| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.Generic; |
| | | 6 | | using System.Security.Cryptography.X509Certificates; |
| | | 7 | | using System.Xml; |
| | | 8 | | using CoreWCF.IdentityModel; |
| | | 9 | | using CoreWCF.IdentityModel.Selectors; |
| | | 10 | | using CoreWCF.IdentityModel.Tokens; |
| | | 11 | | using CoreWCF.Security.Tokens; |
| | | 12 | | using HexBinary = CoreWCF.Security.SoapHexBinary; |
| | | 13 | | using TokenEntry = CoreWCF.Security.WSSecurityTokenSerializer.TokenEntry; |
| | | 14 | | |
| | | 15 | | namespace CoreWCF.Security |
| | | 16 | | { |
| | | 17 | | internal class WSSecurityJan2004 : WSSecurityTokenSerializer.SerializerEntries |
| | | 18 | | { |
| | 132 | 19 | | public WSSecurityJan2004(WSSecurityTokenSerializer tokenSerializer, SamlSerializer samlSerializer) |
| | | 20 | | { |
| | 132 | 21 | | WSSecurityTokenSerializer = tokenSerializer; |
| | 132 | 22 | | SamlSerializer = samlSerializer; |
| | 132 | 23 | | } |
| | | 24 | | |
| | 528 | 25 | | public WSSecurityTokenSerializer WSSecurityTokenSerializer { get; } |
| | | 26 | | |
| | 132 | 27 | | public SamlSerializer SamlSerializer { get; } |
| | | 28 | | |
| | | 29 | | protected void PopulateJan2004TokenEntries(IList<TokenEntry> tokenEntryList) |
| | | 30 | | { |
| | 132 | 31 | | tokenEntryList.Add(new GenericXmlTokenEntry()); |
| | 132 | 32 | | tokenEntryList.Add(new UserNamePasswordTokenEntry(WSSecurityTokenSerializer)); |
| | 132 | 33 | | tokenEntryList.Add(new X509TokenEntry(WSSecurityTokenSerializer)); |
| | 132 | 34 | | } |
| | | 35 | | |
| | | 36 | | public override void PopulateTokenEntries(IList<TokenEntry> tokenEntryList) |
| | | 37 | | { |
| | 6 | 38 | | PopulateJan2004TokenEntries(tokenEntryList); |
| | 6 | 39 | | tokenEntryList.Add(new SamlTokenEntry(WSSecurityTokenSerializer, SamlSerializer)); |
| | 6 | 40 | | tokenEntryList.Add(new WrappedKeyTokenEntry(WSSecurityTokenSerializer)); |
| | 6 | 41 | | } |
| | | 42 | | |
| | | 43 | | protected class SamlTokenEntry : TokenEntry |
| | | 44 | | { |
| | | 45 | | private readonly SamlSerializer _samlSerializer; |
| | | 46 | | private readonly SecurityTokenSerializer _tokenSerializer; |
| | | 47 | | |
| | 132 | 48 | | public SamlTokenEntry(SecurityTokenSerializer tokenSerializer, SamlSerializer samlSerializer) |
| | | 49 | | { |
| | 132 | 50 | | _tokenSerializer = tokenSerializer; |
| | 132 | 51 | | if (samlSerializer != null) |
| | | 52 | | { |
| | 0 | 53 | | _samlSerializer = samlSerializer; |
| | | 54 | | } |
| | | 55 | | else |
| | | 56 | | { |
| | 132 | 57 | | _samlSerializer = new SamlSerializer(); |
| | | 58 | | } |
| | 132 | 59 | | } |
| | | 60 | | |
| | 30 | 61 | | protected override XmlDictionaryString LocalName { get { return XD.SecurityJan2004Dictionary.SamlAssertion; |
| | 30 | 62 | | protected override XmlDictionaryString NamespaceUri { get { return XD.SecurityJan2004Dictionary.SamlUri; } } |
| | 10 | 63 | | protected override Type[] GetTokenTypesCore() { return new Type[] { typeof(SamlSecurityToken) }; } |
| | 0 | 64 | | public override string TokenTypeUri { get { return null; } } |
| | 0 | 65 | | protected override string ValueTypeUri { get { return null; } } |
| | | 66 | | |
| | | 67 | | //we don't need it, as we we populate differently in SamlSerializer |
| | | 68 | | public override SecurityKeyIdentifierClause CreateKeyIdentifierClauseFromTokenXmlCore(XmlElement issuedToken |
| | | 69 | | SecurityTokenReferenceStyle tokenReferenceStyle) |
| | | 70 | | { |
| | 0 | 71 | | TokenReferenceStyleHelper.Validate(tokenReferenceStyle); |
| | | 72 | | |
| | | 73 | | switch (tokenReferenceStyle) |
| | | 74 | | { |
| | | 75 | | // SAML uses same reference for internal and external |
| | | 76 | | case SecurityTokenReferenceStyle.Internal: |
| | | 77 | | case SecurityTokenReferenceStyle.External: |
