| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Security.Cryptography.X509Certificates; |
| | | 6 | | using CoreWCF.IdentityModel.Selectors; |
| | | 7 | | |
| | | 8 | | namespace CoreWCF.Security |
| | | 9 | | { |
| | | 10 | | public class X509ClientCertificateAuthentication |
| | | 11 | | { |
| | | 12 | | internal const X509CertificateValidationMode DefaultCertificateValidationMode = X509CertificateValidationMode.Ch |
| | | 13 | | internal const X509RevocationMode DefaultRevocationMode = X509RevocationMode.Online; |
| | | 14 | | internal const StoreLocation DefaultTrustedStoreLocation = StoreLocation.LocalMachine; |
| | | 15 | | internal const bool DefaultMapCertificateToWindowsAccount = false; |
| | | 16 | | private static X509CertificateValidator s_defaultCertificateValidator; |
| | 118 | 17 | | private X509CertificateValidationMode _certificateValidationMode = DefaultCertificateValidationMode; |
| | 118 | 18 | | private X509RevocationMode _revocationMode = DefaultRevocationMode; |
| | 118 | 19 | | private StoreLocation _trustedStoreLocation = DefaultTrustedStoreLocation; |
| | | 20 | | private X509CertificateValidator _customCertificateValidator = null; |
| | | 21 | | private bool _mapClientCertificateToWindowsAccount = DefaultMapCertificateToWindowsAccount; |
| | 118 | 22 | | private bool _includeWindowsGroups = SspiSecurityTokenProvider.DefaultExtractWindowsGroupClaims; |
| | | 23 | | private bool _isReadOnly; |
| | | 24 | | |
| | 52 | 25 | | internal X509ClientCertificateAuthentication() |
| | | 26 | | { |
| | 52 | 27 | | } |
| | | 28 | | |
| | 66 | 29 | | internal X509ClientCertificateAuthentication(X509ClientCertificateAuthentication other) |
| | | 30 | | { |
| | 66 | 31 | | _certificateValidationMode = other._certificateValidationMode; |
| | 66 | 32 | | _customCertificateValidator = other._customCertificateValidator; |
| | 66 | 33 | | _includeWindowsGroups = other._includeWindowsGroups; |
| | 66 | 34 | | _mapClientCertificateToWindowsAccount = other._mapClientCertificateToWindowsAccount; |
| | 66 | 35 | | _trustedStoreLocation = other._trustedStoreLocation; |
| | 66 | 36 | | _revocationMode = other._revocationMode; |
| | 66 | 37 | | _isReadOnly = other._isReadOnly; |
| | 66 | 38 | | } |
| | | 39 | | |
| | | 40 | | internal static X509CertificateValidator DefaultCertificateValidator |
| | | 41 | | { |
| | | 42 | | get |
| | | 43 | | { |
| | 0 | 44 | | if (s_defaultCertificateValidator == null) |
| | | 45 | | { |
| | 0 | 46 | | bool useMachineContext = DefaultTrustedStoreLocation == StoreLocation.LocalMachine; |
| | 0 | 47 | | X509ChainPolicy chainPolicy = new X509ChainPolicy |
| | 0 | 48 | | { |
| | 0 | 49 | | RevocationMode = DefaultRevocationMode |
| | 0 | 50 | | }; |
| | 0 | 51 | | s_defaultCertificateValidator = X509CertificateValidator.CreateChainTrustValidator(useMachineContext |
| | | 52 | | } |
| | 0 | 53 | | return s_defaultCertificateValidator; |
| | | 54 | | } |
| | | 55 | | } |
| | | 56 | | |
| | | 57 | | public X509CertificateValidationMode CertificateValidationMode |
| | | 58 | | { |
| | | 59 | | get |
| | | 60 | | { |
| | 0 | 61 | | return _certificateValidationMode; |
| | | 62 | | } |
| | | 63 | | set |
| | | 64 | | { |
| | 8 | 65 | | X509CertificateValidationModeHelper.Validate(value); |
| | 8 | 66 | | ThrowIfImmutable(); |
| | 8 | 67 | | _certificateValidationMode = value; |
| | 8 | 68 | | } |
| | | 69 | | } |
| | | 70 | | |
| | | 71 | | public X509RevocationMode RevocationMode |
| | | 72 | | { |
| | | 73 | | get |
| | | 74 | | { |
| | 0 | 75 | | return _revocationMode; |
| | | 76 | | } |
| | | 77 | | set |
| | | 78 | | { |
