public static SafeFreeCredentials AcquireCredentialsHandle(SSPIInterface SecModule, string package, CredentialUse intent, ref AuthIdentity authdata)
{
if (Logging.On)
{
Logging.PrintInfo(Logging.Web, string.Concat(new object[] { "AcquireCredentialsHandle(package = ", package, ", intent = ", intent, ", authdata = ", (AuthIdentity) authdata, ")" }));
}
SafeFreeCredentials outCredential = null;
int error = SecModule.AcquireCredentialsHandle(package, intent, ref authdata, out outCredential);
if (error == 0)
{
return outCredential;
}
if (Logging.On)
{
Logging.PrintError(Logging.Web, SR.GetString("net_log_operation_failed_with_error", new object[] { "AcquireCredentialsHandle()", string.Format(CultureInfo.CurrentCulture, "0X{0:X}", new object[] { error }) }));
}
throw new Win32Exception(error);
}
public static int AcquireCredentialsHandle(SecurDll dll, string package, CredentialUse intent, ref AuthIdentity authdata, out SafeFreeCredentials outCredential)
{
long num2;
int num = -1;
switch (dll)
{
case SecurDll.SECURITY:
outCredential = new SafeFreeCredential_SECURITY();
RuntimeHelpers.PrepareConstrainedRegions();
try
{
goto Label_008D;
}
finally
{
num = UnsafeNclNativeMethods.SafeNetHandles_SECURITY.AcquireCredentialsHandleW(null, package, (int) intent, null, ref authdata, null, null, ref outCredential._handle, out num2);
}
break;
case SecurDll.SECUR32:
break;
default:
goto Label_0068;
}
outCredential = new SafeFreeCredential_SECUR32();
RuntimeHelpers.PrepareConstrainedRegions();
try
{
goto Label_008D;
}
finally
{
num = UnsafeNclNativeMethods.SafeNetHandles_SECUR32.AcquireCredentialsHandleA(null, package, (int) intent, null, ref authdata, null, null, ref outCredential._handle, out num2);
}
Label_0068:;
throw new ArgumentException(SR.GetString("net_invalid_enum", new object[] { "SecurDll" }), "Dll");
Label_008D:
if (num != 0)
{
outCredential.SetHandleAsInvalid();
}
return num;
}
private void Initialize(bool isServer, string package, NetworkCredential credential, string spn, ContextFlags requestedContextFlags, System.Security.Authentication.ExtendedProtection.ChannelBinding channelBinding)
{
this.m_TokenSize = SSPIWrapper.GetVerifyPackageInfo(GlobalSSPI.SSPIAuth, package, true).MaxToken;
this.m_IsServer = isServer;
this.m_Spn = spn;
this.m_SecurityContext = null;
this.m_RequestedContextFlags = requestedContextFlags;
this.m_Package = package;
this.m_ChannelBinding = channelBinding;
if (credential is SystemNetworkCredential)
{
this.m_CredentialsHandle = SSPIWrapper.AcquireDefaultCredential(GlobalSSPI.SSPIAuth, package, this.m_IsServer ? CredentialUse.Inbound : CredentialUse.Outbound);
this.m_UniqueUserId = "/S";
}
else
{
string userName = credential.InternalGetUserName();
string domain = credential.InternalGetDomain();
AuthIdentity authdata = new AuthIdentity(userName, credential.InternalGetPassword(), ((package == "WDigest") && ((domain == null) || (domain.Length == 0))) ? null : domain);
this.m_UniqueUserId = domain + "/" + userName + "/U";
this.m_CredentialsHandle = SSPIWrapper.AcquireCredentialsHandle(GlobalSSPI.SSPIAuth, package, this.m_IsServer ? CredentialUse.Inbound : CredentialUse.Outbound, ref authdata);
}
}
//
private void Initialize(bool isServer, string package, NetworkCredential credential, string spn, ContextFlags requestedContextFlags, ChannelBinding channelBinding) {
GlobalLog.Print("NTAuthentication#" + ValidationHelper.HashString(this) + "::.ctor() package:" + ValidationHelper.ToString(package) + " spn:" + ValidationHelper.ToString(spn) + " flags :" + requestedContextFlags.ToString());
m_TokenSize = SSPIWrapper.GetVerifyPackageInfo(GlobalSSPI.SSPIAuth, package, true).MaxToken;
