|
//------------------------------------------------------------------------------
// <copyright file="RolePrincipal.cs" company="Microsoft">
// Copyright (c) Microsoft Corporation. All rights reserved.
// </copyright>
//------------------------------------------------------------------------------
/*
* RolePrincipal
*
* Copyright (c) 2002 Microsoft Corporation
*/
namespace System.Web.Security {
using System.Collections.Specialized;
using System.Configuration;
using System.Configuration.Provider;
using System.Diagnostics.CodeAnalysis;
using System.Globalization;
using System.IO;
using System.Reflection;
using System.Runtime.Serialization;
using System.Runtime.Serialization.Formatters.Binary;
using System.Security;
using System.Security.Claims;
using System.Security.Permissions;
using System.Security.Principal;
using System.Text;
using System.Web;
using System.Web.Hosting;
using System.Web.Security.Cryptography;
using System.Web.Util;
[Serializable]
public class RolePrincipal : ClaimsPrincipal, ISerializable
{
[NonSerialized]
static Type s_type;
public RolePrincipal(IIdentity identity, string encryptedTicket)
{
if (identity == null)
throw new ArgumentNullException( "identity" );
if (encryptedTicket == null)
throw new ArgumentNullException( "encryptedTicket" );
_Identity = identity;
_ProviderName = Roles.Provider.Name;
if (identity.IsAuthenticated)
InitFromEncryptedTicket(encryptedTicket);
else
Init();
}
public RolePrincipal(IIdentity identity)
{
if (identity == null)
throw new ArgumentNullException( "identity" );
_Identity = identity;
Init();
}
public RolePrincipal(string providerName, IIdentity identity )
{
if (identity == null)
throw new ArgumentNullException( "identity" );
if( providerName == null)
throw new ArgumentException( SR.GetString(SR.Role_provider_name_invalid) , "providerName" );
_ProviderName = providerName;
if (Roles.Providers[providerName] == null)
throw new ArgumentException(SR.GetString(SR.Role_provider_name_invalid), "providerName");
_Identity = identity;
Init();
}
public RolePrincipal(string providerName, IIdentity identity, string encryptedTicket )
{
if (identity == null)
throw new ArgumentNullException( "identity" );
if (encryptedTicket == null)
throw new ArgumentNullException( "encryptedTicket" );
if( providerName == null)
throw new ArgumentException( SR.GetString(SR.Role_provider_name_invalid) , "providerName" );
_ProviderName = providerName;
if (Roles.Providers[_ProviderName] == null)
throw new ArgumentException(SR.GetString(SR.Role_provider_name_invalid), "providerName");
_Identity = identity;
if (identity.IsAuthenticated)
InitFromEncryptedTicket(encryptedTicket);
else
Init();
}
private void InitFromEncryptedTicket( string encryptedTicket )
{
if (HostingEnvironment.IsHosted && EtwTrace.IsTraceEnabled(EtwTraceLevel.Information, EtwTraceFlags.AppSvc) && HttpContext.Current != null)
EtwTrace.Trace(EtwTraceType.ETW_TYPE_ROLE_BEGIN, HttpContext.Current.WorkerRequest);
if (string.IsNullOrEmpty(encryptedTicket))
goto Exit;
byte[] bTicket = CookieProtectionHelper.Decode(Roles.CookieProtectionValue, encryptedTicket, Purpose.RolePrincipal_Ticket);
if (bTicket == null)
goto Exit;
RolePrincipal rp = null;
MemoryStream ms = null;
try{
ms = new System.IO.MemoryStream(bTicket);
rp = (new BinaryFormatter()).Deserialize(ms) as RolePrincipal;
} catch {
} finally {
ms.Close();
}
if (rp == null)
goto Exit;
if (!StringUtil.EqualsIgnoreCase(rp._Username, _Identity.Name))
goto Exit;
if (!StringUtil.EqualsIgnoreCase(rp._ProviderName, _ProviderName))
goto Exit;
if (DateTime.UtcNow > rp._ExpireDate)
goto Exit;
_Version = rp._Version;
_ExpireDate = rp._ExpireDate;
_IssueDate = rp._IssueDate;
_IsRoleListCached = rp._IsRoleListCached;
_CachedListChanged = false;
_Username = rp._Username;
_Roles = rp._Roles;
// will it be the case that _Identity.Name != _Username?
