } |
| | 0 | 471 | | else if ((requiredClaimsElement == null) && trust13Driver.TryParseRequiredClaimsElement(e, out C |
| | | 472 | | { |
| | 0 | 473 | | requiredClaimsElement = driver.CreateRequiredClaimsElement(requiredClaims); |
| | 0 | 474 | | processedElements.Add(e); |
| | | 475 | | } |
| | | 476 | | } |
| | | 477 | | |
| | 0 | 478 | | for (int i = 0; i < processedElements.Count; ++i) |
| | | 479 | | { |
| | 0 | 480 | | childrenToPromote.Remove(processedElements[i]); |
| | | 481 | | } |
| | | 482 | | |
| | 0 | 483 | | XmlElement keyWrapAlgorithmElement = null; |
| | | 484 | | |
| | | 485 | | // Replace the appropriate elements. |
| | 0 | 486 | | for (int i = 0; i < tmpCollection.Count; ++i) |
| | | 487 | | { |
| | 0 | 488 | | if (trust13Driver.IsSignWithElement(tmpCollection[i], out string algorithmParameter)) |
| | | 489 | | { |
| | 0 | 490 | | tmpCollection[i] = driver.CreateSignWithElement(algorithmParameter); |
| | | 491 | | } |
| | 0 | 492 | | else if (trust13Driver.IsEncryptWithElement(tmpCollection[i], out algorithmParameter)) |
| | | 493 | | { |
| | 0 | 494 | | tmpCollection[i] = driver.CreateEncryptWithElement(algorithmParameter); |
| | | 495 | | } |
| | 0 | 496 | | else if (trust13Driver.IsEncryptionAlgorithmElement(tmpCollection[i], out algorithmParameter) && |
| | | 497 | | { |
| | 0 | 498 | | tmpCollection[i] = encryptionElement; |
| | 0 | 499 | | encryptionElement = null; |
| | | 500 | | } |
| | 0 | 501 | | else if (trust13Driver.IsCanonicalizationAlgorithmElement(tmpCollection[i], out algorithmParamet |
| | | 502 | | { |
| | 0 | 503 | | tmpCollection[i] = canonicalizationElement; |
| | 0 | 504 | | canonicalizationElement = null; |
| | | 505 | | } |
| | 0 | 506 | | else if (trust13Driver.IsKeyWrapAlgorithmElement(tmpCollection[i], out algorithmParameter) && (k |
| | | 507 | | { |
| | 0 | 508 | | keyWrapAlgorithmElement = tmpCollection[i]; |
| | | 509 | | } |
| | 0 | 510 | | else if (trust13Driver.TryParseRequiredClaimsElement(tmpCollection[i], out Collection<XmlElement |
| | | 511 | | { |
| | 0 | 512 | | tmpCollection[i] = requiredClaimsElement; |
| | 0 | 513 | | requiredClaimsElement = null; |
| | | 514 | | } |
| | | 515 | | } |
| | | 516 | | |
| | 0 | 517 | | if (keyWrapAlgorithmElement != null) |
| | | 518 | | { |
| | | 519 | | // Remove KeyWrapAlgorithmElement as this is not define in Trust Feb 2005. |
| | 0 | 520 | | tmpCollection.Remove(keyWrapAlgorithmElement); |
| | | 521 | | } |
| | | 522 | | |
| | | 523 | | // Add the remaining elements to the additionaParameters list to the end. |
| | 0 | 524 | | if (encryptionElement != null) |
| | | 525 | | { |
| | 0 | 526 | | tmpCollection.Add(encryptionElement); |
| | | 527 | | } |
| | | 528 | | |
| | 0 | 529 | | if (canonicalizationElement != null) |
| | | 530 | | { |
| | 0 | 531 | | tmpCollection.Add(canonicalizationElement); |
| | | 532 | | } |
| | | 533 | | |
| | 0 | 534 | | if (requiredClaimsElement != null) |
| | | 535 | | { |
| | 0 | 536 | | tmpCollection.Add(requiredClaimsElement); |
| | | 537 | | } |
| | | 538 | | |
