| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Runtime.InteropServices; |
| | | 6 | | using CoreWCF.Channels; |
| | | 7 | | using CoreWCF.Runtime; |
| | | 8 | | using CoreWCF.Security; |
| | | 9 | | using CoreWCF.Security.Tokens; |
| | | 10 | | |
| | | 11 | | namespace CoreWCF |
| | | 12 | | { |
| | | 13 | | public class MessageSecurityOverHttp |
| | | 14 | | { |
| | | 15 | | internal const MessageCredentialType DefaultClientCredentialType = MessageCredentialType.Windows; |
| | | 16 | | internal const bool DefaultNegotiateServiceCredential = true; |
| | | 17 | | private MessageCredentialType _clientCredentialType; |
| | | 18 | | private SecurityAlgorithmSuite _algorithmSuite; |
| | 2 | 19 | | private static readonly TimeSpan s_defaultServerIssuedTransitionTokenLifetime = TimeSpan.FromMinutes(15); |
| | | 20 | | private const string NetFrameworkFrameworkName = ".NET Framework"; |
| | 45 | 21 | | public MessageSecurityOverHttp() |
| | | 22 | | { |
| | 45 | 23 | | _clientCredentialType = DefaultClientCredentialType; |
| | 45 | 24 | | NegotiateServiceCredential = DefaultNegotiateServiceCredential; |
| | 45 | 25 | | _algorithmSuite = SecurityAlgorithmSuite.Default; |
| | 45 | 26 | | } |
| | | 27 | | |
| | | 28 | | public MessageCredentialType ClientCredentialType |
| | | 29 | | { |
| | 1 | 30 | | get { return _clientCredentialType; } |
| | | 31 | | set |
| | | 32 | | { |
| | 25 | 33 | | if (!MessageCredentialTypeHelper.IsDefined(value)) |
| | | 34 | | { |
| | 0 | 35 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof(val |
| | | 36 | | } |
| | | 37 | | |
| | 25 | 38 | | if (value is MessageCredentialType.Windows) |
| | | 39 | | { |
| | | 40 | | //TODO Remove this after .net 5+ |
| | 2 | 41 | | string frameworkDescription = RuntimeInformation.FrameworkDescription; |
| | 2 | 42 | | if (frameworkDescription.IndexOf(NetFrameworkFrameworkName, StringComparison.Ordinal) >= 0) |
| | | 43 | | { |
| | 0 | 44 | | throw new PlatformNotSupportedException("Windows auth only supported on .NET Core"); |
| | | 45 | | } |
| | | 46 | | } |
| | | 47 | | |
| | 25 | 48 | | _clientCredentialType = value; |
| | 25 | 49 | | } |
| | | 50 | | } |
| | | 51 | | |
| | 47 | 52 | | public bool NegotiateServiceCredential { get; set; } |
| | | 53 | | |
| | | 54 | | public SecurityAlgorithmSuite AlgorithmSuite |
| | | 55 | | { |
| | 87 | 56 | | get { return _algorithmSuite; } |
| | | 57 | | set |
| | | 58 | | { |
| | 6 | 59 | | _algorithmSuite = value ?? throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(value |
| | 6 | 60 | | WasAlgorithmSuiteSet = true; |
| | 6 | 61 | | } |
| | | 62 | | } |
| | | 63 | | |
| | 93 | 64 | | internal bool WasAlgorithmSuiteSet { get; private set; } |
| | | 65 | | |
| | | 66 | | protected virtual bool IsSecureConversationEnabled() |
| | | 67 | | { |
| | 0 | 68 | | return true; |
| | | 69 | | } |
| | | 70 | | |
| | | 71 | | public SecurityBindingElement CreateSecurityBindingElement(bool isSecureTransportMode, bool isReliableSession, M |
| | | 72 | | { |
| | 87 | 73 | | if (isReliableSession && !IsSecureConversationEnabled()) |
| | | 74 | | { |
| | 0 | 75 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR.Sec |
