public static AcquireCredentialsHandle ( System.Net.Security.SSPIInterface secModule, string package, System.Net.Interop intent, System.Net.Interop &authdata ) : SafeFreeCredentials | ||
secModule | System.Net.Security.SSPIInterface | |
package | string | |
intent | System.Net.Interop | |
authdata | System.Net.Interop | |
return | SafeFreeCredentials |
// // Security: we temporarily reset thread token to open the handle under process account. // private static SafeFreeCredentials AcquireCredentialsHandle(Interop.Secur32.CredentialUse credUsage, Interop.Secur32.SecureCredential secureCredential) { // First try without impersonation, if it fails, then try the process account. // I.E. We don't know which account the certificate context was created under. try { // // For app-compat we want to ensure the credential are accessed under >>process<< acount. // return(WindowsIdentity.RunImpersonated <SafeFreeCredentials>(SafeAccessTokenHandle.InvalidHandle, () => { return SSPIWrapper.AcquireCredentialsHandle(GlobalSSPI.SSPISecureChannel, SecurityPackage, credUsage, secureCredential); })); } catch { return(SSPIWrapper.AcquireCredentialsHandle(GlobalSSPI.SSPISecureChannel, SecurityPackage, credUsage, secureCredential)); } }
private void Initialize(bool isServer, string package, NetworkCredential credential, string spn, ContextFlags requestedContextFlags, System.Security.Authentication.ExtendedProtection.ChannelBinding channelBinding) { this.m_TokenSize = SSPIWrapper.GetVerifyPackageInfo(GlobalSSPI.SSPIAuth, package, true).MaxToken; this.m_IsServer = isServer; this.m_Spn = spn; this.m_SecurityContext = null; this.m_RequestedContextFlags = requestedContextFlags; this.m_Package = package; this.m_ChannelBinding = channelBinding; if (credential is SystemNetworkCredential) { this.m_CredentialsHandle = SSPIWrapper.AcquireDefaultCredential(GlobalSSPI.SSPIAuth, package, this.m_IsServer ? CredentialUse.Inbound : CredentialUse.Outbound); this.m_UniqueUserId = "/S"; } else { string userName = credential.InternalGetUserName(); string domain = credential.InternalGetDomain(); AuthIdentity authdata = new AuthIdentity(userName, credential.InternalGetPassword(), ((package == "WDigest") && ((domain == null) || (domain.Length == 0))) ? null : domain); this.m_UniqueUserId = domain + "/" + userName + "/U"; this.m_CredentialsHandle = SSPIWrapper.AcquireCredentialsHandle(GlobalSSPI.SSPIAuth, package, this.m_IsServer ? CredentialUse.Inbound : CredentialUse.Outbound, ref authdata); } }
private void Initialize(bool isServer, string package, NetworkCredential credential, string spn, Interop.SspiCli.ContextFlags requestedContextFlags, ChannelBinding channelBinding) { GlobalLog.Print("NTAuthentication#" + LoggingHash.HashString(this) + "::.ctor() package:" + LoggingHash.ObjectToString(package) + " spn:" + LoggingHash.ObjectToString(spn) + " flags :" + requestedContextFlags.ToString()); _tokenSize = SSPIWrapper.GetVerifyPackageInfo(GlobalSSPI.SSPIAuth, package, true).MaxToken; _isServer = isServer; _spn = spn; _securityContext = null; _requestedContextFlags = requestedContextFlags; _package = package; _channelBinding = channelBinding; GlobalLog.Print("Peer SPN-> '" + _spn + "'"); // // Check if we're using DefaultCredentials. // Debug.Assert(CredentialCache.DefaultCredentials == CredentialCache.DefaultNetworkCredentials); if (credential == CredentialCache.DefaultCredentials) { GlobalLog.Print("NTAuthentication#" + LoggingHash.HashString(this) + "::.ctor(): using DefaultCredentials"); _credentialsHandle = SSPIWrapper.AcquireDefaultCredential( GlobalSSPI.SSPIAuth, package, (_isServer ? Interop.SspiCli.CredentialUse.Inbound : Interop.SspiCli.CredentialUse.Outbound)); } else { unsafe { SafeSspiAuthDataHandle authData = null; try { Interop.SecurityStatus result = Interop.SspiCli.SspiEncodeStringsAsAuthIdentity( credential.UserName, credential.Domain, credential.Password, out authData); if (result != Interop.SecurityStatus.OK) { if (NetEventSource.Log.IsEnabled()) { NetEventSource.PrintError( NetEventSource.ComponentType.Security, SR.Format( SR.net_log_operation_failed_with_error, "SspiEncodeStringsAsAuthIdentity()", String.Format(CultureInfo.CurrentCulture, "0x{0:X}", (int)result))); } throw new Win32Exception((int)result); } _credentialsHandle = SSPIWrapper.AcquireCredentialsHandle(GlobalSSPI.SSPIAuth, package, (_isServer ? Interop.SspiCli.CredentialUse.Inbound : Interop.SspiCli.CredentialUse.Outbound), ref authData); } finally { if (authData != null) { authData.Dispose(); } } } } }