| | 0 | 539 | | if (childrenToPromote.Count > 0) |
| | | 540 | | { |
| | | 541 | | // There are some non-standard elements. Just bump them to the top-level element. |
| | 0 | 542 | | for (int i = 0; i < childrenToPromote.Count; ++i) |
| | | 543 | | { |
| | 0 | 544 | | tmpCollection.Add(childrenToPromote[i]); |
| | | 545 | | } |
| | | 546 | | } |
| | | 547 | | } |
| | | 548 | | } |
| | | 549 | | |
| | 0 | 550 | | return tmpCollection; |
| | | 551 | | } |
| | | 552 | | |
| | | 553 | | private bool CollectionContainsElementsWithTrustNamespace(Collection<XmlElement> collection, string trustNamespa |
| | | 554 | | { |
| | 0 | 555 | | for (int i = 0; i < collection.Count; i++) |
| | | 556 | | { |
| | 0 | 557 | | if ((collection[i] != null) && (collection[i].NamespaceURI == trustNamespace)) |
| | | 558 | | { |
| | 0 | 559 | | return true; |
| | | 560 | | } |
| | | 561 | | } |
| | 0 | 562 | | return false; |
| | | 563 | | } |
| | | 564 | | |
| | | 565 | | private bool CanPromoteToRoot(XmlElement innerElement, WSTrustDec2005.DriverDec2005 trust13Driver, bool clientSi |
| | | 566 | | { |
| | | 567 | | // check if SecondaryParameters has claim requirements specified |
| | 0 | 568 | | if (trust13Driver.TryParseRequiredClaimsElement(innerElement, out Collection<XmlElement> dummyOutParamForReq |
| | | 569 | | { |
| | | 570 | | // if client has not specified any claim requirements, promote claim requirements |
| | | 571 | | // in SecondaryParameters to root level (and subsequently fix up the trust namespace) |
| | 0 | 572 | | return !clientSideClaimTypeRequirementsSpecified; |
| | | 573 | | } |
| | | 574 | | |
| | | 575 | | // KeySize, KeyType and TokenType were converted to top-level property values when the WSDL was |
| | | 576 | | // imported, so drop it here. We check for EncryptWith and SignWith as these are Client specific algorithm v |
| | | 577 | | // don't have to promote the service specified values. KeyWrapAlgorithm was never sent in the RST |
| | | 578 | | // in V1 and hence we are dropping it here as well. |
| | 0 | 579 | | return (!trust13Driver.TryParseKeyTypeElement(innerElement, out SecurityKeyType dummyOutParamForKeyType) && |
| | 0 | 580 | | !trust13Driver.TryParseKeySizeElement(innerElement, out int dummyOutParamForKeySize) && |
| | 0 | 581 | | !trust13Driver.TryParseTokenTypeElement(innerElement, out string dummyStringOutParam) && |
| | 0 | 582 | | !trust13Driver.IsSignWithElement(innerElement, out dummyStringOutParam) && |
| | 0 | 583 | | !trust13Driver.IsEncryptWithElement(innerElement, out dummyStringOutParam) && |
| | 0 | 584 | | !trust13Driver.IsKeyWrapAlgorithmElement(innerElement, out dummyStringOutParam)); |
| | | 585 | | } |
| | | 586 | | |
| | | 587 | | internal void AddAlgorithmParameters(SecurityAlgorithmSuite algorithmSuite, SecurityStandardsManager standardsMa |
| | | 588 | | { |
| | 50 | 589 | | AdditionalRequestParameters.Insert(0, standardsManager.TrustDriver.CreateEncryptionAlgorithmElement(algorith |
| | 50 | 590 | | AdditionalRequestParameters.Insert(0, standardsManager.TrustDriver.CreateCanonicalizationAlgorithmElement(al |