m_IsServer = isServer;
m_Spn = spn;
m_SecurityContext = null;
m_RequestedContextFlags = requestedContextFlags;
m_Package = package;
m_ChannelBinding = channelBinding;
GlobalLog.Print("Peer SPN-> '" + m_Spn + "'");
//
// check if we're using DefaultCredentials
//
if (credential is SystemNetworkCredential)
{
GlobalLog.Print("NTAuthentication#" + ValidationHelper.HashString(this) + "::.ctor(): using DefaultCredentials");
m_CredentialsHandle = SSPIWrapper.AcquireDefaultCredential(
GlobalSSPI.SSPIAuth,
package,
(m_IsServer? CredentialUse.Inbound: CredentialUse.Outbound));
m_UniqueUserId = "/S"; // save off for unique connection marking ONLY used by HTTP client
}
else if (ComNetOS.IsWin7orLater)
{
unsafe
{
SafeSspiAuthDataHandle authData = null;
try
{
SecurityStatus result = UnsafeNclNativeMethods.SspiHelper.SspiEncodeStringsAsAuthIdentity(
credential.InternalGetUserName(), credential.InternalGetDomain(),
credential.InternalGetPassword(), out authData);
if (result != SecurityStatus.OK)
{
if (Logging.On) Logging.PrintError(Logging.Web, SR.GetString(SR.net_log_operation_failed_with_error, "SspiEncodeStringsAsAuthIdentity()", String.Format(CultureInfo.CurrentCulture, "0x{0:X}", (int)result)));
throw new Win32Exception((int)result);
}
m_CredentialsHandle = SSPIWrapper.AcquireCredentialsHandle(GlobalSSPI.SSPIAuth,
package, (m_IsServer ? CredentialUse.Inbound : CredentialUse.Outbound), ref authData);
}
finally
{
if (authData != null)
{
authData.Close();
}
}
}
}
else
{
//
// we're not using DefaultCredentials, we need a
// AuthIdentity struct to contain credentials
// SECREVIEW:
// we'll save username/domain in temp strings, to avoid decrypting multiple times.
// password is only used once
//
string username = credential.InternalGetUserName();
string domain = credential.InternalGetDomain();
// ATTN:
// NetworkCredential class does not differentiate between null and "" but SSPI packages treat these cases differently
// For NTLM we want to keep "" for Wdigest.Dll we should use null.
AuthIdentity authIdentity = new AuthIdentity(username, credential.InternalGetPassword(), (object)package == (object)NegotiationInfoClass.WDigest && (domain == null || domain.Length == 0)? null: domain);
m_UniqueUserId = domain + "/" + username + "/U"; // save off for unique connection marking ONLY used by HTTP client
GlobalLog.Print("NTAuthentication#" + ValidationHelper.HashString(this) + "::.ctor(): using authIdentity:" + authIdentity.ToString());
m_CredentialsHandle = SSPIWrapper.AcquireCredentialsHandle(
GlobalSSPI.SSPIAuth,
package,
(m_IsServer? CredentialUse.Inbound: CredentialUse.Outbound),
ref authIdentity
);
}
}
public unsafe static int AcquireCredentialsHandle( SecurDll dll,
string package,
CredentialUse intent,
ref AuthIdentity authdata,
out SafeFreeCredentials outCredential
)
{
GlobalLog.Print("SafeFreeCredentials::AcquireCredentialsHandle#1("
+ dll + ","
+ package + ", "
+ intent + ", "
+ authdata + ")"
);
int errorCode = -1;
long timeStamp;
switch (dll) {
case SecurDll.SECURITY:
outCredential = new SafeFreeCredential_SECURITY();
RuntimeHelpers.PrepareConstrainedRegions();
try {} finally {
errorCode = UnsafeNclNativeMethods.SafeNetHandles_SECURITY.AcquireCredentialsHandleW(
null,
package,
(int)intent,
null,
ref authdata,
null,
null,
ref outCredential._handle,
out timeStamp
);
}
break;
default: throw new ArgumentException(SR.GetString(SR.net_invalid_enum, "SecurDll"), "Dll");
}
#if TRAVE
GlobalLog.Print("Unmanaged::AcquireCredentialsHandle() returns 0x"
+ String.Format("{0:x}", errorCode)
+ ", handle = " + outCredential.ToString()
);
#endif
if (errorCode != 0) {
outCredential.SetHandleAsInvalid();
}
return errorCode;