| | | 76 | | } |
| | | 77 | | |
| | | 78 | | SecurityBindingElement result; |
| | 87 | 79 | | bool isKerberosSelected = false; |
| | | 80 | | SecurityBindingElement oneShotSecurity; |
| | 87 | 81 | | if (isSecureTransportMode) |
| | | 82 | | { |
| | 87 | 83 | | switch (_clientCredentialType) |
| | | 84 | | { |
| | | 85 | | case MessageCredentialType.None: |
| | 0 | 86 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Forma |
| | | 87 | | case MessageCredentialType.UserName: |
| | 53 | 88 | | oneShotSecurity = SecurityBindingElement.CreateUserNameOverTransportBindingElement(); |
| | 53 | 89 | | break; |
| | | 90 | | case MessageCredentialType.Certificate: |
| | 33 | 91 | | oneShotSecurity = SecurityBindingElement.CreateCertificateOverTransportBindingElement(); |
| | 33 | 92 | | break; |
| | | 93 | | case MessageCredentialType.Windows: |
| | 1 | 94 | | oneShotSecurity = SecurityBindingElement.CreateSspiNegotiationOverTransportBindingElement(true); |
| | 1 | 95 | | break; |
| | | 96 | | case MessageCredentialType.IssuedToken: |
| | 0 | 97 | | oneShotSecurity = SecurityBindingElement.CreateIssuedTokenOverTransportBindingElement(IssuedSecu |
| | 0 | 98 | | break; |
| | | 99 | | default: |
| | | 100 | | Fx.Assert("unknown ClientCredentialType"); |
| | 0 | 101 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException()); |
| | | 102 | | } |
| | 87 | 103 | | if (IsSecureConversationEnabled()) |
| | | 104 | | { |
| | 85 | 105 | | result = SecurityBindingElement.CreateSecureConversationBindingElement(oneShotSecurity, true); |
| | | 106 | | } |
| | | 107 | | else |
| | | 108 | | { |
| | 2 | 109 | | result = oneShotSecurity; |
| | | 110 | | } |
| | | 111 | | } |
| | | 112 | | else |
| | | 113 | | { |
| | 0 | 114 | | throw new PlatformNotSupportedException(); |
| | | 115 | | //TODO |
| | | 116 | | //if (negotiateServiceCredential) |
| | | 117 | | //{ |
| | | 118 | | // switch (this.clientCredentialType) |
| | | 119 | | // { |
| | | 120 | | // case MessageCredentialType.None: |
| | | 121 | | // oneShotSecurity = SecurityBindingElement.CreateSslNegotiationBindingElement(false, true); |
| | | 122 | | // break; |
| | | 123 | | // case MessageCredentialType.UserName: |
| | | 124 | | // oneShotSecurity = SecurityBindingElement.CreateUserNameForSslBindingElement(true); |
| | | 125 | | // break; |
| | | 126 | | // case MessageCredentialType.Certificate: |
| | | 127 | | // oneShotSecurity = SecurityBindingElement.CreateSslNegotiationBindingElement(true, true); |
| | | 128 | | // break; |
| | | 129 | | // case MessageCredentialType.Windows: |
| | | 130 | | // oneShotSecurity = SecurityBindingElement.CreateSspiNegotiationBindingElement(true); |
| | | 131 | | // break; |
| | | 132 | | // case MessageCredentialType.IssuedToken: |
| | | 133 | | // oneShotSecurity = SecurityBindingElement.CreateIssuedTokenForSslBindingElement(IssuedSecur |
| | | 134 | | // break; |
| | | 135 | | // default: |
| | | 136 | | // Fx.Assert("unknown ClientCredentialType"); |
| | | 137 | | // throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException()); |
| | | 138 | | // } |
| | | 139 | | //} |
| | | 140 | | //else |
| | | 141 | | //{ |
