| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.ObjectModel; |
| | | 6 | | using System.ComponentModel; |
| | | 7 | | using System.Runtime.CompilerServices; |
| | | 8 | | using CoreWCF.Channels; |
| | | 9 | | using CoreWCF.Collections.Generic; |
| | | 10 | | using CoreWCF.Dispatcher; |
| | | 11 | | using CoreWCF.IdentityModel.Policy; |
| | | 12 | | using CoreWCF.Runtime; |
| | | 13 | | using Microsoft.AspNetCore.Authorization; |
| | | 14 | | using Microsoft.Extensions.DependencyInjection; |
| | | 15 | | |
| | | 16 | | namespace CoreWCF.Description |
| | | 17 | | { |
| | | 18 | | public sealed class ServiceAuthorizationBehavior : IServiceBehavior, IDisposable, ICloneable |
| | | 19 | | { |
| | | 20 | | internal const bool DefaultImpersonateCallerForAllOperations = false; |
| | | 21 | | internal const bool DefaultImpersonateOnSerializingReply = false; |
| | | 22 | | internal const PrincipalPermissionMode DefaultPrincipalPermissionMode = PrincipalPermissionMode.UseWindowsGroups |
| | | 23 | | private bool _impersonateCallerForAllOperations; |
| | | 24 | | private readonly bool _impersonateOnSerializingReply; |
| | | 25 | | private ReadOnlyCollection<IAuthorizationPolicy> _externalAuthorizationPolicies; |
| | | 26 | | private ServiceAuthorizationManager _serviceAuthorizationManager; |
| | | 27 | | private IServiceScopeFactory _serviceScopeFactory; |
| | | 28 | | private IServiceScope _scope; |
| | | 29 | | private PrincipalPermissionMode _principalPermissionMode; |
| | | 30 | | private bool _isExternalPoliciesSet; |
| | | 31 | | private bool _isAuthorizationManagerSet; |
| | | 32 | | private bool _isReadOnly; |
| | | 33 | | |
| | 575 | 34 | | public ServiceAuthorizationBehavior() |
| | | 35 | | { |
| | 575 | 36 | | _impersonateCallerForAllOperations = DefaultImpersonateCallerForAllOperations; |
| | 575 | 37 | | _impersonateOnSerializingReply = DefaultImpersonateOnSerializingReply; |
| | 575 | 38 | | _principalPermissionMode = DefaultPrincipalPermissionMode; |
| | 575 | 39 | | } |
| | | 40 | | |
| | 585 | 41 | | private ServiceAuthorizationBehavior(ServiceAuthorizationBehavior other) |
| | | 42 | | { |
| | 585 | 43 | | _impersonateCallerForAllOperations = other._impersonateCallerForAllOperations; |
| | 585 | 44 | | _impersonateOnSerializingReply = other._impersonateOnSerializingReply; |
| | 585 | 45 | | _externalAuthorizationPolicies = other._externalAuthorizationPolicies; |
| | 585 | 46 | | _serviceAuthorizationManager = other._serviceAuthorizationManager; |
| | 585 | 47 | | _serviceScopeFactory = other._serviceScopeFactory; |
| | 585 | 48 | | _scope = other._scope; |
| | 585 | 49 | | _principalPermissionMode = other._principalPermissionMode; |
| | 585 | 50 | | _isExternalPoliciesSet = other._isExternalPoliciesSet; |
| | 585 | 51 | | _isAuthorizationManagerSet = other._isAuthorizationManagerSet; |
| | 585 | 52 | | _isReadOnly = other._isReadOnly; |
| | 585 | 53 | | } |
| | | 54 | | |
| | | 55 | | public ReadOnlyCollection<IAuthorizationPolicy> ExternalAuthorizationPolicies |
| | | 56 | | { |
| | | 57 | | get |
| | | 58 | | { |
| | 0 | 59 | | return _externalAuthorizationPolicies; |
| | | 60 | | } |
| | | 61 | | set |
| | | 62 | | { |
| | 17 | 63 | | ThrowIfImmutable(); |
| | 17 | 64 | | _isExternalPoliciesSet = true; |
| | 17 | 65 | | _externalAuthorizationPolicies = value; |
| | 17 | 66 | | } |
| | | 67 | | } |
| | | 68 | | |
| | | 69 | | public bool ShouldSerializeExternalAuthorizationPolicies() |
| | | 70 | | { |
| | 0 | 71 | | return _isExternalPoliciesSet; |
| | | 72 | | } |
| | | 73 | | |
| | | 74 | | public ServiceAuthorizationManager ServiceAuthorizationManager |
| | | 75 | | { |
| | | 76 | | get |
| | | 77 | | { |
| | 0 | 78 | | return _serviceAuthorizationManager; |
| | | 79 | | } |