| | | 591 | | |
| | 50 | 592 | | if (_keyType == SecurityKeyType.BearerKey) |
| | | 593 | | { |
| | | 594 | | // As the client does not have a proof token in the Bearer case |
| | | 595 | | // we don't have any specific algorithms to request for. |
| | 50 | 596 | | return; |
| | | 597 | | } |
| | | 598 | | |
| | 0 | 599 | | string signWithAlgorithm = (_keyType == SecurityKeyType.SymmetricKey) ? algorithmSuite.DefaultSymmetricSigna |
| | 0 | 600 | | AdditionalRequestParameters.Insert(0, standardsManager.TrustDriver.CreateSignWithElement(signWithAlgorithm)) |
| | | 601 | | string encryptWithAlgorithm; |
| | 0 | 602 | | if (issuedKeyType == SecurityKeyType.SymmetricKey) |
| | | 603 | | { |
| | 0 | 604 | | encryptWithAlgorithm = algorithmSuite.DefaultEncryptionAlgorithm; |
| | | 605 | | } |
| | | 606 | | else |
| | | 607 | | { |
| | 0 | 608 | | encryptWithAlgorithm = algorithmSuite.DefaultAsymmetricKeyWrapAlgorithm; |
| | | 609 | | } |
| | 0 | 610 | | AdditionalRequestParameters.Insert(0, standardsManager.TrustDriver.CreateEncryptWithElement(encryptWithAlgor |
| | | 611 | | |
| | 0 | 612 | | if (standardsManager.TrustVersion != TrustVersion.WSTrustFeb2005) |
| | | 613 | | { |
| | 0 | 614 | | AdditionalRequestParameters.Insert(0, ((WSTrustDec2005.DriverDec2005)standardsManager.TrustDriver).Creat |
| | | 615 | | } |
| | | 616 | | |
| | 0 | 617 | | return; |
| | | 618 | | } |
| | | 619 | | |
| | | 620 | | internal bool DoAlgorithmsMatch(SecurityAlgorithmSuite algorithmSuite, SecurityStandardsManager standardsManager |
| | | 621 | | { |
| | 0 | 622 | | bool doesSignWithAlgorithmMatch = false; |
| | 0 | 623 | | bool doesEncryptWithAlgorithmMatch = false; |
| | 0 | 624 | | bool doesEncryptionAlgorithmMatch = false; |
| | 0 | 625 | | bool doesCanonicalizationAlgorithmMatch = false; |
| | 0 | 626 | | bool doesKeyWrapAlgorithmMatch = false; |
| | 0 | 627 | | otherRequestParameters = new Collection<XmlElement>(); |
| | 0 | 628 | | bool trustNormalizationPerformed = false; |
| | | 629 | | |
| | | 630 | | Collection<XmlElement> trustVersionNormalizedParameterCollection; |
| | | 631 | | |
| | | 632 | | // For Trust 1.3 we move all the additional parameters into the secondaryParameters |
| | | 633 | | // element. So the list contains just one element called SecondaryParameters that |
| | | 634 | | // contains all the other elements as child elements. |
| | 0 | 635 | | if ((standardsManager.TrustVersion == TrustVersion.WSTrust13) && |
| | 0 | 636 | | (AdditionalRequestParameters.Count == 1) && |
| | 0 | 637 | | (((WSTrustDec2005.DriverDec2005)standardsManager.TrustDriver).IsSecondaryParametersElement(AdditionalReq |
| | | 638 | | { |
| | 0 | 639 | | trustNormalizationPerformed = true; |
| | 0 | 640 | | trustVersionNormalizedParameterCollection = new Collection<XmlElement>(); |
| | 0 | 641 | | foreach (XmlElement innerElement in AdditionalRequestParameters[0]) |
| | | 642 | | { |
| | 0 | 643 | | trustVersionNormalizedParameterCollection.Add(innerElement); |
| | | 644 | | } |
| | | 645 | | } |
