|
//------------------------------------------------------------
// Copyright (c) Microsoft Corporation. All rights reserved.
//------------------------------------------------------------
using System;
using System.Collections.Generic;
using System.Collections.ObjectModel;
using System.Configuration;
using System.Diagnostics;
using System.Globalization;
using System.IdentityModel.Diagnostics;
using System.IdentityModel.Selectors;
using System.IdentityModel.Tokens;
using System.Security.Claims;
using System.Security.Cryptography.X509Certificates;
using System.ServiceModel.Security;
using System.Xml;
namespace System.IdentityModel.Configuration
{
/// <summary>
/// Defines the collection of configurable properties controlling the behavior of the Windows Identity Foundation.
/// </summary>
public class IdentityConfiguration
{
#pragma warning disable 1591
public const string DefaultServiceName = ConfigurationStrings.DefaultServiceName;
public static readonly TimeSpan DefaultMaxClockSkew = new TimeSpan(0, 5, 0);
internal const string DefaultMaxClockSkewString = "00:05:00";
public static readonly X509CertificateValidationMode DefaultCertificateValidationMode = X509CertificateValidationMode.PeerOrChainTrust;
public static readonly Type DefaultIssuerNameRegistryType = typeof(ConfigurationBasedIssuerNameRegistry);
public static readonly X509RevocationMode DefaultRevocationMode = X509RevocationMode.Online;
public static readonly StoreLocation DefaultTrustedStoreLocation = StoreLocation.LocalMachine;
#pragma warning restore 1591
ClaimsAuthenticationManager _claimsAuthenticationManager = new ClaimsAuthenticationManager();
ClaimsAuthorizationManager _claimsAuthorizationManager = new ClaimsAuthorizationManager();
bool _isInitialized;
SecurityTokenHandlerCollectionManager _securityTokenHandlerCollectionManager;
string _identityConfigurationName = DefaultServiceName;
TimeSpan _serviceMaxClockSkew = DefaultMaxClockSkew;
SecurityTokenHandlerConfiguration _serviceHandlerConfiguration;
X509Certificate2 _serviceCertificate;
List<X509Certificate2> knownCertificates;
/// <summary>
/// Initializes an instance of <see cref="IdentityConfiguration"/>
/// </summary>
public IdentityConfiguration()
{
SystemIdentityModelSection section = SystemIdentityModelSection.Current;
IdentityConfigurationElement element = (section != null) ? section.IdentityConfigurationElements.GetElement(DefaultServiceName) : null;
LoadConfiguration(element);
}
/// <summary>
/// Initializes an instance of <see cref="IdentityConfiguration"/>
/// </summary>
/// <param name="serviceCertificate">The service certificate to be used in ServiceTokenResolver and SessionSecurityTokenHandler.</param>
public IdentityConfiguration(X509Certificate2 serviceCertificate)
: this()
{
this.ServiceCertificate = serviceCertificate;
}
/// <summary>
/// Initializes an instance of <see cref="IdentityConfiguration"/>
/// </summary>
/// <param name="loadConfig">Whether or not config should be loaded.</param>
/// <exception cref="InvalidOperationException">Thrown if loadConfig is set to true but there is no
/// <System.IdentityModel> configuration element</exception>
public IdentityConfiguration(bool loadConfig)
{
if (loadConfig)
{
SystemIdentityModelSection section = SystemIdentityModelSection.Current;
if (section == null)
{
throw DiagnosticUtility.ThrowHelperInvalidOperation(SR.GetString(SR.ID7027));
}
IdentityConfigurationElement element = section.IdentityConfigurationElements.GetElement(DefaultServiceName);
LoadConfiguration(element);
}
else
{
LoadConfiguration(null);
}
}
/// <summary>
/// Initializes an instance of <see cref="IdentityConfiguration"/>
/// </summary>
/// <param name="loadConfig">Whether or not config should be loaded.</param>
/// <param name="serviceCertificate">The service certificate to be used in ServiceTokenResolver and SessionSecurityTokenHandler.</param>
/// <exception cref="InvalidOperationException">Thrown if loadConfig is set to true but there is no
