public void ShouldOutputCorrectInputValue() { var store = new MockPolicyStore(); ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); InputPolicyClaim inputPolicyClaim1 = new InputPolicyClaim(this.issuer, this.inputClaimType, "*"); ClaimType outputClaimType1 = new ClaimType("http://myOutputClaimType1"); OutputPolicyClaim outputPolicyClaim1 = new OutputPolicyClaim(outputClaimType1, "myOutputClaimValue"); PolicyRule policyRule1 = new PolicyRule(AssertionsMatch.Any, new[] { inputPolicyClaim1 }, outputPolicyClaim1); InputPolicyClaim inputPolicyClaim2 = new InputPolicyClaim(this.issuer, this.inputClaimType, "inputClaimValue"); ClaimType outputClaimType2 = new ClaimType("http://myOutputClaimType2"); OutputPolicyClaim outputPolicyClaim2 = new OutputPolicyClaim(outputClaimType2, string.Empty, CopyFromConstants.InputValue); PolicyRule policyRule2 = new PolicyRule(AssertionsMatch.Any, new[] { inputPolicyClaim2 }, outputPolicyClaim2); store.RetrieveScopesReturnValue = new List <PolicyScope>() { new PolicyScope(new Uri("http://myScope"), new[] { policyRule1, policyRule2 }) }; IEnumerable <Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "inputClaimValue", string.Empty, "http://myInputClaimIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(2, evaluatedOutputClaims.Count()); var outputClaim1 = evaluatedOutputClaims.FirstOrDefault(c => c.ClaimType == "http://myOutputClaimType1"); Assert.IsNotNull(outputClaim1); Assert.AreEqual("myOutputClaimValue", outputClaim1.Value); var outputClaim2 = evaluatedOutputClaims.FirstOrDefault(c => c.ClaimType == "http://myOutputClaimType2"); Assert.IsNotNull(outputClaim2); Assert.AreEqual("inputClaimValue", outputClaim2.Value); }
public void ShouldMatchInputClaim() { var store = new MockPolicyStore(); ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); InputPolicyClaim inputClaim = new InputPolicyClaim(this.issuer, this.inputClaimType, "myInputClaim"); OutputPolicyClaim outputClaim = new OutputPolicyClaim(this.outputClaimType, "myOutputClaimValue"); PolicyRule rule = new PolicyRule(AssertionsMatch.Any, new[] { inputClaim }, outputClaim); var policyScope = new PolicyScope(new Uri("http://myScope"), new[] { rule }); policyScope.AddIssuer(new Issuer("http://originalIssuer", string.Empty, "OriginalIssuer")); store.RetrieveScopesReturnValue = new List <PolicyScope>() { policyScope }; IEnumerable <Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "myInputClaim", string.Empty, "http://myInputClaimIssuer", "http://originalIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(1, evaluatedOutputClaims.Count()); Assert.AreEqual("http://myOutputClaimType", evaluatedOutputClaims.ElementAt(0).ClaimType); Assert.AreEqual("myOutputClaimValue", evaluatedOutputClaims.ElementAt(0).Value); Assert.AreEqual("http://myInputClaimIssuer", evaluatedOutputClaims.ElementAt(0).Issuer); Assert.AreEqual("OriginalIssuer", evaluatedOutputClaims.ElementAt(0).OriginalIssuer); }
public void ShouldMatchInputClaimValueInCaseInsensitiveFashion() { var store = new MockPolicyStore(); var scopeUri = new Uri("http://myScope"); var inputClaimValue = "myInputClaimValue"; var outputClaimValue = "myOutputClaimValue"; InputPolicyClaim inputClaim = new InputPolicyClaim( new Issuer("http://myInputClaimIssuer", "myInputClaimIssuer"), new ClaimType("http://myInputClaimType", "myInputClaimType"), inputClaimValue); OutputPolicyClaim outputClaim = new OutputPolicyClaim( new ClaimType("http://myOutputClaimType", "myOutputClaimType"), outputClaimValue); PolicyRule rule = new PolicyRule(AssertionsMatch.Any, new[] { inputClaim }, outputClaim); store.RetrieveScopesReturnValue = new List <PolicyScope> { new PolicyScope(scopeUri, new[] { rule }) }; var evaluator = new ClaimsPolicyEvaluator(store); var evaluatedOutputClaims = evaluator.Evaluate(scopeUri, new[] { new Claim("http://myInputClaimType", inputClaimValue.ToUpperInvariant(), string.Empty, "http://myInputClaimIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(1, evaluatedOutputClaims.Count()); Assert.AreEqual(outputClaimValue, evaluatedOutputClaims.ElementAt(0).Value); }
