| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System.Collections.Generic; |
| | | 5 | | using System.Collections.ObjectModel; |
| | | 6 | | using CoreWCF.IdentityModel.Policy; |
| | | 7 | | using CoreWCF.IdentityModel.Selectors; |
| | | 8 | | using CoreWCF.IdentityModel.Tokens; |
| | | 9 | | using System.Security.Claims; |
| | | 10 | | using System; |
| | | 11 | | using System.Threading.Tasks; |
| | | 12 | | |
| | | 13 | | namespace CoreWCF.Security |
| | | 14 | | { |
| | | 15 | | /// <summary> |
| | | 16 | | /// Wraps a X509SecurityTokenHandler. Delegates the token authentication call the inner tokenAuthenticator. |
| | | 17 | | /// Wraps the returned ClaimsIdentities into an AuthorizationPolicy that supports IAuthorizationPolicy |
| | | 18 | | /// </summary> |
| | | 19 | | internal class WrappedX509SecurityTokenAuthenticator : X509SecurityTokenAuthenticator |
| | | 20 | | { |
| | | 21 | | private readonly X509SecurityTokenHandler _wrappedX509SecurityTokenHandler; |
| | | 22 | | private readonly ExceptionMapper _exceptionMapper; |
| | | 23 | | |
| | | 24 | | /// <summary> |
| | | 25 | | /// Initializes an instance of <see cref="WrappedX509SecurityTokenAuthenticator"/> |
| | | 26 | | /// </summary> |
| | | 27 | | /// <param name="wrappedX509SecurityTokenHandler">X509SecurityTokenHandler to wrap.</param> |
| | | 28 | | /// <param name="exceptionMapper">Converts token validation exceptions to SOAP faults.</param> |
| | | 29 | | public WrappedX509SecurityTokenAuthenticator( |
| | | 30 | | X509SecurityTokenHandler wrappedX509SecurityTokenHandler, |
| | | 31 | | ExceptionMapper exceptionMapper) |
| | 0 | 32 | | : base(X509CertificateValidator.None, GetMapToWindowsSetting(wrappedX509SecurityTokenHandler), true) |
| | | 33 | | { |
| | 0 | 34 | | _wrappedX509SecurityTokenHandler = wrappedX509SecurityTokenHandler ?? throw DiagnosticUtility.ExceptionUtili |
| | 0 | 35 | | _exceptionMapper = exceptionMapper ?? throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameo |
| | 0 | 36 | | } |
| | | 37 | | |
| | | 38 | | /// <summary> |
| | | 39 | | /// Validates the token using the wrapped token handler and generates IAuthorizationPolicy |
| | | 40 | | /// wrapping the returned ClaimsIdentities. |
| | | 41 | | /// </summary> |
| | | 42 | | /// <param name="token">Token to be validated.</param> |
| | | 43 | | /// <returns>Read-only collection of IAuthorizationPolicy</returns> |
| | | 44 | | protected override ValueTask<ReadOnlyCollection<IAuthorizationPolicy>> ValidateTokenCoreAsync(SecurityToken toke |
| | | 45 | | { |
| | 0 | 46 | | ReadOnlyCollection<ClaimsIdentity> identities = null; |
| | | 47 | | try |
| | | 48 | | { |
| | 0 | 49 | | identities = _wrappedX509SecurityTokenHandler.ValidateToken(token); |
| | 0 | 50 | | } |
| | 0 | 51 | | catch (Exception ex) |
| | | 52 | | { |
| | 0 | 53 | | if (!_exceptionMapper.HandleSecurityTokenProcessingException(ex)) |
| | | 54 | | { |
| | 0 | 55 | | throw; |
| | | 56 | | } |
| | 0 | 57 | | } |
| | | 58 | | |
| | | 59 | | // tlsnego will dispose of the x509, when we write out the bootstrap we will get a dispose error. |
| | | 60 | | |
| | 0 | 61 | | bool shouldSaveBootstrapContext = SecurityTokenHandlerConfiguration.DefaultSaveBootstrapContext; |
| | 0 | 62 | | if (_wrappedX509SecurityTokenHandler.Configuration != null) |
| | | 63 | | { |
| | 0 | 64 | | shouldSaveBootstrapContext = _wrappedX509SecurityTokenHandler.Configuration.SaveBootstrapContext; |
| | | 65 | | } |
| | | 66 | | |
| | 0 | 67 | | if (shouldSaveBootstrapContext) |
| | | 68 | | { |
| | 0 | 69 | | X509SecurityToken x509Token = token as X509SecurityToken; |
| | | 70 | | SecurityToken tokenToCache; |
| | 0 | 71 | | if (x509Token != null) |
| | | 72 | | { |
| | 0 | 73 | | tokenToCache = new X509SecurityToken(x509Token.Certificate); |
| | | 74 | | } |
| | | 75 | | else |
| | | 76 | | { |
| | 0 | 77 | | tokenToCache = token; |
| | | 78 | | } |
| | | 79 | | |
| | 0 | 80 | | BootstrapContext bootstrapContext = new BootstrapContext(tokenToCache, _wrappedX509SecurityTokenHandler) |
| | 0 | 81 | | foreach (ClaimsIdentity identity in identities) |
| | | 82 | | { |
| | 0 | 83 | | identity.BootstrapContext = bootstrapContext; |
| | | 84 | | } |
| | | 85 | | } |
| | | 86 | | |
| | 0 | 87 | | List<IAuthorizationPolicy> policies = new List<IAuthorizationPolicy>(1); |
| | 0 | 88 | | policies.Add(new AuthorizationPolicy(identities)); |
| | | 89 | | |
| | 0 | 90 | | return new ValueTask<ReadOnlyCollection<IAuthorizationPolicy>>(policies.AsReadOnly()); |
| | | 91 | | } |
| | | 92 | | |
| | | 93 | | private static bool GetMapToWindowsSetting(X509SecurityTokenHandler securityTokenHandler) |
| | | 94 | | { |
| | 0 | 95 | | if (securityTokenHandler == null) |
| | | 96 | | { |
| | 0 | 97 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(securityTokenHandler)); |
| | | 98 | | } |
| | | 99 | | |
| | 0 | 100 | | return securityTokenHandler.MapToWindows; |
| | | 101 | | } |
| | | 102 | | } |
| | | 103 | | } |