| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System.Security.Cryptography.X509Certificates; |
| | | 5 | | using CoreWCF.IdentityModel.Selectors; |
| | | 6 | | |
| | | 7 | | namespace CoreWCF.IdentityModel.Tokens |
| | | 8 | | { |
| | | 9 | | /// <summary> |
| | | 10 | | /// Resolves issuer tokens received from service partners. |
| | | 11 | | /// </summary> |
| | | 12 | | public class IssuerTokenResolver : SecurityTokenResolver |
| | | 13 | | { |
| | | 14 | | /// <summary> |
| | | 15 | | /// Default store for resolving X509 certificates. |
| | | 16 | | /// </summary> |
| | 2 | 17 | | public static readonly StoreName DefaultStoreName = StoreName.TrustedPeople; |
| | | 18 | | /// <summary> |
| | | 19 | | /// Default store location for resolving X509 certificates. |
| | | 20 | | /// </summary> |
| | 2 | 21 | | public static readonly StoreLocation DefaultStoreLocation = StoreLocation.LocalMachine; |
| | 2 | 22 | | internal static IssuerTokenResolver s_defaultInstance = new IssuerTokenResolver(); |
| | | 23 | | |
| | | 24 | | /// <summary> |
| | | 25 | | /// Creates an instance of IssuerTokenResolver. |
| | | 26 | | /// </summary> |
| | | 27 | | public IssuerTokenResolver() |
| | 2 | 28 | | : this( new X509CertificateStoreTokenResolver( DefaultStoreName, DefaultStoreLocation ) ) |
| | | 29 | | { |
| | 2 | 30 | | } |
| | | 31 | | |
| | | 32 | | /// <summary> |
| | | 33 | | /// Creates an instance of IssuerTokenResolver using a given <see cref="SecurityTokenResolver"/>. |
| | | 34 | | /// </summary> |
| | | 35 | | /// <param name="wrappedTokenResolver">The <see cref="SecurityTokenResolver"/> to use.</param> |
| | 2 | 36 | | public IssuerTokenResolver( SecurityTokenResolver wrappedTokenResolver ) |
| | | 37 | | { |
| | 2 | 38 | | WrappedTokenResolver = wrappedTokenResolver ?? throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentN |
| | 2 | 39 | | } |
| | | 40 | | |
| | | 41 | | /// <summary> |
| | | 42 | | /// Gets the <see cref="SecurityTokenResolver"/> wrapped by this class. |
| | | 43 | | /// </summary> |
| | 0 | 44 | | public SecurityTokenResolver WrappedTokenResolver { get; } = null; |
| | | 45 | | |
| | | 46 | | /// <summary> |
| | | 47 | | /// Inherited from <see cref="SecurityTokenResolver"/>. |
| | | 48 | | /// </summary> |
| | | 49 | | protected override bool TryResolveSecurityKeyCore( SecurityKeyIdentifierClause keyIdentifierClause, out Security |
| | | 50 | | { |
| | 0 | 51 | | if ( keyIdentifierClause == null ) |
| | | 52 | | { |
| | 0 | 53 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( nameof(keyIdentifierClause) ); |
| | | 54 | | } |
| | | 55 | | |
| | 0 | 56 | | if (keyIdentifierClause is X509RawDataKeyIdentifierClause rawDataClause) |
| | | 57 | | { |
| | 0 | 58 | | key = rawDataClause.CreateKey(); |
| | 0 | 59 | | return true; |
| | | 60 | | } |
| | | 61 | | |
| | 0 | 62 | | if (keyIdentifierClause is RsaKeyIdentifierClause rsaClause) |
| | | 63 | | { |
| | 0 | 64 | | key = rsaClause.CreateKey(); |
| | 0 | 65 | | return true; |
| | | 66 | | } |
| | | 67 | | |
| | 0 | 68 | | if ( WrappedTokenResolver.TryResolveSecurityKey( keyIdentifierClause, out key ) ) |
| | | 69 | | { |
| | 0 | 70 | | return true; |
| | | 71 | | } |
| | | 72 | | |
| | 0 | 73 | | return false; |
| | | 74 | | } |
| | | 75 | | |
| | | 76 | | /// <summary> |
| | | 77 | | /// Inherited from <see cref="SecurityTokenResolver"/>. |
| | | 78 | | /// </summary> |
| | | 79 | | protected override bool TryResolveTokenCore( SecurityKeyIdentifier keyIdentifier, out SecurityToken token ) |
| | | 80 | | { |
| | 0 | 81 | | if ( keyIdentifier == null ) |
| | | 82 | | { |
| | 0 | 83 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(keyIdentifier)); |
| | | 84 | | } |
| | | 85 | | |
| | 0 | 86 | | token = null; |
| | 0 | 87 | | foreach ( SecurityKeyIdentifierClause clause in keyIdentifier ) |
| | | 88 | | { |
| | 0 | 89 | | if ( TryResolveTokenCore( clause, out token ) ) |
| | | 90 | | { |
| | 0 | 91 | | return true; |
| | | 92 | | } |
| | | 93 | | } |
| | | 94 | | |
| | 0 | 95 | | return false; |
| | 0 | 96 | | } |
| | | 97 | | |
| | | 98 | | /// <summary> |
| | | 99 | | /// Inherited from <see cref="SecurityTokenResolver"/>. |
| | | 100 | | /// </summary> |
| | | 101 | | protected override bool TryResolveTokenCore( SecurityKeyIdentifierClause keyIdentifierClause, out SecurityToken |
| | | 102 | | { |
| | 0 | 103 | | if ( keyIdentifierClause == null ) |
| | | 104 | | { |
| | 0 | 105 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( nameof(keyIdentifierClause) ); |
| | | 106 | | } |
| | | 107 | | |
| | | 108 | | |
| | | 109 | | // |
| | | 110 | | // Try raw X509 |
| | | 111 | | // |
| | 0 | 112 | | if (keyIdentifierClause is X509RawDataKeyIdentifierClause rawDataClause) |
| | | 113 | | { |
| | 0 | 114 | | token = new X509SecurityToken(new X509Certificate2(rawDataClause.GetX509RawData())); |
| | 0 | 115 | | return true; |
| | | 116 | | } |
| | | 117 | | |
| | | 118 | | // |
| | | 119 | | // Try RSA |
| | | 120 | | // |
| | 0 | 121 | | if (keyIdentifierClause is RsaKeyIdentifierClause rsaClause) |
| | | 122 | | { |
| | 0 | 123 | | token = new RsaSecurityToken(rsaClause.Rsa); |
| | 0 | 124 | | return true; |
| | | 125 | | } |
| | | 126 | | |
| | 0 | 127 | | if ( WrappedTokenResolver.TryResolveToken( keyIdentifierClause, out token ) ) |
| | | 128 | | { |
| | 0 | 129 | | return true; |
| | | 130 | | } |
| | | 131 | | |
| | 0 | 132 | | return false; |
| | | 133 | | } |
| | | 134 | | } |
| | | 135 | | } |