| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.Generic; |
| | | 6 | | using System.Net.Mail; |
| | | 7 | | using System.Runtime.Serialization; |
| | | 8 | | using System.Security.Cryptography; |
| | | 9 | | using System.Security.Cryptography.X509Certificates; |
| | | 10 | | using System.Security.Principal; |
| | | 11 | | using System.Xml; |
| | | 12 | | using CoreWCF.IdentityModel.Claims; |
| | | 13 | | using CoreWCF.IdentityModel.Policy; |
| | | 14 | | using CoreWCF.Security.Tokens; |
| | | 15 | | |
| | | 16 | | namespace CoreWCF.Security |
| | | 17 | | { |
| | | 18 | | internal static class SctClaimSerializer |
| | | 19 | | { |
| | | 20 | | private static void SerializeSid(SecurityIdentifier sid, SctClaimDictionary dictionary, XmlDictionaryWriter writ |
| | | 21 | | { |
| | 0 | 22 | | byte[] sidBytes = new byte[sid.BinaryLength]; |
| | 0 | 23 | | sid.GetBinaryForm(sidBytes, 0); |
| | 0 | 24 | | writer.WriteBase64(sidBytes, 0, sidBytes.Length); |
| | 0 | 25 | | } |
| | | 26 | | |
| | | 27 | | private static void WriteRightAttribute(Claim claim, SctClaimDictionary dictionary, XmlDictionaryWriter writer) |
| | | 28 | | { |
| | 0 | 29 | | if (Rights.PossessProperty.Equals(claim.Right)) |
| | | 30 | | { |
| | 0 | 31 | | return; |
| | | 32 | | } |
| | | 33 | | |
| | 0 | 34 | | writer.WriteAttributeString(dictionary.Right, dictionary.EmptyString, claim.Right); |
| | 0 | 35 | | } |
| | | 36 | | |
| | | 37 | | private static string ReadRightAttribute(XmlDictionaryReader reader, SctClaimDictionary dictionary) |
| | | 38 | | { |
| | 0 | 39 | | string right = reader.GetAttribute(dictionary.Right, dictionary.EmptyString); |
| | 0 | 40 | | return string.IsNullOrEmpty(right) ? Rights.PossessProperty : right; |
| | | 41 | | } |
| | | 42 | | |
| | | 43 | | private static void WriteSidAttribute(SecurityIdentifier sid, SctClaimDictionary dictionary, XmlDictionaryWriter |
| | | 44 | | { |
| | 0 | 45 | | byte[] sidBytes = new byte[sid.BinaryLength]; |
| | 0 | 46 | | sid.GetBinaryForm(sidBytes, 0); |
| | 0 | 47 | | writer.WriteAttributeString(dictionary.Sid, dictionary.EmptyString, Convert.ToBase64String(sidBytes)); |
| | 0 | 48 | | } |
| | | 49 | | |
| | | 50 | | private static SecurityIdentifier ReadSidAttribute(XmlDictionaryReader reader, SctClaimDictionary dictionary) |
| | | 51 | | { |
| | 0 | 52 | | byte[] sidBytes = Convert.FromBase64String(reader.GetAttribute(dictionary.Sid, dictionary.EmptyString)); |
| | 0 | 53 | | return new SecurityIdentifier(sidBytes, 0); |
| | | 54 | | } |
| | | 55 | | |
| | | 56 | | public static void SerializeClaim(Claim claim, SctClaimDictionary dictionary, XmlDictionaryWriter writer, XmlObj |
| | | 57 | | { |
| | | 58 | | // the order in which known claim types are checked is optimized for use patterns |
| | 0 | 59 | | if (claim == null) |
| | | 60 | | { |
| | 0 | 61 | | writer.WriteElementString(dictionary.NullValue, dictionary.EmptyString, string.Empty); |
| | 0 | 62 | | return; |
| | | 63 | | } |
| | 0 | 64 | | else if (ClaimTypes.Sid.Equals(claim.ClaimType)) |
| | | 65 | | { |
| | 0 | 66 | | writer.WriteStartElement(dictionary.WindowsSidClaim, dictionary.EmptyString); |
| | 0 | 67 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 68 | | SerializeSid((SecurityIdentifier)claim.Resource, dictionary, writer); |
