| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.ObjectModel; |
| | | 6 | | using System.Net; |
| | | 7 | | using System.Security.Claims; |
| | | 8 | | using System.Security.Principal; |
| | | 9 | | using System.Threading; |
| | | 10 | | using System.Threading.Tasks; |
| | | 11 | | using System.Xml; |
| | | 12 | | using CoreWCF.IdentityModel; |
| | | 13 | | using CoreWCF.IdentityModel.Policy; |
| | | 14 | | using CoreWCF.IdentityModel.Selectors; |
| | | 15 | | using CoreWCF.IdentityModel.Tokens; |
| | | 16 | | using CoreWCF.Security.NegotiateInternal; |
| | | 17 | | |
| | | 18 | | namespace CoreWCF.Security |
| | | 19 | | { |
| | | 20 | | internal sealed class SpnegoTokenAuthenticator : SspiNegotiationTokenAuthenticator |
| | | 21 | | { |
| | | 22 | | private bool _extractGroupsForWindowsAccounts; |
| | | 23 | | private NetworkCredential _serverCredential; |
| | | 24 | | private bool _allowUnauthenticatedCallers; |
| | | 25 | | private LdapSettings _ldapSettings; |
| | | 26 | | |
| | | 27 | | // SafeFreeCredentials credentialsHandle; |
| | | 28 | | private INegotiateInternalState _negotiateHandler; |
| | | 29 | | public SpnegoTokenAuthenticator() |
| | 1 | 30 | | : base() |
| | | 31 | | { |
| | | 32 | | // empty |
| | 1 | 33 | | } |
| | | 34 | | |
| | | 35 | | // settings |
| | | 36 | | public bool ExtractGroupsForWindowsAccounts |
| | | 37 | | { |
| | 0 | 38 | | get => _extractGroupsForWindowsAccounts; |
| | | 39 | | set |
| | | 40 | | { |
| | 1 | 41 | | CommunicationObject.ThrowIfDisposedOrImmutable(); |
| | 1 | 42 | | _extractGroupsForWindowsAccounts = value; |
| | 1 | 43 | | } |
| | | 44 | | } |
| | | 45 | | |
| | | 46 | | public NetworkCredential ServerCredential |
| | | 47 | | { |
| | 0 | 48 | | get => _serverCredential; |
| | | 49 | | set |
| | | 50 | | { |
| | 0 | 51 | | CommunicationObject.ThrowIfDisposedOrImmutable(); |
| | 0 | 52 | | _serverCredential = value; |
| | 0 | 53 | | } |
| | | 54 | | } |
| | | 55 | | |
| | | 56 | | public LdapSettings LdapSettings |
| | | 57 | | { |
| | 0 | 58 | | get => _ldapSettings; |
| | | 59 | | set |
| | | 60 | | { |
| | 1 | 61 | | CommunicationObject.ThrowIfDisposedOrImmutable(); |
| | 1 | 62 | | _ldapSettings = value; |
| | 1 | 63 | | } |
| | | 64 | | } |
| | | 65 | | |
| | | 66 | | public bool AllowUnauthenticatedCallers |
| | | 67 | | { |
| | 0 | 68 | | get => _allowUnauthenticatedCallers; |
| | | 69 | | set |
| | | 70 | | { |
| | 1 | 71 | | CommunicationObject.ThrowIfDisposedOrImmutable(); |
| | 1 | 72 | | _allowUnauthenticatedCallers = value; |
| | 1 | 73 | | } |
| | | 74 | | } |
| | | 75 | | |
| | | 76 | | // overrides |
| | 0 | 77 | | public override XmlDictionaryString NegotiationValueType => XD.TrustApr2004Dictionary.SpnegoValueTypeUri; |
| | | 78 | | |
| | | 79 | | public override Task OpenAsync(CancellationToken token) |
| | | 80 | | { |
| | 1 | 81 | | base.OpenAsync(token); |
| | 1 | 82 | | if (_negotiateHandler == null) |
| | | 83 | | { |
| | 1 | 84 | | _negotiateHandler = new NegotiateInternalStateFactory().CreateInstance(); |
| | | 85 | | } |
| | | 86 | | |
| | 1 | 87 | | return Task.CompletedTask; |
| | | 88 | | } |
| | | 89 | | |
| | | 90 | | public override Task CloseAsync(CancellationToken token) |
| | | 91 | | { |
| | 0 | 92 | | base.CloseAsync(token); |
| | 0 | 93 | | FreeCredentialsHandle(); |