/// <System.IdentityModel> configuration element</exception>
public IdentityConfiguration(bool loadConfig, X509Certificate2 serviceCertificate)
: this(loadConfig)
{
this.ServiceCertificate = serviceCertificate;
}
/// <summary>
/// Initializes an instance of <see cref="IdentityConfiguration"/>
/// </summary>
/// <param name="identityConfigurationName">The name of the <service> element from which configuration is to be loaded.</param>
/// <exception cref="InvalidOperationException">Thrown if there is no <System.IdentityModel> configuration element</exception>
/// <remarks>If this constructor is called then a System.IdentityModel config section with the provided name must exist.</remarks>
public IdentityConfiguration(string identityConfigurationName)
{
if (identityConfigurationName == null)
{
throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("identityConfigurationName");
}
SystemIdentityModelSection section = SystemIdentityModelSection.Current;
if (section == null)
{
throw DiagnosticUtility.ThrowHelperInvalidOperation(SR.GetString(SR.ID7027));
}
_identityConfigurationName = identityConfigurationName;
IdentityConfigurationElement element = section.IdentityConfigurationElements.GetElement(identityConfigurationName);
LoadConfiguration(element);
}
/// <summary>
/// Initializes an instance of <see cref="IdentityConfiguration"/>
/// </summary>
/// <param name="identityConfigurationName">The name of the <service> element from which configuration is to be loaded.</param>
/// <exception cref="InvalidOperationException">Thrown if there is no <System.IdentityModel> configuration element</exception>
/// <param name="serviceCertificate">Thrown if there is no <System.IdentityModel> configuration element</param>
/// <remarks>If this constructor is called then a System.IdentityModel config section with the provided name must exist.</remarks>
public IdentityConfiguration(string identityConfigurationName, X509Certificate2 serviceCertificate)
: this(identityConfigurationName)
{
this.ServiceCertificate = serviceCertificate;
}
/// <summary>
/// Gets or sets the AudienceRestriction.
/// </summary>
public AudienceRestriction AudienceRestriction
{
get { return _serviceHandlerConfiguration.AudienceRestriction; }
set { _serviceHandlerConfiguration.AudienceRestriction = value; }
}
/// <summary>
/// Gets the Caches configured.
/// </summary>
public IdentityModelCaches Caches
{
get { return _serviceHandlerConfiguration.Caches; }
set { _serviceHandlerConfiguration.Caches = value; }
}
/// <summary>
/// Gets or sets the certificate validation mode used by handlers to validate issuer certificates
/// </summary>
public X509CertificateValidationMode CertificateValidationMode
{
get { return _serviceHandlerConfiguration.CertificateValidationMode; }
set { _serviceHandlerConfiguration.CertificateValidationMode = value; }
}
/// <summary>
/// Gets or sets the certificate validator used by handlers to validate issuer certificates
/// </summary>
public X509CertificateValidator CertificateValidator
{
get { return _serviceHandlerConfiguration.CertificateValidator; }
set { _serviceHandlerConfiguration.CertificateValidator = value; }
}
/// <summary>
/// Gets or Sets the ClaimsAuthenticationManager.
/// </summary>
public ClaimsAuthenticationManager ClaimsAuthenticationManager
{
get { return _claimsAuthenticationManager; }
set
{
if (value == null)
{
throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
}
_claimsAuthenticationManager = value;
}
}
/// <summary>
/// Gets or Sets the ClaimsAuthorizationManager.
/// </summary>
public ClaimsAuthorizationManager ClaimsAuthorizationManager
{
get { return _claimsAuthorizationManager; }
set
{
if (value == null)
{
throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
}
_claimsAuthorizationManager = value;
}
}
/// <summary>
/// Gets or Sets detection of replaying of tokens by handlers in the default handler configuration.
