| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System.Collections.ObjectModel; |
| | | 5 | | using System.Net; |
| | | 6 | | using System.Xml; |
| | | 7 | | using CoreWCF.Channels; |
| | | 8 | | using CoreWCF.Description; |
| | | 9 | | using CoreWCF.Runtime; |
| | | 10 | | using CoreWCF.Security.Tokens; |
| | | 11 | | |
| | | 12 | | namespace CoreWCF.Security |
| | | 13 | | { |
| | | 14 | | internal class WSSecurityPolicy12 : WSSecurityPolicy |
| | | 15 | | { |
| | | 16 | | public const string WsspNamespace = @"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"; |
| | | 17 | | public const string SignedEncryptedSupportingTokensName = "SignedEncryptedSupportingTokens"; |
| | | 18 | | public const string RequireImpliedDerivedKeysName = "RequireImpliedDerivedKeys"; |
| | | 19 | | public const string RequireExplicitDerivedKeysName = "RequireExplicitDerivedKeys"; |
| | | 20 | | |
| | | 21 | | public override string WsspNamespaceUri |
| | | 22 | | { |
| | 0 | 23 | | get { return WsspNamespace; } |
| | | 24 | | } |
| | | 25 | | |
| | | 26 | | public override bool IsSecurityVersionSupported(MessageSecurityVersion version) |
| | | 27 | | { |
| | 0 | 28 | | return version == MessageSecurityVersion.WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicS |
| | 0 | 29 | | version == MessageSecurityVersion.WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12 || |
| | 0 | 30 | | version == MessageSecurityVersion.WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecu |
| | | 31 | | } |
| | | 32 | | |
| | | 33 | | public override TrustDriver TrustDriver |
| | | 34 | | { |
| | | 35 | | get |
| | | 36 | | { |
| | 0 | 37 | | return new WSTrustDec2005.DriverDec2005(new SecurityStandardsManager(MessageSecurityVersion.WSSecurity11 |
| | | 38 | | } |
| | | 39 | | } |
| | | 40 | | |
| | | 41 | | public override Collection<XmlElement> CreateWsspSupportingTokensAssertion(MetadataExporter exporter, Collection |
| | | 42 | | { |
| | 0 | 43 | | Collection<XmlElement> supportingTokenAssertions = new Collection<XmlElement>(); |
| | | 44 | | |
| | | 45 | | // Signed Supporting Tokens |
| | 0 | 46 | | XmlElement supportingTokenAssertion = CreateWsspSignedSupportingTokensAssertion(exporter, signed, optionalSi |
| | 0 | 47 | | if (supportingTokenAssertion != null) |
| | 0 | 48 | | supportingTokenAssertions.Add(supportingTokenAssertion); |
| | | 49 | | |
| | | 50 | | // Signed Encrypted Supporting Tokens |
| | 0 | 51 | | supportingTokenAssertion = CreateWsspSignedEncryptedSupportingTokensAssertion(exporter, signedEncrypted, opt |
| | 0 | 52 | | if (supportingTokenAssertion != null) |
| | 0 | 53 | | supportingTokenAssertions.Add(supportingTokenAssertion); |
| | | 54 | | |
| | | 55 | | // Endorsing Supporting Tokens. |
| | 0 | 56 | | supportingTokenAssertion = CreateWsspEndorsingSupportingTokensAssertion(exporter, endorsing, optionalEndorsi |
| | 0 | 57 | | if (supportingTokenAssertion != null) |
| | 0 | 58 | | supportingTokenAssertions.Add(supportingTokenAssertion); |
| | | 59 | | |
| | | 60 | | // Signed Endorsing Supporting Tokens. |
| | 0 | 61 | | supportingTokenAssertion = CreateWsspSignedEndorsingSupportingTokensAssertion(exporter, signedEndorsing, opt |
