_KerberosClient.cs source code in C# .NET

                        
Code:
                         / Net / Net / 3.5.50727.3053 / DEVDIV / depot / DevDiv / releases / whidbey / netfxsp / ndp / fx / src / Net / System / Net / _KerberosClient.cs / 1 / _KerberosClient.cs
                        

                        
                            //------------------------------------------------------------------------------ 
// 
//     Copyright (c) Microsoft Corporation.  All rights reserved.
// 
//----------------------------------------------------------------------------- 

namespace System.Net { 
    using System.Collections; 
    using System.Net.Sockets;
    using System.Security.Permissions; 
    using System.Globalization;

    internal class KerberosClient : ISessionAuthenticationModule {
 
        internal const string AuthType = "Kerberos";
        internal static string Signature = AuthType.ToLower(CultureInfo.InvariantCulture); 
        internal static int SignatureSize = Signature.Length; 

        // we can't work on non-NT platforms, so we shut off with an exception 
        // NOTE this exception IS caught internally.
        internal KerberosClient() {
            if (!ComNetOS.IsWin2K) {
                throw new PlatformNotSupportedException(SR.GetString(SR.Win2000Required)); 
            }
        } 
 
        public Authorization Authenticate(string challenge, WebRequest webRequest, ICredentials credentials) {
            GlobalLog.Print("KerberosClient::Authenticate() challenge:[" + ValidationHelper.ToString(challenge) + "] webRequest#" + ValidationHelper.HashString(webRequest) + " credentials#" + ValidationHelper.HashString(credentials) + " calling DoAuthenticate()"); 
            return DoAuthenticate(challenge, webRequest, credentials, false);
        }

 
        private Authorization DoAuthenticate(string challenge, WebRequest webRequest, ICredentials credentials, bool preAuthenticate) {
            GlobalLog.Print("KerberosClient::DoAuthenticate() challenge:[" + ValidationHelper.ToString(challenge) + "] webRequest#" + ValidationHelper.HashString(webRequest) + " credentials#" + ValidationHelper.HashString(credentials) + " preAuthenticate:" + preAuthenticate.ToString()); 
 
            GlobalLog.Assert(credentials != null, "KerberosClient::DoAuthenticate()|credentials == null");
            if (credentials == null) { 
                return null;
            }

            HttpWebRequest httpWebRequest = webRequest as HttpWebRequest; 

            GlobalLog.Assert(httpWebRequest != null, "KerberosClient::DoAuthenticate()|httpWebRequest == null"); 
            GlobalLog.Assert(httpWebRequest.ChallengedUri != null, "KerberosClient::DoAuthenticate()|httpWebRequest.ChallengedUri == null"); 

            NTAuthentication authSession = null; 
            string incoming = null;

            if (!preAuthenticate) {
                int index = AuthenticationManager.FindSubstringNotInQuotes(challenge, Signature); 
                if (index < 0) {
                    return null; 
                } 

                int blobBegin = index + SignatureSize; 

                //
                // there may be multiple challenges. If the next character after the
                // package name is not a comma then it is challenge data 
                //
                if (challenge.Length > blobBegin && challenge[blobBegin] != ',') { 
                    ++blobBegin; 
                }
                else { 
                    index = -1;
                }

                if (index >= 0 && challenge.Length > blobBegin) 
                {
                    // Strip other modules information in case of multiple challenges 
                    // i.e do not take ", NTLM" as part of the following Negotiate blob 
                    // Negotiate TlRMTVNTUAACAAAADgAOADgAAAA1wo ... MAbwBmAHQALgBjAG8AbQAAAAAA,NTLM
                    index = challenge.IndexOf(',', blobBegin); 
                    if (index != -1)
                        incoming = challenge.Substring(blobBegin, index - blobBegin);
                    else
                        incoming = challenge.Substring(blobBegin); 
                }
 
                authSession = httpWebRequest.CurrentAuthenticationState.GetSecurityContext(this); 
                GlobalLog.Print("KerberosClient::DoAuthenticate() key:" + ValidationHelper.HashString(httpWebRequest.CurrentAuthenticationState) + " retrieved authSession:" + ValidationHelper.HashString(authSession));
            } 

            if (authSession==null) {
                NetworkCredential NC = credentials.GetCredential(httpWebRequest.ChallengedUri, Signature);
                GlobalLog.Print("KerberosClient::DoAuthenticate() GetCredential() returns:" + ValidationHelper.ToString(NC)); 

                if (NC == null || (!(NC is SystemNetworkCredential) && NC.InternalGetUserName().Length == 0)) 
                { 
                    return null;
                } 