/// </summary>
public bool DetectReplayedTokens
{
get { return _serviceHandlerConfiguration.DetectReplayedTokens; }
set { _serviceHandlerConfiguration.DetectReplayedTokens = value; }
}
/// <summary>
/// Determines if <see cref="IdentityConfiguration.Initialize"/> has been called.
/// </summary>
public virtual bool IsInitialized
{
get
{
return _isInitialized;
}
protected set
{
_isInitialized = value;
}
}
private static SecurityTokenResolver GetServiceTokenResolver(IdentityConfigurationElement element)
{
try
{
return CustomTypeElement.Resolve<SecurityTokenResolver>(element.ServiceTokenResolver);
}
catch (ArgumentException inner)
{
throw DiagnosticUtility.ThrowHelperConfigurationError(
element, ConfigurationStrings.ServiceTokenResolver, inner);
}
}
private static SecurityTokenResolver GetIssuerTokenResolver(IdentityConfigurationElement element)
{
try
{
return CustomTypeElement.Resolve<SecurityTokenResolver>(element.IssuerTokenResolver);
}
catch (ArgumentException inner)
{
throw DiagnosticUtility.ThrowHelperConfigurationError(
element, ConfigurationStrings.IssuerTokenResolver, inner);
}
}
private static ClaimsAuthenticationManager GetClaimsAuthenticationManager(IdentityConfigurationElement element)
{
try
{
return CustomTypeElement.Resolve<ClaimsAuthenticationManager>(element.ClaimsAuthenticationManager);
}
catch (ArgumentException inner)
{
throw DiagnosticUtility.ThrowHelperConfigurationError(
element, ConfigurationStrings.ClaimsAuthenticationManager, inner);
}
}
private static IssuerNameRegistry GetIssuerNameRegistry(IssuerNameRegistryElement element)
{
try
{
Type type = string.IsNullOrEmpty(element.Type) ? DefaultIssuerNameRegistryType : Type.GetType(element.Type);
return TypeResolveHelper.Resolve<IssuerNameRegistry>(element, type);
}
catch (ArgumentException inner)
{
throw DiagnosticUtility.ThrowHelperConfigurationError(
element, ConfigurationStrings.IssuerNameRegistry, inner);
}
}
/// <summary>
/// Updates properties in the <see cref="SecurityTokenHandlerConfiguration"/> objects for the
/// <see cref="SecurityTokenHandlerCollection"/> objects contained in
/// <see cref="IdentityConfiguration.SecurityTokenHandlerCollectionManager"/> to be consistent with the property
/// values on this <see cref="IdentityConfiguration"/> instance.
/// </summary>
/// <remarks>
/// This method should be invoked prior to using these token handlers
/// for token processing.
/// </remarks>
/// <exception cref="InvalidOperationException">If this method is invoked more than once.</exception>
public virtual void Initialize()
{
if (this.IsInitialized)
{
throw DiagnosticUtility.ThrowHelperInvalidOperation(SR.GetString(SR.ID7009));
}
SecurityTokenHandlerCollection defaultCollection = this.SecurityTokenHandlers;
if (!object.ReferenceEquals(_serviceHandlerConfiguration, defaultCollection.Configuration))
{
//
// If someone has created their own new STHConfig and set it as default, leave that config alone.
//
TraceUtility.TraceString(TraceEventType.Information, SR.GetString(SR.ID4283));
this.IsInitialized = true;
return;
}
// Update the ServiceTokenResolver of the default TokenHandlerCollection's configuration, if serviceCertificate is set.