| | 0 | 78 | | throw new NotImplementedException(); |
| | | 79 | | // return new SamlAssertionKeyIdentifierClause(assertionId); |
| | | 80 | | default: |
| | 0 | 81 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof |
| | | 82 | | } |
| | | 83 | | } |
| | | 84 | | |
| | | 85 | | public override SecurityToken ReadTokenCore(XmlDictionaryReader reader, SecurityTokenResolver tokenResolver) |
| | | 86 | | { |
| | 0 | 87 | | SamlSecurityToken samlToken = _samlSerializer.ReadToken(reader, _tokenSerializer, tokenResolver); |
| | 0 | 88 | | return samlToken; |
| | | 89 | | } |
| | | 90 | | |
| | | 91 | | public override void WriteTokenCore(XmlDictionaryWriter writer, SecurityToken token) |
| | | 92 | | { |
| | 0 | 93 | | throw new NotImplementedException(); |
| | | 94 | | } |
| | | 95 | | } |
| | | 96 | | |
| | | 97 | | internal abstract class BinaryTokenEntry : TokenEntry |
| | | 98 | | { |
| | 2 | 99 | | internal static readonly XmlDictionaryString s_elementName = XD.SecurityJan2004Dictionary.BinarySecurityToke |
| | 2 | 100 | | internal static readonly XmlDictionaryString s_encodingTypeAttribute = XD.SecurityJan2004Dictionary.Encoding |
| | | 101 | | internal const string EncodingTypeAttributeString = SecurityJan2004Strings.EncodingType; |
| | | 102 | | internal const string EncodingTypeValueBase64Binary = SecurityJan2004Strings.EncodingTypeValueBase64Binary; |
| | | 103 | | internal const string EncodingTypeValueHexBinary = SecurityJan2004Strings.EncodingTypeValueHexBinary; |
| | 2 | 104 | | internal static readonly XmlDictionaryString s_valueTypeAttribute = XD.SecurityJan2004Dictionary.ValueType; |
| | | 105 | | |
| | | 106 | | private readonly WSSecurityTokenSerializer _tokenSerializer; |
| | | 107 | | private readonly string[] _valueTypeUris = null; |
| | | 108 | | |
| | 132 | 109 | | protected BinaryTokenEntry(WSSecurityTokenSerializer tokenSerializer, string valueTypeUri) |
| | | 110 | | { |
| | 132 | 111 | | _tokenSerializer = tokenSerializer; |
| | 132 | 112 | | _valueTypeUris = new string[1]; |
| | 132 | 113 | | _valueTypeUris[0] = valueTypeUri; |
| | 132 | 114 | | } |
| | | 115 | | |
| | 0 | 116 | | protected BinaryTokenEntry(WSSecurityTokenSerializer tokenSerializer, string[] valueTypeUris) |
| | | 117 | | { |
| | 0 | 118 | | if (valueTypeUris == null) |
| | | 119 | | { |
| | 0 | 120 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(valueTypeUris)); |
| | | 121 | | } |
| | | 122 | | |
| | 0 | 123 | | _tokenSerializer = tokenSerializer; |
| | 0 | 124 | | _valueTypeUris = new string[valueTypeUris.GetLength(0)]; |
| | 0 | 125 | | for (int i = 0; i < _valueTypeUris.GetLength(0); ++i) |
| | | 126 | | { |
| | 0 | 127 | | _valueTypeUris[i] = valueTypeUris[i]; |
| | | 128 | | } |
| | 0 | 129 | | } |
| | | 130 | | |
| | 33 | 131 | | protected override XmlDictionaryString LocalName { get { return s_elementName; } } |
| | 33 | 132 | | protected override XmlDictionaryString NamespaceUri { get { return XD.SecurityJan2004Dictionary.Namespace; } |
| | 0 | 133 | | public override string TokenTypeUri { get { return _valueTypeUris[0]; } } |
| | 3 | 134 | | protected override string ValueTypeUri { get { return _valueTypeUris[0]; } } |
| | | 135 | | public override bool SupportsTokenTypeUri(string tokenTypeUri) |
| | | 136 | | { |
| | 0 | 137 | | for (int i = 0; i < _valueTypeUris.GetLength(0); ++i) |
| | | 138 | | { |
| | 0 | 139 | | if (_valueTypeUris[i] == tokenTypeUri) |
| | | 140 | | { |
| | 0 | 141 | | return true; |
| | | 142 | | } |
| | | 143 | | } |
| | | 144 | | |
| | 0 | 145 | | return false; |
| | | 146 | | } |
| | | 147 | | |
| | | 148 | | public abstract SecurityKeyIdentifierClause CreateKeyIdentifierClauseFromBinaryCore(byte[] rawData); |
| | | 149 | | |