}
public static SafeFreeCredentials AcquireCredentialsHandle(SSPIInterface SecModule, string package, CredentialUse intent, ref AuthIdentity authdata)
{
if (Logging.On)
{
Logging.PrintInfo(Logging.Web, string.Concat(new object[] { "AcquireCredentialsHandle(package = ", package, ", intent = ", intent, ", authdata = ", (AuthIdentity)authdata, ")" }));
}
SafeFreeCredentials outCredential = null;
int error = SecModule.AcquireCredentialsHandle(package, intent, ref authdata, out outCredential);
if (error == 0)
{
return(outCredential);
}
if (Logging.On)
{
Logging.PrintError(Logging.Web, SR.GetString("net_log_operation_failed_with_error", new object[] { "AcquireCredentialsHandle()", string.Format(CultureInfo.CurrentCulture, "0X{0:X}", new object[] { error }) }));
}
throw new Win32Exception(error);
}
public int AcquireCredentialsHandle(string moduleName, CredentialUse usage, ref AuthIdentity authdata, out SafeFreeCredentials outCredential)
{
return(SafeFreeCredentials.AcquireCredentialsHandle(Library, moduleName, usage, ref authdata, out outCredential));
}
public int AcquireCredentialsHandle(string moduleName, CredentialUse usage, ref AuthIdentity authdata, out SafeFreeCredentials outCredential) {
return SafeFreeCredentials.AcquireCredentialsHandle(Library, moduleName, usage, ref authdata, out outCredential);
}
public static SafeFreeCredentials AcquireCredentialsHandle(SSPIInterface SecModule, string package, CredentialUse intent, ref AuthIdentity authdata)
{
GlobalLog.Print("SSPIWrapper::AcquireCredentialsHandle#2(): using " + package);
if (Logging.On)
{
Logging.PrintInfo(Logging.Web,
"AcquireCredentialsHandle(" +
"package = " + package + ", " +
"intent = " + intent + ", " +
"authdata = " + authdata + ")");
}
SafeFreeCredentials credentialsHandle = null;
int errorCode = SecModule.AcquireCredentialsHandle(package,
intent,
ref authdata,
out credentialsHandle
);
if (errorCode != 0)
{
#if TRAVE
GlobalLog.Print("SSPIWrapper::AcquireCredentialsHandle#2(): error " + SecureChannel.MapSecurityStatus((uint)errorCode));
#endif
if (Logging.On)
{
Logging.PrintError(Logging.Web, SR.GetString(SR.net_log_operation_failed_with_error, "AcquireCredentialsHandle()", String.Format(CultureInfo.CurrentCulture, "0X{0:X}", errorCode)));
}
throw new Win32Exception(errorCode);
}
return(credentialsHandle);
}
private void Initialize(bool isServer, string package, NetworkCredential credential, string spn, ContextFlags requestedContextFlags, System.Security.Authentication.ExtendedProtection.ChannelBinding channelBinding)
{
this.m_TokenSize = SSPIWrapper.GetVerifyPackageInfo(GlobalSSPI.SSPIAuth, package, true).MaxToken;
this.m_IsServer = isServer;
this.m_Spn = spn;
this.m_SecurityContext = null;
this.m_RequestedContextFlags = requestedContextFlags;
this.m_Package = package;
this.m_ChannelBinding = channelBinding;
if (credential is SystemNetworkCredential)
{
this.m_CredentialsHandle = SSPIWrapper.AcquireDefaultCredential(GlobalSSPI.SSPIAuth, package, this.m_IsServer ? CredentialUse.Inbound : CredentialUse.Outbound);
this.m_UniqueUserId = "/S";
}
else
{
string userName = credential.InternalGetUserName();
string domain = credential.InternalGetDomain();
AuthIdentity authdata = new AuthIdentity(userName, credential.InternalGetPassword(), ((package == "WDigest") && ((domain == null) || (domain.Length == 0))) ? null : domain);
this.m_UniqueUserId = domain + "/" + userName + "/U";
this.m_CredentialsHandle = SSPIWrapper.AcquireCredentialsHandle(GlobalSSPI.SSPIAuth, package, this.m_IsServer ? CredentialUse.Inbound : CredentialUse.Outbound, ref authdata);
}
}
//
// NTAuthentication::NTAuthentication()
// Created: 12-01-1999: L.M.
