public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext) { List <Claim> claims = new List <Claim>(); X509Extension item = null; foreach (ClaimSet claimSet in authContext.ClaimSets) { if (item == null) { X509CertificateClaimSet x509CertificateClaimSet = claimSet as X509CertificateClaimSet; if (x509CertificateClaimSet != null && x509CertificateClaimSet.X509Certificate != null) { item = x509CertificateClaimSet.X509Certificate.Extensions["2.5.29.17"]; } } foreach (Claim claim in claimSet) { if (ClaimTypes.Dns != claim.ClaimType) { continue; } claims.Add(claim); } } if (1 != claims.Count) { throw new InvalidOperationException(SRClient.InvalidDNSClaims(claims.Count)); } if (LenientDnsIdentityVerifier.CheckTopLevelDomainCompatibleness(claims[0].Resource.ToString(), identity.IdentityClaim.Resource.ToString())) { return(true); } return(SecureSocketUtil.CertificateCheckSubjectAlternativeNames(item, identity.IdentityClaim.Resource.ToString())); }
public static bool CertificateCheckSubjectAlternativeNames(X509Extension extensions, string hostName) { if (extensions != null) { string[] strArrays = Regex.Split(extensions.Format(true), Environment.NewLine); string[] strArrays1 = strArrays; for (int i = 0; i < (int)strArrays1.Length; i++) { string str = strArrays1[i]; if (!string.IsNullOrEmpty(str)) { string[] strArrays2 = str.Trim().Split(new char[] { '=' }); if (strArrays2[0].Trim().Equals("DNS Name") && LenientDnsIdentityVerifier.CheckTopLevelDomainCompatibleness(strArrays2[1].Trim(), hostName)) { return(true); } } } } return(false); }
public static bool CustomizedCertificateValidator(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors, string hostName) { bool flag; if (sslPolicyErrors == SslPolicyErrors.None) { return(true); } if (sslPolicyErrors != SslPolicyErrors.RemoteCertificateNameMismatch) { return(false); } X509Certificate2 x509Certificate2 = certificate as X509Certificate2; Fx.AssertAndThrow(x509Certificate2 != null, "CustomizedCertificateValidator received an invalid certificate"); try { foreach (Claim claim in new X509CertificateClaimSet(x509Certificate2)) { if (!(claim.ClaimType == ClaimTypes.Dns) || !LenientDnsIdentityVerifier.CheckTopLevelDomainCompatibleness(claim.Resource.ToString(), hostName)) { continue; } flag = true; return(flag); } flag = SecureSocketUtil.CertificateCheckSubjectAlternativeNames(x509Certificate2.Extensions["2.5.29.17"], hostName); } catch (Exception exception) { if (Fx.IsFatal(exception)) { throw; } return(false); } return(flag); }