| | 0 | 69 | | writer.WriteEndElement(); |
| | 0 | 70 | | return; |
| | | 71 | | } |
| | 0 | 72 | | else if (ClaimTypes.DenyOnlySid.Equals(claim.ClaimType)) |
| | | 73 | | { |
| | 0 | 74 | | writer.WriteStartElement(dictionary.DenyOnlySidClaim, dictionary.EmptyString); |
| | 0 | 75 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 76 | | SerializeSid((SecurityIdentifier)claim.Resource, dictionary, writer); |
| | 0 | 77 | | writer.WriteEndElement(); |
| | 0 | 78 | | return; |
| | | 79 | | } |
| | 0 | 80 | | else if (ClaimTypes.X500DistinguishedName.Equals(claim.ClaimType)) |
| | | 81 | | { |
| | 0 | 82 | | writer.WriteStartElement(dictionary.X500DistinguishedNameClaim, dictionary.EmptyString); |
| | 0 | 83 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 84 | | byte[] rawData = ((X500DistinguishedName)claim.Resource).RawData; |
| | 0 | 85 | | writer.WriteBase64(rawData, 0, rawData.Length); |
| | 0 | 86 | | writer.WriteEndElement(); |
| | 0 | 87 | | return; |
| | | 88 | | } |
| | 0 | 89 | | else if (ClaimTypes.Thumbprint.Equals(claim.ClaimType)) |
| | | 90 | | { |
| | 0 | 91 | | writer.WriteStartElement(dictionary.X509ThumbprintClaim, dictionary.EmptyString); |
| | 0 | 92 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 93 | | byte[] thumbprint = (byte[])claim.Resource; |
| | 0 | 94 | | writer.WriteBase64(thumbprint, 0, thumbprint.Length); |
| | 0 | 95 | | writer.WriteEndElement(); |
| | 0 | 96 | | return; |
| | | 97 | | } |
| | 0 | 98 | | else if (ClaimTypes.Name.Equals(claim.ClaimType)) |
| | | 99 | | { |
| | 0 | 100 | | writer.WriteStartElement(dictionary.NameClaim, dictionary.EmptyString); |
| | 0 | 101 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 102 | | writer.WriteString((string)claim.Resource); |
| | 0 | 103 | | writer.WriteEndElement(); |
| | 0 | 104 | | return; |
| | | 105 | | } |
| | 0 | 106 | | else if (ClaimTypes.Dns.Equals(claim.ClaimType)) |
| | | 107 | | { |
| | 0 | 108 | | writer.WriteStartElement(dictionary.DnsClaim, dictionary.EmptyString); |
| | 0 | 109 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 110 | | writer.WriteString((string)claim.Resource); |
| | 0 | 111 | | writer.WriteEndElement(); |
| | 0 | 112 | | return; |
| | | 113 | | } |
| | 0 | 114 | | else if (ClaimTypes.Rsa.Equals(claim.ClaimType)) |
| | | 115 | | { |
| | 0 | 116 | | writer.WriteStartElement(dictionary.RsaClaim, dictionary.EmptyString); |
| | 0 | 117 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 118 | | writer.WriteString(((RSA)claim.Resource).ToXmlString(false)); |
| | 0 | 119 | | writer.WriteEndElement(); |
| | 0 | 120 | | return; |
| | | 121 | | } |
| | 0 | 122 | | else if (ClaimTypes.Email.Equals(claim.ClaimType)) |
| | | 123 | | { |
| | 0 | 124 | | writer.WriteStartElement(dictionary.MailAddressClaim, dictionary.EmptyString); |
| | 0 | 125 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 126 | | writer.WriteString(((MailAddress)claim.Resource).Address); |
| | 0 | 127 | | writer.WriteEndElement(); |
| | 0 | 128 | | return; |
| | | 129 | | } |
| | 0 | 130 | | else if (claim == Claim.System) |
| | | 131 | | { |
| | 0 | 132 | | writer.WriteElementString(dictionary.SystemClaim, dictionary.EmptyString, string.Empty); |