// Parameters:
// package - security package to use (kerberos/ntlm/negotiate)
// networkCredential - credentials we're using for authentication
// remotePeerId - for a server session:
// ignored (except when delegating, in which case this has the same rules as the client session.)
// for a client session:
// for kerberos: specifies the expected account under which the server
// is supposed to be running (KDC). If the server runs under a
// different account an exception is thrown during the blob
// exchange. (this allows mutual authentication.)
// One can specify a fully qualified account name (domain\userName)
// or just a username, in which case the domain is assumed
// to be the same as the client.
// for ntlm: ignored
//
// Description: Initializes SSPI
//
public NTAuthentication(string package, NetworkCredential networkCredential, string remotePeerId, DelegationFix delegationFix)
{
GlobalLog.Print("NTAuthentication::.ctor() package:" + package);
#if SERVER_SIDE_SSPI
m_SecureSessionType = SecureSessionType.ClientSession;
#endif
m_RemotePeerId = remotePeerId; // only needed for Kerberos, it's the KDC
m_Endianness = Endianness.Network;
m_SecurityContext = new SecurityContext(GlobalSSPI.SSPIAuth);
bool found = false;
GlobalLog.Print("NTAuthentication::.ctor() searching for name: " + package);
if (m_SupportedSecurityPackages != null)
{
for (int i = 0; i < m_SupportedSecurityPackages.Length; i++)
{
GlobalLog.Print("NTAuthentication::.ctor() supported name: " + m_SupportedSecurityPackages[i].Name);
if (string.Compare(m_SupportedSecurityPackages[i].Name, package, true, CultureInfo.InvariantCulture) == 0)
{
GlobalLog.Print("NTAuthentication::.ctor(): found SecurityPackage(" + package + ")");
m_TokenSize = m_SupportedSecurityPackages[i].MaxToken;
m_Capabilities = m_SupportedSecurityPackages[i].Capabilities;
found = true;
break;
}
}
}
if (!found)
{
GlobalLog.Print("NTAuthentication::.ctor(): initialization failed: SecurityPackage(" + package + ") NOT FOUND");
throw new WebException(SR.GetString(SR.net_securitypackagesupport), WebExceptionStatus.SecureChannelFailure);
}
//
// In order to prevent a race condition where one request could
// steal a connection from another request, before a handshake is
// complete, we create a new Group for each authentication request.
//
if (package == NtlmClient.AuthType || package == NegotiateClient.AuthType)
{
m_UniqueUserId = (Interlocked.Increment(ref s_UniqueGroupId)).ToString();
}
//
// check if we're using DefaultCredentials
//
if (networkCredential is SystemNetworkCredential)
{
//
// we're using DefaultCredentials
//
GlobalLog.Print("NTAuthentication::.ctor(): using DefaultCredentials");
m_UniqueUserId += "/S"; // save off for unique connection marking
// DELEGATION:
// The fix is implemented in cooperation with HttpWebRequest class
// Remove from both places and change the constructor of NTAuthentication class
// once the Common Language Runtime will start propagating the Thread token with their stack
// compression stuff.