| | 0 | 94 | | return Task.CompletedTask; |
| | | 95 | | } |
| | | 96 | | |
| | | 97 | | public override void OnAbort() |
| | | 98 | | { |
| | | 99 | | try |
| | | 100 | | { |
| | 0 | 101 | | base.OnAbort(); |
| | 0 | 102 | | } |
| | | 103 | | finally |
| | | 104 | | { |
| | 0 | 105 | | FreeCredentialsHandle(); |
| | 0 | 106 | | } |
| | 0 | 107 | | } |
| | | 108 | | |
| | | 109 | | private void FreeCredentialsHandle() |
| | | 110 | | { |
| | 0 | 111 | | if (_negotiateHandler != null) |
| | | 112 | | { |
| | 0 | 113 | | _negotiateHandler.Dispose(); |
| | | 114 | | } |
| | 0 | 115 | | } |
| | | 116 | | |
| | | 117 | | protected override SspiNegotiationTokenAuthenticatorState CreateSspiState(byte[] incomingBlob, string incomingVa |
| | | 118 | | { |
| | 0 | 119 | | ISspiNegotiation windowsNegotiation = new WindowsSspiNegotiation(GetNegotiateState()); |
| | 0 | 120 | | return new SspiNegotiationTokenAuthenticatorState(windowsNegotiation); |
| | | 121 | | } |
| | | 122 | | |
| | | 123 | | protected override ValueTask<ReadOnlyCollection<IAuthorizationPolicy>> ValidateSspiNegotiationAsync(ISspiNegotia |
| | | 124 | | { |
| | 0 | 125 | | WindowsSspiNegotiation windowsNegotiation = (WindowsSspiNegotiation)sspiNegotiation; |
| | 0 | 126 | | if (windowsNegotiation.IsValidContext == false) |
| | | 127 | | { |
| | 0 | 128 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperWarning(new SecurityNegotiationException(SR.Format(S |
| | | 129 | | } |
| | | 130 | | // SecurityTraceRecordHelper.TraceServiceSpnego(windowsNegotiation); |
| | 0 | 131 | | if (IsClientAnonymous) |
| | | 132 | | { |
| | 0 | 133 | | return new ValueTask<ReadOnlyCollection<IAuthorizationPolicy>>(EmptyReadOnlyCollection<IAuthorizationPol |
| | | 134 | | } |
| | 0 | 135 | | IIdentity identity = windowsNegotiation.GetIdentity(); |
| | 0 | 136 | | if (identity != null) |
| | | 137 | | { |
| | 0 | 138 | | return GetAuthorizationPoliciesAsync(identity); |
| | | 139 | | } |
| | | 140 | | else |
| | | 141 | | { |
| | 0 | 142 | | throw new Exception("Identity can't be determined."); |
| | | 143 | | } |
| | | 144 | | } |
| | | 145 | | |
| | | 146 | | private ValueTask<ReadOnlyCollection<IAuthorizationPolicy>> GetAuthorizationPoliciesAsync(IIdentity identity) |
| | | 147 | | { |
| | 0 | 148 | | IIdentity remoteIdentity = identity; |
| | | 149 | | SecurityToken token; |
| | 0 | 150 | | WindowsSecurityTokenAuthenticator authenticator = new WindowsSecurityTokenAuthenticator(_extractGroupsForWin |
| | 0 | 151 | | if (remoteIdentity is WindowsIdentity) |
| | | 152 | | { |
| | 0 | 153 | | WindowsIdentity windowIdentity = (WindowsIdentity)remoteIdentity; |
| | 0 | 154 | | SecurityUtils.ValidateAnonymityConstraint(windowIdentity, false); |
| | 0 | 155 | | token = new WindowsSecurityToken(windowIdentity, SecurityUniqueId.Create().Value, windowIdentity.Authent |
| | | 156 | | } |
| | | 157 | | else |
| | | 158 | | { |
| | 0 | 159 | | token = new GenericIdentitySecurityToken((GenericIdentity)remoteIdentity, SecurityUniqueId.Create().Valu |
| | | 160 | | } |
| | 0 | 161 | | return authenticator.ValidateTokenAsync(token); |
| | | 162 | | } |
| | | 163 | | |
| | 0 | 164 | | private INegotiateInternalState GetNegotiateState() => new NegotiateInternalStateFactory().CreateInstance(); |
| | | 165 | | } |
| | | 166 | | } |