if (this.ServiceCertificate != null)
{
SecurityTokenResolver serviceCertificateResolver = SecurityTokenResolver.CreateDefaultSecurityTokenResolver(new ReadOnlyCollection<SecurityToken>(
new SecurityToken[] { new X509SecurityToken(this.ServiceCertificate) }), false);
SecurityTokenResolver tokenResolver = this.SecurityTokenHandlers.Configuration.ServiceTokenResolver;
if ((tokenResolver != null) && (tokenResolver != EmptySecurityTokenResolver.Instance))
{
this.SecurityTokenHandlers.Configuration.ServiceTokenResolver = new AggregateTokenResolver(new SecurityTokenResolver[] { serviceCertificateResolver, tokenResolver });
}
else
{
this.SecurityTokenHandlers.Configuration.ServiceTokenResolver = serviceCertificateResolver;
}
}
SecurityTokenResolver configuredIssuerTokenResolver = this.IssuerTokenResolver;
if (this.IssuerTokenResolver == SecurityTokenHandlerConfiguration.DefaultIssuerTokenResolver)
{
//
// Add the known certificates from WCF's ServiceCredentials in front of
// the default issuer token resolver.
//
if (this.KnownIssuerCertificates != null)
{
int count = this.KnownIssuerCertificates.Count;
if (count > 0)
{
SecurityToken[] tokens = new SecurityToken[count];
for (int i = 0; i < count; i++)
{
tokens[i] = new X509SecurityToken(this.KnownIssuerCertificates[i]);
}
SecurityTokenResolver knownCertificateTokenResolver = SecurityTokenResolver.CreateDefaultSecurityTokenResolver(new ReadOnlyCollection<SecurityToken>(tokens), false);
this.IssuerTokenResolver = new AggregateTokenResolver(new SecurityTokenResolver[] { knownCertificateTokenResolver, configuredIssuerTokenResolver });
}
}
}
if (this.CertificateValidationMode != X509CertificateValidationMode.Custom)
{
defaultCollection.Configuration.CertificateValidator = X509Util.CreateCertificateValidator(defaultCollection.Configuration.CertificateValidationMode,
defaultCollection.Configuration.RevocationMode,
defaultCollection.Configuration.TrustedStoreLocation);
}
else if (object.ReferenceEquals(defaultCollection.Configuration.CertificateValidator, SecurityTokenHandlerConfiguration.DefaultCertificateValidator))
{
//
// If the mode is custom but the validator or still default, something has gone wrong.
//
throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.GetString(SR.ID4280)));
}
this.IsInitialized = true;
}
/// <summary>
/// Loads the settings for the IdentityConfiguration from the application or web configuration file.
/// </summary>
/// <remarks>
/// If there is no configuration file, or the named section does not exist, then no exception is thrown,
/// instead the class is loaded with a set of default values.
/// </remarks>
protected void LoadConfiguration(IdentityConfigurationElement element)
{
if (element != null)
{
//
// Load the claims authentication manager
//
if (element.ClaimsAuthenticationManager.IsConfigured)
{
_claimsAuthenticationManager = GetClaimsAuthenticationManager(element);
}
//
// Load the claims authorization manager.
//
if (element.ClaimsAuthorizationManager.IsConfigured)
{
_claimsAuthorizationManager = CustomTypeElement.Resolve<ClaimsAuthorizationManager>(element.ClaimsAuthorizationManager);
}
//
// Load the service level Security Token Handler configuration
//
_serviceHandlerConfiguration = LoadHandlerConfiguration(element);
}
//
// Reads handler configuration via LoadConfiguredHandlers. Do this last.
//
_securityTokenHandlerCollectionManager = LoadHandlers(element);
}
/// <summary>
/// Loads the <see cref="SecurityTokenHandlerCollectionManager"/> defined for a given service.
/// </summary>
/// <param name="serviceElement">The <see cref="IdentityConfigurationElement"/> used to configure this instance.</param>
/// <returns></returns>
protected SecurityTokenHandlerCollectionManager LoadHandlers(IdentityConfigurationElement serviceElement)
{
//
// We start with a token handler collection manager that contains a single collection that includes the default
// handlers for the system.