| | | 646 | | else |
| | | 647 | | { |
| | 0 | 648 | | trustVersionNormalizedParameterCollection = AdditionalRequestParameters; |
| | | 649 | | } |
| | | 650 | | |
| | 0 | 651 | | for (int i = 0; i < trustVersionNormalizedParameterCollection.Count; i++) |
| | | 652 | | { |
| | 0 | 653 | | XmlElement element = trustVersionNormalizedParameterCollection[i]; |
| | 0 | 654 | | if (standardsManager.TrustDriver.IsCanonicalizationAlgorithmElement(element, out string algorithm)) |
| | | 655 | | { |
| | 0 | 656 | | if (algorithmSuite.DefaultCanonicalizationAlgorithm != algorithm) |
| | | 657 | | { |
| | 0 | 658 | | return false; |
| | | 659 | | } |
| | 0 | 660 | | doesCanonicalizationAlgorithmMatch = true; |
| | | 661 | | } |
| | 0 | 662 | | else if (standardsManager.TrustDriver.IsSignWithElement(element, out algorithm)) |
| | | 663 | | { |
| | 0 | 664 | | if ((_keyType == SecurityKeyType.SymmetricKey && algorithm != algorithmSuite.DefaultSymmetricSignatu |
| | 0 | 665 | | || (_keyType == SecurityKeyType.AsymmetricKey && algorithm != algorithmSuite.DefaultAsymmetricSi |
| | | 666 | | { |
| | 0 | 667 | | return false; |
| | | 668 | | } |
| | 0 | 669 | | doesSignWithAlgorithmMatch = true; |
| | | 670 | | } |
| | 0 | 671 | | else if (standardsManager.TrustDriver.IsEncryptWithElement(element, out algorithm)) |
| | | 672 | | { |
| | 0 | 673 | | if ((_keyType == SecurityKeyType.SymmetricKey && algorithm != algorithmSuite.DefaultEncryptionAlgori |
| | 0 | 674 | | || (_keyType == SecurityKeyType.AsymmetricKey && algorithm != algorithmSuite.DefaultAsymmetricKe |
| | | 675 | | { |
| | 0 | 676 | | return false; |
| | | 677 | | } |
| | 0 | 678 | | doesEncryptWithAlgorithmMatch = true; |
| | | 679 | | } |
| | 0 | 680 | | else if (standardsManager.TrustDriver.IsEncryptionAlgorithmElement(element, out algorithm)) |
| | | 681 | | { |
| | 0 | 682 | | if (algorithm != algorithmSuite.DefaultEncryptionAlgorithm) |
| | | 683 | | { |
| | 0 | 684 | | return false; |
| | | 685 | | } |
| | 0 | 686 | | doesEncryptionAlgorithmMatch = true; |
| | | 687 | | } |
| | 0 | 688 | | else if (standardsManager.TrustDriver.IsKeyWrapAlgorithmElement(element, out algorithm)) |
| | | 689 | | { |
| | 0 | 690 | | if (algorithm != algorithmSuite.DefaultAsymmetricKeyWrapAlgorithm) |
| | | 691 | | { |
| | 0 | 692 | | return false; |
| | | 693 | | } |
| | 0 | 694 | | doesKeyWrapAlgorithmMatch = true; |
| | | 695 | | } |
| | | 696 | | else |
| | | 697 | | { |
| | 0 | 698 | | otherRequestParameters.Add(element); |
| | | 699 | | } |
| | | 700 | | } |
| | | 701 | | |
| | | 702 | | // Undo normalization if performed |
| | | 703 | | // move all back into secondaryParameters |
| | 0 | 704 | | if (trustNormalizationPerformed) |
| | | 705 | | { |
| | 0 | 706 | | otherRequestParameters = AdditionalRequestParameters; |
| | | 707 | | } |
| | | 708 | | |
| | 0 | 709 | | if (_keyType == SecurityKeyType.BearerKey) |
| | | 710 | | { |
| | | 711 | | // As the client does not have a proof token in the Bearer case |
| | | 712 | | // we don't have any specific algorithms to request for. |