                ICredentialPolicy policy = AuthenticationManager.CredentialPolicy;
                if (policy != null && !policy.ShouldSendCredential(httpWebRequest.ChallengedUri, httpWebRequest, NC, this))
                    return null; 

                string spn = httpWebRequest.CurrentAuthenticationState.GetComputeSpn(httpWebRequest); 
                GlobalLog.Print("KerberosClient::Authenticate() ChallengedSpn:" + ValidationHelper.ToString(spn)); 

                authSession = 
                    new NTAuthentication(
                        AuthType,
                        NC,
                        spn, 
                        httpWebRequest);
 
 
                GlobalLog.Print("KerberosClient::DoAuthenticate() setting SecurityContext for:" + ValidationHelper.HashString(httpWebRequest.CurrentAuthenticationState) + " to authSession:" + ValidationHelper.HashString(authSession));
                httpWebRequest.CurrentAuthenticationState.SetSecurityContext(authSession, this); 
            }

            string clientResponse = authSession.GetOutgoingBlob(incoming);
            if (clientResponse==null) { 
                return null;
            } 
 
            return new Authorization(AuthType + " " + clientResponse, authSession.IsCompleted, string.Empty, authSession.IsMutualAuthFlag);
        } 

        public bool CanPreAuthenticate {
            get {
                return true; 
            }
        } 
 
        public Authorization PreAuthenticate(WebRequest webRequest, ICredentials credentials) {
            GlobalLog.Print("KerberosClient::PreAuthenticate() webRequest#" + ValidationHelper.HashString(webRequest) + " credentials#" + ValidationHelper.HashString(credentials) + " calling DoAuthenticate()"); 
            return DoAuthenticate(null, webRequest, credentials, true);
        }

        public string AuthenticationType { 
            get {
                return AuthType; 
            } 
        }
 
        //
        // called when getting the final blob on the 200 OK from the server
        //
        public bool Update(string challenge, WebRequest webRequest) { 
            GlobalLog.Print("KerberosClient::Update(): " + challenge);
 
            HttpWebRequest httpWebRequest = webRequest as HttpWebRequest; 

            GlobalLog.Assert(httpWebRequest != null, "KerberosClient::Update()|httpWebRequest == null"); 
            GlobalLog.Assert(httpWebRequest.ChallengedUri != null, "KerberosClient::Update()|httpWebRequest.ChallengedUri == null");

            //
            // try to retrieve the state of the ongoing handshake 
            //
            NTAuthentication authSession = httpWebRequest.CurrentAuthenticationState.GetSecurityContext(this); 
            GlobalLog.Print("KerberosClient::Update() key:" + ValidationHelper.HashString(httpWebRequest.CurrentAuthenticationState) + " retrieved authSession:" + ValidationHelper.HashString(authSession)); 

            if (authSession==null) { 
                GlobalLog.Print("KerberosClient::Update() null session returning true");
                return true;
            }
 
            GlobalLog.Print("KerberosClient::Update() authSession.IsCompleted:" + authSession.IsCompleted.ToString());
 
            if (httpWebRequest.CurrentAuthenticationState.StatusCodeMatch==httpWebRequest.ResponseStatusCode) { 
                GlobalLog.Print("KerberosClient::Update() still handshaking (based on status code) returning false");
                return false; 
            }

            //
            // the whole point here is to to close the Security Context (this will complete the authentication handshake 
            // with server authentication for schemese that support it such as Kerberos)
            // 
            int index = challenge==null ? -1 : AuthenticationManager.FindSubstringNotInQuotes(challenge, Signature); 
            if (index>=0) {
                int blobBegin = index + SignatureSize; 
                string incoming = null;