| | 0 | 133 | | return; |
| | | 134 | | } |
| | 0 | 135 | | else if (ClaimTypes.Hash.Equals(claim.ClaimType)) |
| | | 136 | | { |
| | 0 | 137 | | writer.WriteStartElement(dictionary.HashClaim, dictionary.EmptyString); |
| | 0 | 138 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 139 | | byte[] hash = (byte[])claim.Resource; |
| | 0 | 140 | | writer.WriteBase64(hash, 0, hash.Length); |
| | 0 | 141 | | writer.WriteEndElement(); |
| | 0 | 142 | | return; |
| | | 143 | | } |
| | 0 | 144 | | else if (ClaimTypes.Spn.Equals(claim.ClaimType)) |
| | | 145 | | { |
| | 0 | 146 | | writer.WriteStartElement(dictionary.SpnClaim, dictionary.EmptyString); |
| | 0 | 147 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 148 | | writer.WriteString((string)claim.Resource); |
| | 0 | 149 | | writer.WriteEndElement(); |
| | 0 | 150 | | return; |
| | | 151 | | } |
| | 0 | 152 | | else if (ClaimTypes.Upn.Equals(claim.ClaimType)) |
| | | 153 | | { |
| | 0 | 154 | | writer.WriteStartElement(dictionary.UpnClaim, dictionary.EmptyString); |
| | 0 | 155 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 156 | | writer.WriteString((string)claim.Resource); |
| | 0 | 157 | | writer.WriteEndElement(); |
| | 0 | 158 | | return; |
| | | 159 | | } |
| | 0 | 160 | | else if (ClaimTypes.Uri.Equals(claim.ClaimType)) |
| | | 161 | | { |
| | 0 | 162 | | writer.WriteStartElement(dictionary.UrlClaim, dictionary.EmptyString); |
| | 0 | 163 | | WriteRightAttribute(claim, dictionary, writer); |
| | 0 | 164 | | writer.WriteString(((Uri)claim.Resource).AbsoluteUri); |
| | 0 | 165 | | writer.WriteEndElement(); |
| | 0 | 166 | | return; |
| | | 167 | | } |
| | | 168 | | else |
| | | 169 | | { |
| | | 170 | | // this is an extensible claim... need to delegate to xml object serializer |
| | 0 | 171 | | serializer.WriteObject(writer, claim); |
| | | 172 | | } |
| | 0 | 173 | | } |
| | | 174 | | |
| | | 175 | | public static void SerializeClaimSet(ClaimSet claimSet, SctClaimDictionary dictionary, XmlDictionaryWriter write |
| | | 176 | | { |
| | 0 | 177 | | if (claimSet is X509CertificateClaimSet) |
| | | 178 | | { |
| | 0 | 179 | | X509CertificateClaimSet x509ClaimSet = (X509CertificateClaimSet)claimSet; |
| | 0 | 180 | | writer.WriteStartElement(dictionary.X509CertificateClaimSet, dictionary.EmptyString); |
| | 0 | 181 | | byte[] rawData = x509ClaimSet.X509Certificate.RawData; |
| | 0 | 182 | | writer.WriteBase64(rawData, 0, rawData.Length); |
| | 0 | 183 | | writer.WriteEndElement(); |
| | | 184 | | } |
| | 0 | 185 | | else if (claimSet == ClaimSet.System) |
| | | 186 | | { |
| | 0 | 187 | | writer.WriteElementString(dictionary.SystemClaimSet, dictionary.EmptyString, string.Empty); |
| | | 188 | | } |
| | 0 | 189 | | else if (claimSet == ClaimSet.Windows) |
| | | 190 | | { |
| | 0 | 191 | | writer.WriteElementString(dictionary.WindowsClaimSet, dictionary.EmptyString, string.Empty); |
| | | 192 | | } |
| | 0 | 193 | | else if (claimSet == ClaimSet.Anonymous) |
| | | 194 | | { |
| | 0 | 195 | | writer.WriteElementString(dictionary.AnonymousClaimSet, dictionary.EmptyString, string.Empty); |
| | | 196 | | } |
| | 0 | 197 | | else if (claimSet is WindowsClaimSet || claimSet is DefaultClaimSet) |
| | | 198 | | { |
