We need you! We're working hard on the next version of Developer Fusion - Let us know what you think we should be up to!

The Labs \ Source Viewer \ SSCLI \ System.Net \ AuthenticationState

SSCLI
  1. //------------------------------------------------------------------------------
  2. // <copyright file="_AuthenticationState.cs" company="Microsoft">
  3. //
  4. // Copyright (c) 2006 Microsoft Corporation. All rights reserved.
  5. //
  6. // The use and distribution terms for this software are contained in the file
  7. // named license.txt, which can be found in the root of this distribution.
  8. // By using this software in any fashion, you are agreeing to be bound by the
  9. // terms of this license.
  10. //
  11. // You must not remove this notice, or any other, from this software.
  12. //
  13. // </copyright>
  14. //------------------------------------------------------------------------------
  16. namespace System.Net
  17. {
  18.     using System.Collections;
  19.     using System.IO;
  20.     using System.Runtime.Serialization;
  21.     using System.Security;
  22.     using System.Security.Cryptography.X509Certificates;
  23.     using System.Security.Permissions;
  24.     using System.Text;
  25.     using System.Text.RegularExpressions;
  26.     using System.Threading;
  27.     using System.Globalization;
  28.     using System.Net.Security;
  29.    
  30.     /// <devdoc>
  31.     /// <para>Used by HttpWebRequest to syncronize and orchestrate authentication<para>
  32.     /// </devdoc>
  33.     internal class AuthenticationState
  34.     {
  35.        
  36.         // true if we already attempted pre-authentication regardless if it has been
  37.         // 1) possible,
  38.         // 2) succesfull or
  39.         // 3) unsuccessfull
  40.         private bool TriedPreAuth;
  41.        
  42.         internal Authorization Authorization;
  43.        
  44.         internal IAuthenticationModule Module;
  45.        
  46.         // used to request a special connection for NTLM
  47.         internal string UniqueGroupId;
  48.        
  49.         // used to distinguish proxy auth from server auth
  50.         private bool IsProxyAuth;
  51.        
  52.         // the Uri of the host we're authenticating (proxy/server)
  53.         // used to match entries in the CredentialCache
  54.         internal Uri ChallengedUri;
  55.         private string ChallengedSpn;
  56.        
  57.        
  58.         internal HttpResponseHeader AuthenticateHeader {
  59.             get { return IsProxyAuth ? HttpResponseHeader.ProxyAuthenticate : HttpResponseHeader.WwwAuthenticate; }
  60.         }
  61.         internal string AuthorizationHeader {
  62.             get { return IsProxyAuth ? HttpKnownHeaderNames.ProxyAuthorization : HttpKnownHeaderNames.Authorization; }
  63.         }
  64.         internal HttpStatusCode StatusCodeMatch {
  65.             get { return IsProxyAuth ? HttpStatusCode.ProxyAuthenticationRequired : HttpStatusCode.Unauthorized; }
  66.         }
  67.        
  68.         internal AuthenticationState(bool isProxyAuth)
  69.         {
  70.             IsProxyAuth = isProxyAuth;
  71.         }
  72.        
  73.         //
  74.         // we need to do this to handle proxies in the correct way before
  75.         // calling into the AuthenticationManager APIs
  76.         //
  77.         private void PrepareState(HttpWebRequest httpWebRequest)
  78.         {
  79.             Uri newUri = IsProxyAuth ? httpWebRequest.ServicePoint.InternalAddress : httpWebRequest.Address;
  80.            
  81.             if ((object)ChallengedUri != (object)newUri) {
  82.                 if ((object)ChallengedUri == null || (object)ChallengedUri.Scheme != (object)newUri.Scheme || ChallengedUri.Host != newUri.Host || ChallengedUri.Port != newUri.Port) {
  83.                     //
  84.                     // must be a new server/port/scheme for this auth state, can happen on a redirect
  85.                     //
  86.                     ChallengedSpn = null;
  87.                 }
  88.                 ChallengedUri = newUri;
  89.             }
  90.             httpWebRequest.CurrentAuthenticationState = this;
  91.         }
  92.         //
  93.         //
  94.         //
  95.         internal string GetComputeSpn(HttpWebRequest httpWebRequest)
  96.         {
  97.             if (ChallengedSpn != null)
  98.                 return ChallengedSpn;
  99.            
