mcs/class/System.Web/System.Web.Security/RolePrincipal.cs

   1 //
   2 // System.Web.Security.RolePrincipal
   3 //
   4 // Authors:
   5 //      Ben Maurer (bmaurer@users.sourceforge.net)
   6 //      Sebastien Pouliot  <sebastien@ximian.com>
   7 //
   8 // (C) 2003 Ben Maurer
   9 // Copyright (C) 2005 Novell, Inc (http://www.novell.com)
  10 //
  11 // Permission is hereby granted, free of charge, to any person obtaining
  12 // a copy of this software and associated documentation files (the
  13 // "Software"), to deal in the Software without restriction, including
  14 // without limitation the rights to use, copy, modify, merge, publish,
  15 // distribute, sublicense, and/or sell copies of the Software, and to
  16 // permit persons to whom the Software is furnished to do so, subject to
  17 // the following conditions:
  18 //
  19 // The above copyright notice and this permission notice shall be
  20 // included in all copies or substantial portions of the Software.
  21 //
  22 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  23 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  24 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  25 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  26 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  27 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  28 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  29 //
  30
  31 #if NET_2_0
  32
  33 using System.Collections.Specialized;
  34 using System.Security.Cryptography;
  35 using System.Security.Permissions;
  36 using System.Security.Principal;
  37 using System.Web.Configuration;
  38 using System.IO;
  39 using System.Text;
  40
  41 namespace System.Web.Security {
  42
  43         [Serializable]
  44         [AspNetHostingPermission (SecurityAction.LinkDemand, Level = AspNetHostingPermissionLevel.Minimal)]
  45         public sealed class RolePrincipal : IPrincipal {
  46
  47                 IIdentity _identity;
  48                 bool _listChanged;
  49                 string[] _cachedArray;
  50                 HybridDictionary _cachedRoles;
  51                 readonly string _providerName;
  52
  53                 int _version = 1;
  54                 string _cookiePath;
  55                 DateTime _issueDate;
  56                 DateTime _expireDate;
  57
  58
  59                 public RolePrincipal (IIdentity identity)
  60                 {
  61                         if (identity == null)
  62                                 throw new ArgumentNullException ("identity");
  63
  64                         this._identity = identity;
  65                         this._cookiePath = RoleManagerConfig.CookiePath;
  66                         this._issueDate = DateTime.Now;
  67                         this._expireDate = _issueDate.Add (RoleManagerConfig.CookieTimeout);
  68                 }
  69
  70                 public RolePrincipal (IIdentity identity, string encryptedTicket)
  71                         : this (identity)
  72                 {
  73                         DecryptTicket (encryptedTicket);
  74                 }
  75
  76                 public RolePrincipal (string providerName, IIdentity identity)
  77                         : this (identity)
  78                 {
  79                         if (providerName == null)
  80                                 throw new ArgumentNullException ("providerName");
  81
  82                         this._providerName = providerName;
  83                 }
  84
  85                 public RolePrincipal (string providerName, IIdentity identity, string encryptedTicket)
  86                         : this (providerName, identity)
  87                 {
  88                         DecryptTicket (encryptedTicket);
  89                 }
  90
  91                 public string [] GetRoles ()
  92                 {
  93                         if (!_identity.IsAuthenticated)
  94                                 return new string[0];
  95
  96                         if (!IsRoleListCached || Expired) {
  97                                 _cachedArray = Provider.GetRolesForUser (_identity.Name);
  98                                 _cachedRoles = new HybridDictionary (true);
  99
 100                                 foreach (string r in _cachedArray)
 101                                         _cachedRoles.Add(r, r);
 102
 103                                 _listChanged = true;
 104                         }
 105
 106                         return _cachedArray;
 107                 }
 108
 109                 public bool IsInRole (string role)
 110                 {
 111                         if (!_identity.IsAuthenticated)
 112                                 return false;
 113
 114                         GetRoles ();
 115
 116                         return _cachedRoles [role] != null;
 117                 }
 118
 119                 public string ToEncryptedTicket ()
 120                 {
 121                         string roles = string.Join (",", GetRoles ());
 122                         string cookiePath = RoleManagerConfig.CookiePath;
 123                         int approxTicketLen = roles.Length + cookiePath.Length + 64;
 124
 125                         if (_cachedArray.Length > Roles.MaxCachedResults)
 126                                return null;
 127
 128                         MemoryStream ticket = new MemoryStream (approxTicketLen);
 129                         BinaryWriter writer = new BinaryWriter (ticket);
 130
 131                         // version
 132                         writer.Write (Version);
 133
 134                         // issue datetime
 135                         DateTime issueDate = DateTime.Now;
 136                         writer.Write (issueDate.Ticks);
 137
 138                         // expiration datetime
 139                         writer.Write (_expireDate.Ticks);
 140
 141                         writer.Write (cookiePath);
 142                         writer.Write (roles);
 143
 144                         CookieProtection cookieProtection = RoleManagerConfig.CookieProtection;
 145
 146                         if (cookieProtection == CookieProtection.None)
 147                                 return GetBase64FromBytes (ticket.GetBuffer (), 0, (int) ticket.Position);
 148
 149                         if (cookieProtection == CookieProtection.All || cookieProtection == CookieProtection.Validation) {
 150
 151                                 byte [] hashBytes = null;