| | | 150 | | public override SecurityKeyIdentifierClause CreateKeyIdentifierClauseFromTokenXmlCore(XmlElement issuedToken |
| | | 151 | | SecurityTokenReferenceStyle tokenReferenceStyle) |
| | | 152 | | { |
| | 0 | 153 | | TokenReferenceStyleHelper.Validate(tokenReferenceStyle); |
| | | 154 | | |
| | | 155 | | switch (tokenReferenceStyle) |
| | | 156 | | { |
| | | 157 | | case SecurityTokenReferenceStyle.Internal: |
| | 0 | 158 | | return CreateDirectReference(issuedTokenXml, UtilityStrings.IdAttribute, UtilityStrings.Namespac |
| | | 159 | | case SecurityTokenReferenceStyle.External: |
| | 0 | 160 | | string encoding = issuedTokenXml.GetAttribute(EncodingTypeAttributeString, null); |
| | 0 | 161 | | string encodedData = issuedTokenXml.InnerText; |
| | | 162 | | |
| | | 163 | | byte[] binaryData; |
| | 0 | 164 | | if (encoding == null || encoding == EncodingTypeValueBase64Binary) |
| | | 165 | | { |
| | 0 | 166 | | binaryData = Convert.FromBase64String(encodedData); |
| | | 167 | | } |
| | 0 | 168 | | else if (encoding == EncodingTypeValueHexBinary) |
| | | 169 | | { |
| | 0 | 170 | | binaryData = HexBinary.Parse(encodedData).Value; |
| | | 171 | | } |
| | | 172 | | else |
| | | 173 | | { |
| | 0 | 174 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Un |
| | | 175 | | } |
| | | 176 | | |
| | 0 | 177 | | return CreateKeyIdentifierClauseFromBinaryCore(binaryData); |
| | | 178 | | default: |
| | 0 | 179 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof |
| | | 180 | | } |
| | | 181 | | } |
| | | 182 | | |
| | | 183 | | public abstract SecurityToken ReadBinaryCore(string id, string valueTypeUri, byte[] rawData); |
| | | 184 | | |
| | | 185 | | public override SecurityToken ReadTokenCore(XmlDictionaryReader reader, SecurityTokenResolver tokenResolver) |
| | | 186 | | { |
| | 3 | 187 | | string wsuId = reader.GetAttribute(XD.UtilityDictionary.IdAttribute, XD.UtilityDictionary.Namespace); |
| | 3 | 188 | | string valueTypeUri = reader.GetAttribute(s_valueTypeAttribute, null); |
| | 3 | 189 | | string encoding = reader.GetAttribute(s_encodingTypeAttribute, null); |
| | | 190 | | |
| | | 191 | | byte[] binaryData; |
| | 3 | 192 | | if (encoding == null || encoding == EncodingTypeValueBase64Binary) |
| | | 193 | | { |
| | 3 | 194 | | binaryData = reader.ReadElementContentAsBase64(); |
| | | 195 | | } |
| | 0 | 196 | | else if (encoding == EncodingTypeValueHexBinary) |
| | | 197 | | { |
| | 0 | 198 | | binaryData = HexBinary.Parse(reader.ReadElementContentAsString()).Value; |
| | | 199 | | } |
| | | 200 | | else |
| | | 201 | | { |
| | 0 | 202 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.UnknownEnc |
| | | 203 | | } |
| | | 204 | | |
| | 3 | 205 | | return ReadBinaryCore(wsuId, valueTypeUri, binaryData); |
| | | 206 | | } |
| | | 207 | | |
| | | 208 | | public abstract void WriteBinaryCore(SecurityToken token, out string id, out byte[] rawData); |
| | | 209 | | |
| | | 210 | | public override void WriteTokenCore(XmlDictionaryWriter writer, SecurityToken token) |
| | | 211 | | { |
| | 0 | 212 | | WriteBinaryCore(token, out string id, out byte[] rawData); |
| | | 213 | | |
| | 0 | 214 | | if (rawData == null) |
| | | 215 | | { |
| | 0 | 216 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(rawData)); |
| | | 217 | | } |
| | | 218 | | |
| | 0 | 219 | | writer.WriteStartElement(XD.SecurityJan2004Dictionary.Prefix.Value, s_elementName, XD.SecurityJan2004Dic |
| | 0 | 220 | | if (id != null) |
| | | 221 | | { |
| | 0 | 222 | | writer.WriteAttributeString(XD.UtilityDictionary.Prefix.Value, XD.UtilityDictionary.IdAttribute, XD. |
| | | 223 | | } |
| | 0 | 224 | | if (_valueTypeUris != null) |
| | | 225 | | { |
| | 0 | 226 | | writer.WriteAttributeString(s_valueTypeAttribute, null, _valueTypeUris[0]); |
| | | 227 | | } |
| | 0 | 228 | | if (_tokenSerializer.EmitBspRequiredAttributes) |