  100.             string spnKey = httpWebRequest.ChallengedUri.GetParts(UriComponents.Scheme | UriComponents.Host | UriComponents.Port | UriComponents.Path, UriFormat.SafeUnescaped);
  101.             string spn = AuthenticationManager.SpnDictionary.InternalGet(spnKey);
  102.             if (spn == null) {
  103.                 if (!IsProxyAuth && httpWebRequest.ServicePoint.InternalProxyServicePoint) {
  104.                     // Here the NT-Security folks need us to attempt a DNS lookup to figure out
  105.                     // the FQDN. only do the lookup for short names (no IP addresses or DNS names)
  106.                     //
  107.                     // Initialize a backup value
  108.                     spn = httpWebRequest.ChallengedUri.Host;
  109.                    
  110.                     if (httpWebRequest.ChallengedUri.HostNameType != UriHostNameType.IPv6 && httpWebRequest.ChallengedUri.HostNameType != UriHostNameType.IPv4 && spn.IndexOf('.') == -1) {
  111.                         try {
  112.                             spn = Dns.InternalGetHostByName(spn).HostName;
  113.                             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::GetComputeSpn() Dns returned host:" + ValidationHelper.ToString(spn));
  114.                         }
  115.                         catch (Exception exception) {
  116.                             if (NclUtilities.IsFatal(exception))
  117.                                 throw;
  118.                             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::GetComputeSpn() GetHostByName(host) failed:" + ValidationHelper.ToString(exception));
  119.                         }
  120.                     }
  121.                 }
  122.                 else {
  123.                    
  124.                     spn = httpWebRequest.ServicePoint.Hostname;
  125.                 }
  126.                 spn = "HTTP/" + spn;
  127.                 spnKey = httpWebRequest.ChallengedUri.GetParts(UriComponents.SchemeAndServer, UriFormat.SafeUnescaped) + "/";
  128.                 AuthenticationManager.SpnDictionary.InternalSet(spnKey, spn);
  129.             }
  130.             return ChallengedSpn = spn;
  131.         }
  132.         //
  133.         internal void PreAuthIfNeeded(HttpWebRequest httpWebRequest, ICredentials authInfo)
  134.         {
  135.             //
  136.             // attempt to do preauth, if needed
  137.             //
  138.             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::PreAuthIfNeeded() TriedPreAuth:" + TriedPreAuth.ToString() + " authInfo:" + ValidationHelper.HashString(authInfo));
  139.             if (!TriedPreAuth) {
  140.                 TriedPreAuth = true;
  141.                 if (authInfo != null) {
  142.                     PrepareState(httpWebRequest);
  143.                     Authorization preauth = null;
  144.                     try {
  145.                         preauth = AuthenticationManager.PreAuthenticate(httpWebRequest, authInfo);
  146.                         GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::PreAuthIfNeeded() preauth:" + ValidationHelper.HashString(preauth));
  147.                         if (preauth != null && preauth.Message != null) {
  148.                             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::PreAuthIfNeeded() setting TriedPreAuth to Complete:" + preauth.Complete.ToString());
  149.                             UniqueGroupId = preauth.ConnectionGroupId;
  150.                             httpWebRequest.Headers.Set(AuthorizationHeader, preauth.Message);
  151.                         }
  152.                     }
  153.                     catch (Exception exception) {
  154.                         GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::PreAuthIfNeeded() PreAuthenticate() returned exception:" + exception.Message);
  155.                         ClearSession(httpWebRequest);
  156.                     }
  157.                     catch {
  158.                         GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::PreAuthIfNeeded() PreAuthenticate() returned exception: Non-CLS Compliant Exception");
  159.                         ClearSession(httpWebRequest);
  160.                     }
  161.                 }
  162.             }
  163.         }
  164.        
  165.         //
  166.         // attempts to authenticate the request:
  167.         // returns true only if it succesfully called into the AuthenticationManager
  168.         // and got back a valid Authorization and succesfully set the appropriate auth headers
  169.         //
  170.         internal bool AttemptAuthenticate(HttpWebRequest httpWebRequest, ICredentials authInfo)
  171.         {
  172.             //
  173.             // Check for previous authentication attempts or the presence of credentials
  174.             //
  175.             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::AttemptAuthenticate() httpWebRequest#" + ValidationHelper.HashString(httpWebRequest) + " AuthorizationHeader:" + AuthorizationHeader.ToString());
  176.            