RenewIfOld();
if (HostingEnvironment.IsHosted && EtwTrace.IsTraceEnabled(EtwTraceLevel.Information, EtwTraceFlags.AppSvc) && HttpContext.Current != null)
EtwTrace.Trace( EtwTraceType.ETW_TYPE_ROLE_END, HttpContext.Current.WorkerRequest, "RolePrincipal", _Identity.Name);
return;
Exit:
Init();
_CachedListChanged = true;
if (HostingEnvironment.IsHosted && EtwTrace.IsTraceEnabled(EtwTraceLevel.Information, EtwTraceFlags.AppSvc) && HttpContext.Current != null)
EtwTrace.Trace(EtwTraceType.ETW_TYPE_ROLE_END, HttpContext.Current.WorkerRequest, "RolePrincipal", _Identity.Name);
return;
}
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
private void Init() {
_Version = 1;
_IssueDate = DateTime.UtcNow;
_ExpireDate = DateTime.UtcNow.AddMinutes(Roles.CookieTimeout);
//_CookiePath = Roles.CookiePath;
_IsRoleListCached = false;
_CachedListChanged = false;
if (_ProviderName == null)
_ProviderName = Roles.Provider.Name;
if (_Roles == null)
_Roles = new HybridDictionary(true);
if (_Identity != null)
_Username = _Identity.Name;
AddIdentityAttachingRoles(_Identity);
}
/// <summary>
/// helper method to bind roles with an identity.
/// </summary>
[SecuritySafeCritical]
void AddIdentityAttachingRoles(IIdentity identity)
{
ClaimsIdentity claimsIdentity = null;
if (identity is ClaimsIdentity)
{
claimsIdentity = (identity as ClaimsIdentity).Clone();
}
else
{
claimsIdentity = new ClaimsIdentity(identity);
}
AttachRoleClaims(claimsIdentity);
base.AddIdentity(claimsIdentity);
}
[SecuritySafeCritical]
void AttachRoleClaims(ClaimsIdentity claimsIdentity)
{
RoleClaimProvider claimProvider = new RoleClaimProvider(this, claimsIdentity);
if (s_type == null)
{
s_type = typeof(DynamicRoleClaimProvider);
}
s_type.InvokeMember("AddDynamicRoleClaims", BindingFlags.InvokeMethod | BindingFlags.Public | BindingFlags.Static, null, null, new object[] { claimsIdentity, claimProvider.Claims }, CultureInfo.InvariantCulture);
}
////////////////////////////////////////////////////////////
// Public properties
public int Version { get { return _Version;}}
public DateTime ExpireDate { get { return _ExpireDate.ToLocalTime();}}
public DateTime IssueDate { get { return _IssueDate.ToLocalTime();}}
// DevDiv Bugs: 9446
// Expired should check against DateTime.UtcNow instead of DateTime.Now because
// _ExpireData is a Utc DateTime.
public bool Expired { get { return _ExpireDate < DateTime.UtcNow;}}
public String CookiePath { get { return Roles.CookiePath;}} //
public override IIdentity Identity { get { return _Identity; }}
public bool IsRoleListCached { get { return _IsRoleListCached; }}
public bool CachedListChanged { get { return _CachedListChanged; }}
public string ProviderName { get { return _ProviderName; } }
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
// Public functions
[SecurityPermission(SecurityAction.Assert, Flags = SecurityPermissionFlag.SerializationFormatter)]
public string ToEncryptedTicket()
{
if (!Roles.Enabled)
return null;
if (_Identity != null && !_Identity.IsAuthenticated)
return null;
if (_Identity == null && string.IsNullOrEmpty(_Username))
return null;
if (_Roles.Count > Roles.MaxCachedResults)
return null;
MemoryStream ms = new System.IO.MemoryStream();
byte[] buf = null;
IIdentity id = _Identity;
try {
_Identity = null;
BinaryFormatter bf = new BinaryFormatter();
bool originalSerializingForCookieValue = _serializingForCookie;
try {
// DevDiv 481327: ClaimsPrincipal is an expensive type to serialize and deserialize. If the developer is using
// role management, then he is going to be querying regular ASP.NET membership roles rather than claims, so
// we can cut back on the number of bytes sent across the wire by ignoring any claims in the underlying
// identity. Otherwise we risk sending a cookie too large for the browser to handle.