| | | 80 | | set |
| | | 81 | | { |
| | 5 | 82 | | ThrowIfImmutable(); |
| | 5 | 83 | | _isAuthorizationManagerSet = true; |
| | 5 | 84 | | _serviceAuthorizationManager = value; |
| | 5 | 85 | | } |
| | | 86 | | } |
| | | 87 | | |
| | | 88 | | public bool ShouldSerializeServiceAuthorizationManager() |
| | | 89 | | { |
| | 0 | 90 | | return _isAuthorizationManagerSet; |
| | | 91 | | } |
| | | 92 | | |
| | | 93 | | [DefaultValue(DefaultPrincipalPermissionMode)] |
| | | 94 | | public PrincipalPermissionMode PrincipalPermissionMode |
| | | 95 | | { |
| | | 96 | | get |
| | | 97 | | { |
| | 0 | 98 | | return _principalPermissionMode; |
| | | 99 | | } |
| | | 100 | | set |
| | | 101 | | { |
| | 7 | 102 | | if (!PrincipalPermissionModeHelper.IsDefined(value)) |
| | | 103 | | { |
| | 0 | 104 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof(val |
| | | 105 | | } |
| | 7 | 106 | | ThrowIfImmutable(); |
| | 7 | 107 | | _principalPermissionMode = value; |
| | 7 | 108 | | } |
| | | 109 | | } |
| | | 110 | | |
| | | 111 | | |
| | | 112 | | [DefaultValue(DefaultImpersonateCallerForAllOperations)] |
| | | 113 | | public bool ImpersonateCallerForAllOperations |
| | | 114 | | { |
| | | 115 | | get |
| | | 116 | | { |
| | 0 | 117 | | return _impersonateCallerForAllOperations; |
| | | 118 | | } |
| | | 119 | | set |
| | | 120 | | { |
| | 0 | 121 | | ThrowIfImmutable(); |
| | 0 | 122 | | _impersonateCallerForAllOperations = value; |
| | 0 | 123 | | } |
| | | 124 | | } |
| | | 125 | | |
| | | 126 | | |
| | | 127 | | [DefaultValue(DefaultImpersonateOnSerializingReply)] |
| | | 128 | | public bool ImpersonateOnSerializingReply |
| | | 129 | | { |
| | | 130 | | get |
| | | 131 | | { |
| | 0 | 132 | | return _impersonateOnSerializingReply; |
| | | 133 | | } |
| | | 134 | | set |
| | | 135 | | { |
| | | 136 | | // ThrowIfImmutable(); |
| | | 137 | | // impersonateOnSerializingReply = value; |
| | 0 | 138 | | throw new PlatformNotSupportedException(); |
| | | 139 | | } |
| | | 140 | | } |
| | | 141 | | |
| | | 142 | | [Obsolete("ServiceAuthorizationBehavior.AuthorizationService will be made internal in next major release.")] |
| | | 143 | | public IAuthorizationService AuthorizationService |
| | | 144 | | { |
| | 0 | 145 | | get => throw new NotSupportedException(); |
| | 0 | 146 | | set => throw new NotSupportedException(); |
| | | 147 | | } |
| | | 148 | | |
| | | 149 | | private IAuthorizationService GetAuthorizationService() |
| | | 150 | | { |
| | 751 | 151 | | IServiceScope scope = _scope ??= _serviceScopeFactory?.CreateScope(); |
| | 751 | 152 | | return scope?.ServiceProvider.GetService<IAuthorizationService>(); |
| | | 153 | | } |
| | | 154 | | |
| | | 155 | | internal IServiceScopeFactory ServiceScopeFactory |
| | | 156 | | { |
| | | 157 | | set |
| | | 158 | | { |
| | 571 | 159 | | ThrowIfImmutable(); |
| | 571 | 160 | | _serviceScopeFactory = value; |
| | 571 | 161 | | } |
| | | 162 | | } |
| | | 163 | | |
| | | 164 | | [MethodImpl(MethodImplOptions.NoInlining)] |
| | | 165 | | private void ApplyAuthorizationPoliciesAndManager(DispatchRuntime behavior) |
| | | 166 | | { |
| | 27 | 167 | | if (_externalAuthorizationPolicies != null) |
| | | 168 | | { |
| | 26 | 169 | | behavior.ExternalAuthorizationPolicies = _externalAuthorizationPolicies; |
| | | 170 | | } |
| | 27 | 171 | | if (_serviceAuthorizationManager != null) |
| | | 172 | | { |
| | 5 | 173 | | behavior.ServiceAuthorizationManager = _serviceAuthorizationManager; |
| | | 174 | | } |
| | 27 | 175 | | } |
| | | 176 | | |
| | | 177 | | [MethodImpl(MethodImplOptions.NoInlining)] |
| | | 178 | | private void CopyAuthorizationPoliciesAndManager(ServiceAuthorizationBehavior other) |
| | | 179 | | { |