 152                                 byte [] validationBytes = MachineKeySectionUtils.ValidationKeyBytes (MachineConfig);
 153                                 writer.Write (validationBytes);
 154
 155                                 switch (MachineConfig.Validation) {
 156                                         case MachineKeyValidation.MD5:
 157                                                 hashBytes = MD5.Create ().ComputeHash (ticket.GetBuffer (), 0, (int) ticket.Position);
 158                                                 break;
 159
 160                                         case MachineKeyValidation.TripleDES:
 161                                         case MachineKeyValidation.SHA1:
 162                                                 hashBytes = SHA1.Create ().ComputeHash (ticket.GetBuffer (), 0, (int) ticket.Position);
 163                                                 break;
 164                                 }
 165
 166                                 writer.Seek (-validationBytes.Length, SeekOrigin.Current);
 167                                 writer.Write (hashBytes);
 168                         }
 169
 170                         byte [] ticketBytes = null;
 171                         if (cookieProtection == CookieProtection.All || cookieProtection == CookieProtection.Encryption) {
 172                                 ICryptoTransform enc;
 173                                 enc = TripleDES.Create ().CreateEncryptor (MachineKeySectionUtils.DecryptionKey192Bits (MachineConfig),
 174                                                                            InitVector);
 175                                 ticketBytes = enc.TransformFinalBlock (ticket.GetBuffer (), 0, (int) ticket.Position);
 176                         }
 177
 178                         if (ticketBytes == null)
 179                                 return GetBase64FromBytes (ticket.GetBuffer (), 0, (int) ticket.Position);
 180                         else
 181                                 return GetBase64FromBytes (ticketBytes, 0, ticketBytes.Length);
 182                 }
 183
 184                 void DecryptTicket (string encryptedTicket)
 185                 {
 186                         if (encryptedTicket == null || encryptedTicket == String.Empty)
 187                                 throw new ArgumentException ("Invalid encrypted ticket", "encryptedTicket");
 188
 189                         byte [] ticketBytes = GetBytesFromBase64 (encryptedTicket);
 190                         byte [] decryptedTicketBytes = null;
 191
 192                         CookieProtection cookieProtection = RoleManagerConfig.CookieProtection;
 193                         if (cookieProtection == CookieProtection.All || cookieProtection == CookieProtection.Encryption) {
 194                                 ICryptoTransform decryptor;
 195                                 decryptor = TripleDES.Create ().CreateDecryptor (
 196                                         MachineKeySectionUtils.DecryptionKey192Bits (MachineConfig),
 197                                         InitVector);
 198                                 decryptedTicketBytes = decryptor.TransformFinalBlock (ticketBytes, 0, ticketBytes.Length);
 199                         }
 200                         else
 201                                 decryptedTicketBytes = ticketBytes;
 202
 203                         if (cookieProtection == CookieProtection.All || cookieProtection == CookieProtection.Validation) {
 204                                 byte [] validationBytes = MachineKeySectionUtils.ValidationKeyBytes (MachineConfig);
 205                                 byte [] rolesWithValidationBytes = null;
 206                                 byte [] tmpValidation = null;
 207
 208                                 int hashSize = (MachineConfig.Validation == MachineKeyValidation.MD5) ? 16 : 20; //md5 is 16 bytes, sha1 is 20 bytes
 209
 210                                 rolesWithValidationBytes = new byte [decryptedTicketBytes.Length - hashSize + validationBytes.Length];
 211
 212                                 Buffer.BlockCopy (decryptedTicketBytes, 0, rolesWithValidationBytes, 0, decryptedTicketBytes.Length - hashSize);
 213                                 Buffer.BlockCopy (validationBytes, 0, rolesWithValidationBytes, decryptedTicketBytes.Length - hashSize, validationBytes.Length);
 214
 215                                 switch (MachineConfig.Validation) {
 216                                         case MachineKeyValidation.MD5:
 217                                                 tmpValidation = MD5.Create ().ComputeHash (rolesWithValidationBytes);
 218                                                 break;
 219
 220                                         case MachineKeyValidation.TripleDES:
 221                                         case MachineKeyValidation.SHA1:
 222                                                 tmpValidation = SHA1.Create ().ComputeHash (rolesWithValidationBytes);
 223                                                 break;
 224                                 }
 225                                 for (int i = 0; i < tmpValidation.Length; i++) {
 226                                         if (i >= decryptedTicketBytes.Length ||
 227                                                 tmpValidation [i] != decryptedTicketBytes [i + decryptedTicketBytes.Length - hashSize])
 228                                                 throw new HttpException ("ticket validation failed");
 229                                 }
 230                         }
 231
 232                         MemoryStream ticket = new MemoryStream (decryptedTicketBytes);
 233                         BinaryReader reader = new BinaryReader (ticket);
 234
 235                         // version
 236                         _version = reader.ReadInt32 ();
 237
 238                         // issued date
 239                         _issueDate = new DateTime (reader.ReadInt64 ());
 240
 241                         // expire date
 242                         _expireDate = new DateTime (reader.ReadInt64 ());
 243
 244                         // cookie path
 245                         _cookiePath = reader.ReadString ();
 246
 247                         // roles
 248                         string roles = reader.ReadString ();
 249
 250                         if (!Expired) {
 251                                 InitializeRoles (roles);
 252                                 //update ticket if less than half of CookieTimeout remaining.