//
SecurityTokenHandlerCollectionManager manager = SecurityTokenHandlerCollectionManager.CreateEmptySecurityTokenHandlerCollectionManager();
if (serviceElement != null)
{
//
// Load any token handler collections that appear as part of this service element
//
if (serviceElement.SecurityTokenHandlerSets.Count > 0)
{
foreach (SecurityTokenHandlerElementCollection handlerElementCollection in serviceElement.SecurityTokenHandlerSets)
{
try
{
SecurityTokenHandlerConfiguration handlerConfiguration;
SecurityTokenHandlerCollection handlerCollection;
if (string.IsNullOrEmpty(handlerElementCollection.Name) ||
StringComparer.Ordinal.Equals(handlerElementCollection.Name, ConfigurationStrings.DefaultConfigurationElementName))
{
//
// For the default collection, merge the IdentityConfiguration with the underlying config, if it exists.
//
if (handlerElementCollection.SecurityTokenHandlerConfiguration.IsConfigured)
{
//
// Configuration from a nested configuration object. We start with Service level configuration for
// handlers and then override the collection specific configuration. The result is a new configuration
// object that can only be modified by accessing the collection or handlers configuration properties.
//
_serviceHandlerConfiguration = LoadHandlerConfiguration(serviceElement);
handlerConfiguration = LoadHandlerConfiguration(_serviceHandlerConfiguration, handlerElementCollection.SecurityTokenHandlerConfiguration);
}
else
{
//
// No nested configuration object. We use the values from the ServiceElement for this case.
//
handlerConfiguration = LoadHandlerConfiguration(serviceElement);
}
_serviceHandlerConfiguration = handlerConfiguration;
}
else
{
//
// This is a non-default collection. There should be no settings inherited from IdentityConfiguration.
//
if (handlerElementCollection.SecurityTokenHandlerConfiguration.IsConfigured)
{
handlerConfiguration = LoadHandlerConfiguration(null, handlerElementCollection.SecurityTokenHandlerConfiguration);
}
else
{
//
// If there is no underlying config, set everything as default.
//
handlerConfiguration = new SecurityTokenHandlerConfiguration();
}
}
handlerCollection = new SecurityTokenHandlerCollection(handlerConfiguration);
manager[handlerElementCollection.Name] = handlerCollection;
foreach (CustomTypeElement handlerElement in handlerElementCollection)
{
handlerCollection.Add(CustomTypeElement.Resolve<SecurityTokenHandler>(handlerElement));
}
}
catch (ArgumentException inner)
{
throw DiagnosticUtility.ThrowHelperConfigurationError(serviceElement, handlerElementCollection.Name, inner);
}
}
}
//
// Ensure that the default usage collection always exists
//
if (!manager.ContainsKey(SecurityTokenHandlerCollectionManager.Usage.Default))
{
manager[SecurityTokenHandlerCollectionManager.Usage.Default] = SecurityTokenHandlerCollection.CreateDefaultSecurityTokenHandlerCollection(_serviceHandlerConfiguration);
}
}
else
{
//
// Ensure that the default usage collection always exists
//
_serviceHandlerConfiguration = new SecurityTokenHandlerConfiguration();
_serviceHandlerConfiguration.MaxClockSkew = _serviceMaxClockSkew;
if (!manager.ContainsKey(SecurityTokenHandlerCollectionManager.Usage.Default))
{
manager[SecurityTokenHandlerCollectionManager.Usage.Default] = SecurityTokenHandlerCollection.CreateDefaultSecurityTokenHandlerCollection(_serviceHandlerConfiguration);
}
}
return manager;
}
/// <summary>
/// Loads a SecurityTokenHandlerConfiguration using the elements directly under the ServiceElement.