| | 0 | 180 | | _externalAuthorizationPolicies = other._externalAuthorizationPolicies; |
| | 0 | 181 | | _serviceAuthorizationManager = other._serviceAuthorizationManager; |
| | 0 | 182 | | } |
| | | 183 | | |
| | | 184 | | void IServiceBehavior.Validate(ServiceDescription serviceDescription, ServiceHostBase serviceHostBase) |
| | | 185 | | { |
| | 2434 | 186 | | foreach (ServiceEndpoint endpoint in serviceDescription.Endpoints) |
| | | 187 | | { |
| | 641 | 188 | | TransportBindingElement transportBindingElement = endpoint.Binding.CreateBindingElements().Find<Transpor |
| | | 189 | | Fx.Assert(transportBindingElement != null, "TransportBindingElement is null"); |
| | 641 | 190 | | var behaviors = (KeyedByTypeCollection<IEndpointBehavior>)endpoint.EndpointBehaviors; |
| | 641 | 191 | | behaviors.Add(new EndpointAuthorizationBehavior()); |
| | | 192 | | } |
| | 576 | 193 | | } |
| | | 194 | | |
| | | 195 | | void IServiceBehavior.AddBindingParameters(ServiceDescription description, ServiceHostBase serviceHostBase, Coll |
| | | 196 | | { |
| | 664 | 197 | | } |
| | | 198 | | |
| | | 199 | | void IServiceBehavior.ApplyDispatchBehavior(ServiceDescription description, ServiceHostBase serviceHostBase) |
| | | 200 | | { |
| | 576 | 201 | | if (description == null) |
| | | 202 | | { |
| | 0 | 203 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException(nameof(description)) |
| | | 204 | | } |
| | 576 | 205 | | if (serviceHostBase == null) |
| | | 206 | | { |
| | 0 | 207 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException(nameof(serviceHostBa |
| | | 208 | | } |
| | | 209 | | |
| | 2432 | 210 | | for (int i = 0; i < serviceHostBase.ChannelDispatchers.Count; i++) |
| | | 211 | | { |
| | | 212 | | // TODO: ServiceMetadataBehavior reference needs to be put back once we have MetadataBehavior |
| | 640 | 213 | | if (serviceHostBase.ChannelDispatchers[i] is ChannelDispatcher channelDispatcher /*&& !ServiceMetadataBe |
| | | 214 | | { |
| | 2562 | 215 | | foreach (EndpointDispatcher endpointDispatcher in channelDispatcher.Endpoints) |
| | | 216 | | { |
| | 641 | 217 | | DispatchRuntime behavior = endpointDispatcher.DispatchRuntime; |
| | 641 | 218 | | behavior.PrincipalPermissionMode = _principalPermissionMode; |
| | 641 | 219 | | if (!endpointDispatcher.IsSystemEndpoint) |
| | | 220 | | { |
| | 641 | 221 | | behavior.ImpersonateCallerForAllOperations = _impersonateCallerForAllOperations; |
| | 641 | 222 | | behavior.ImpersonateOnSerializingReply = _impersonateOnSerializingReply; |
| | | 223 | | } |
| | 641 | 224 | | if (_isAuthorizationManagerSet || _isExternalPoliciesSet) |
| | | 225 | | { |
| | 27 | 226 | | ApplyAuthorizationPoliciesAndManager(behavior); |
| | | 227 | | } |
| | | 228 | | |
| | 641 | 229 | | IAuthorizationService authorizationService = GetAuthorizationService(); |
| | 641 | 230 | | if (authorizationService != null) |
| | | 231 | | { |
| | 110 | 232 | | behavior.SetAuthorizationService(GetAuthorizationService()); |
| | | 233 | | } |
| | | 234 | | } |
| | | 235 | | } |
| | | 236 | | } |
| | 576 | 237 | | } |
| | | 238 | | |
| | | 239 | | internal void MakeReadOnly() |
| | | 240 | | { |
| | 0 | 241 | | _isReadOnly = true; |
| | 0 | 242 | | } |
| | | 243 | | |
| | | 244 | | public object Clone() |
| | | 245 | | { |
| | 585 | 246 | | return new ServiceAuthorizationBehavior(this); |
| | | 247 | | } |
| | | 248 | | |
| | | 249 | | private void ThrowIfImmutable() |
| | | 250 | | { |
| | 600 | 251 | | if (_isReadOnly) |
| | | 252 | | { |
| | 0 | 253 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.ObjectIsReadO |
| | | 254 | | } |
| | 600 | 255 | | } |
| | | 256 | | |
| | | 257 | | public void Dispose() |
| | | 258 | | { |
| | 1028 | 259 | | _scope?.Dispose(); |
| | 0 | 260 | | } |
| | | 261 | | } |
| | | 262 | | } |