| | 0 | 62 | | if (supportingTokenAssertion != null) |
| | 0 | 63 | | supportingTokenAssertions.Add(supportingTokenAssertion); |
| | | 64 | | |
| | 0 | 65 | | return supportingTokenAssertions; |
| | | 66 | | } |
| | | 67 | | |
| | | 68 | | public override XmlElement CreateWsspSpnegoContextTokenAssertion(MetadataExporter exporter, SspiSecurityTokenPar |
| | | 69 | | { |
| | 0 | 70 | | XmlElement result = CreateWsspAssertion(SpnegoContextTokenName); |
| | 0 | 71 | | SetIncludeTokenValue(result, parameters.InclusionMode); |
| | 0 | 72 | | result.AppendChild( |
| | 0 | 73 | | CreateWspPolicyWrapper( |
| | 0 | 74 | | exporter, |
| | 0 | 75 | | CreateWsspRequireDerivedKeysAssertion(parameters.RequireDerivedKeys), |
| | 0 | 76 | | // Always emit <sp:MustNotSendCancel/> for spnego and sslnego |
| | 0 | 77 | | CreateWsspMustNotSendCancelAssertion(false), |
| | 0 | 78 | | CreateWsspMustNotSendAmendAssertion(), |
| | 0 | 79 | | CreateWsspMustNotSendRenewAssertion() |
| | 0 | 80 | | )); |
| | 0 | 81 | | return result; |
| | | 82 | | } |
| | | 83 | | |
| | | 84 | | public override XmlElement CreateMsspSslContextTokenAssertion(MetadataExporter exporter, SslSecurityTokenParamet |
| | | 85 | | { |
| | 0 | 86 | | XmlElement result = CreateMsspAssertion(SslContextTokenName); |
| | 0 | 87 | | SetIncludeTokenValue(result, parameters.InclusionMode); |
| | 0 | 88 | | result.AppendChild( |
| | 0 | 89 | | CreateWspPolicyWrapper( |
| | 0 | 90 | | exporter, |
| | 0 | 91 | | CreateWsspRequireDerivedKeysAssertion(parameters.RequireDerivedKeys), |
| | 0 | 92 | | // Always emit <sp:MustNotSendCancel/> for spnego and sslnego |
| | 0 | 93 | | CreateWsspMustNotSendCancelAssertion(false), |
| | 0 | 94 | | CreateMsspRequireClientCertificateAssertion(parameters.RequireClientCertificate), |
| | 0 | 95 | | CreateWsspMustNotSendAmendAssertion(), |
| | 0 | 96 | | CreateWsspMustNotSendRenewAssertion() |
| | 0 | 97 | | )); |
| | 0 | 98 | | return result; |
| | | 99 | | } |
| | | 100 | | |
| | | 101 | | public override XmlElement CreateWsspSecureConversationTokenAssertion(MetadataExporter exporter, SecureConversat |
| | | 102 | | { |
| | 0 | 103 | | XmlElement result = CreateWsspAssertion(SecureConversationTokenName); |
| | 0 | 104 | | SetIncludeTokenValue(result, parameters.InclusionMode); |
| | 0 | 105 | | result.AppendChild( |
| | 0 | 106 | | CreateWspPolicyWrapper( |
| | 0 | 107 | | exporter, |
| | 0 | 108 | | CreateWsspRequireDerivedKeysAssertion(parameters.RequireDerivedKeys), |
| | 0 | 109 | | CreateWsspMustNotSendCancelAssertion(parameters.RequireCancellation), |
| | 0 | 110 | | CreateWsspBootstrapPolicyAssertion(exporter, parameters.BootstrapSecurityBindingElement), |
| | 0 | 111 | | CreateWsspMustNotSendAmendAssertion(), |
| | 0 | 112 | | (!parameters.RequireCancellation || !parameters.CanRenewSession) ? CreateWsspMustNotSendRenewAsserti |
| | 0 | 113 | | )); |
| | 0 | 114 | | return result; |
| | | 115 | | } |
| | | 116 | | |
| | | 117 | | XmlElement CreateWsspMustNotSendAmendAssertion() |
| | | 118 | | { |
| | 0 | 119 | | XmlElement result = CreateWsspAssertion(MustNotSendAmendName); |
| | 0 | 120 | | return result; |
| | | 121 | | } |