| | 0 | 199 | | writer.WriteStartElement(dictionary.ClaimSet, dictionary.EmptyString); |
| | 0 | 200 | | writer.WriteStartElement(dictionary.PrimaryIssuer, dictionary.EmptyString); |
| | 0 | 201 | | if (claimSet.Issuer == claimSet) |
| | | 202 | | { |
| | 0 | 203 | | writer.WriteElementString(dictionary.NullValue, dictionary.EmptyString, string.Empty); |
| | | 204 | | } |
| | | 205 | | else |
| | | 206 | | { |
| | 0 | 207 | | SerializeClaimSet(claimSet.Issuer, dictionary, writer, serializer, claimSerializer); |
| | | 208 | | } |
| | 0 | 209 | | writer.WriteEndElement(); |
| | | 210 | | |
| | 0 | 211 | | foreach (Claim claim in claimSet) |
| | | 212 | | { |
| | 0 | 213 | | writer.WriteStartElement(dictionary.Claim, dictionary.EmptyString); |
| | 0 | 214 | | SerializeClaim(claim, dictionary, writer, claimSerializer); |
| | 0 | 215 | | writer.WriteEndElement(); |
| | | 216 | | } |
| | 0 | 217 | | writer.WriteEndElement(); |
| | | 218 | | } |
| | | 219 | | else |
| | | 220 | | { |
| | 0 | 221 | | serializer.WriteObject(writer, claimSet); |
| | | 222 | | } |
| | 0 | 223 | | } |
| | | 224 | | |
| | | 225 | | public static Claim DeserializeClaim(XmlDictionaryReader reader, SctClaimDictionary dictionary, XmlObjectSeriali |
| | | 226 | | { |
| | 0 | 227 | | if (reader.IsStartElement(dictionary.NullValue, dictionary.EmptyString)) |
| | | 228 | | { |
| | 0 | 229 | | reader.ReadElementString(); |
| | 0 | 230 | | return null; |
| | | 231 | | } |
| | 0 | 232 | | else if (reader.IsStartElement(dictionary.WindowsSidClaim, dictionary.EmptyString)) |
| | | 233 | | { |
| | 0 | 234 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 235 | | reader.ReadStartElement(); |
| | 0 | 236 | | byte[] sidBytes = reader.ReadContentAsBase64(); |
| | 0 | 237 | | reader.ReadEndElement(); |
| | 0 | 238 | | return new Claim(ClaimTypes.Sid, new SecurityIdentifier(sidBytes, 0), right); |
| | | 239 | | } |
| | 0 | 240 | | else if (reader.IsStartElement(dictionary.DenyOnlySidClaim, dictionary.EmptyString)) |
| | | 241 | | { |
| | 0 | 242 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 243 | | reader.ReadStartElement(); |
| | 0 | 244 | | byte[] sidBytes = reader.ReadContentAsBase64(); |
| | 0 | 245 | | reader.ReadEndElement(); |
| | 0 | 246 | | return new Claim(ClaimTypes.DenyOnlySid, new SecurityIdentifier(sidBytes, 0), right); |
| | | 247 | | } |
| | 0 | 248 | | else if (reader.IsStartElement(dictionary.X500DistinguishedNameClaim, dictionary.EmptyString)) |
| | | 249 | | { |
| | 0 | 250 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 251 | | reader.ReadStartElement(); |
| | 0 | 252 | | byte[] rawData = reader.ReadContentAsBase64(); |
| | 0 | 253 | | reader.ReadEndElement(); |
| | 0 | 254 | | return new Claim(ClaimTypes.X500DistinguishedName, new X500DistinguishedName(rawData), right); |
| | | 255 | | } |
| | 0 | 256 | | else if (reader.IsStartElement(dictionary.X509ThumbprintClaim, dictionary.EmptyString)) |
| | | 257 | | { |
| | 0 | 258 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 259 | | reader.ReadStartElement(); |
| | 0 | 260 | | byte[] thumbprint = reader.ReadContentAsBase64(); |
| | 0 | 261 | | reader.ReadEndElement(); |
| | 0 | 262 | | return new Claim(ClaimTypes.Thumbprint, thumbprint, right); |
| | | 263 | | } |