                //
                // there may be multiple challenges. If the next character after the 
                // package name is not a comma then it is challenge data
                // 
                if (challenge.Length > blobBegin && challenge[blobBegin] != ',') { 
                    ++blobBegin;
                } else { 
                    index = -1;
                }
                if (index >= 0 && challenge.Length > blobBegin) {
                    incoming = challenge.Substring(blobBegin); 
                }
                GlobalLog.Print("KerberosClient::Update() closing security context using last incoming blob:[" + ValidationHelper.ToString(incoming) + "]"); 
                string clientResponse = authSession.GetOutgoingBlob(incoming); 
                httpWebRequest.CurrentAuthenticationState.Authorization.MutuallyAuthenticated = authSession.IsMutualAuthFlag;
                GlobalLog.Print("KerberosClient::Update() GetOutgoingBlob() returns clientResponse:[" + ValidationHelper.ToString(clientResponse) + "] IsCompleted:" + authSession.IsCompleted.ToString()); 
            }
            GlobalLog.Print("KerberosClient::Update() session removed and ConnectionGroup released returning true");
            ClearSession(httpWebRequest);
            return true; 
        }
 
        public void ClearSession(WebRequest webRequest) { 
            HttpWebRequest httpWebRequest = webRequest as HttpWebRequest;
            GlobalLog.Assert(httpWebRequest != null, "KerberosClient::ClearSession()|httpWebRequest == null"); 
            httpWebRequest.CurrentAuthenticationState.ClearSession();
        }

        public bool CanUseDefaultCredentials { 
            get {
                return true; 
            } 
        }
 
    }; // class KerberosClient


} // namespace System.Net 

// File provided for Reference Use Only by Microsoft Corporation (c) 2007.
//------------------------------------------------------------------------------ 
// 
//     Copyright (c) Microsoft Corporation.  All rights reserved.
// 
//----------------------------------------------------------------------------- 

namespace System.Net { 
    using System.Collections; 
    using System.Net.Sockets;
    using System.Security.Permissions; 
    using System.Globalization;

    internal class KerberosClient : ISessionAuthenticationModule {
 
        internal const string AuthType = "Kerberos";
        internal static string Signature = AuthType.ToLower(CultureInfo.InvariantCulture); 
        internal static int SignatureSize = Signature.Length; 

        // we can't work on non-NT platforms, so we shut off with an exception 
        // NOTE this exception IS caught internally.
        internal KerberosClient() {
            if (!ComNetOS.IsWin2K) {
                throw new PlatformNotSupportedException(SR.GetString(SR.Win2000Required)); 
            }
        } 
 
        public Authorization Authenticate(string challenge, WebRequest webRequest, ICredentials credentials) {
            GlobalLog.Print("KerberosClient::Authenticate() challenge:[" + ValidationHelper.ToString(challenge) + "] webRequest#" + ValidationHelper.HashString(webRequest) + " credentials#" + ValidationHelper.HashString(credentials) + " calling DoAuthenticate()"); 
            return DoAuthenticate(challenge, webRequest, credentials, false);
        }

 
        private Authorization DoAuthenticate(string challenge, WebRequest webRequest, ICredentials credentials, bool preAuthenticate) {
            GlobalLog.Print("KerberosClient::DoAuthenticate() challenge:[" + ValidationHelper.ToString(challenge) + "] webRequest#" + ValidationHelper.HashString(webRequest) + " credentials#" + ValidationHelper.HashString(credentials) + " preAuthenticate:" + preAuthenticate.ToString()); 
 
            GlobalLog.Assert(credentials != null, "KerberosClient::DoAuthenticate()|credentials == null");
            if (credentials == null) { 
                return null;
            }

            HttpWebRequest httpWebRequest = webRequest as HttpWebRequest; 

            GlobalLog.Assert(httpWebRequest != null, "KerberosClient::DoAuthenticate()|httpWebRequest == null"); 
            GlobalLog.Assert(httpWebRequest.ChallengedUri != null, "KerberosClient::DoAuthenticate()|httpWebRequest.ChallengedUri == null"); 

            NTAuthentication authSession = null; 
            string incoming = null;

            if (!preAuthenticate) {
                int index = AuthenticationManager.FindSubstringNotInQuotes(challenge, Signature); 
                if (index < 0) {
                    return null; 
                } 

                int blobBegin = index + SignatureSize; 