/// </summary>
protected SecurityTokenHandlerConfiguration LoadHandlerConfiguration(IdentityConfigurationElement element)
{
SecurityTokenHandlerConfiguration handlerConfiguration = new SecurityTokenHandlerConfiguration();
try
{
if (element.ElementInformation.Properties[ConfigurationStrings.MaximumClockSkew].ValueOrigin != PropertyValueOrigin.Default)
{
handlerConfiguration.MaxClockSkew = element.MaximumClockSkew;
}
else
{
handlerConfiguration.MaxClockSkew = _serviceMaxClockSkew;
}
}
catch (ArgumentException inner)
{
throw DiagnosticUtility.ThrowHelperConfigurationError(element, ConfigurationStrings.MaximumClockSkew, inner);
}
if (element.AudienceUris.IsConfigured)
{
handlerConfiguration.AudienceRestriction.AudienceMode = element.AudienceUris.Mode;
foreach (AudienceUriElement audienceUriElement in element.AudienceUris)
{
handlerConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(audienceUriElement.Value, UriKind.RelativeOrAbsolute));
}
}
if (element.Caches.IsConfigured)
{
if (element.Caches.TokenReplayCache.IsConfigured)
{
handlerConfiguration.Caches.TokenReplayCache = CustomTypeElement.Resolve<TokenReplayCache>(element.Caches.TokenReplayCache);
}
if (element.Caches.SessionSecurityTokenCache.IsConfigured)
{
handlerConfiguration.Caches.SessionSecurityTokenCache = CustomTypeElement.Resolve<SessionSecurityTokenCache>(element.Caches.SessionSecurityTokenCache);
}
}
if (element.CertificateValidation.IsConfigured)
{
handlerConfiguration.RevocationMode = element.CertificateValidation.RevocationMode;
handlerConfiguration.CertificateValidationMode = element.CertificateValidation.CertificateValidationMode;
handlerConfiguration.TrustedStoreLocation = element.CertificateValidation.TrustedStoreLocation;
if (element.CertificateValidation.CertificateValidator.IsConfigured)
{
handlerConfiguration.CertificateValidator = CustomTypeElement.Resolve<X509CertificateValidator>(element.CertificateValidation.CertificateValidator);
}
}
//
// Load the issuer name registry
//
if (element.IssuerNameRegistry.IsConfigured)
{
handlerConfiguration.IssuerNameRegistry = GetIssuerNameRegistry(element.IssuerNameRegistry);
}
//
// Load the issuer token resolver
//
if (element.IssuerTokenResolver.IsConfigured)
{
handlerConfiguration.IssuerTokenResolver = GetIssuerTokenResolver(element);
}
//
// SaveBootstrapContext
//
handlerConfiguration.SaveBootstrapContext = element.SaveBootstrapContext;
//
// Load the service token resolver
//
if (element.ServiceTokenResolver.IsConfigured)
{
handlerConfiguration.ServiceTokenResolver = GetServiceTokenResolver(element);
}
//
// TokenReplayCache related items
//
if (element.TokenReplayDetection.IsConfigured)
{
//
// Set on SecurityTokenHandlerConfiguration
//
// DetectReplayedTokens set - { true | false }
//
handlerConfiguration.DetectReplayedTokens = element.TokenReplayDetection.Enabled;
// ExpirationPeriod { TimeSpan }
//
handlerConfiguration.TokenReplayCacheExpirationPeriod = element.TokenReplayDetection.ExpirationPeriod;
}
return handlerConfiguration;
}
/// <summary>
/// Loads configuration elements pertaining to the <see cref="SecurityTokenHandlerCollection"/>
/// </summary>
/// <param name="baseConfiguration">Base <see cref="SecurityTokenHandlerConfiguration"/> from which to inherit default values.</param>
/// <param name="element">The <see cref="SecurityTokenHandlerConfigurationElement"/> from the configuration file.</param>
/// <returns></returns>
protected SecurityTokenHandlerConfiguration LoadHandlerConfiguration(SecurityTokenHandlerConfiguration baseConfiguration, SecurityTokenHandlerConfigurationElement element)
{
SecurityTokenHandlerConfiguration handlerConfiguration = (baseConfiguration == null) ? new SecurityTokenHandlerConfiguration() : baseConfiguration;
if (element.AudienceUris.IsConfigured)
{
//
// There is no inheritance of the content of the element from base to child, only the whole element. If the
// user specifies any part, they must specify it all.