| | 0 | 264 | | else if (reader.IsStartElement(dictionary.NameClaim, dictionary.EmptyString)) |
| | | 265 | | { |
| | 0 | 266 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 267 | | reader.ReadStartElement(); |
| | 0 | 268 | | string name = reader.ReadString(); |
| | 0 | 269 | | reader.ReadEndElement(); |
| | 0 | 270 | | return new Claim(ClaimTypes.Name, name, right); |
| | | 271 | | } |
| | 0 | 272 | | else if (reader.IsStartElement(dictionary.DnsClaim, dictionary.EmptyString)) |
| | | 273 | | { |
| | 0 | 274 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 275 | | reader.ReadStartElement(); |
| | 0 | 276 | | string dns = reader.ReadString(); |
| | 0 | 277 | | reader.ReadEndElement(); |
| | 0 | 278 | | return new Claim(ClaimTypes.Dns, dns, right); |
| | | 279 | | } |
| | 0 | 280 | | else if (reader.IsStartElement(dictionary.RsaClaim, dictionary.EmptyString)) |
| | | 281 | | { |
| | 0 | 282 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 283 | | reader.ReadStartElement(); |
| | 0 | 284 | | string rsaXml = reader.ReadString(); |
| | 0 | 285 | | reader.ReadEndElement(); |
| | | 286 | | |
| | 0 | 287 | | RSA rsa = RSA.Create(); |
| | 0 | 288 | | rsa.FromXmlString(rsaXml); |
| | 0 | 289 | | return new Claim(ClaimTypes.Rsa, rsa, right); |
| | | 290 | | } |
| | 0 | 291 | | else if (reader.IsStartElement(dictionary.MailAddressClaim, dictionary.EmptyString)) |
| | | 292 | | { |
| | 0 | 293 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 294 | | reader.ReadStartElement(); |
| | 0 | 295 | | string address = reader.ReadString(); |
| | 0 | 296 | | reader.ReadEndElement(); |
| | 0 | 297 | | return new Claim(ClaimTypes.Email, new System.Net.Mail.MailAddress(address), right); |
| | | 298 | | } |
| | 0 | 299 | | else if (reader.IsStartElement(dictionary.SystemClaim, dictionary.EmptyString)) |
| | | 300 | | { |
| | 0 | 301 | | reader.ReadElementString(); |
| | 0 | 302 | | return Claim.System; |
| | | 303 | | } |
| | 0 | 304 | | else if (reader.IsStartElement(dictionary.HashClaim, dictionary.EmptyString)) |
| | | 305 | | { |
| | 0 | 306 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 307 | | reader.ReadStartElement(); |
| | 0 | 308 | | byte[] hash = reader.ReadContentAsBase64(); |
| | 0 | 309 | | reader.ReadEndElement(); |
| | 0 | 310 | | return new Claim(ClaimTypes.Hash, hash, right); |
| | | 311 | | } |
| | 0 | 312 | | else if (reader.IsStartElement(dictionary.SpnClaim, dictionary.EmptyString)) |
| | | 313 | | { |
| | 0 | 314 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 315 | | reader.ReadStartElement(); |
| | 0 | 316 | | string spn = reader.ReadString(); |
| | 0 | 317 | | reader.ReadEndElement(); |
| | 0 | 318 | | return new Claim(ClaimTypes.Spn, spn, right); |
| | | 319 | | } |
| | 0 | 320 | | else if (reader.IsStartElement(dictionary.UpnClaim, dictionary.EmptyString)) |
| | | 321 | | { |
| | 0 | 322 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 323 | | reader.ReadStartElement(); |
| | 0 | 324 | | string upn = reader.ReadString(); |
| | 0 | 325 | | reader.ReadEndElement(); |
| | 0 | 326 | | return new Claim(ClaimTypes.Upn, upn, right); |
| | | 327 | | } |
| | 0 | 328 | | else if (reader.IsStartElement(dictionary.UrlClaim, dictionary.EmptyString)) |
| | | 329 | | { |
