public void ShoudMatchInputClaimWithAssertionMatchAll()
{
var store = new MockPolicyStore();
ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store);
InputPolicyClaim inputClaim = new InputPolicyClaim(this.issuer, this.inputClaimType, "myInputClaim");
OutputPolicyClaim outputClaim = new OutputPolicyClaim(this.outputClaimType, "myOutputClaimValue");
PolicyRule rule = new PolicyRule(AssertionsMatch.All, new[] { inputClaim }, outputClaim);
store.RetrieveScopesReturnValue = new List<PolicyScope>() { new PolicyScope(new Uri("http://myScope"), new[] { rule }) };
IEnumerable<Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "myInputClaim", string.Empty, "http://myInputClaimIssuer") });
Assert.IsNotNull(evaluatedOutputClaims);
Assert.AreEqual(1, evaluatedOutputClaims.Count());
Assert.AreEqual("http://myOutputClaimType", evaluatedOutputClaims.ElementAt(0).ClaimType);
Assert.AreEqual("myOutputClaimValue", evaluatedOutputClaims.ElementAt(0).Value);
}
public void ShouldPassEvaluateRuleIfCopyOutputValueFromInputIssuer()
{
var store = new XmlPolicyStore("My Xml Store Path", new MockXmlRepository(@"content\integrationTest2.xml"));
PolicyScope scope = store.RetrieveScope(new Uri("http://localhost/1"));
var issuer = scope.Issuers.ElementAt(0);
IList<InputPolicyClaim> inputClaims = new List<InputPolicyClaim>();
ClaimType claimType = new ClaimType("http://myClaimType", "myClaimType");
inputClaims.Add(new InputPolicyClaim(issuer, claimType, "*"));
PolicyRule newRule = new PolicyRule(AssertionsMatch.Any, inputClaims, new OutputPolicyClaim(claimType, string.Empty, CopyFromConstants.InputIssuer));
store.AddPolicyRule(new Uri("http://localhost/1"), newRule);
string claimValue = "myInputClaimValue33";
ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store);
Claim inputClaim = new Claim("http://myClaimType", claimValue, string.Empty, "http://myIssuer1");
IEnumerable<Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://localhost/1"), new[] { inputClaim });
Assert.IsNotNull(evaluatedOutputClaims);
Assert.AreEqual("http://myClaimType", evaluatedOutputClaims.ElementAt(0).ClaimType);
}
public void ShouldMatchInputClaimAndCopyInputIssuerToOutputValue()
{
var store = new MockPolicyStore();
ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store);
ClaimType inputClaimType = new ClaimType("http://myInputClaimType");
ClaimType outputClaimType = new ClaimType("http://myOutputClaimType");
Issuer issuer = new Issuer("http://myInputClaimIssuer");
InputPolicyClaim inputClaim = new InputPolicyClaim(issuer, inputClaimType, "myInputClaim");
OutputPolicyClaim outputClaim = new OutputPolicyClaim(outputClaimType, string.Empty, CopyFromConstants.InputIssuer);
PolicyRule rule = new PolicyRule(AssertionsMatch.Any, new[] { inputClaim }, outputClaim);
store.RetrieveScopesReturnValue = new List<PolicyScope>() { new PolicyScope(new Uri("http://myScope"), new[] { rule }) };
IEnumerable<Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "myInputClaim", string.Empty, "http://myInputClaimIssuer") });
Assert.IsNotNull(evaluatedOutputClaims);
Assert.AreEqual(1, evaluatedOutputClaims.Count());
Assert.AreEqual("http://myOutputClaimType", evaluatedOutputClaims.ElementAt(0).ClaimType);
Assert.AreEqual("http://myInputClaimIssuer", evaluatedOutputClaims.ElementAt(0).Value);
}
public void ShouldPassEvaluateRuleIfFixedOutputValue()
{
var store = new XmlPolicyStore("My Xml Store Path", new MockXmlRepository(@"content\integrationTest1.xml"));
ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store);
Claim inputClaim = new Claim("http://myInputClaimType1", "myInputClaim", string.Empty, "http://myIssuer1");
IEnumerable<Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://localhost/1"), new[] { inputClaim });
Assert.IsNotNull(evaluatedOutputClaims);
Assert.AreEqual(1, evaluatedOutputClaims.Count());
Assert.AreEqual("http://myOutputClaimType1", evaluatedOutputClaims.ElementAt(0).ClaimType);
Assert.AreEqual("myOutputClaimValue", evaluatedOutputClaims.ElementAt(0).Value);
}
public void ShouldThrowIfScopeIsNotFoundOnStore()
{
var store = new MockPolicyStore();
Issuer issuer = new Issuer("http://myIssuer", "myIssuer");
ClaimType myClaimType = new ClaimType("http://myClaimType", "myClaimType");
store.RetrieveScopesReturnValue =
new List<PolicyScope>()
{
new PolicyScope(
new Uri("http://mappedScope"),
new[] { new PolicyRule(AssertionsMatch.All, new[] { new InputPolicyClaim(issuer, myClaimType, "myClaimValue") }, new OutputPolicyClaim(myClaimType, string.Empty, CopyFromConstants.InputValue)) })
};
ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store);
evaluator.Evaluate(new Uri("http://unmappedScope"), new[] { new Claim("http://myInputClaimType", "myInputClaim") });
}
public void ShouldThrowIfInvalidScope()
{
ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(new MockPolicyStore());
evaluator.Evaluate(null, new[] { new Claim("http://myInputClaimType", "myInputClaim") });
}
public void ShouldReturnEmptyOutputCollectionIfInputCollectionIsEmpty()
{
ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(new MockPolicyStore());
IEnumerable<Claim> outputClaims = evaluator.Evaluate(new Uri("http://myScope"), new Claim[] { });
Assert.IsNotNull(outputClaims);
Assert.AreEqual(0, outputClaims.Count());
}
public void ShouldOutputCorrectInputValue()
{
var store = new MockPolicyStore();
ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store);
InputPolicyClaim inputPolicyClaim1 = new InputPolicyClaim(this.issuer, this.inputClaimType, "*");
ClaimType outputClaimType1 = new ClaimType("http://myOutputClaimType1");
OutputPolicyClaim outputPolicyClaim1 = new OutputPolicyClaim(outputClaimType1, "myOutputClaimValue");
PolicyRule policyRule1 = new PolicyRule(AssertionsMatch.Any, new[] { inputPolicyClaim1 }, outputPolicyClaim1);
InputPolicyClaim inputPolicyClaim2 = new InputPolicyClaim(this.issuer, this.inputClaimType, "inputClaimValue");
ClaimType outputClaimType2 = new ClaimType("http://myOutputClaimType2");
OutputPolicyClaim outputPolicyClaim2 = new OutputPolicyClaim(outputClaimType2, string.Empty, CopyFromConstants.InputValue);
PolicyRule policyRule2 = new PolicyRule(AssertionsMatch.Any, new[] { inputPolicyClaim2 }, outputPolicyClaim2);
store.RetrieveScopesReturnValue = new List<PolicyScope>() { new PolicyScope(new Uri("http://myScope"), new[] { policyRule1, policyRule2 }) };
IEnumerable<Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "inputClaimValue", string.Empty, "http://myInputClaimIssuer") });
Assert.IsNotNull(evaluatedOutputClaims);
Assert.AreEqual(2, evaluatedOutputClaims.Count());
var outputClaim1 = evaluatedOutputClaims.FirstOrDefault(c => c.ClaimType == "http://myOutputClaimType1");
Assert.IsNotNull(outputClaim1);
Assert.AreEqual("myOutputClaimValue", outputClaim1.Value);
var outputClaim2 = evaluatedOutputClaims.FirstOrDefault(c => c.ClaimType == "http://myOutputClaimType2");
Assert.IsNotNull(outputClaim2);
Assert.AreEqual("inputClaimValue", outputClaim2.Value);
}
public void ShouldMatchInputClaimValueInCaseInsensitiveFashion()
{
var store = new MockPolicyStore();
var scopeUri = new Uri("http://myScope");
var inputClaimValue = "myInputClaimValue";
var outputClaimValue = "myOutputClaimValue";
InputPolicyClaim inputClaim = new InputPolicyClaim(
new Issuer("http://myInputClaimIssuer", "myInputClaimIssuer"),
new ClaimType("http://myInputClaimType", "myInputClaimType"),
inputClaimValue);
OutputPolicyClaim outputClaim = new OutputPolicyClaim(
new ClaimType("http://myOutputClaimType", "myOutputClaimType"),
outputClaimValue);
PolicyRule rule = new PolicyRule(AssertionsMatch.Any, new[] { inputClaim }, outputClaim);
store.RetrieveScopesReturnValue = new List<PolicyScope> { new PolicyScope(scopeUri, new[] { rule }) };
var evaluator = new ClaimsPolicyEvaluator(store);
var evaluatedOutputClaims = evaluator.Evaluate(scopeUri, new[] { new Claim("http://myInputClaimType", inputClaimValue.ToUpperInvariant(), string.Empty, "http://myInputClaimIssuer") });
Assert.IsNotNull(evaluatedOutputClaims);
Assert.AreEqual(1, evaluatedOutputClaims.Count());
Assert.AreEqual(outputClaimValue, evaluatedOutputClaims.ElementAt(0).Value);
}
protected override IClaimsIdentity GetOutputClaimsIdentity(IClaimsPrincipal principal, RequestSecurityToken request, Scope scope)
{
if (null == principal)
{
throw new ArgumentNullException("principal");
}
var outputIdentity = new ClaimsIdentity();
IEnumerable<Claim> outputClaims;
if (this.scopeModel.UseClaimsPolicyEngine)
{
IClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(PolicyStoreFactory.Instance);
outputClaims = evaluator.Evaluate(new Uri(scope.AppliesToAddress), ((IClaimsIdentity)principal.Identity).Claims);
}
else
{
outputClaims = ((IClaimsIdentity)principal.Identity).Claims;
}
outputIdentity.Claims.AddRange(outputClaims);
if (outputIdentity.Name == null && outputIdentity.Claims.SingleOrDefault(c => c.ClaimType == ClaimTypes.NameIdentifier) != null)
outputIdentity.Claims.Add(new Claim(ClaimTypes.Name, outputIdentity.Claims.SingleOrDefault(c => c.ClaimType == ClaimTypes.NameIdentifier).Value));
return outputIdentity;
}