| | | 122 | | |
| | | 123 | | XmlElement CreateWsspMustNotSendRenewAssertion() |
| | | 124 | | { |
| | 0 | 125 | | XmlElement result = CreateWsspAssertion(MustNotSendRenewName); |
| | 0 | 126 | | return result; |
| | | 127 | | } |
| | | 128 | | |
| | | 129 | | XmlElement CreateWsspSignedSupportingTokensAssertion(MetadataExporter exporter, Collection<SecurityTokenParamete |
| | | 130 | | { |
| | | 131 | | XmlElement result; |
| | | 132 | | |
| | 0 | 133 | | if ((signed == null || signed.Count == 0) |
| | 0 | 134 | | && (optionalSigned == null || optionalSigned.Count == 0)) |
| | | 135 | | { |
| | 0 | 136 | | result = null; |
| | | 137 | | } |
| | | 138 | | else |
| | | 139 | | { |
| | 0 | 140 | | XmlElement policy = CreateWspPolicyWrapper(exporter); |
| | | 141 | | |
| | 0 | 142 | | if (signed != null) |
| | | 143 | | { |
| | 0 | 144 | | foreach (SecurityTokenParameters p in signed) |
| | | 145 | | { |
| | 0 | 146 | | policy.AppendChild(CreateTokenAssertion(exporter, p)); |
| | | 147 | | } |
| | | 148 | | } |
| | 0 | 149 | | if (optionalSigned != null) |
| | | 150 | | { |
| | 0 | 151 | | foreach (SecurityTokenParameters p in optionalSigned) |
| | | 152 | | { |
| | 0 | 153 | | policy.AppendChild(CreateTokenAssertion(exporter, p, true)); |
| | | 154 | | } |
| | | 155 | | } |
| | | 156 | | |
| | 0 | 157 | | result = CreateWsspAssertion(SignedSupportingTokensName); |
| | 0 | 158 | | result.AppendChild(policy); |
| | | 159 | | } |
| | | 160 | | |
| | 0 | 161 | | return result; |
| | | 162 | | } |
| | | 163 | | |
| | | 164 | | XmlElement CreateWsspSignedEncryptedSupportingTokensAssertion(MetadataExporter exporter, Collection<SecurityToke |
| | | 165 | | { |
| | | 166 | | XmlElement result; |
| | | 167 | | |
| | 0 | 168 | | if ((signedEncrypted == null || signedEncrypted.Count == 0) |
| | 0 | 169 | | && (optionalSignedEncrypted == null || optionalSignedEncrypted.Count == 0)) |
| | | 170 | | { |
| | 0 | 171 | | result = null; |
| | | 172 | | } |
| | | 173 | | else |
| | | 174 | | { |
| | 0 | 175 | | XmlElement policy = CreateWspPolicyWrapper(exporter); |
| | | 176 | | |
| | 0 | 177 | | if (signedEncrypted != null) |
| | | 178 | | { |
| | 0 | 179 | | foreach (SecurityTokenParameters p in signedEncrypted) |
| | | 180 | | { |
| | 0 | 181 | | policy.AppendChild(CreateTokenAssertion(exporter, p)); |
| | | 182 | | } |
| | | 183 | | } |
| | 0 | 184 | | if (optionalSignedEncrypted != null) |
| | | 185 | | { |
| | 0 | 186 | | foreach (SecurityTokenParameters p in optionalSignedEncrypted) |
| | | 187 | | { |
| | 0 | 188 | | policy.AppendChild(CreateTokenAssertion(exporter, p, true)); |
| | | 189 | | } |
| | | 190 | | } |
| | | 191 | | |
| | 0 | 192 | | result = CreateWsspAssertion(SignedEncryptedSupportingTokensName); |
| | 0 | 193 | | result.AppendChild(policy); |
| | | 194 | | } |
| | | 195 | | |
| | 0 | 196 | | return result; |
| | | 197 | | } |
| | | 198 | | |
| | | 199 | | public override XmlElement CreateWsspTrustAssertion(MetadataExporter exporter, SecurityKeyEntropyMode keyEntropy |
| | | 200 | | { |
| | 0 | 201 | | return CreateWsspTrustAssertion(Trust13Name, exporter, keyEntropyMode); |
| | | 202 | | } |
| | | 203 | | } |
| | | 204 | | } |