| | 0 | 330 | | string right = ReadRightAttribute(reader, dictionary); |
| | 0 | 331 | | reader.ReadStartElement(); |
| | 0 | 332 | | string url = reader.ReadString(); |
| | 0 | 333 | | reader.ReadEndElement(); |
| | 0 | 334 | | return new Claim(ClaimTypes.Uri, new Uri(url), right); |
| | | 335 | | } |
| | | 336 | | else |
| | | 337 | | { |
| | 0 | 338 | | return (Claim)serializer.ReadObject(reader); |
| | | 339 | | } |
| | | 340 | | } |
| | | 341 | | |
| | | 342 | | public static ClaimSet DeserializeClaimSet(XmlDictionaryReader reader, SctClaimDictionary dictionary, XmlObjectS |
| | | 343 | | { |
| | 0 | 344 | | if (reader.IsStartElement(dictionary.NullValue, dictionary.EmptyString)) |
| | | 345 | | { |
| | 0 | 346 | | reader.ReadElementString(); |
| | 0 | 347 | | return null; |
| | | 348 | | } |
| | 0 | 349 | | else if (reader.IsStartElement(dictionary.X509CertificateClaimSet, dictionary.EmptyString)) |
| | | 350 | | { |
| | 0 | 351 | | reader.ReadStartElement(); |
| | 0 | 352 | | byte[] rawData = reader.ReadContentAsBase64(); |
| | 0 | 353 | | reader.ReadEndElement(); |
| | 0 | 354 | | return new X509CertificateClaimSet(new X509Certificate2(rawData), false); |
| | | 355 | | } |
| | 0 | 356 | | else if (reader.IsStartElement(dictionary.SystemClaimSet, dictionary.EmptyString)) |
| | | 357 | | { |
| | 0 | 358 | | reader.ReadElementString(); |
| | 0 | 359 | | return ClaimSet.System; |
| | | 360 | | } |
| | 0 | 361 | | else if (reader.IsStartElement(dictionary.WindowsClaimSet, dictionary.EmptyString)) |
| | | 362 | | { |
| | 0 | 363 | | reader.ReadElementString(); |
| | 0 | 364 | | return ClaimSet.Windows; |
| | | 365 | | } |
| | 0 | 366 | | else if (reader.IsStartElement(dictionary.AnonymousClaimSet, dictionary.EmptyString)) |
| | | 367 | | { |
| | 0 | 368 | | reader.ReadElementString(); |
| | 0 | 369 | | return ClaimSet.Anonymous; |
| | | 370 | | } |
| | 0 | 371 | | else if (reader.IsStartElement(dictionary.ClaimSet, dictionary.EmptyString)) |
| | | 372 | | { |
| | 0 | 373 | | ClaimSet issuer = null; |
| | 0 | 374 | | List<Claim> claims = new List<Claim>(); |
| | 0 | 375 | | reader.ReadStartElement(); |
| | | 376 | | |
| | 0 | 377 | | if (reader.IsStartElement(dictionary.PrimaryIssuer, dictionary.EmptyString)) |
| | | 378 | | { |
| | 0 | 379 | | reader.ReadStartElement(); |
| | 0 | 380 | | issuer = DeserializeClaimSet(reader, dictionary, serializer, claimSerializer); |
| | 0 | 381 | | reader.ReadEndElement(); |
| | | 382 | | } |
| | | 383 | | |
| | 0 | 384 | | while (reader.IsStartElement()) |
| | | 385 | | { |
| | 0 | 386 | | reader.ReadStartElement(); |
| | 0 | 387 | | claims.Add(DeserializeClaim(reader, dictionary, claimSerializer)); |
| | 0 | 388 | | reader.ReadEndElement(); |
| | | 389 | | } |
| | | 390 | | |
| | 0 | 391 | | reader.ReadEndElement(); |
| | 0 | 392 | | return issuer != null ? new DefaultClaimSet(issuer, claims) : new DefaultClaimSet(claims); |
| | | 393 | | } |
| | | 394 | | else |
| | | 395 | | { |
| | 0 | 396 | | return (ClaimSet)serializer.ReadObject(reader); |
| | | 397 | | } |
| | | 398 | | } |
| | | 399 | | |
| | | 400 | | public static void SerializeIdentities(AuthorizationContext authContext, SctClaimDictionary dictionary, XmlDicti |
| | | 401 | | { |
| | | 402 | | IList<IIdentity> identities; |
