2 // System.Web.Security.RolePrincipal
5 // Ben Maurer (bmaurer@users.sourceforge.net)
6 // Sebastien Pouliot <sebastien@ximian.com>
9 // Copyright (C) 2005 Novell, Inc (http://www.novell.com)
11 // Permission is hereby granted, free of charge, to any person obtaining
12 // a copy of this software and associated documentation files (the
13 // "Software"), to deal in the Software without restriction, including
14 // without limitation the rights to use, copy, modify, merge, publish,
15 // distribute, sublicense, and/or sell copies of the Software, and to
16 // permit persons to whom the Software is furnished to do so, subject to
17 // the following conditions:
19 // The above copyright notice and this permission notice shall be
20 // included in all copies or substantial portions of the Software.
22 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
23 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
24 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
25 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
26 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
27 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
28 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
33 using System.Collections.Specialized;
34 using System.Security.Cryptography;
35 using System.Security.Permissions;
36 using System.Security.Principal;
37 using System.Web.Configuration;
41 namespace System.Web.Security {
44 [AspNetHostingPermission (SecurityAction.LinkDemand, Level = AspNetHostingPermissionLevel.Minimal)]
45 public sealed class RolePrincipal : IPrincipal {
47 private IIdentity _identity;
48 private bool _listChanged;
49 private string[] _cachedArray;
50 private HybridDictionary _cachedRoles;
51 readonly string _providerName;
53 private int _version = 1;
54 private string _cookiePath;
55 private DateTime _issueDate;
56 private DateTime _exprireDate;
59 public RolePrincipal (IIdentity identity)
62 throw new ArgumentNullException ("identity");
64 this._identity = identity;
65 this._cookiePath = RoleManagerConfig.CookiePath;
66 this._issueDate = DateTime.Now;
67 this._exprireDate = _issueDate.Add (RoleManagerConfig.CookieTimeout);
70 public RolePrincipal (IIdentity identity, string encryptedTicket)
73 DecryptTicket (encryptedTicket);
76 public RolePrincipal (string providerName, IIdentity identity)
79 if (providerName == null)
80 throw new ArgumentNullException ("providerName");
82 this._providerName = providerName;
85 public RolePrincipal (string providerName, IIdentity identity, string encryptedTicket)
86 : this (providerName, identity)
88 DecryptTicket (encryptedTicket);
91 public string [] GetRoles ()
93 if (!_identity.IsAuthenticated)
96 if (!IsRoleListCached && !Expired) {
97 _cachedArray = Provider.GetRolesForUser (_identity.Name);
98 _cachedRoles = new HybridDictionary (true);
100 foreach (string r in _cachedArray)
101 _cachedRoles.Add(r, r);
109 public bool IsInRole (string role)
111 if (!_identity.IsAuthenticated)
116 return _cachedRoles [role] != null;
119 public string ToEncryptedTicket ()
121 string roles = string.Join (",", GetRoles ());
122 string cookiePath = RoleManagerConfig.CookiePath;
123 int approxTicketLen = roles.Length + cookiePath.Length + 64;
125 MemoryStream ticket = new MemoryStream (approxTicketLen);
126 BinaryWriter writer = new BinaryWriter (ticket);
129 writer.Write (Version);
132 DateTime issueDate = DateTime.Now;
133 writer.Write (issueDate.Ticks);
135 // expiration datetime
136 writer.Write (issueDate.Add(RoleManagerConfig.CookieTimeout).Ticks);
138 writer.Write (cookiePath);
139 writer.Write (roles);
141 CookieProtection cookieProtection = RoleManagerConfig.CookieProtection;
143 if (cookieProtection == CookieProtection.None)
144 return GetBase64FromBytes (ticket.GetBuffer (), 0, (int) ticket.Position);
146 if (cookieProtection == CookieProtection.All || cookieProtection == CookieProtection.Validation) {
148 byte [] hashBytes = null;
149 byte [] validationBytes = MachineKeySectionUtils.ValidationKeyBytes (MachineConfig);
150 writer.Write (validationBytes);
152 switch (MachineConfig.Validation) {
153 case MachineKeyValidation.MD5:
154 hashBytes = MD5.Create ().ComputeHash (ticket.GetBuffer (), 0, (int) ticket.Position);
157 case MachineKeyValidation.TripleDES:
158 case MachineKeyValidation.SHA1:
159 hashBytes = SHA1.Create ().ComputeHash (ticket.GetBuffer (), 0, (int) ticket.Position);
163 writer.Seek (-validationBytes.Length, SeekOrigin.Current);
164 writer.Write (hashBytes);
167 byte [] ticketBytes = null;