 253                                 if (Roles.CookieSlidingExpiration){
 254                                         if (_expireDate-DateTime.Now < TimeSpan.FromTicks (RoleManagerConfig.CookieTimeout.Ticks/2))    {
 255                                                 _issueDate = DateTime.Now;
 256                                                 _expireDate = DateTime.Now.Add (RoleManagerConfig.CookieTimeout);
 257                                                 SetDirty ();
 258                                         }
 259                                 }
 260                         } else {
 261                                 // issue a new ticket
 262                                 _issueDate = DateTime.Now;
 263                                 _expireDate = _issueDate.Add (RoleManagerConfig.CookieTimeout);
 264                         }
 265                 }
 266
 267                 void InitializeRoles (string decryptedRoles)
 268                 {
 269                         _cachedArray = decryptedRoles.Split (',');
 270                         _cachedRoles = new HybridDictionary (true);
 271
 272                         foreach (string r in _cachedArray)
 273                                 _cachedRoles.Add (r, r);
 274                 }
 275
 276                 byte [] InitVector
 277                 {
 278                         get { return new byte [] { 1, 2, 3, 4, 5, 6, 7, 8 }; }
 279                 }
 280
 281                 public bool CachedListChanged {
 282                         get { return _listChanged; }
 283                 }
 284
 285                 public string CookiePath {
 286                         get { return _cookiePath; }
 287                 }
 288
 289                 public bool Expired {
 290                         get { return ExpireDate < DateTime.Now; }
 291                 }
 292
 293                 public DateTime ExpireDate {
 294                         get { return _expireDate; }
 295                 }
 296
 297                 public IIdentity Identity {
 298                         get { return _identity; }
 299                 }
 300
 301                 public bool IsRoleListCached {
 302                         get { return (_cachedRoles != null) && RoleManagerConfig.CacheRolesInCookie; }
 303                 }
 304
 305                 public DateTime IssueDate {
 306                         get { return _issueDate; }
 307                 }
 308
 309                 public string ProviderName {
 310                         get { return String.IsNullOrEmpty(_providerName) ? Provider.Name : _providerName; }
 311                 }
 312
 313                 public int Version {
 314                         get { return _version; }
 315                 }
 316
 317                 RoleProvider Provider {
 318                         get {
 319                                 if (String.IsNullOrEmpty (_providerName))
 320                                         return Roles.Provider;
 321
 322                                 return Roles.Providers [_providerName];
 323                         }
 324                 }
 325
 326                 public void SetDirty ()
 327                 {
 328                         _listChanged = true;
 329                         _cachedRoles = null;
 330                         _cachedArray = null;
 331                 }
 332
 333                 static string GetBase64FromBytes (byte [] bytes, int offset, int len)
 334                 {
 335                         return Convert.ToBase64String (bytes, offset, len);
 336                 }
 337
 338                 static byte [] GetBytesFromBase64 (string base64String)
 339                 {
 340                         return Convert.FromBase64String (base64String);
 341                 }
 342
 343                 RoleManagerSection RoleManagerConfig
 344                 {
 345                         get { return (RoleManagerSection) WebConfigurationManager.GetSection ("system.web/roleManager"); }
 346                 }
 347
 348                 MachineKeySection MachineConfig
 349                 {
 350                         get { return (MachineKeySection) WebConfigurationManager.GetSection ("system.web/machineKey"); }
 351                 }
 352         }
 353 }
 354 #endif
 355