| | 0 | 403 | | if (authContext.Properties.TryGetValue(SecurityUtils.Identities, out object obj)) |
| | | 404 | | { |
| | 0 | 405 | | identities = obj as IList<IIdentity>; |
| | 0 | 406 | | if (identities != null && identities.Count > 0) |
| | | 407 | | { |
| | 0 | 408 | | writer.WriteStartElement(dictionary.Identities, dictionary.EmptyString); |
| | 0 | 409 | | for (int i = 0; i < identities.Count; ++i) |
| | | 410 | | { |
| | 0 | 411 | | SerializePrimaryIdentity(identities[i], dictionary, writer, serializer); |
| | | 412 | | } |
| | 0 | 413 | | writer.WriteEndElement(); |
| | | 414 | | } |
| | | 415 | | } |
| | 0 | 416 | | } |
| | | 417 | | |
| | | 418 | | private static void SerializePrimaryIdentity(IIdentity identity, SctClaimDictionary dictionary, XmlDictionaryWri |
| | | 419 | | { |
| | 0 | 420 | | if (identity != null && identity != SecurityUtils.AnonymousIdentity) |
| | | 421 | | { |
| | 0 | 422 | | writer.WriteStartElement(dictionary.PrimaryIdentity, dictionary.EmptyString); |
| | 0 | 423 | | if (identity is WindowsIdentity) |
| | | 424 | | { |
| | 0 | 425 | | WindowsIdentity wid = (WindowsIdentity)identity; |
| | 0 | 426 | | writer.WriteStartElement(dictionary.WindowsSidIdentity, dictionary.EmptyString); |
| | 0 | 427 | | WriteSidAttribute(wid.User, dictionary, writer); |
| | | 428 | | |
| | | 429 | | // This is to work around WOW64 bug Windows OS 1491447 |
| | 0 | 430 | | string authenticationType = null; |
| | 0 | 431 | | using (WindowsIdentity self = WindowsIdentity.GetCurrent()) |
| | | 432 | | { |
| | | 433 | | // is owner or admin? AuthenticationType could throw un-authorized exception |
| | 0 | 434 | | if ((self.User == wid.Owner) || |
| | 0 | 435 | | (wid.Owner != null && self.Groups.Contains(wid.Owner)) || |
| | 0 | 436 | | (wid.Owner != SecurityUtils.AdministratorsSid && self.Groups.Contains(SecurityUtils.Administ |
| | | 437 | | { |
| | 0 | 438 | | authenticationType = wid.AuthenticationType; |
| | | 439 | | } |
| | 0 | 440 | | } |
| | 0 | 441 | | if (!string.IsNullOrEmpty(authenticationType)) |
| | | 442 | | { |
| | 0 | 443 | | writer.WriteAttributeString(dictionary.AuthenticationType, dictionary.EmptyString, authenticatio |
| | | 444 | | } |
| | | 445 | | |
| | 0 | 446 | | writer.WriteString(wid.Name); |
| | 0 | 447 | | writer.WriteEndElement(); |
| | | 448 | | } |
| | 0 | 449 | | else if (identity is WindowsSidIdentity) |
| | | 450 | | { |
| | 0 | 451 | | WindowsSidIdentity wsid = (WindowsSidIdentity)identity; |
| | 0 | 452 | | writer.WriteStartElement(dictionary.WindowsSidIdentity, dictionary.EmptyString); |
| | 0 | 453 | | WriteSidAttribute(wsid.SecurityIdentifier, dictionary, writer); |
| | 0 | 454 | | if (!string.IsNullOrEmpty(wsid.AuthenticationType)) |
| | | 455 | | { |
| | 0 | 456 | | writer.WriteAttributeString(dictionary.AuthenticationType, dictionary.EmptyString, wsid.Authenti |
| | | 457 | | } |
| | | 458 | | |
| | 0 | 459 | | writer.WriteString(wsid.Name); |
| | 0 | 460 | | writer.WriteEndElement(); |
| | | 461 | | } |
| | 0 | 462 | | else if (identity is GenericIdentity) |
| | | 463 | | { |
| | 0 | 464 | | GenericIdentity genericIdentity = (GenericIdentity)identity; |
| | 0 | 465 | | writer.WriteStartElement(dictionary.GenericIdentity, dictionary.EmptyString); |
