public void AuthenticationProviderSetsAuthenticatedIdentity() { var accounts = new SampleAccountRepository(); var authProvider = new SrpAuthenticationProvider(accounts); var srpClient = new SrpClient(); var sessionId = Guid.NewGuid(); var clientEphemeral = srpClient.GenerateEphemeral(); var request = new Hashtable { { SrpProtocolConstants.SRP_STEP_NUMBER, 1 }, { SrpProtocolConstants.SRP_USERNAME, UserName }, { SrpProtocolConstants.SRP_CLIENT_PUBLIC_EPHEMERAL, clientEphemeral.Public }, }; var authRequest = new AuthRequestMessage { Credentials = request, ClientAddress = "localhost", SessionID = sessionId }; var response = authProvider.Authenticate(authRequest); Assert.IsNotNull(response); Assert.IsNotNull(response.Parameters); Assert.IsNotNull(response.Parameters[SrpProtocolConstants.SRP_SALT]); Assert.IsNotNull(response.Parameters[SrpProtocolConstants.SRP_SERVER_PUBLIC_EPHEMERAL]); // step1 is performed Assert.IsTrue(authProvider.PendingAuthentications.Any()); // server returns salt even for the unknown user name so we can't tell whether the user exists or not var salt = (string)response.Parameters[SrpProtocolConstants.SRP_SALT]; var serverPublicEphemeral = (string)response.Parameters[SrpProtocolConstants.SRP_SERVER_PUBLIC_EPHEMERAL]; var privateKey = srpClient.DerivePrivateKey(salt, UserName, Password); var clientSession = srpClient.DeriveSession(clientEphemeral.Secret, serverPublicEphemeral, salt, UserName, privateKey); // perform step2 authRequest.Credentials[SrpProtocolConstants.SRP_STEP_NUMBER] = 2; authRequest.Credentials[SrpProtocolConstants.SRP_CLIENT_SESSION_PROOF] = clientSession.Proof; // make sure that identity is set response = authProvider.Authenticate(authRequest); Assert.IsNotNull(response); Assert.IsNotNull(response.Parameters); Assert.IsNotNull(response.Parameters[SrpProtocolConstants.SRP_SERVER_SESSION_PROOF]); Assert.IsTrue(response.Completed); Assert.IsTrue(response.Success); Assert.IsNotNull(response.AuthenticatedIdentity); Assert.IsNotNull(response.AuthenticatedIdentity.IsAuthenticated); Assert.AreEqual(response.AuthenticatedIdentity.Name, UserName); var serverProof = (string)response.Parameters[SrpProtocolConstants.SRP_SERVER_SESSION_PROOF]; srpClient.VerifySession(clientEphemeral.Public, clientSession, serverProof); }
public void UnknownUsernameReturnsSameSaltAndNewEphemeralOnEachRequest() { var accounts = new SampleAccountRepository(); var authProvider = new SrpAuthenticationProvider(accounts); var srpClient = new SrpClient(); var sessionId = Guid.NewGuid(); var request = new Hashtable { { SrpProtocolConstants.SRP_STEP_NUMBER, 1 }, { SrpProtocolConstants.SRP_USERNAME, "UnknownUser" }, { SrpProtocolConstants.SRP_CLIENT_PUBLIC_EPHEMERAL, srpClient.GenerateEphemeral().Public }, }; var authRequest = new AuthRequestMessage { Credentials = request, ClientAddress = "localhost", SessionID = sessionId }; var response = authProvider.Authenticate(authRequest); Assert.IsNotNull(response); Assert.IsNotNull(response.Parameters); Assert.IsNotNull(response.Parameters[SrpProtocolConstants.SRP_SALT]); Assert.IsNotNull(response.Parameters[SrpProtocolConstants.SRP_SERVER_PUBLIC_EPHEMERAL]); // step1 is not performed because the user is unknown Assert.IsFalse(authProvider.PendingAuthentications.Any()); // server returns salt even for the unknown user name so we can't tell whether the user exists or not var salt1 = (string)response.Parameters[SrpProtocolConstants.SRP_SALT]; var ephemeral1 = (string)response.Parameters[SrpProtocolConstants.SRP_SERVER_PUBLIC_EPHEMERAL]; response = authProvider.Authenticate(authRequest); Assert.IsNotNull(response); Assert.IsNotNull(response.Parameters); Assert.IsNotNull(response.Parameters[SrpProtocolConstants.SRP_SALT]); Assert.IsNotNull(response.Parameters[SrpProtocolConstants.SRP_SERVER_PUBLIC_EPHEMERAL]); var salt2 = (string)response.Parameters[SrpProtocolConstants.SRP_SALT]; var ephemeral2 = (string)response.Parameters[SrpProtocolConstants.SRP_SERVER_PUBLIC_EPHEMERAL]; // server returns the same salt for every unknown username, but new ephemeral on each request Assert.AreEqual(salt1, salt2); Assert.AreNotEqual(ephemeral1, ephemeral2); }