// // NTAuthentication::NTAuthentication() // Created: 12-01-1999: L.M. // Parameters: // package - security package to use (kerberos/ntlm/negotiate) // networkCredential - credentials we're using for authentication // remotePeerId - for a server session: // ignored (except when delegating, in which case this has the same rules as the client session.) // for a client session: // for kerberos: specifies the expected account under which the server // is supposed to be running (KDC). If the server runs under a // different account an exception is thrown during the blob // exchange. (this allows mutual authentication.) // One can specify a fully qualified account name (domain\userName) // or just a username, in which case the domain is assumed // to be the same as the client. // for ntlm: ignored // // Description: Initializes SSPI // public NTAuthentication(string package, NetworkCredential networkCredential, string remotePeerId, DelegationFix delegationFix) { GlobalLog.Print("NTAuthentication::.ctor() package:" + package); #if SERVER_SIDE_SSPI m_SecureSessionType = SecureSessionType.ClientSession; #endif m_RemotePeerId = remotePeerId; // only needed for Kerberos, it's the KDC m_Endianness = Endianness.Network; m_SecurityContext = new SecurityContext(GlobalSSPI.SSPIAuth); bool found = false; GlobalLog.Print("NTAuthentication::.ctor() searching for name: " + package); if (m_SupportedSecurityPackages != null) { for (int i = 0; i < m_SupportedSecurityPackages.Length; i++) { GlobalLog.Print("NTAuthentication::.ctor() supported name: " + m_SupportedSecurityPackages[i].Name); if (string.Compare(m_SupportedSecurityPackages[i].Name, package, true, CultureInfo.InvariantCulture) == 0) { GlobalLog.Print("NTAuthentication::.ctor(): found SecurityPackage(" + package + ")"); m_TokenSize = m_SupportedSecurityPackages[i].MaxToken; m_Capabilities = m_SupportedSecurityPackages[i].Capabilities; found = true; break; } } } if (!found) { GlobalLog.Print("NTAuthentication::.ctor(): initialization failed: SecurityPackage(" + package + ") NOT FOUND"); throw new WebException(SR.GetString(SR.net_securitypackagesupport), WebExceptionStatus.SecureChannelFailure); } // // In order to prevent a race condition where one request could // steal a connection from another request, before a handshake is // complete, we create a new Group for each authentication request. // if (package == NtlmClient.AuthType || package == NegotiateClient.AuthType) { m_UniqueUserId = (Interlocked.Increment(ref s_UniqueGroupId)).ToString(); } // // check if we're using DefaultCredentials // if (networkCredential is SystemNetworkCredential) { // // we're using DefaultCredentials // GlobalLog.Print("NTAuthentication::.ctor(): using DefaultCredentials"); m_UniqueUserId += "/S"; // save off for unique connection marking // DELEGATION: // The fix is implemented in cooperation with HttpWebRequest class // Remove from both places and change the constructor of NTAuthentication class // once the Common Language Runtime will start propagating the Thread token with their stack // compression stuff. // GlobalLog.Assert(delegationFix != null, "DelegationFix ==NULL -> request Credentials has been changed after the request submission!", ""); if (delegationFix != null) { delegationFix.SetToken(); } GlobalLog.Print("DELEGATION for peer-> '" + m_RemotePeerId + "', SetToken = " + delegationFix.Token.ToString()); try { m_CredentialsHandle = SSPIWrapper.AcquireCredentialsHandle( GlobalSSPI.SSPIAuth, package, CredentialUse.Outgoing); } finally { if (delegationFix != null) { delegationFix.RevertToken(); } GlobalLog.Print("DELEGATION for peer-> '" + m_RemotePeerId + "', UNSetToken = " + delegationFix.Token.ToString()); } return; } // // we're not using DefaultCredentials, we need a // AuthIdentity struct to contain credentials // SECREVIEW: // we'll save username/domain in temp strings, to avoid decrypting multiple times. // password is only used once // string username = networkCredential.UserName; string domain = networkCredential.Domain; m_UniqueUserId += domain + "/" + username + "/U"; // save off for unique connection marking AuthIdentity authIdentity = new AuthIdentity(username, networkCredential.Password, domain); GlobalLog.Print("NTAuthentication::.ctor(): using authIdentity:" + authIdentity.ToString()); m_CredentialsHandle = SSPIWrapper.AcquireCredentialsHandle( GlobalSSPI.SSPIAuth, package, CredentialUse.Outgoing, authIdentity ); }