| | 0 | 466 | | if (!string.IsNullOrEmpty(genericIdentity.AuthenticationType)) |
| | | 467 | | { |
| | 0 | 468 | | writer.WriteAttributeString(dictionary.AuthenticationType, dictionary.EmptyString, genericIdenti |
| | | 469 | | } |
| | | 470 | | |
| | 0 | 471 | | writer.WriteString(genericIdentity.Name); |
| | 0 | 472 | | writer.WriteEndElement(); |
| | | 473 | | } |
| | | 474 | | else |
| | | 475 | | { |
| | 0 | 476 | | serializer.WriteObject(writer, identity); |
| | | 477 | | } |
| | 0 | 478 | | writer.WriteEndElement(); |
| | | 479 | | } |
| | 0 | 480 | | } |
| | | 481 | | |
| | | 482 | | public static IList<IIdentity> DeserializeIdentities(XmlDictionaryReader reader, SctClaimDictionary dictionary, |
| | | 483 | | { |
| | 0 | 484 | | List<IIdentity> identities = null; |
| | 0 | 485 | | if (reader.IsStartElement(dictionary.Identities, dictionary.EmptyString)) |
| | | 486 | | { |
| | 0 | 487 | | identities = new List<IIdentity>(); |
| | 0 | 488 | | reader.ReadStartElement(); |
| | 0 | 489 | | while (reader.IsStartElement(dictionary.PrimaryIdentity, dictionary.EmptyString)) |
| | | 490 | | { |
| | 0 | 491 | | IIdentity identity = DeserializePrimaryIdentity(reader, dictionary, serializer); |
| | 0 | 492 | | if (identity != null && identity != SecurityUtils.AnonymousIdentity) |
| | | 493 | | { |
| | 0 | 494 | | identities.Add(identity); |
| | | 495 | | } |
| | | 496 | | } |
| | 0 | 497 | | reader.ReadEndElement(); |
| | | 498 | | } |
| | 0 | 499 | | return identities; |
| | | 500 | | } |
| | | 501 | | |
| | | 502 | | private static IIdentity DeserializePrimaryIdentity(XmlDictionaryReader reader, SctClaimDictionary dictionary, X |
| | | 503 | | { |
| | 0 | 504 | | IIdentity identity = null; |
| | 0 | 505 | | if (reader.IsStartElement(dictionary.PrimaryIdentity, dictionary.EmptyString)) |
| | | 506 | | { |
| | 0 | 507 | | reader.ReadStartElement(); |
| | 0 | 508 | | if (reader.IsStartElement(dictionary.WindowsSidIdentity, dictionary.EmptyString)) |
| | | 509 | | { |
| | 0 | 510 | | SecurityIdentifier sid = ReadSidAttribute(reader, dictionary); |
| | 0 | 511 | | string authenticationType = reader.GetAttribute(dictionary.AuthenticationType, dictionary.EmptyStrin |
| | 0 | 512 | | reader.ReadStartElement(); |
| | 0 | 513 | | string name = reader.ReadContentAsString(); |
| | 0 | 514 | | identity = new WindowsSidIdentity(sid, name, authenticationType ?? string.Empty); |
| | 0 | 515 | | reader.ReadEndElement(); |
| | | 516 | | } |
| | 0 | 517 | | else if (reader.IsStartElement(dictionary.GenericIdentity, dictionary.EmptyString)) |
| | | 518 | | { |
| | 0 | 519 | | string authenticationType = reader.GetAttribute(dictionary.AuthenticationType, dictionary.EmptyStrin |
| | 0 | 520 | | reader.ReadStartElement(); |
| | 0 | 521 | | string name = reader.ReadContentAsString(); |
| | 0 | 522 | | identity = SecurityUtils.CreateIdentity(name, authenticationType ?? string.Empty); |
| | 0 | 523 | | reader.ReadEndElement(); |
| | | 524 | | } |
| | | 525 | | else |
| | | 526 | | { |
| | 0 | 527 | | identity = (IIdentity)serializer.ReadObject(reader); |
| | | 528 | | } |
| | 0 | 529 | | reader.ReadEndElement(); |
| | | 530 | | } |
| | 0 | 531 | | return identity; |
| | | 532 | | } |
| | | 533 | | } |
| | | 534 | | } |