| | | 229 | | { |
| | 0 | 230 | | writer.WriteAttributeString(s_encodingTypeAttribute, null, EncodingTypeValueBase64Binary); |
| | | 231 | | } |
| | 0 | 232 | | writer.WriteBase64(rawData, 0, rawData.Length); |
| | 0 | 233 | | writer.WriteEndElement(); // BinarySecurityToken |
| | 0 | 234 | | } |
| | | 235 | | } |
| | | 236 | | |
| | | 237 | | private class GenericXmlTokenEntry : TokenEntry |
| | | 238 | | { |
| | 0 | 239 | | protected override XmlDictionaryString LocalName { get { return null; } } |
| | 0 | 240 | | protected override XmlDictionaryString NamespaceUri { get { return null; } } |
| | 10 | 241 | | protected override Type[] GetTokenTypesCore() { return new Type[] { typeof(GenericXmlSecurityToken) }; } |
| | 0 | 242 | | public override string TokenTypeUri { get { return null; } } |
| | 0 | 243 | | protected override string ValueTypeUri { get { return null; } } |
| | | 244 | | |
| | 132 | 245 | | public GenericXmlTokenEntry() |
| | | 246 | | { |
| | 132 | 247 | | } |
| | | 248 | | |
| | | 249 | | |
| | | 250 | | public override bool CanReadTokenCore(XmlElement element) |
| | | 251 | | { |
| | 0 | 252 | | return false; |
| | | 253 | | } |
| | | 254 | | |
| | | 255 | | public override bool CanReadTokenCore(XmlDictionaryReader reader) |
| | | 256 | | { |
| | 51 | 257 | | return false; |
| | | 258 | | } |
| | | 259 | | |
| | | 260 | | public override SecurityKeyIdentifierClause CreateKeyIdentifierClauseFromTokenXmlCore(XmlElement issuedToken |
| | | 261 | | SecurityTokenReferenceStyle tokenReferenceStyle) |
| | | 262 | | { |
| | 0 | 263 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException()); |
| | | 264 | | } |
| | | 265 | | |
| | | 266 | | public override SecurityToken ReadTokenCore(XmlDictionaryReader reader, SecurityTokenResolver tokenResolver) |
| | | 267 | | { |
| | 0 | 268 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException()); |
| | | 269 | | } |
| | | 270 | | |
| | | 271 | | public override void WriteTokenCore(XmlDictionaryWriter writer, SecurityToken token) |
| | | 272 | | { |
| | 0 | 273 | | if (token is BufferedGenericXmlSecurityToken bufferedXmlToken && bufferedXmlToken.TokenXmlBuffer != null |
| | | 274 | | { |
| | 0 | 275 | | using (XmlDictionaryReader reader = bufferedXmlToken.TokenXmlBuffer.GetReader(0)) |
| | | 276 | | { |
| | 0 | 277 | | writer.WriteNode(reader, false); |
| | 0 | 278 | | } |
| | | 279 | | } |
| | | 280 | | else |
| | | 281 | | { |
| | 0 | 282 | | GenericXmlSecurityToken xmlToken = (GenericXmlSecurityToken)token; |
| | 0 | 283 | | xmlToken.TokenXml.WriteTo(writer); |
| | | 284 | | } |
| | 0 | 285 | | } |
| | | 286 | | } |
| | | 287 | | |
| | | 288 | | protected class WrappedKeyTokenEntry : TokenEntry |
| | | 289 | | { |
| | | 290 | | private readonly WSSecurityTokenSerializer _tokenSerializer; |
| | | 291 | | |
| | 132 | 292 | | public WrappedKeyTokenEntry(WSSecurityTokenSerializer tokenSerializer) |
| | | 293 | | { |
| | 132 | 294 | | _tokenSerializer = tokenSerializer; |
| | 132 | 295 | | } |
| | | 296 | | |
| | 30 | 297 | | protected override XmlDictionaryString LocalName { get { return EncryptedKey.ElementName; } } |
| | 30 | 298 | | protected override XmlDictionaryString NamespaceUri { get { return XD.XmlEncryptionDictionary.Namespace; } } |
| | 10 | 299 | | protected override Type[] GetTokenTypesCore() { return new Type[] { typeof(WrappedKeySecurityToken) }; } |
| | 0 | 300 | | public override string TokenTypeUri { get { return null; } } |
| | 0 | 301 | | protected override string ValueTypeUri { get { return null; } } |
| | | 302 | | |
| | | 303 | | public override SecurityKeyIdentifierClause CreateKeyIdentifierClauseFromTokenXmlCore(XmlElement issuedToken |
| | | 304 | | SecurityTokenReferenceStyle tokenReferenceStyle) |
| | | 305 | | { |