//
handlerConfiguration.AudienceRestriction.AudienceMode = AudienceUriMode.Always;
handlerConfiguration.AudienceRestriction.AllowedAudienceUris.Clear();
handlerConfiguration.AudienceRestriction.AudienceMode = element.AudienceUris.Mode;
foreach (AudienceUriElement audienceUriElement in element.AudienceUris)
{
handlerConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(audienceUriElement.Value, UriKind.RelativeOrAbsolute));
}
}
if (element.Caches.IsConfigured)
{
if (element.Caches.TokenReplayCache.IsConfigured)
{
handlerConfiguration.Caches.TokenReplayCache = CustomTypeElement.Resolve<TokenReplayCache>(element.Caches.TokenReplayCache);
}
if (element.Caches.SessionSecurityTokenCache.IsConfigured)
{
handlerConfiguration.Caches.SessionSecurityTokenCache = CustomTypeElement.Resolve<SessionSecurityTokenCache>(element.Caches.SessionSecurityTokenCache);
}
}
if (element.CertificateValidation.IsConfigured)
{
handlerConfiguration.RevocationMode = element.CertificateValidation.RevocationMode;
handlerConfiguration.CertificateValidationMode = element.CertificateValidation.CertificateValidationMode;
handlerConfiguration.TrustedStoreLocation = element.CertificateValidation.TrustedStoreLocation;
if (element.CertificateValidation.CertificateValidator.IsConfigured)
{
handlerConfiguration.CertificateValidator = CustomTypeElement.Resolve<X509CertificateValidator>(element.CertificateValidation.CertificateValidator);
}
}
//
// Load the issuer name registry
//
if (element.IssuerNameRegistry.IsConfigured)
{
handlerConfiguration.IssuerNameRegistry = GetIssuerNameRegistry(element.IssuerNameRegistry);
}
//
// Load the issuer token resolver
//
if (element.IssuerTokenResolver.IsConfigured)
{
handlerConfiguration.IssuerTokenResolver = CustomTypeElement.Resolve<SecurityTokenResolver>(element.IssuerTokenResolver);
}
//
// Load MaxClockSkew
//
try
{
if (element.ElementInformation.Properties[ConfigurationStrings.MaximumClockSkew].ValueOrigin != PropertyValueOrigin.Default)
{
handlerConfiguration.MaxClockSkew = element.MaximumClockSkew;
}
}
catch (ArgumentException inner)
{
throw DiagnosticUtility.ThrowHelperConfigurationError(element, ConfigurationStrings.MaximumClockSkew, inner);
}
//
// SaveBootstrapTokens
//
if (element.ElementInformation.Properties[ConfigurationStrings.SaveBootstrapContext].ValueOrigin != PropertyValueOrigin.Default)
{
handlerConfiguration.SaveBootstrapContext = element.SaveBootstrapContext;
}
//
// Load the service token resolver
//
if (element.ServiceTokenResolver.IsConfigured)
{
handlerConfiguration.ServiceTokenResolver = CustomTypeElement.Resolve<SecurityTokenResolver>(element.ServiceTokenResolver);
}
//
// TokenReplayCache related items
//
if (element.TokenReplayDetection.IsConfigured)
{
//
// Set on SecurityTokenHandlerConfiguration
//
//
// DetectReplayedTokens set - { true | false }
//
handlerConfiguration.DetectReplayedTokens = element.TokenReplayDetection.Enabled;
//
// ExpirationPeriod { TimeSpan }
//
handlerConfiguration.TokenReplayCacheExpirationPeriod = element.TokenReplayDetection.ExpirationPeriod;
}
return handlerConfiguration;
}
/// <summary>
/// Gets or sets the maximum allowable time difference between the
/// system clocks of the two parties that are communicating.
/// </summary>
public TimeSpan MaxClockSkew
{
get { return _serviceHandlerConfiguration.MaxClockSkew; }
set { _serviceHandlerConfiguration.MaxClockSkew = value; }
}
/// <summary>
/// Gets or sets the service name of this configuration.