| | | 142 | | // switch (this.clientCredentialType) |
| | | 143 | | // { |
| | | 144 | | // case MessageCredentialType.None: |
| | | 145 | | // oneShotSecurity = SecurityBindingElement.CreateAnonymousForCertificateBindingElement(); |
| | | 146 | | // break; |
| | | 147 | | // case MessageCredentialType.UserName: |
| | | 148 | | // oneShotSecurity = SecurityBindingElement.CreateUserNameForCertificateBindingElement(); |
| | | 149 | | // break; |
| | | 150 | | // case MessageCredentialType.Certificate: |
| | | 151 | | // oneShotSecurity = SecurityBindingElement.CreateMutualCertificateBindingElement(); |
| | | 152 | | // break; |
| | | 153 | | // case MessageCredentialType.Windows: |
| | | 154 | | // oneShotSecurity = SecurityBindingElement.CreateKerberosBindingElement(); |
| | | 155 | | // isKerberosSelected = true; |
| | | 156 | | // break; |
| | | 157 | | // case MessageCredentialType.IssuedToken: |
| | | 158 | | // oneShotSecurity = SecurityBindingElement.CreateIssuedTokenForCertificateBindingElement(Iss |
| | | 159 | | // break; |
| | | 160 | | // default: |
| | | 161 | | // Fx.Assert("unknown ClientCredentialType"); |
| | | 162 | | // throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException()); |
| | | 163 | | // } |
| | | 164 | | //} |
| | | 165 | | //if (IsSecureConversationEnabled()) |
| | | 166 | | //{ |
| | | 167 | | // result = SecurityBindingElement.CreateSecureConversationBindingElement(oneShotSecurity, true); |
| | | 168 | | //} |
| | | 169 | | //else |
| | | 170 | | //{ |
| | | 171 | | // result = oneShotSecurity; |
| | | 172 | | //} |
| | | 173 | | } |
| | | 174 | | |
| | | 175 | | // set the algorithm suite and issued token params if required |
| | 87 | 176 | | if (WasAlgorithmSuiteSet || (!isKerberosSelected)) |
| | | 177 | | { |
| | 87 | 178 | | result.DefaultAlgorithmSuite = oneShotSecurity.DefaultAlgorithmSuite = AlgorithmSuite; |
| | | 179 | | } |
| | 0 | 180 | | else if (isKerberosSelected) |
| | | 181 | | { |
| | 0 | 182 | | result.DefaultAlgorithmSuite = oneShotSecurity.DefaultAlgorithmSuite = SecurityAlgorithmSuite.KerberosDe |
| | | 183 | | } |
| | | 184 | | |
| | 87 | 185 | | result.IncludeTimestamp = true; |
| | 87 | 186 | | oneShotSecurity.MessageSecurityVersion = version; |
| | 87 | 187 | | result.MessageSecurityVersion = version; |
| | 87 | 188 | | if (!isReliableSession) |
| | | 189 | | { |
| | 87 | 190 | | result.LocalServiceSettings.ReconnectTransportOnFailure = false; |
| | | 191 | | } |
| | | 192 | | else |
| | | 193 | | { |
| | 0 | 194 | | result.LocalServiceSettings.ReconnectTransportOnFailure = true; |
| | | 195 | | } |
| | | 196 | | |
| | 87 | 197 | | if (IsSecureConversationEnabled()) |
| | | 198 | | { |
| | 85 | 199 | | oneShotSecurity.LocalServiceSettings.IssuedCookieLifetime = s_defaultServerIssuedTransitionTokenLifetime |
| | | 200 | | //TODO SpNego when port, remove above and enable below. |
| | | 201 | | // issue the transition SCT for a short duration only |
| | | 202 | | // oneShotSecurity.LocalServiceSettings.IssuedCookieLifetime = SpnegoTokenAuthenticator.defaultServerIss |
| | | 203 | | } |
| | | 204 | | |
| | 87 | 205 | | return result; |
| | | 206 | | } |
| | | 207 | | } |
| | | 208 | | } |