| | 0 | 713 | | return true; |
| | | 714 | | } |
| | 0 | 715 | | if (standardsManager.TrustVersion == TrustVersion.WSTrustFeb2005) |
| | | 716 | | { |
| | | 717 | | // For V1 compatibility check all algorithms |
| | 0 | 718 | | return (doesSignWithAlgorithmMatch && doesCanonicalizationAlgorithmMatch && doesEncryptionAlgorithmMatch |
| | | 719 | | } |
| | | 720 | | else |
| | | 721 | | { |
| | 0 | 722 | | return (doesSignWithAlgorithmMatch && doesCanonicalizationAlgorithmMatch && doesEncryptionAlgorithmMatch |
| | | 723 | | } |
| | | 724 | | } |
| | | 725 | | |
| | | 726 | | internal static IssuedSecurityTokenParameters CreateInfoCardParameters(SecurityStandardsManager standardsManager |
| | | 727 | | { |
| | 0 | 728 | | IssuedSecurityTokenParameters result = new IssuedSecurityTokenParameters(SecurityXXX2005Strings.SamlTokenTyp |
| | 0 | 729 | | { |
| | 0 | 730 | | KeyType = SecurityKeyType.AsymmetricKey |
| | 0 | 731 | | }; |
| | 0 | 732 | | result.ClaimTypeRequirements.Add(new ClaimTypeRequirement(s_wsidPPIClaim)); |
| | 0 | 733 | | result.IssuerAddress = null; |
| | 0 | 734 | | result.AddAlgorithmParameters(algorithm, standardsManager, result.KeyType); |
| | 0 | 735 | | return result; |
| | | 736 | | } |
| | | 737 | | |
| | | 738 | | internal static bool IsInfoCardParameters(IssuedSecurityTokenParameters parameters, SecurityStandardsManager sta |
| | | 739 | | { |
| | 0 | 740 | | if (parameters == null) |
| | | 741 | | { |
| | 0 | 742 | | return false; |
| | | 743 | | } |
| | | 744 | | |
| | 0 | 745 | | if (parameters.TokenType != SecurityXXX2005Strings.SamlTokenType) |
| | | 746 | | { |
| | 0 | 747 | | return false; |
| | | 748 | | } |
| | | 749 | | |
| | 0 | 750 | | if (parameters.KeyType != SecurityKeyType.AsymmetricKey) |
| | | 751 | | { |
| | 0 | 752 | | return false; |
| | | 753 | | } |
| | | 754 | | |
| | 0 | 755 | | if (parameters.ClaimTypeRequirements.Count == 1) |
| | | 756 | | { |
| | 0 | 757 | | if (!(parameters.ClaimTypeRequirements[0] is ClaimTypeRequirement claimTypeRequirement)) |
| | | 758 | | { |
| | 0 | 759 | | return false; |
| | | 760 | | } |
| | | 761 | | |
| | 0 | 762 | | if (claimTypeRequirement.ClaimType != s_wsidPPIClaim) |
| | | 763 | | { |
| | 0 | 764 | | return false; |
| | | 765 | | } |
| | | 766 | | } |
| | 0 | 767 | | else if ((parameters.AdditionalRequestParameters != null) && (parameters.AdditionalRequestParameters.Count > |
| | | 768 | | { |
| | | 769 | | // Check the AdditionalRequest Parameters to see if ClaimTypeRequirements got imported there. |
| | 0 | 770 | | bool claimTypeRequirementMatched = false; |
| | 0 | 771 | | XmlElement claimTypeRequirement = GetClaimTypeRequirement(parameters.AdditionalRequestParameters, standa |
| | 0 | 772 | | if (claimTypeRequirement != null && claimTypeRequirement.ChildNodes.Count == 1) |
| | | 773 | | { |
| | 0 | 774 | | if (claimTypeRequirement.ChildNodes[0] is XmlElement claimTypeElement) |
| | | 775 | | { |
| | 0 | 776 | | XmlNode claimType = claimTypeElement.Attributes.GetNamedItem("Uri"); |