protected override IClaimsIdentity GetOutputClaimsIdentity(IClaimsPrincipal principal, RequestSecurityToken request, Scope scope) { if (null == principal) { throw new ArgumentNullException("principal"); } var outputIdentity = new ClaimsIdentity(); IEnumerable <Claim> outputClaims; if (this.scopeModel.UseClaimsPolicyEngine) { IClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(PolicyStoreFactory.Instance); outputClaims = evaluator.Evaluate(new Uri(scope.AppliesToAddress), ((IClaimsIdentity)principal.Identity).Claims); } else { outputClaims = ((IClaimsIdentity)principal.Identity).Claims; } outputIdentity.Claims.AddRange(outputClaims); if (outputIdentity.Name == null && outputIdentity.Claims.SingleOrDefault(c => c.ClaimType == ClaimTypes.NameIdentifier) != null) { outputIdentity.Claims.Add(new Claim(ClaimTypes.Name, outputIdentity.Claims.SingleOrDefault(c => c.ClaimType == ClaimTypes.NameIdentifier).Value)); } return(outputIdentity); }
public void ShouldMatchInputClaimAndCopyInputIssuerToOutputValue() { var store = new MockPolicyStore(); ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); ClaimType inputClaimType = new ClaimType("http://myInputClaimType"); ClaimType outputClaimType = new ClaimType("http://myOutputClaimType"); Issuer issuer = new Issuer("http://myInputClaimIssuer"); InputPolicyClaim inputClaim = new InputPolicyClaim(issuer, inputClaimType, "myInputClaim"); OutputPolicyClaim outputClaim = new OutputPolicyClaim(outputClaimType, string.Empty, CopyFromConstants.InputIssuer); PolicyRule rule = new PolicyRule(AssertionsMatch.Any, new[] { inputClaim }, outputClaim); store.RetrieveScopesReturnValue = new List <PolicyScope>() { new PolicyScope(new Uri("http://myScope"), new[] { rule }) }; IEnumerable <Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "myInputClaim", string.Empty, "http://myInputClaimIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(1, evaluatedOutputClaims.Count()); Assert.AreEqual("http://myOutputClaimType", evaluatedOutputClaims.ElementAt(0).ClaimType); Assert.AreEqual("http://myInputClaimIssuer", evaluatedOutputClaims.ElementAt(0).Value); }
public void ShouldReturnEmptyOutputCollectionIfInputCollectionIsEmpty() { ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(new MockPolicyStore()); IEnumerable <Claim> outputClaims = evaluator.Evaluate(new Uri("http://myScope"), new Claim[] { }); Assert.IsNotNull(outputClaims); Assert.AreEqual(0, outputClaims.Count()); }
public void ShouldPassEvaluateRuleIfFixedOutputValue() { var store = new XmlPolicyStore("My Xml Store Path", new MockXmlRepository(@"content\integrationTest1.xml")); ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); Claim inputClaim = new Claim("http://myInputClaimType1", "myInputClaim", string.Empty, "http://myIssuer1"); IEnumerable <Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://localhost/1"), new[] { inputClaim }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(1, evaluatedOutputClaims.Count()); Assert.AreEqual("http://myOutputClaimType1", evaluatedOutputClaims.ElementAt(0).ClaimType); Assert.AreEqual("myOutputClaimValue", evaluatedOutputClaims.ElementAt(0).Value); }
protected override ClaimsIdentity GetOutputClaimsIdentity(ClaimsPrincipal principal, RequestSecurityToken request, Scope scope) { if (null == principal) { throw new ArgumentNullException(nameof(principal)); } var outputIdentity = new ClaimsIdentity(); IEnumerable <Claim> outputClaims; var inputClaims = ((ClaimsIdentity)principal.Identity).Claims.ToArray(); if (scopeModel.UseClaimsPolicyEngine) { if (Logger.IsDebugEnabled) { Logger.DebugFormat("Mapping of claims. All values before are: {0}", String.Join(",", inputClaims.Select(i => i.ToString()))); } IClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(PolicyStoreFactory.Instance); outputClaims = evaluator.Evaluate(new Uri(scope.AppliesToAddress), inputClaims); if (Logger.IsDebugEnabled) { Logger.DebugFormat("Mapping of claims. All values after are: {0}", String.Join(",", outputClaims.Select(i => i.ToString()))); } } else { if (Logger.IsDebugEnabled) { Logger.DebugFormat("No mapping of claims. All values are: {0}", String.Join(",", inputClaims.Select(i => i.ToString()))); } outputClaims = inputClaims; } outputIdentity.AddClaims(outputClaims); var nameIdentifierClaim = outputIdentity.Claims.SingleOrDefault(c => c.Type == ClaimTypes.NameIdentifier); if (outputIdentity.Name == null && nameIdentifierClaim != null) { outputIdentity.AddClaim(new Claim(ClaimTypes.Name, nameIdentifierClaim.Value)); } var isPersistentClaim = inputClaims.SingleOrDefault(c => c.Type == ClaimTypes.IsPersistent); if (isPersistentClaim != null) { outputIdentity.AddClaim(new Claim(ClaimTypes.IsPersistent, isPersistentClaim.Value)); } return(outputIdentity); }
public void ShouldThrowIfScopeIsNotFoundOnStore() { var store = new MockPolicyStore(); Issuer issuer = new Issuer("http://myIssuer", "myIssuer"); ClaimType myClaimType = new ClaimType("http://myClaimType", "myClaimType"); store.RetrieveScopesReturnValue = new List <PolicyScope>() { new PolicyScope( new Uri("http://mappedScope"), new[] { new PolicyRule(AssertionsMatch.All, new[] { new InputPolicyClaim(issuer, myClaimType, "myClaimValue") }, new OutputPolicyClaim(myClaimType, string.Empty, CopyFromConstants.InputValue)) }) }; ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); evaluator.Evaluate(new Uri("http://unmappedScope"), new[] { new Claim("http://myInputClaimType", "myInputClaim") }); }
public void ShoudMatchInputClaimWithAssertionMatchAll() { var store = new MockPolicyStore(); ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); InputPolicyClaim inputClaim = new InputPolicyClaim(this.issuer, this.inputClaimType, "myInputClaim"); OutputPolicyClaim outputClaim = new OutputPolicyClaim(this.outputClaimType, "myOutputClaimValue"); PolicyRule rule = new PolicyRule(AssertionsMatch.All, new[] { inputClaim }, outputClaim); store.RetrieveScopesReturnValue = new List<PolicyScope>() { new PolicyScope(new Uri("http://myScope"), new[] { rule }) }; IEnumerable<Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "myInputClaim", string.Empty, "http://myInputClaimIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(1, evaluatedOutputClaims.Count()); Assert.AreEqual("http://myOutputClaimType", evaluatedOutputClaims.ElementAt(0).ClaimType); Assert.AreEqual("myOutputClaimValue", evaluatedOutputClaims.ElementAt(0).Value); }
public void ShouldNotMatchInputClaimWithDifferentValue() { var store = new MockPolicyStore(); ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); InputPolicyClaim inputClaim = new InputPolicyClaim(this.issuer, this.inputClaimType, "myInputClaim"); OutputPolicyClaim outputClaim = new OutputPolicyClaim(this.outputClaimType, "myOutputClaimValue"); PolicyRule rule = new PolicyRule(AssertionsMatch.Any, new[] { inputClaim }, outputClaim); store.RetrieveScopesReturnValue = new List <PolicyScope> { new PolicyScope(new Uri("http://myScope"), new[] { rule }) }; IEnumerable <Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "otherInputClaim", string.Empty, "http://myInputClaimIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(0, evaluatedOutputClaims.Count()); }
public void ShouldMatchInputClaimWithWildcardOnValue() { var store = new MockPolicyStore(); ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); InputPolicyClaim inputClaim = new InputPolicyClaim(new Issuer("http://myInputClaimIssuer", "myInputClaimIssuer"), new ClaimType("http://myInputClaimType", "myInputClaimType"), "*"); OutputPolicyClaim outputClaim = new OutputPolicyClaim(new ClaimType("http://myOutputClaimType", "myOutputClaimType"), "myOutputClaimValue"); PolicyRule rule = new PolicyRule(AssertionsMatch.Any, new[] { inputClaim }, outputClaim); store.RetrieveScopesReturnValue = new List <PolicyScope>() { new PolicyScope(new Uri("http://myScope"), new[] { rule }) }; IEnumerable <Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "anyValueShouldMatch", string.Empty, "http://myInputClaimIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(1, evaluatedOutputClaims.Count()); Assert.AreEqual("http://myOutputClaimType", evaluatedOutputClaims.ElementAt(0).ClaimType); Assert.AreEqual("myOutputClaimValue", evaluatedOutputClaims.ElementAt(0).Value); }