  177.             if (Authorization != null && Authorization.Complete) {
  178.                 GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::AttemptAuthenticate() Authorization!=null Authorization.Complete:" + Authorization.Complete.ToString());
  179.                 if (IsProxyAuth) {
  180.                     GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::AttemptAuthenticate() ProxyAuth cleaning up auth status");
  181.                     ClearAuthReq(httpWebRequest);
  182.                 }
  183.                 return false;
  184.             }
  185.            
  186.             if (authInfo == null) {
  187.                 GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::AttemptAuthenticate() authInfo==null Authorization#" + ValidationHelper.HashString(Authorization));
  188.                 return false;
  189.             }
  190.            
  191.             string challenge = httpWebRequest.AuthHeader(AuthenticateHeader);
  192.            
  193.             if (challenge == null) {
  194.                 //
  195.                 // the server sent no challenge, but this might be the case
  196.                 // in which we're succeeding an authorization handshake to
  197.                 // a proxy while a handshake with the server is still in progress.
  198.                 // if the handshake with the proxy is complete and we actually have
  199.                 // a handshake with the server in progress we can send the authorization header for the server as well.
  200.                 //
  201.                 if (!IsProxyAuth && Authorization != null && httpWebRequest.ProxyAuthenticationState.Authorization != null) {
  202.                     httpWebRequest.Headers.Set(AuthorizationHeader, Authorization.Message);
  203.                 }
  204.                 GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::AttemptAuthenticate() challenge==null Authorization#" + ValidationHelper.HashString(Authorization));
  205.                 return false;
  206.             }
  207.            
  208.             //
  209.             // if the AuthenticationManager throws on Authenticate,
  210.             // bubble up that Exception to the user
  211.             //
  212.             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::AttemptAuthenticate() challenge:" + challenge);
  213.            
  214.             PrepareState(httpWebRequest);
  215.             try {
  216.                 Authorization = AuthenticationManager.Authenticate(challenge, httpWebRequest, authInfo);
  217.             }
  218.             catch (Exception exception) {
  219.                 Authorization = null;
  220.                 GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::PreAuthIfNeeded() PreAuthenticate() returned exception:" + exception.Message);
  221.                 ClearSession(httpWebRequest);
  222.                 throw;
  223.             }
  224.             catch {
  225.                 Authorization = null;
  226.                 GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::PreAuthIfNeeded() PreAuthenticate() returned exception: Non-CLS Compliant Exception");
  227.                 ClearSession(httpWebRequest);
  228.                 throw;
  229.             }
  230.            
  231.            
  232.             if (Authorization == null) {
  233.                 GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::AttemptAuthenticate() Authorization==null");
  234.                 return false;
  235.             }
  236.             if (Authorization.Message == null) {
  237.                 GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::AttemptAuthenticate() Authorization.Message==null");
  238.                 Authorization = null;
  239.                 return false;
  240.             }
  241.            
  242.             UniqueGroupId = Authorization.ConnectionGroupId;
  243.             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::AttemptAuthenticate() AuthorizationHeader:" + AuthorizationHeader + " blob: " + Authorization.Message.Length + "bytes Complete:" + Authorization.Complete.ToString());
  244.            
  245.             try {
  246.                 //
  247.                 // a "bad" module could try sending bad characters in the HTTP headers.
  248.                 // catch the exception from WebHeaderCollection.CheckBadChars()
  249.                 // fail the auth process
  250.                 // and return the exception to the user as InnerException
  251.                 //
  252.                 httpWebRequest.Headers.Set(AuthorizationHeader, Authorization.Message);
  253.             }
  254.             catch {
  255.                 Authorization = null;
  256.                 ClearSession(httpWebRequest);
  257.                 throw;
  258.             }
  259.            
  260.             return true;
  261.         }
  262.        
  263.         internal void ClearAuthReq(HttpWebRequest httpWebRequest)
  264.         {
  265.             //
  266.             // if we are authenticating and we're being redirected to
  267.             // another authentication space then remove the current
  268.             // authentication header
  269.             //
  270.             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::ClearAuthReq() httpWebRequest#" + ValidationHelper.HashString(httpWebRequest) + " " + AuthorizationHeader.ToString() + ": " + ValidationHelper.ToString(httpWebRequest.Headers[AuthorizationHeader]));
  271.             TriedPreAuth = false;
  272.             Authorization = null;
  273.             UniqueGroupId = null;
  274.             httpWebRequest.Headers.Remove(AuthorizationHeader);
  275.         }
  276.        