//
GlobalLog.Assert(delegationFix != null, "DelegationFix ==NULL -> request Credentials has been changed after the request submission!", "");
if (delegationFix != null)
{
delegationFix.SetToken();
}
GlobalLog.Print("DELEGATION for peer-> '" + m_RemotePeerId + "', SetToken = " + delegationFix.Token.ToString());
try {
m_CredentialsHandle =
SSPIWrapper.AcquireCredentialsHandle(
GlobalSSPI.SSPIAuth,
package,
CredentialUse.Outgoing);
}
finally {
if (delegationFix != null)
{
delegationFix.RevertToken();
}
GlobalLog.Print("DELEGATION for peer-> '" + m_RemotePeerId + "', UNSetToken = " + delegationFix.Token.ToString());
}
return;
}
//
// we're not using DefaultCredentials, we need a
// AuthIdentity struct to contain credentials
// SECREVIEW:
// we'll save username/domain in temp strings, to avoid decrypting multiple times.
// password is only used once
//
string username = networkCredential.UserName;
string domain = networkCredential.Domain;
m_UniqueUserId += domain + "/" + username + "/U"; // save off for unique connection marking
AuthIdentity authIdentity = new AuthIdentity(username, networkCredential.Password, domain);
GlobalLog.Print("NTAuthentication::.ctor(): using authIdentity:" + authIdentity.ToString());
m_CredentialsHandle = SSPIWrapper.AcquireCredentialsHandle(
GlobalSSPI.SSPIAuth,
package,
CredentialUse.Outgoing,
authIdentity
);
}
public static int AcquireCredentialsHandle(SecurDll dll, string package, CredentialUse intent, ref AuthIdentity authdata, out SafeFreeCredentials outCredential)
{
long num2;
int num = -1;
switch (dll)
{
case SecurDll.SECURITY:
outCredential = new SafeFreeCredential_SECURITY();
RuntimeHelpers.PrepareConstrainedRegions();
try
{
goto Label_008D;
}
finally
{
num = UnsafeNclNativeMethods.SafeNetHandles_SECURITY.AcquireCredentialsHandleW(null, package, (int)intent, null, ref authdata, null, null, ref outCredential._handle, out num2);
}
break;
case SecurDll.SECUR32:
break;
default:
goto Label_0068;
}
outCredential = new SafeFreeCredential_SECUR32();
RuntimeHelpers.PrepareConstrainedRegions();
try
{
goto Label_008D;
}
finally
{
num = UnsafeNclNativeMethods.SafeNetHandles_SECUR32.AcquireCredentialsHandleA(null, package, (int)intent, null, ref authdata, null, null, ref outCredential._handle, out num2);
}
Label_0068 :;
throw new ArgumentException(SR.GetString("net_invalid_enum", new object[] { "SecurDll" }), "Dll");
Label_008D:
if (num != 0)
{
outCredential.SetHandleAsInvalid();
}
return(num);
}
public static SafeFreeCredentials AcquireCredentialsHandle(SSPIInterface SecModule, string package, CredentialUse intent, ref AuthIdentity authdata) {
GlobalLog.Print("SSPIWrapper::AcquireCredentialsHandle#2(): using " + package);
if (Logging.On) Logging.PrintInfo(Logging.Web,
"AcquireCredentialsHandle(" +
"package = " + package + ", " +
"intent = " + intent + ", " +
"authdata = " + authdata + ")");
SafeFreeCredentials credentialsHandle = null;
int errorCode = SecModule.AcquireCredentialsHandle(package,
intent,
ref authdata,
out credentialsHandle
);
if (errorCode != 0) {
#if TRAVE
GlobalLog.Print("SSPIWrapper::AcquireCredentialsHandle#2(): error " + SecureChannel.MapSecurityStatus((uint)errorCode));
#endif
if (Logging.On) Logging.PrintError(Logging.Web, SR.GetString(SR.net_log_operation_failed_with_error, "AcquireCredentialsHandle()", String.Format(CultureInfo.CurrentCulture, "0X{0:X}", errorCode)));
throw new Win32Exception(errorCode);
}
return credentialsHandle;
}