| | 0 | 777 | | if (claimType != null && claimType.Value == s_wsidPPIClaim) |
| | | 778 | | { |
| | 0 | 779 | | claimTypeRequirementMatched = true; |
| | | 780 | | } |
| | | 781 | | } |
| | | 782 | | } |
| | | 783 | | |
| | 0 | 784 | | if (!claimTypeRequirementMatched) |
| | | 785 | | { |
| | 0 | 786 | | return false; |
| | | 787 | | } |
| | | 788 | | } |
| | | 789 | | else |
| | | 790 | | { |
| | 0 | 791 | | return false; |
| | | 792 | | } |
| | 0 | 793 | | if (parameters.IssuerAddress != null) |
| | | 794 | | { |
| | 0 | 795 | | return false; |
| | | 796 | | } |
| | | 797 | | |
| | 0 | 798 | | return true; |
| | | 799 | | } |
| | | 800 | | |
| | | 801 | | // The method walks through the entire set of AdditionalRequestParameters and return the Claims Type requirement |
| | | 802 | | internal static XmlElement GetClaimTypeRequirement(Collection<XmlElement> additionalRequestParameters, SecurityS |
| | | 803 | | { |
| | 0 | 804 | | foreach (XmlElement requestParameter in additionalRequestParameters) |
| | | 805 | | { |
| | 0 | 806 | | if ((requestParameter.LocalName == ((CoreWCF.Security.WSTrust.Driver)standardsManager.TrustDriver).Drive |
| | 0 | 807 | | (requestParameter.NamespaceURI == ((CoreWCF.Security.WSTrust.Driver)standardsManager.TrustDriver).Dr |
| | | 808 | | { |
| | 0 | 809 | | return requestParameter; |
| | | 810 | | } |
| | | 811 | | |
| | 0 | 812 | | if ((requestParameter.LocalName == DXD.TrustDec2005Dictionary.SecondaryParameters.Value) && |
| | 0 | 813 | | (requestParameter.NamespaceURI == DXD.TrustDec2005Dictionary.Namespace.Value)) |
| | | 814 | | { |
| | 0 | 815 | | Collection<XmlElement> secondaryParameters = new Collection<XmlElement>(); |
| | 0 | 816 | | foreach (XmlNode node in requestParameter.ChildNodes) |
| | | 817 | | { |
| | 0 | 818 | | if (node is XmlElement nodeAsElement) |
| | | 819 | | { |
| | 0 | 820 | | secondaryParameters.Add(nodeAsElement); |
| | | 821 | | } |
| | | 822 | | } |
| | 0 | 823 | | XmlElement claimTypeRequirement = GetClaimTypeRequirement(secondaryParameters, standardsManager); |
| | 0 | 824 | | if (claimTypeRequirement != null) |
| | | 825 | | { |
| | 0 | 826 | | return claimTypeRequirement; |
| | | 827 | | } |
| | | 828 | | } |
| | | 829 | | } |
| | | 830 | | |
| | 0 | 831 | | return null; |
| | 0 | 832 | | } |
| | | 833 | | |
| | | 834 | | public override string ToString() |
| | | 835 | | { |
| | 0 | 836 | | StringBuilder sb = new StringBuilder(); |
| | 0 | 837 | | sb.AppendLine(base.ToString()); |
| | | 838 | | |
| | 0 | 839 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "TokenType: {0}", TokenType ?? "null")); |
| | 0 | 840 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "KeyType: {0}", _keyType.ToString())); |
| | 0 | 841 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "KeySize: {0}", _keySize.ToString(CultureInfo.Inva |
| | 0 | 842 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "IssuerAddress: {0}", IssuerAddress == null ? "nul |
| | 0 | 843 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "IssuerMetadataAddress: {0}", IssuerMetadataAddres |
