protected override async Task<HttpResponseMessage> SendAsync(
HttpRequestMessage request, CancellationToken cancellationToken)
{
var cert = request.GetClientCertificate();
if (cert == null) return await base.SendAsync(request, cancellationToken);
try
{
_validator.Validate(cert);
}
catch (SecurityTokenValidationException)
{
return new HttpResponseMessage(HttpStatusCode.Unauthorized);
}
var issuer = _issuerMapper(cert);
if (issuer == null)
{
return new HttpResponseMessage(HttpStatusCode.Unauthorized);
}
var claims = ExtractClaims(cert, issuer);
var identity = new ClaimsIdentity(new ClaimsIdentity(claims, X509AuthnMethod));
AddIdentityToCurrentPrincipal(identity, request);
return await base.SendAsync(request, cancellationToken);
}
public void GetClientCertificate_Throws_WhenRequestIsNull()
{
// Arrange
HttpRequestMessage request = null;
// Act & Assert
Assert.ThrowsArgumentNull(() => request.GetClientCertificate(), "request");
}
protected override Task<HttpResponseMessage> SendAsync(
HttpRequestMessage request,
CancellationToken cancellationToken)
{
var cert = request.GetClientCertificate();
if (cert != null)
{
// Not sure how this ever results in not null. Hope to find out
}
return base.SendAsync(request, cancellationToken);
}
public void GetClientCertificate_ReturnsClientCertificateFromProperty_WhenOnlyPropertyIsPresent()
{
// Arrange
using (HttpRequestMessage request = CreateRequest())
{
X509Certificate2 expectedCertificate = CreateCertificate();
request.Properties[HttpPropertyKeys.ClientCertificateKey] = expectedCertificate;
// Act
X509Certificate2 certificate = request.GetClientCertificate();
// Assert
Assert.Same(expectedCertificate, certificate);
}
}
protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
// Retrieving the Client certificate sent by the client
X509Certificate cert = request.GetClientCertificate();
// The following code SHOULD be replaced with some custom mapping logic from client certificate to their roles.
// The client certificate is not being checked for certificate revocation or ensure PKI validity.
if (cert != null)
{
if (cert.GetCertHashString() == Program.ClientCertHash)
{
Thread.CurrentPrincipal = new GenericPrincipal(new GenericIdentity(cert.Subject), new[] { "Administrators" });
}
}
return base.SendAsync(request, cancellationToken);
}
public void GetClientCertificate_ReturnsClientCertificateFromContext_WhenOnlyContextIsPresent()
{
// Arrange
using (HttpRequestMessage request = CreateRequest())
{
X509Certificate2 expectedCertificate = CreateCertificate();
request.SetRequestContext(new HttpRequestContext
{
ClientCertificate = expectedCertificate
});
// Act
X509Certificate2 certificate = request.GetClientCertificate();
// Assert
Assert.Same(expectedCertificate, certificate);
}
}
public void GetClientCertificate_ReturnsClientCertificateFromContext_WhenBothContextAndPropertyArePresent()
{
// Arrange
using (HttpRequestMessage request = CreateRequest())
{
X509Certificate2 expectedCertificate = CreateCertificate();
request.SetRequestContext(new HttpRequestContext
{
ClientCertificate = expectedCertificate
});
X509Certificate2 otherCertificate = CreateCertificate();
request.Properties[HttpPropertyKeys.ClientCertificateKey] = otherCertificate;
// Act
X509Certificate2 certificate = request.GetClientCertificate();
// Assert
Assert.Same(expectedCertificate, certificate);
}
}
protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
// Retrieving the Client certificate sent by the client
X509Certificate cert = request.GetClientCertificate();
// The following code SHOULD be replaced with some custom mapping logic from client certificate to their roles.
if (cert != null)
{
if (cert.GetCertHashString() == ClientCertHash)
{
Thread.CurrentPrincipal = new GenericPrincipal(new GenericIdentity(cert.Subject, "X509Certificate"), new[] { "Administrators" });
if (HttpContext.Current != null)
{
HttpContext.Current.User = Thread.CurrentPrincipal;
}
}
}
return base.SendAsync(request, cancellationToken);
}
public ClaimsPrincipal Authenticate(HttpRequestMessage request)
{
string resourceName = request.RequestUri.AbsoluteUri;
// if session feature is enabled (and this is not a token request), check for session token first
if (Configuration.EnableSessionToken && !IsSessionTokenRequest(request))
{
var principal = AuthenticateSessionToken(request);
if (principal.Identity.IsAuthenticated)
{
Tracing.Information(Area.HttpAuthentication, "Client authenticated using session token");
return principal;
}
}
// check for credentials on the authorization header
if (Configuration.HasAuthorizationHeaderMapping)
{
var authZ = request.Headers.Authorization;
if (authZ != null)
{
Tracing.Verbose(Area.HttpAuthentication, "Mapping for authorization header found: " + authZ.Scheme);
var principal = AuthenticateAuthorizationHeader(authZ.Scheme, authZ.Parameter);
if (principal.Identity.IsAuthenticated)
{
Tracing.Information(Area.HttpAuthentication, "Client authenticated using authorization header mapping: " + authZ.Scheme);
return Transform(resourceName, principal);
}
}
}
// check for credentials on other headers
if (Configuration.HasHeaderMapping)
{
if (request.Headers != null)
{
Tracing.Verbose(Area.HttpAuthentication, "Mapping for header header found.");
var principal = AuthenticateHeaders(request.Headers);
if (principal.Identity.IsAuthenticated)
{
Tracing.Information(Area.HttpAuthentication, "Client authenticated using header mapping");
return Transform(resourceName, principal);
}
}
}
// check for credentials on the query string
if (Configuration.HasQueryStringMapping)
{
if (request.RequestUri != null && !string.IsNullOrWhiteSpace(request.RequestUri.Query))
{
Tracing.Verbose(Area.HttpAuthentication, "Mapping for query string found.");
var principal = AuthenticateQueryStrings(request.RequestUri);
if (principal.Identity.IsAuthenticated)
{
Tracing.Information(Area.HttpAuthentication, "Client authenticated using query string mapping");
return Transform(resourceName, principal);
}
}
}
// check for client certificate
if (Configuration.HasClientCertificateMapping)
{
var cert = request.GetClientCertificate();
if (cert != null)
{
Tracing.Verbose(Area.HttpAuthentication, "Mapping for client certificate found.");
var principal = AuthenticateClientCertificate(cert);
if (principal.Identity.IsAuthenticated)
{
Tracing.Information(Area.HttpAuthentication, "Client authenticated using client certificate");
return Transform(resourceName, principal);
}
}
}
// do claim transformation (if enabled), and return.
return Transform(resourceName, Principal.Anonymous);
}
public bool TryGetClientCertificateFromRequest(HttpRequestMessage request, out X509Certificate2 clientCertificate)
{
clientCertificate = request.GetClientCertificate();
if (clientCertificate != null)
{
return true;
}
return false;
}