public void ShouldPassEvaluateRuleIfCopyOutputValueFromInputIssuer() { var store = new XmlPolicyStore("My Xml Store Path", new MockXmlRepository(@"content\integrationTest2.xml")); PolicyScope scope = store.RetrieveScope(new Uri("http://localhost/1")); var issuer = scope.Issuers.ElementAt(0); IList <InputPolicyClaim> inputClaims = new List <InputPolicyClaim>(); ClaimType claimType = new ClaimType("http://myClaimType", "myClaimType"); inputClaims.Add(new InputPolicyClaim(issuer, claimType, "*")); PolicyRule newRule = new PolicyRule(AssertionsMatch.Any, inputClaims, new OutputPolicyClaim(claimType, string.Empty, CopyFromConstants.InputIssuer)); store.AddPolicyRule(new Uri("http://localhost/1"), newRule); string claimValue = "myInputClaimValue33"; ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); Claim inputClaim = new Claim("http://myClaimType", claimValue, string.Empty, "http://myIssuer1"); IEnumerable <Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://localhost/1"), new[] { inputClaim }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual("http://myClaimType", evaluatedOutputClaims.ElementAt(0).ClaimType); }
protected override IClaimsIdentity GetOutputClaimsIdentity(IClaimsPrincipal principal, RequestSecurityToken request, Scope scope) { if (null == principal) { throw new ArgumentNullException("principal"); } var outputIdentity = new ClaimsIdentity(); IEnumerable<Claim> outputClaims; if (this.scopeModel.UseClaimsPolicyEngine) { IClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(PolicyStoreFactory.Instance); outputClaims = evaluator.Evaluate(new Uri(scope.AppliesToAddress), ((IClaimsIdentity)principal.Identity).Claims); } else { outputClaims = ((IClaimsIdentity)principal.Identity).Claims; } outputIdentity.Claims.AddRange(outputClaims); return outputIdentity; }
public void ShouldThrowIfInvalidScope() { ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(new MockPolicyStore()); Assert.Throws <ArgumentNullException>(() => evaluator.Evaluate(null, new[] { new Claim("http://myInputClaimType", "myInputClaim") })); }
public void ShouldMatchInputClaimValueInCaseInsensitiveFashion() { var store = new MockPolicyStore(); var scopeUri = new Uri("http://myScope"); var inputClaimValue = "myInputClaimValue"; var outputClaimValue = "myOutputClaimValue"; InputPolicyClaim inputClaim = new InputPolicyClaim( new Issuer("http://myInputClaimIssuer", "myInputClaimIssuer"), new ClaimType("http://myInputClaimType", "myInputClaimType"), inputClaimValue); OutputPolicyClaim outputClaim = new OutputPolicyClaim( new ClaimType("http://myOutputClaimType", "myOutputClaimType"), outputClaimValue); PolicyRule rule = new PolicyRule(AssertionsMatch.Any, new[] { inputClaim }, outputClaim); store.RetrieveScopesReturnValue = new List<PolicyScope> { new PolicyScope(scopeUri, new[] { rule }) }; var evaluator = new ClaimsPolicyEvaluator(store); var evaluatedOutputClaims = evaluator.Evaluate(scopeUri, new[] { new Claim("http://myInputClaimType", inputClaimValue.ToUpperInvariant(), string.Empty, "http://myInputClaimIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(1, evaluatedOutputClaims.Count()); Assert.AreEqual(outputClaimValue, evaluatedOutputClaims.ElementAt(0).Value); }