| | | 306 | | |
| | 0 | 307 | | TokenReferenceStyleHelper.Validate(tokenReferenceStyle); |
| | | 308 | | |
| | | 309 | | switch (tokenReferenceStyle) |
| | | 310 | | { |
| | | 311 | | case SecurityTokenReferenceStyle.Internal: |
| | 0 | 312 | | return CreateDirectReference(issuedTokenXml, XmlEncryptionStrings.Id, null, null); |
| | | 313 | | case SecurityTokenReferenceStyle.External: |
| | 0 | 314 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new XmlException(SR.Format(SR.CantInfe |
| | | 315 | | default: |
| | 0 | 316 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof |
| | | 317 | | } |
| | | 318 | | } |
| | | 319 | | |
| | | 320 | | public override SecurityToken ReadTokenCore(XmlDictionaryReader reader, SecurityTokenResolver tokenResolver) |
| | | 321 | | { |
| | 0 | 322 | | EncryptedKey encryptedKey = new EncryptedKey |
| | 0 | 323 | | { |
| | 0 | 324 | | SecurityTokenSerializer = _tokenSerializer |
| | 0 | 325 | | }; |
| | 0 | 326 | | encryptedKey.ReadFrom(reader); |
| | 0 | 327 | | SecurityKeyIdentifier unwrappingTokenIdentifier = encryptedKey.KeyIdentifier; |
| | 0 | 328 | | byte[] wrappedKey = encryptedKey.GetWrappedKey(); |
| | 0 | 329 | | WrappedKeySecurityToken wrappedKeyToken = CreateWrappedKeyToken(encryptedKey.Id, encryptedKey.Encryption |
| | 0 | 330 | | encryptedKey.CarriedKeyName, unwrappingTokenIdentifier, wrappedKey, tokenResolver); |
| | 0 | 331 | | wrappedKeyToken.EncryptedKey = encryptedKey; |
| | | 332 | | |
| | 0 | 333 | | return wrappedKeyToken; |
| | | 334 | | } |
| | | 335 | | |
| | | 336 | | private WrappedKeySecurityToken CreateWrappedKeyToken(string id, string encryptionMethod, string carriedKeyN |
| | | 337 | | SecurityKeyIdentifier unwrappingTokenIdentifier, byte[] wrappedKey, SecurityTokenResolver tokenResolver) |
| | | 338 | | { |
| | 0 | 339 | | if (tokenResolver is ISspiNegotiationInfo sspiResolver) |
| | | 340 | | { |
| | 0 | 341 | | ISspiNegotiation unwrappingSspiContext = sspiResolver.SspiNegotiation; |
| | | 342 | | // ensure that the encryption algorithm is compatible |
| | 0 | 343 | | if (encryptionMethod != unwrappingSspiContext.KeyEncryptionAlgorithm) |
| | | 344 | | { |
| | 0 | 345 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format |
| | | 346 | | } |
| | 0 | 347 | | byte[] unwrappedKey = unwrappingSspiContext.Decrypt(wrappedKey); |
| | 0 | 348 | | return new WrappedKeySecurityToken(id, unwrappedKey, encryptionMethod, unwrappingSspiContext, unwrap |
| | | 349 | | } |
| | | 350 | | else |
| | | 351 | | { |
| | 0 | 352 | | if (tokenResolver == null) |
| | | 353 | | { |
| | 0 | 354 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException(nameof(token |
| | | 355 | | } |
| | 0 | 356 | | if (unwrappingTokenIdentifier == null || unwrappingTokenIdentifier.Count == 0) |
| | | 357 | | { |
| | 0 | 358 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format |
| | | 359 | | } |
| | | 360 | | |
| | | 361 | | SecurityToken unwrappingToken; |
| | 0 | 362 | | if (tokenResolver is SecurityHeaderTokenResolver resolver) |
| | | 363 | | { |
| | 0 | 364 | | unwrappingToken = resolver.ExpectedWrapper; |
| | 0 | 365 | | if (unwrappingToken != null) |
| | | 366 | | { |
| | 0 | 367 | | if (!resolver.CheckExternalWrapperMatch(unwrappingTokenIdentifier)) |
| | | 368 | | { |
| | 0 | 369 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException( |
| | 0 | 370 | | SR.Format(SR.EncryptedKeyWasNotEncryptedWithTheRequiredEncryptingToken, unwrappingTo |
| | | 371 | | } |
| | | 372 | | } |
| | | 373 | | else |
| | | 374 | | { |
| | 0 | 375 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException( |
| | 0 | 376 | | SR.Format(SR.UnableToResolveKeyInfoForUnwrappingToken, unwrappingTokenIdentifier, resolv |
| | | 377 | | } |
| | | 378 | | } |
| | | 379 | | else |
| | | 380 | | { |