| | 0 | 844 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "DefaultMessgeSecurityVersion: {0}", DefaultMessag |
| | 0 | 845 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "UseStrTransform: {0}", UseStrTransform.ToString() |
| | | 846 | | |
| | 0 | 847 | | if (IssuerBinding == null) |
| | | 848 | | { |
| | 0 | 849 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "IssuerBinding: null")); |
| | | 850 | | } |
| | | 851 | | else |
| | | 852 | | { |
| | 0 | 853 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "IssuerBinding:")); |
| | 0 | 854 | | BindingElementCollection bindingElements = IssuerBinding.CreateBindingElements(); |
| | 0 | 855 | | for (int i = 0; i < bindingElements.Count; i++) |
| | | 856 | | { |
| | 0 | 857 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, " BindingElement[{0}]:", i.ToString(Cultu |
| | 0 | 858 | | sb.AppendLine(" " + bindingElements[i].ToString().Trim().Replace("\n", "\n ")); |
| | | 859 | | } |
| | | 860 | | } |
| | | 861 | | |
| | 0 | 862 | | if (ClaimTypeRequirements.Count == 0) |
| | | 863 | | { |
| | 0 | 864 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "ClaimTypeRequirements: none")); |
| | | 865 | | } |
| | | 866 | | else |
| | | 867 | | { |
| | 0 | 868 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, "ClaimTypeRequirements:")); |
| | 0 | 869 | | for (int i = 0; i < ClaimTypeRequirements.Count; i++) |
| | | 870 | | { |
| | 0 | 871 | | sb.AppendLine(string.Format(CultureInfo.InvariantCulture, " {0}, optional={1}", ClaimTypeRequiremen |
| | | 872 | | } |
| | | 873 | | } |
| | | 874 | | |
| | 0 | 875 | | return sb.ToString().Trim(); |
| | | 876 | | } |
| | | 877 | | |
| | | 878 | | protected internal override void InitializeSecurityTokenRequirement(SecurityTokenRequirement requirement) |
| | | 879 | | { |
| | 2 | 880 | | requirement.TokenType = TokenType; |
| | 2 | 881 | | requirement.RequireCryptographicToken = true; |
| | 2 | 882 | | requirement.KeyType = KeyType; |
| | | 883 | | |
| | 2 | 884 | | if (requirement is ServiceModelSecurityTokenRequirement serviceModelSecurityTokenRequirement) |
| | | 885 | | { |
| | 2 | 886 | | serviceModelSecurityTokenRequirement.DefaultMessageSecurityVersion = DefaultMessageSecurityVersion; |
| | | 887 | | } |
| | | 888 | | else |
| | | 889 | | { |
| | 0 | 890 | | requirement.Properties[ServiceModelSecurityTokenRequirement.DefaultMessageSecurityVersionProperty] = Def |
| | | 891 | | } |
| | | 892 | | |
| | 2 | 893 | | if (KeySize > 0) |
| | | 894 | | { |
| | 0 | 895 | | requirement.KeySize = KeySize; |
| | | 896 | | } |
| | 2 | 897 | | requirement.Properties[ServiceModelSecurityTokenRequirement.IssuerAddressProperty] = IssuerAddress; |
| | 2 | 898 | | if (IssuerBinding != null) |
| | | 899 | | { |
| | 0 | 900 | | requirement.Properties[ServiceModelSecurityTokenRequirement.IssuerBindingProperty] = IssuerBinding; |
| | | 901 | | } |
| | 2 | 902 | | requirement.Properties[ServiceModelSecurityTokenRequirement.IssuedSecurityTokenParametersProperty] = Clone() |
| | 2 | 903 | | } |
| | | 904 | | } |
| | | 905 | | } |