  277.         //
  278.         // gives the IAuthenticationModule a chance to update its internal state.
  279.         // do any necessary cleanup and update the Complete status of the associated Authorization.
  280.         //
  281.         internal void Update(HttpWebRequest httpWebRequest)
  282.         {
  283.             //
  284.             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::Update() httpWebRequest#" + ValidationHelper.HashString(httpWebRequest) + " Authorization#" + ValidationHelper.HashString(Authorization) + " ResponseStatusCode:" + httpWebRequest.ResponseStatusCode.ToString());
  285.            
  286.             if (Authorization != null) {
  287.                
  288.                 PrepareState(httpWebRequest);
  289.                
  290.                 ISessionAuthenticationModule myModule = Module as ISessionAuthenticationModule;
  291.                
  292.                 if (myModule != null) {
  293.                     //
  294.                     // the whole point here is to complete the Security Context. Sometimes, though,
  295.                     // a bad cgi script or a bad server, could miss sending back the final blob.
  296.                     // in this case we won't be able to complete the handshake, but we'll have to clean up anyway.
  297.                     //
  298.                     string challenge = httpWebRequest.AuthHeader(AuthenticateHeader);
  299.                     GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::Update() Complete:" + Authorization.Complete.ToString() + " Module:" + ValidationHelper.ToString(Module) + " challenge:" + ValidationHelper.ToString(challenge));
  300.                    
  301.                     if (!IsProxyAuth && httpWebRequest.ResponseStatusCode == HttpStatusCode.ProxyAuthenticationRequired) {
  302.                         //
  303.                         // don't call Update on the module, since there's an ongoing
  304.                         // handshake and we don't need to update any state in such a case
  305.                         //
  306.                         GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::Update() skipping call to " + myModule.ToString() + ".Update() since we need to reauthenticate with the proxy");
  307.                     }
  308.                     else {
  309.                         bool complete = true;
  310.                         try {
  311.                             complete = myModule.Update(challenge, httpWebRequest);
  312.                             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::Update() " + myModule.ToString() + ".Update() returned complete:" + complete.ToString());
  313.                         }
  314.                         catch (Exception exception) {
  315.                             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::Update() " + myModule.ToString() + ".Update() caught exception:" + exception.Message);
  316.                             ClearSession(httpWebRequest);
  317.                            
  318.                            
  319.                         }
  320.                         catch {
  321.                             GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::Update() " + myModule.ToString() + ".Update() caught exception: Non-CLS Compliant Exception");
  322.                             ClearSession(httpWebRequest);
  323.                            
  324.                            
  325.                         }
  326.                        
  327.                         Authorization.SetComplete(complete);
  328.                     }
  329.                    
  330.                 }
  331.                
  332.                 //
  333.                 // If authentication was successful, create binding between
  334.                 // the request and the authorization for future preauthentication
  335.                 //
  336.                 if (Module != null && Authorization.Complete && Module.CanPreAuthenticate && httpWebRequest.ResponseStatusCode != StatusCodeMatch) {
  337.                     GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::Update() handshake is Complete calling BindModule()");
  338.                     AuthenticationManager.BindModule(ChallengedUri, Authorization, Module);
  339.                 }
  340.             }
  341.         }
  342.        
  343.         internal void ClearSession()
  344.         {
  345.         }
  346.        
  347.         internal void ClearSession(HttpWebRequest httpWebRequest)
  348.         {
  349.             PrepareState(httpWebRequest);
  350.             ISessionAuthenticationModule myModule = Module as ISessionAuthenticationModule;
  351.             Module = null;
  352.            
  353.             if (myModule != null) {
  354.                 try {
  355.                     myModule.ClearSession(httpWebRequest);
  356.                 }
  357.                 catch (Exception exception) {
  358.                     if (NclUtilities.IsFatal(exception))
  359.                         throw;
  360.                    
  361.                     GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::ClearSession() " + myModule.ToString() + ".Update() caught exception:" + exception.Message);
  362.                 }
  363.                 catch {
  364.                     GlobalLog.Print("AuthenticationState#" + ValidationHelper.HashString(this) + "::ClearSession() " + myModule.ToString() + ".Update() caught exception: Non-CLS Compliant Exception");
  365.                 }
  366.             }
  367.            
  368.         }
  369.        
  370.     }
  371. }

Developer Fusion