| | | 381 | | try |
| | | 382 | | { |
| | 0 | 383 | | unwrappingToken = tokenResolver.ResolveToken(unwrappingTokenIdentifier); |
| | 0 | 384 | | } |
| | 0 | 385 | | catch (Exception exception) |
| | | 386 | | { |
| | 0 | 387 | | if (exception is MessageSecurityException) |
| | 0 | 388 | | throw; |
| | | 389 | | |
| | 0 | 390 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException( |
| | 0 | 391 | | SR.Format(SR.UnableToResolveKeyInfoForUnwrappingToken, unwrappingTokenIdentifier, tokenR |
| | | 392 | | } |
| | | 393 | | } |
| | 0 | 394 | | byte[] unwrappedKey = SecurityUtils.DecryptKey(unwrappingToken, encryptionMethod, wrappedKey, out Se |
| | 0 | 395 | | return new WrappedKeySecurityToken(id, unwrappedKey, encryptionMethod, unwrappingToken, unwrappingTo |
| | | 396 | | } |
| | | 397 | | } |
| | | 398 | | |
| | | 399 | | public override void WriteTokenCore(XmlDictionaryWriter writer, SecurityToken token) |
| | | 400 | | { |
| | 0 | 401 | | WrappedKeySecurityToken wrappedKeyToken = token as WrappedKeySecurityToken; |
| | 0 | 402 | | wrappedKeyToken.EnsureEncryptedKeySetUp(); |
| | 0 | 403 | | wrappedKeyToken.EncryptedKey.SecurityTokenSerializer = _tokenSerializer; |
| | 0 | 404 | | wrappedKeyToken.EncryptedKey.WriteTo(writer, ServiceModelDictionaryManager.Instance); |
| | 0 | 405 | | } |
| | | 406 | | } |
| | | 407 | | |
| | | 408 | | private class UserNamePasswordTokenEntry : TokenEntry |
| | | 409 | | { |
| | | 410 | | private readonly WSSecurityTokenSerializer _tokenSerializer; |
| | | 411 | | |
| | 132 | 412 | | public UserNamePasswordTokenEntry(WSSecurityTokenSerializer tokenSerializer) |
| | | 413 | | { |
| | 132 | 414 | | _tokenSerializer = tokenSerializer; |
| | 132 | 415 | | } |
| | | 416 | | |
| | 51 | 417 | | protected override XmlDictionaryString LocalName { get { return XD.SecurityJan2004Dictionary.UserNameTokenEl |
| | 51 | 418 | | protected override XmlDictionaryString NamespaceUri { get { return XD.SecurityJan2004Dictionary.Namespace; } |
| | 10 | 419 | | protected override Type[] GetTokenTypesCore() { return new Type[] { typeof(UserNameSecurityToken) }; } |
| | 0 | 420 | | public override string TokenTypeUri { get { return SecurityJan2004Strings.UPTokenType; } } |
| | 18 | 421 | | protected override string ValueTypeUri { get { return null; } } |
| | | 422 | | |
| | | 423 | | public override SecurityKeyIdentifierClause CreateKeyIdentifierClauseFromTokenXmlCore(XmlElement issuedToken |
| | | 424 | | SecurityTokenReferenceStyle tokenReferenceStyle) |
| | | 425 | | { |
| | 0 | 426 | | TokenReferenceStyleHelper.Validate(tokenReferenceStyle); |
| | | 427 | | |
| | | 428 | | switch (tokenReferenceStyle) |
| | | 429 | | { |
| | | 430 | | case SecurityTokenReferenceStyle.Internal: |
| | 0 | 431 | | return CreateDirectReference(issuedTokenXml, UtilityStrings.IdAttribute, UtilityStrings.Namespac |
| | | 432 | | case SecurityTokenReferenceStyle.External: |
| | | 433 | | // UP tokens aren't referred to externally |
| | 0 | 434 | | return null; |
| | | 435 | | default: |
| | 0 | 436 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof |
| | | 437 | | } |
| | | 438 | | } |
| | | 439 | | |
| | | 440 | | public override SecurityToken ReadTokenCore(XmlDictionaryReader reader, SecurityTokenResolver tokenResolver) |
| | | 441 | | { |
| | 18 | 442 | | ParseToken(reader, out string id, out string userName, out string password); |
| | | 443 | | |
| | 18 | 444 | | if (id == null) |
| | | 445 | | { |
| | 0 | 446 | | id = SecurityUniqueId.Create().Value; |
| | | 447 | | } |
| | | 448 | | |
| | 18 | 449 | | return new UserNameSecurityToken(userName, password, id); |
| | | 450 | | } |
| | | 451 | | |
| | | 452 | | public override void WriteTokenCore(XmlDictionaryWriter writer, SecurityToken token) |
| | | 453 | | { |