| | 0 | 79 | | ThrowIfImmutable(); |
| | 0 | 80 | | _revocationMode = value; |
| | 0 | 81 | | } |
| | | 82 | | } |
| | | 83 | | |
| | | 84 | | public StoreLocation TrustedStoreLocation |
| | | 85 | | { |
| | | 86 | | get |
| | | 87 | | { |
| | 0 | 88 | | return _trustedStoreLocation; |
| | | 89 | | } |
| | | 90 | | set |
| | | 91 | | { |
| | 0 | 92 | | ThrowIfImmutable(); |
| | 0 | 93 | | _trustedStoreLocation = value; |
| | 0 | 94 | | } |
| | | 95 | | } |
| | | 96 | | |
| | | 97 | | public X509CertificateValidator CustomCertificateValidator |
| | | 98 | | { |
| | | 99 | | get |
| | | 100 | | { |
| | 0 | 101 | | return _customCertificateValidator; |
| | | 102 | | } |
| | | 103 | | set |
| | | 104 | | { |
| | 3 | 105 | | ThrowIfImmutable(); |
| | 3 | 106 | | _customCertificateValidator = value; |
| | 3 | 107 | | } |
| | | 108 | | } |
| | | 109 | | |
| | | 110 | | public bool MapClientCertificateToWindowsAccount |
| | | 111 | | { |
| | | 112 | | get |
| | | 113 | | { |
| | 16 | 114 | | return _mapClientCertificateToWindowsAccount; |
| | | 115 | | } |
| | | 116 | | set |
| | | 117 | | { |
| | 0 | 118 | | ThrowIfImmutable(); |
| | 0 | 119 | | _mapClientCertificateToWindowsAccount = value; |
| | 0 | 120 | | } |
| | | 121 | | } |
| | | 122 | | |
| | | 123 | | public bool IncludeWindowsGroups |
| | | 124 | | { |
| | | 125 | | get |
| | | 126 | | { |
| | 16 | 127 | | return _includeWindowsGroups; |
| | | 128 | | } |
| | | 129 | | set |
| | | 130 | | { |
| | 0 | 131 | | ThrowIfImmutable(); |
| | 0 | 132 | | _includeWindowsGroups = value; |
| | 0 | 133 | | } |
| | | 134 | | } |
| | | 135 | | |
| | | 136 | | internal X509CertificateValidator GetCertificateValidator() |
| | | 137 | | { |
| | 16 | 138 | | if (_certificateValidationMode == X509CertificateValidationMode.None) |
| | | 139 | | { |
| | 2 | 140 | | return X509CertificateValidator.None; |
| | | 141 | | } |
| | 14 | 142 | | else if (_certificateValidationMode == X509CertificateValidationMode.PeerTrust) |
| | | 143 | | { |
| | 0 | 144 | | return X509CertificateValidator.PeerTrust; |
| | | 145 | | } |
| | 14 | 146 | | else if (_certificateValidationMode == X509CertificateValidationMode.Custom) |
| | | 147 | | { |
| | 3 | 148 | | if (_customCertificateValidator == null) |
| | | 149 | | { |
| | 0 | 150 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.MissingCu |
| | | 151 | | } |
| | 3 | 152 | | return _customCertificateValidator; |
| | | 153 | | } |
| | | 154 | | else |
| | | 155 | | { |
| | 11 | 156 | | bool useMachineContext = _trustedStoreLocation == StoreLocation.LocalMachine; |
| | 11 | 157 | | X509ChainPolicy chainPolicy = new X509ChainPolicy |
| | 11 | 158 | | { |
| | 11 | 159 | | RevocationMode = _revocationMode |
| | 11 | 160 | | }; |
| | 11 | 161 | | if (_certificateValidationMode == X509CertificateValidationMode.ChainTrust) |
| | | 162 | | { |
| | 11 | 163 | | return X509CertificateValidator.CreateChainTrustValidator(useMachineContext, chainPolicy); |
| | | 164 | | } |
| | | 165 | | else |
| | | 166 | | { |
| | 0 | 167 | | return X509CertificateValidator.CreatePeerOrChainTrustValidator(useMachineContext, chainPolicy); |
| | | 168 | | } |
| | | 169 | | } |
| | | 170 | | } |
| | | 171 | | |
| | | 172 | | internal void MakeReadOnly() |
| | | 173 | | { |
| | 0 | 174 | | _isReadOnly = true; |
| | 0 | 175 | | } |
| | | 176 | | |
| | | 177 | | private void ThrowIfImmutable() |
| | | 178 | | { |
| | 11 | 179 | | if (_isReadOnly) |
| | | 180 | | { |
| | 0 | 181 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.ObjectIsReadO |
| | | 182 | | } |
| | 11 | 183 | | } |
| | | 184 | | } |
| | | 185 | | } |