_serializingForCookie = true;
bf.Serialize(ms, this);
}
finally {
_serializingForCookie = originalSerializingForCookieValue;
}
buf = ms.ToArray();
} finally {
ms.Close();
_Identity = id;
}
return CookieProtectionHelper.Encode(Roles.CookieProtectionValue, buf, Purpose.RolePrincipal_Ticket);
}
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
private void RenewIfOld() {
if (!Roles.CookieSlidingExpiration)
return;
DateTime dtN = DateTime.UtcNow;
TimeSpan t1 = dtN - _IssueDate;
TimeSpan t2 = _ExpireDate - dtN;
if (t2 > t1)
return;
_ExpireDate = dtN + (_ExpireDate - _IssueDate);
_IssueDate = dtN;
_CachedListChanged = true;
}
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
public string[] GetRoles()
{
if (_Identity == null)
throw new ProviderException(SR.GetString(SR.Role_Principal_not_fully_constructed));
if (!_Identity.IsAuthenticated)
return new string[0];
string[] roles;
if (!_IsRoleListCached || !_GetRolesCalled) {
_Roles.Clear();
roles = Roles.Providers[_ProviderName].GetRolesForUser(Identity.Name);
foreach (string role in roles)
if (_Roles[role] == null)
_Roles.Add(role, String.Empty);
_IsRoleListCached = true;
_CachedListChanged = true;
_GetRolesCalled = true;
return roles;
} else {
roles = new string[_Roles.Count];
int index = 0;
foreach (string role in _Roles.Keys)
roles[index++] = role;
return roles;
}
}
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
public override bool IsInRole(string role)
{
if (_Identity == null)
throw new ProviderException(SR.GetString(SR.Role_Principal_not_fully_constructed));
if (!_Identity.IsAuthenticated || role == null)
return false;
role = role.Trim();
if (!IsRoleListCached) {
_Roles.Clear();
string[] roles = Roles.Providers[_ProviderName].GetRolesForUser(Identity.Name);
foreach(string roleTemp in roles)
if (_Roles[roleTemp] == null)
_Roles.Add(roleTemp, String.Empty);
_IsRoleListCached = true;
_CachedListChanged = true;
}
if (_Roles[role] != null)
return true;
//
return base.IsInRole(role);
}
public void SetDirty()
{
_IsRoleListCached = false;
_CachedListChanged = true;
}
protected RolePrincipal(SerializationInfo info, StreamingContext context)
:base(info, context)
{
_Version = info.GetInt32("_Version");
_ExpireDate = info.GetDateTime("_ExpireDate");
_IssueDate = info.GetDateTime("_IssueDate");
try {
_Identity = info.GetValue("_Identity", typeof(IIdentity)) as IIdentity;
} catch { } // Ignore Exceptions
_ProviderName = info.GetString("_ProviderName");
_Username = info.GetString("_Username");
_IsRoleListCached = info.GetBoolean("_IsRoleListCached");
_Roles = new HybridDictionary(true);
string allRoles = info.GetString("_AllRoles");
if (allRoles != null) {
foreach(string role in allRoles.Split(new char[] {','}))
if (_Roles[role] == null)
_Roles.Add(role, String.Empty);
}
// attach ourselves to the first valid claimsIdentity.
bool found = false;
foreach (var claimsIdentity in base.Identities)
{
if (claimsIdentity != null)
{
AttachRoleClaims(claimsIdentity);
found = true;
break;
}
}
if (!found)
{
AddIdentityAttachingRoles(new ClaimsIdentity(_Identity));
}
}
void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context)
{
GetObjectData(info, context);
}
protected override void GetObjectData(SerializationInfo info, StreamingContext context)
{
if (!_serializingForCookie) {
base.GetObjectData(info, context);
}
info.AddValue("_Version", _Version);
info.AddValue("_ExpireDate", _ExpireDate);
info.AddValue("_IssueDate", _IssueDate);
try {
info.AddValue("_Identity", _Identity);
} catch { } // Ignore Exceptions
info.AddValue("_ProviderName", _ProviderName);
info.AddValue("_Username", _Identity == null ? _Username : _Identity.Name);
info.AddValue("_IsRoleListCached", _IsRoleListCached);
if (_Roles.Count > 0) {
StringBuilder sb = new StringBuilder(_Roles.Count * 10);
foreach(object role in _Roles.Keys)
sb.Append(((string)role) + ",");
string allRoles = sb.ToString();
info.AddValue("_AllRoles", allRoles.Substring(0, allRoles.Length - 1));
} else {
info.AddValue("_AllRoles", String.Empty);
}
}
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
private int _Version;
private DateTime _ExpireDate;
private DateTime _IssueDate;
private IIdentity _Identity;
private string _ProviderName;
private string _Username;
private bool _IsRoleListCached;
private bool _CachedListChanged;
[ThreadStatic]
private static bool _serializingForCookie;
[NonSerialized]
private HybridDictionary _Roles = null;
[NonSerialized]
private bool _GetRolesCalled;
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
}
}
|