| | 0 | 454 | | UserNameSecurityToken upToken = (UserNameSecurityToken)token; |
| | 0 | 455 | | WriteUserNamePassword(writer, upToken.Id, upToken.UserName, upToken.Password); |
| | 0 | 456 | | } |
| | | 457 | | |
| | | 458 | | private void WriteUserNamePassword(XmlDictionaryWriter writer, string id, string userName, string password) |
| | | 459 | | { |
| | 0 | 460 | | writer.WriteStartElement(XD.SecurityJan2004Dictionary.Prefix.Value, XD.SecurityJan2004Dictionary.UserNam |
| | 0 | 461 | | XD.SecurityJan2004Dictionary.Namespace); // <wsse:UsernameToken |
| | 0 | 462 | | writer.WriteAttributeString(XD.UtilityDictionary.Prefix.Value, XD.UtilityDictionary.IdAttribute, |
| | 0 | 463 | | XD.UtilityDictionary.Namespace, id); // wsu:Id="..." |
| | 0 | 464 | | writer.WriteElementString(XD.SecurityJan2004Dictionary.Prefix.Value, XD.SecurityJan2004Dictionary.UserNa |
| | 0 | 465 | | XD.SecurityJan2004Dictionary.Namespace, userName); // ><wsse:Username>...</wsse:Username> |
| | 0 | 466 | | if (password != null) |
| | | 467 | | { |
| | 0 | 468 | | writer.WriteStartElement(XD.SecurityJan2004Dictionary.Prefix.Value, XD.SecurityJan2004Dictionary.Pas |
| | 0 | 469 | | XD.SecurityJan2004Dictionary.Namespace); |
| | 0 | 470 | | if (_tokenSerializer.EmitBspRequiredAttributes) |
| | | 471 | | { |
| | 0 | 472 | | writer.WriteAttributeString(XD.SecurityJan2004Dictionary.TypeAttribute, null, SecurityJan2004Str |
| | | 473 | | } |
| | 0 | 474 | | writer.WriteString(password); // <wsse:Password>...</wsse:Password> |
| | 0 | 475 | | writer.WriteEndElement(); |
| | | 476 | | } |
| | 0 | 477 | | writer.WriteEndElement(); // </wsse:UsernameToken> |
| | 0 | 478 | | } |
| | | 479 | | |
| | | 480 | | private static string ParsePassword(XmlDictionaryReader reader) |
| | | 481 | | { |
| | 18 | 482 | | string type = reader.GetAttribute(XD.SecurityJan2004Dictionary.TypeAttribute, null); |
| | 18 | 483 | | if (type != null && type.Length > 0 && type != SecurityJan2004Strings.UPTokenPasswordTextValue) |
| | | 484 | | { |
| | 0 | 485 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException(SR.Format(SR.Uns |
| | | 486 | | } |
| | | 487 | | |
| | 18 | 488 | | return reader.ReadElementString(); |
| | | 489 | | } |
| | | 490 | | |
| | | 491 | | private static void ParseToken(XmlDictionaryReader reader, out string id, out string userName, out string pa |
| | | 492 | | { |
| | 18 | 493 | | userName = null; |
| | 18 | 494 | | password = null; |
| | | 495 | | |
| | 18 | 496 | | reader.MoveToContent(); |
| | 18 | 497 | | id = reader.GetAttribute(XD.UtilityDictionary.IdAttribute, XD.UtilityDictionary.Namespace); |
| | | 498 | | |
| | 18 | 499 | | reader.ReadStartElement(XD.SecurityJan2004Dictionary.UserNameTokenElement, XD.SecurityJan2004Dictionary. |
| | 54 | 500 | | while (reader.IsStartElement()) |
| | | 501 | | { |
| | 36 | 502 | | if (reader.IsStartElement(XD.SecurityJan2004Dictionary.UserNameElement, XD.SecurityJan2004Dictionary |
| | | 503 | | { |
| | 18 | 504 | | userName = reader.ReadElementString(); |
| | | 505 | | } |
| | 18 | 506 | | else if (reader.IsStartElement(XD.SecurityJan2004Dictionary.PasswordElement, XD.SecurityJan2004Dicti |
| | | 507 | | { |
| | 18 | 508 | | password = ParsePassword(reader); |
| | | 509 | | } |
| | 0 | 510 | | else if (reader.IsStartElement(XD.SecurityJan2004Dictionary.NonceElement, XD.SecurityJan2004Dictiona |
| | | 511 | | { |
| | | 512 | | // Nonce can be safely ignored |
| | 0 | 513 | | reader.Skip(); |
| | | 514 | | } |
| | 0 | 515 | | else if (reader.IsStartElement(XD.UtilityDictionary.CreatedElement, XD.UtilityDictionary.Namespace)) |
| | | 516 | | { |
| | | 517 | | // wsu:Created can be safely ignored |
| | 0 | 518 | | reader.Skip(); |
| | | 519 | | } |
| | | 520 | | else |
| | | 521 | | { |
| | 0 | 522 | | throw new NotImplementedException(); |
