| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.Generic; |
| | | 6 | | using System.Security.Claims; |
| | | 7 | | using System.Text; |
| | | 8 | | using CoreWCF.IdentityModel.Selectors; |
| | | 9 | | |
| | | 10 | | namespace CoreWCF.IdentityModel.Tokens |
| | | 11 | | { |
| | | 12 | | public class SamlSecurityTokenRequirement |
| | | 13 | | { |
| | | 14 | | private X509CertificateValidator _certificateValidator; |
| | | 15 | | |
| | | 16 | | /// <summary> |
| | | 17 | | /// Creates an instance of <see cref="SamlSecurityTokenRequirement"/> |
| | | 18 | | /// </summary> |
| | 18 | 19 | | public SamlSecurityTokenRequirement() |
| | | 20 | | { |
| | 18 | 21 | | } |
| | | 22 | | |
| | | 23 | | /// <summary> |
| | | 24 | | /// Gets/sets the X509CertificateValidator associated with this token requirement |
| | | 25 | | /// </summary> |
| | | 26 | | public X509CertificateValidator CertificateValidator |
| | | 27 | | { |
| | | 28 | | get |
| | | 29 | | { |
| | 0 | 30 | | return _certificateValidator; |
| | | 31 | | } |
| | | 32 | | set |
| | | 33 | | { |
| | 0 | 34 | | _certificateValidator = value ?? throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof |
| | 0 | 35 | | } |
| | | 36 | | } |
| | | 37 | | |
| | | 38 | | /// <summary> |
| | | 39 | | /// Gets or sets the Claim Type that will be used to generate the |
| | | 40 | | /// FederatedIdentity.Name property. |
| | | 41 | | /// </summary> |
| | 18 | 42 | | public string NameClaimType { get; set; } = ClaimsIdentity.DefaultNameClaimType; |
| | | 43 | | |
| | | 44 | | /// <summary> |
| | | 45 | | /// Gets the Claim Types that are used to generate the |
| | | 46 | | /// FederatedIdentity.Roles property. |
| | | 47 | | /// </summary> |
| | 18 | 48 | | public string RoleClaimType { get; set; } = ClaimTypes.Role; |
| | | 49 | | |
| | | 50 | | /// <summary> |
| | | 51 | | /// Checks if Audience Enforcement checks are required for the given token |
| | | 52 | | /// based on this SamlSecurityTokenRequirement settings. |
| | | 53 | | /// </summary> |
| | | 54 | | /// <param name="audienceUriMode"> |
| | | 55 | | /// The <see cref="AudienceUriMode"/> defining the audience requirement. |
| | | 56 | | /// </param> |
| | | 57 | | /// <param name="token">The Security token to be tested for Audience |
| | | 58 | | /// Enforcement.</param> |
| | | 59 | | /// <returns>True if Audience Enforcement should be applied.</returns> |
| | | 60 | | /// <exception cref="ArgumentNullException">The input argument 'token' is null.</exception> |
| | | 61 | | public virtual bool ShouldEnforceAudienceRestriction(AudienceUriMode audienceUriMode, SecurityToken token) |
| | | 62 | | { |
| | 48 | 63 | | if (null == token) |
| | | 64 | | { |
| | 0 | 65 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(token)); |
| | | 66 | | } |
| | | 67 | | |
| | | 68 | | switch (audienceUriMode) |
| | | 69 | | { |
| | | 70 | | case AudienceUriMode.Always: |
| | 47 | 71 | | return true; |
| | | 72 | | |
| | | 73 | | case AudienceUriMode.Never: |
| | 1 | 74 | | return false; |
| | | 75 | | |
| | | 76 | | case AudienceUriMode.BearerKeyOnly: |
| | 0 | 77 | | return (null == token.SecurityKeys || 0 == token.SecurityKeys.Count); |
| | | 78 | | |
| | | 79 | | default: |
| | 0 | 80 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR |
| | | 81 | | } |
| | | 82 | | } |
| | | 83 | | |
| | | 84 | | /// <summary> |
| | | 85 | | /// Checks the given list of Audience URIs with the AllowedAudienceUri list. |
| | | 86 | | /// </summary> |
| | | 87 | | /// <param name="allowedAudienceUris">Collection of AudienceUris.</param> |
| | | 88 | | /// <param name="tokenAudiences">Collection of audience URIs the token applies to.</param> |
| | | 89 | | /// <exception cref="ArgumentNullException">The input argument 'allowedAudienceUris' is null.</exception> |