public void ShouldOutputCorrectInputValue() { var store = new MockPolicyStore(); ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); InputPolicyClaim inputPolicyClaim1 = new InputPolicyClaim(this.issuer, this.inputClaimType, "*"); ClaimType outputClaimType1 = new ClaimType("http://myOutputClaimType1"); OutputPolicyClaim outputPolicyClaim1 = new OutputPolicyClaim(outputClaimType1, "myOutputClaimValue"); PolicyRule policyRule1 = new PolicyRule(AssertionsMatch.Any, new[] { inputPolicyClaim1 }, outputPolicyClaim1); InputPolicyClaim inputPolicyClaim2 = new InputPolicyClaim(this.issuer, this.inputClaimType, "inputClaimValue"); ClaimType outputClaimType2 = new ClaimType("http://myOutputClaimType2"); OutputPolicyClaim outputPolicyClaim2 = new OutputPolicyClaim(outputClaimType2, string.Empty, CopyFromConstants.InputValue); PolicyRule policyRule2 = new PolicyRule(AssertionsMatch.Any, new[] { inputPolicyClaim2 }, outputPolicyClaim2); store.RetrieveScopesReturnValue = new List<PolicyScope>() { new PolicyScope(new Uri("http://myScope"), new[] { policyRule1, policyRule2 }) }; IEnumerable<Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "inputClaimValue", string.Empty, "http://myInputClaimIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(2, evaluatedOutputClaims.Count()); var outputClaim1 = evaluatedOutputClaims.FirstOrDefault(c => c.ClaimType == "http://myOutputClaimType1"); Assert.IsNotNull(outputClaim1); Assert.AreEqual("myOutputClaimValue", outputClaim1.Value); var outputClaim2 = evaluatedOutputClaims.FirstOrDefault(c => c.ClaimType == "http://myOutputClaimType2"); Assert.IsNotNull(outputClaim2); Assert.AreEqual("inputClaimValue", outputClaim2.Value); }
public void ShouldReturnEmptyOutputCollectionIfInputCollectionIsEmpty() { ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(new MockPolicyStore()); IEnumerable<Claim> outputClaims = evaluator.Evaluate(new Uri("http://myScope"), new Claim[] { }); Assert.IsNotNull(outputClaims); Assert.AreEqual(0, outputClaims.Count()); }
public void ShouldThrowIfInvalidScope() { ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(new MockPolicyStore()); evaluator.Evaluate(null, new[] { new Claim("http://myInputClaimType", "myInputClaim") }); }
public void ShouldThrowIfScopeIsNotFoundOnStore() { var store = new MockPolicyStore(); Issuer issuer = new Issuer("http://myIssuer", "myIssuer"); ClaimType myClaimType = new ClaimType("http://myClaimType", "myClaimType"); store.RetrieveScopesReturnValue = new List<PolicyScope>() { new PolicyScope( new Uri("http://mappedScope"), new[] { new PolicyRule(AssertionsMatch.All, new[] { new InputPolicyClaim(issuer, myClaimType, "myClaimValue") }, new OutputPolicyClaim(myClaimType, string.Empty, CopyFromConstants.InputValue)) }) }; ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); evaluator.Evaluate(new Uri("http://unmappedScope"), new[] { new Claim("http://myInputClaimType", "myInputClaim") }); }
public void ShouldMatchInputClaimAndCopyInputIssuerToOutputValue() { var store = new MockPolicyStore(); ClaimsPolicyEvaluator evaluator = new ClaimsPolicyEvaluator(store); ClaimType inputClaimType = new ClaimType("http://myInputClaimType"); ClaimType outputClaimType = new ClaimType("http://myOutputClaimType"); Issuer issuer = new Issuer("http://myInputClaimIssuer"); InputPolicyClaim inputClaim = new InputPolicyClaim(issuer, inputClaimType, "myInputClaim"); OutputPolicyClaim outputClaim = new OutputPolicyClaim(outputClaimType, string.Empty, CopyFromConstants.InputIssuer); PolicyRule rule = new PolicyRule(AssertionsMatch.Any, new[] { inputClaim }, outputClaim); store.RetrieveScopesReturnValue = new List<PolicyScope>() { new PolicyScope(new Uri("http://myScope"), new[] { rule }) }; IEnumerable<Claim> evaluatedOutputClaims = evaluator.Evaluate(new Uri("http://myScope"), new[] { new Claim("http://myInputClaimType", "myInputClaim", string.Empty, "http://myInputClaimIssuer") }); Assert.IsNotNull(evaluatedOutputClaims); Assert.AreEqual(1, evaluatedOutputClaims.Count()); Assert.AreEqual("http://myOutputClaimType", evaluatedOutputClaims.ElementAt(0).ClaimType); Assert.AreEqual("http://myInputClaimIssuer", evaluatedOutputClaims.ElementAt(0).Value); }