| | | 523 | | // XmlHelper.OnUnexpectedChildNodeError(SecurityJan2004Strings.UserNameTokenElement, reader); |
| | | 524 | | } |
| | | 525 | | } |
| | 18 | 526 | | reader.ReadEndElement(); |
| | | 527 | | |
| | 18 | 528 | | if (userName == null) |
| | | 529 | | { |
| | 0 | 530 | | throw new NotImplementedException(); |
| | | 531 | | // XmlHelper.OnRequiredElementMissing(SecurityJan2004Strings.UserNameElement, SecurityJan2004String |
| | | 532 | | } |
| | 18 | 533 | | } |
| | | 534 | | } |
| | | 535 | | |
| | | 536 | | protected class X509TokenEntry : BinaryTokenEntry |
| | | 537 | | { |
| | | 538 | | internal const string ValueTypeAbsoluteUri = SecurityJan2004Strings.X509TokenType; |
| | | 539 | | |
| | | 540 | | public X509TokenEntry(WSSecurityTokenSerializer tokenSerializer) |
| | 132 | 541 | | : base(tokenSerializer, ValueTypeAbsoluteUri) |
| | | 542 | | { |
| | 132 | 543 | | } |
| | | 544 | | |
| | 10 | 545 | | protected override Type[] GetTokenTypesCore() { return new Type[] { typeof(X509SecurityToken) }; } |
| | | 546 | | |
| | | 547 | | public override SecurityKeyIdentifierClause CreateKeyIdentifierClauseFromBinaryCore(byte[] rawData) |
| | | 548 | | { |
| | 0 | 549 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new XmlException(SR.Format(SR.CantInferReferen |
| | | 550 | | } |
| | | 551 | | |
| | | 552 | | public override SecurityToken ReadBinaryCore(string id, string valueTypeUri, byte[] rawData) |
| | | 553 | | { |
| | 3 | 554 | | if (!SecurityUtils.TryCreateX509CertificateFromRawData(rawData, out X509Certificate2 certificate)) |
| | | 555 | | { |
| | 0 | 556 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.InvalidX50 |
| | | 557 | | } |
| | 3 | 558 | | return new X509SecurityToken(certificate, id, false); |
| | | 559 | | } |
| | | 560 | | |
| | | 561 | | public override void WriteBinaryCore(SecurityToken token, out string id, out byte[] rawData) |
| | | 562 | | { |
| | 0 | 563 | | id = token.Id; |
| | 0 | 564 | | if (token is X509SecurityToken x509Token) |
| | | 565 | | { |
| | 0 | 566 | | rawData = x509Token.Certificate.GetRawCertData(); |
| | | 567 | | } |
| | | 568 | | else |
| | | 569 | | { |
| | 0 | 570 | | throw new PlatformNotSupportedException(); |
| | | 571 | | } |
| | | 572 | | } |
| | | 573 | | } |
| | | 574 | | |
| | | 575 | | public class IdManager : SignatureTargetIdManager |
| | | 576 | | { |
| | 3 | 577 | | private IdManager() |
| | | 578 | | { |
| | 3 | 579 | | } |
| | | 580 | | |
| | | 581 | | public override string DefaultIdNamespacePrefix |
| | | 582 | | { |
| | 0 | 583 | | get { return UtilityStrings.Prefix; } |
| | | 584 | | } |
| | | 585 | | |
| | | 586 | | public override string DefaultIdNamespaceUri |
| | | 587 | | { |
| | 0 | 588 | | get { return UtilityStrings.Namespace; } |
| | | 589 | | } |
| | | 590 | | |
| | 134 | 591 | | internal static IdManager Instance { get; } = new IdManager(); |
| | | 592 | | |
| | | 593 | | public override string ExtractId(XmlDictionaryReader reader) |
| | | 594 | | { |
| | 0 | 595 | | if (reader == null) |
| | | 596 | | { |
| | 0 | 597 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(reader)); |
| | | 598 | | } |
| | | 599 | | |
| | 0 | 600 | | return reader.GetAttribute(XD.UtilityDictionary.IdAttribute, XD.UtilityDictionary.Namespace); |
| | | 601 | | } |
| | | 602 | | |
| | | 603 | | public override void WriteIdAttribute(XmlDictionaryWriter writer, string id) |
| | | 604 | | { |
| | 0 | 605 | | if (writer == null) |
| | | 606 | | { |
| | 0 | 607 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(writer)); |
| | | 608 | | } |
| | | 609 | | |
| | 0 | 610 | | writer.WriteAttributeString(XD.UtilityDictionary.Prefix.Value, XD.UtilityDictionary.IdAttribute, XD.Util |
| | 0 | 611 | | } |
| | | 612 | | } |
| | | 613 | | } |
| | | 614 | | } |