168 if (cookieProtection == CookieProtection.All || cookieProtection == CookieProtection.Encryption) {
169 ICryptoTransform enc;
170 enc = TripleDES.Create ().CreateEncryptor (MachineKeySectionUtils.DecryptionKey192Bits (MachineConfig),
172 ticketBytes = enc.TransformFinalBlock (ticket.GetBuffer (), 0, (int) ticket.Position);
175 if (ticketBytes == null)
176 return GetBase64FromBytes (ticket.GetBuffer (), 0, (int) ticket.Position);
178 return GetBase64FromBytes (ticketBytes, 0, ticketBytes.Length);
181 private void DecryptTicket (string encryptedTicket)
183 if (encryptedTicket == null || encryptedTicket == String.Empty)
184 throw new ArgumentException ("Invalid encrypted ticket", "encryptedTicket");
186 byte [] ticketBytes = GetBytesFromBase64 (encryptedTicket);
187 byte [] decryptedTicketBytes = null;
189 CookieProtection cookieProtection = RoleManagerConfig.CookieProtection;
190 if (cookieProtection == CookieProtection.All || cookieProtection == CookieProtection.Encryption) {
191 ICryptoTransform decryptor;
192 decryptor = TripleDES.Create ().CreateDecryptor (
193 MachineKeySectionUtils.DecryptionKey192Bits (MachineConfig),
195 decryptedTicketBytes = decryptor.TransformFinalBlock (ticketBytes, 0, ticketBytes.Length);
198 decryptedTicketBytes = ticketBytes;
200 if (cookieProtection == CookieProtection.All || cookieProtection == CookieProtection.Validation) {
201 byte [] validationBytes = MachineKeySectionUtils.ValidationKeyBytes (MachineConfig);
202 byte [] rolesWithValidationBytes = null;
203 byte [] tmpValidation = null;
205 int hashSize = (MachineConfig.Validation == MachineKeyValidation.MD5) ? 16 : 20; //md5 is 16 bytes, sha1 is 20 bytes
207 rolesWithValidationBytes = new byte [decryptedTicketBytes.Length - hashSize + validationBytes.Length];
209 Buffer.BlockCopy (decryptedTicketBytes, 0, rolesWithValidationBytes, 0, decryptedTicketBytes.Length - hashSize);
210 Buffer.BlockCopy (validationBytes, 0, rolesWithValidationBytes, decryptedTicketBytes.Length - hashSize, validationBytes.Length);
212 switch (MachineConfig.Validation) {
213 case MachineKeyValidation.MD5:
214 tmpValidation = MD5.Create ().ComputeHash (rolesWithValidationBytes);
217 case MachineKeyValidation.TripleDES:
218 case MachineKeyValidation.SHA1:
219 tmpValidation = SHA1.Create ().ComputeHash (rolesWithValidationBytes);
222 for (int i = 0; i < tmpValidation.Length; i++) {
223 if (i >= decryptedTicketBytes.Length ||
224 tmpValidation [i] != decryptedTicketBytes [i + decryptedTicketBytes.Length - hashSize])
225 throw new HttpException ("ticket validation failed");
229 MemoryStream ticket = new MemoryStream (decryptedTicketBytes);
230 BinaryReader reader = new BinaryReader (ticket);
233 _version = reader.ReadInt32 ();
236 _issueDate = new DateTime (reader.ReadInt64 ());
239 _exprireDate = new DateTime (reader.ReadInt64 ());
242 _cookiePath = reader.ReadString ();
245 string roles = reader.ReadString ();
247 InitializeRoles (roles);
250 private void InitializeRoles (string decryptedRoles)
252 _cachedArray = decryptedRoles.Split (',');
253 _cachedRoles = new HybridDictionary (true);
255 foreach (string r in _cachedArray)
256 _cachedRoles.Add (r, r);
259 private byte [] InitVector
261 get { return new byte [] { 1, 2, 3, 4, 5, 6, 7, 8 }; }
264 public bool CachedListChanged {
265 get { return _listChanged; }
268 public string CookiePath {
269 get { return _cookiePath; }
272 public bool Expired {
273 get { return ExpireDate < DateTime.Now; }
276 public DateTime ExpireDate {
277 get { return _exprireDate; }
280 public IIdentity Identity {
281 get { return _identity; }
284 public bool IsRoleListCached {
285 get { return (_cachedRoles != null) && RoleManagerConfig.CacheRolesInCookie; }
288 public DateTime IssueDate {
289 get { return _issueDate; }
292 public string ProviderName {
293 get { return String.IsNullOrEmpty(_providerName) ? Provider.Name : _providerName; }
297 get { return _version; }
300 RoleProvider Provider {
302 if (String.IsNullOrEmpty (_providerName))
303 return Roles.Provider;
305 return Roles.Providers [_providerName];
309 public void SetDirty ()
316 static string GetBase64FromBytes (byte [] bytes, int offset, int len)
318 return Convert.ToBase64String (bytes, offset, len);
321 static byte [] GetBytesFromBase64 (string base64String)
323 return Convert.FromBase64String (base64String);
326 RoleManagerSection RoleManagerConfig
328 get { return (RoleManagerSection) WebConfigurationManager.GetSection ("system.web/roleManager"); }
331 MachineKeySection MachineConfig
333 get { return (MachineKeySection) WebConfigurationManager.GetSection ("system.web/machineKey"); }