| | | 90 | | /// <exception cref="ArgumentNullException">The input argument 'tokenAudiences' is null.</exception> |
| | | 91 | | /// <exception cref="AudienceUriValidationFailedException">Either the input argument 'tokenAudiences' or the con |
| | | 92 | | /// 'AudienceUris' collection is empty.</exception> |
| | | 93 | | public virtual void ValidateAudienceRestriction(IList<Uri> allowedAudienceUris, IList<Uri> tokenAudiences) |
| | | 94 | | { |
| | 39 | 95 | | if (null == allowedAudienceUris) |
| | | 96 | | { |
| | 0 | 97 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(allowedAudienceUris)); |
| | | 98 | | } |
| | | 99 | | |
| | 39 | 100 | | if (null == tokenAudiences) |
| | | 101 | | { |
| | 0 | 102 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(tokenAudiences)); |
| | | 103 | | } |
| | | 104 | | |
| | 39 | 105 | | if (0 == tokenAudiences.Count) |
| | | 106 | | { |
| | 0 | 107 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new AudienceUriValidationFailedException( |
| | 0 | 108 | | SR.Format(SR.ID1036))); |
| | | 109 | | } |
| | | 110 | | |
| | 39 | 111 | | if (0 == allowedAudienceUris.Count) |
| | | 112 | | { |
| | 0 | 113 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new AudienceUriValidationFailedException( |
| | 0 | 114 | | SR.Format(SR.ID1043))); |
| | | 115 | | } |
| | | 116 | | |
| | 39 | 117 | | bool found = false; |
| | 123 | 118 | | foreach (Uri audience in tokenAudiences) |
| | | 119 | | { |
| | 39 | 120 | | if (audience != null) |
| | | 121 | | { |
| | | 122 | | // Strip off any query string or fragment. This is necessary because the |
| | | 123 | | // CardSpace uses the raw Request-URI to form the audience when issuing |
| | | 124 | | // tokens for personal cards, but we clearly don't want things like the |
| | | 125 | | // ReturnUrl parameter affecting the audience matching. |
| | | 126 | | Uri audienceLeftPart; |
| | 39 | 127 | | if (audience.IsAbsoluteUri) |
| | | 128 | | { |
| | 39 | 129 | | audienceLeftPart = new Uri(audience.GetLeftPart(UriPartial.Path)); |
| | | 130 | | } |
| | | 131 | | else |
| | | 132 | | { |
| | 0 | 133 | | Uri baseUri = new Uri("http://www.example.com"); |
| | 0 | 134 | | Uri resolved = new Uri(baseUri, audience); |
| | 0 | 135 | | audienceLeftPart = baseUri.MakeRelativeUri(new Uri(resolved.GetLeftPart(UriPartial.Path))); |
| | | 136 | | } |
| | | 137 | | |
| | 39 | 138 | | if (allowedAudienceUris.Contains(audienceLeftPart)) |
| | | 139 | | { |
| | 33 | 140 | | found = true; |
| | 33 | 141 | | break; |
| | | 142 | | } |
| | | 143 | | } |
| | | 144 | | } |
| | | 145 | | |
| | 39 | 146 | | if (!found) |
| | | 147 | | { |
| | 6 | 148 | | if (1 == tokenAudiences.Count || null != tokenAudiences[0]) |
| | | 149 | | { |
| | 6 | 150 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new AudienceUriValidationFailedException( |
| | 6 | 151 | | SR.Format(SR.ID1038, tokenAudiences[0].OriginalString))); |
| | | 152 | | } |
| | | 153 | | else |
| | | 154 | | { |
| | 0 | 155 | | StringBuilder sb = new StringBuilder(SR.Format(SR.ID8007)); |
| | 0 | 156 | | bool first = true; |
| | | 157 | | |
| | 0 | 158 | | foreach (Uri a in tokenAudiences) |
| | | 159 | | { |
| | 0 | 160 | | if (a != null) |
| | | 161 | | { |
| | 0 | 162 | | if (first) |
| | | 163 | | { |
| | 0 | 164 | | first = false; |
| | | 165 | | } |
| | | 166 | | else |
| | | 167 | | { |
| | 0 | 168 | | sb.Append(", "); |
| | | 169 | | } |
| | | 170 | | |
| | 0 | 171 | | sb.Append(a.OriginalString); |
| | | 172 | | } |
| | | 173 | | } |
| | 0 | 174 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new AudienceUriValidationFailedException(S |
| | | 175 | | } |
| | | 176 | | } |
| | 33 | 177 | | } |
| | | 178 | | } |
| | | 179 | | } |
| | | 180 | | |