/// </summary>
public string Name
{
get
{
return _identityConfigurationName;
}
}
/// <summary>
/// Gets or sets the IssuerNameRegistry used to resolve issuer names.
/// </summary>
public IssuerNameRegistry IssuerNameRegistry
{
get
{
return _serviceHandlerConfiguration.IssuerNameRegistry;
}
set
{
if (value == null)
{
throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
}
_serviceHandlerConfiguration.IssuerNameRegistry = value;
}
}
/// <summary>
/// The service certificate to initialize the ServiceTokenResolver and the SessionSecurityTokenHandler.
/// </summary>
public X509Certificate2 ServiceCertificate
{
get { return _serviceCertificate; }
set { this._serviceCertificate = value; }
}
internal List<X509Certificate2> KnownIssuerCertificates
{
get
{
return this.knownCertificates;
}
set
{
this.knownCertificates = value;
}
}
/// <summary>
/// Gets or Sets the Issuer token resolver.
/// </summary>
public SecurityTokenResolver IssuerTokenResolver
{
get
{
return _serviceHandlerConfiguration.IssuerTokenResolver;
}
set
{
if (value == null)
{
throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
}
_serviceHandlerConfiguration.IssuerTokenResolver = value;
}
}
/// <summary>
/// Gets or sets the revocation mode used by handlers to validate issuer certificates
/// </summary>
public X509RevocationMode RevocationMode
{
get { return _serviceHandlerConfiguration.RevocationMode; }
set { _serviceHandlerConfiguration.RevocationMode = value; }
}
/// <summary>
/// Gets or Sets the Service token resolver.
/// </summary>
public SecurityTokenResolver ServiceTokenResolver
{
get
{
return _serviceHandlerConfiguration.ServiceTokenResolver;
}
set
{
if (value == null)
{
throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
}
_serviceHandlerConfiguration.ServiceTokenResolver = value;
}
}
/// <summary>
/// Gets or sets if BootstrapContext is saved in the ClaimsIdentity and Sessions after token validation.
/// </summary>
public bool SaveBootstrapContext
{
get { return _serviceHandlerConfiguration.SaveBootstrapContext; }
set { _serviceHandlerConfiguration.SaveBootstrapContext = value; }
}
/// <summary>
/// The <see cref="SecurityTokenHandlerCollectionManager" /> containing the set of <see cref="SecurityTokenHandler" />
/// objects used for serializing and validating tokens found in WS-Trust messages.
/// </summary>
public SecurityTokenHandlerCollectionManager SecurityTokenHandlerCollectionManager
{
get
{
return _securityTokenHandlerCollectionManager;
}
}
/// <summary>
/// The <see cref="SecurityTokenHandlerCollection" /> collection of <see cref="SecurityTokenHandler" />
/// objects used for serializing and validating tokens found in WS-Trust messages.
/// If user wants to register their own token handler, they
/// can simply add their own handler to this collection.
/// </summary>
public SecurityTokenHandlerCollection SecurityTokenHandlers
{
get
{
return _securityTokenHandlerCollectionManager[SecurityTokenHandlerCollectionManager.Usage.Default];
}
}
/// <summary>
/// Gets or Sets the expiration period for items placed in the TokenReplayCache.
/// </summary>
public TimeSpan TokenReplayCacheExpirationPeriod
{
get { return _serviceHandlerConfiguration.TokenReplayCacheExpirationPeriod; }
set { _serviceHandlerConfiguration.TokenReplayCacheExpirationPeriod = value; }
}
/// <summary>
/// Gets or sets the trusted store location used by handlers to validate issuer certificates
/// </summary>
public StoreLocation TrustedStoreLocation
{
get { return _serviceHandlerConfiguration.TrustedStoreLocation; }
set { _serviceHandlerConfiguration.TrustedStoreLocation = value; }
}
}
}
|