                //
                // there may be multiple challenges. If the next character after the
                // package name is not a comma then it is challenge data 
                //
                if (challenge.Length > blobBegin && challenge[blobBegin] != ',') { 
                    ++blobBegin; 
                }
                else { 
                    index = -1;
                }

                if (index >= 0 && challenge.Length > blobBegin) 
                {
                    // Strip other modules information in case of multiple challenges 
                    // i.e do not take ", NTLM" as part of the following Negotiate blob 
                    // Negotiate TlRMTVNTUAACAAAADgAOADgAAAA1wo ... MAbwBmAHQALgBjAG8AbQAAAAAA,NTLM
                    index = challenge.IndexOf(',', blobBegin); 
                    if (index != -1)
                        incoming = challenge.Substring(blobBegin, index - blobBegin);
                    else
                        incoming = challenge.Substring(blobBegin); 
                }
 
                authSession = httpWebRequest.CurrentAuthenticationState.GetSecurityContext(this); 
                GlobalLog.Print("KerberosClient::DoAuthenticate() key:" + ValidationHelper.HashString(httpWebRequest.CurrentAuthenticationState) + " retrieved authSession:" + ValidationHelper.HashString(authSession));
            } 

            if (authSession==null) {
                NetworkCredential NC = credentials.GetCredential(httpWebRequest.ChallengedUri, Signature);
                GlobalLog.Print("KerberosClient::DoAuthenticate() GetCredential() returns:" + ValidationHelper.ToString(NC)); 

                if (NC == null || (!(NC is SystemNetworkCredential) && NC.InternalGetUserName().Length == 0)) 
                { 
                    return null;
                } 

                ICredentialPolicy policy = AuthenticationManager.CredentialPolicy;
                if (policy != null && !policy.ShouldSendCredential(httpWebRequest.ChallengedUri, httpWebRequest, NC, this))
                    return null; 

                string spn = httpWebRequest.CurrentAuthenticationState.GetComputeSpn(httpWebRequest); 
                GlobalLog.Print("KerberosClient::Authenticate() ChallengedSpn:" + ValidationHelper.ToString(spn)); 

                authSession = 
                    new NTAuthentication(
                        AuthType,
                        NC,
                        spn, 
                        httpWebRequest);
 
 
                GlobalLog.Print("KerberosClient::DoAuthenticate() setting SecurityContext for:" + ValidationHelper.HashString(httpWebRequest.CurrentAuthenticationState) + " to authSession:" + ValidationHelper.HashString(authSession));
                httpWebRequest.CurrentAuthenticationState.SetSecurityContext(authSession, this); 
            }

            string clientResponse = authSession.GetOutgoingBlob(incoming);
            if (clientResponse==null) { 
                return null;
            } 
 
            return new Authorization(AuthType + " " + clientResponse, authSession.IsCompleted, string.Empty, authSession.IsMutualAuthFlag);
        } 

        public bool CanPreAuthenticate {
            get {
                return true; 
            }
        } 
 
        public Authorization PreAuthenticate(WebRequest webRequest, ICredentials credentials) {
            GlobalLog.Print("KerberosClient::PreAuthenticate() webRequest#" + ValidationHelper.HashString(webRequest) + " credentials#" + ValidationHelper.HashString(credentials) + " calling DoAuthenticate()"); 
            return DoAuthenticate(null, webRequest, credentials, true);
        }

        public string AuthenticationType { 
            get {
                return AuthType; 
            } 
        }
 
        //
        // called when getting the final blob on the 200 OK from the server
        //
        public bool Update(string challenge, WebRequest webRequest) { 
            GlobalLog.Print("KerberosClient::Update(): " + challenge);
 
            HttpWebRequest httpWebRequest = webRequest as HttpWebRequest; 

            GlobalLog.Assert(httpWebRequest != null, "KerberosClient::Update()|httpWebRequest == null"); 
            GlobalLog.Assert(httpWebRequest.ChallengedUri != null, "KerberosClient::Update()|httpWebRequest.ChallengedUri == null");

            //
            // try to retrieve the state of the ongoing handshake 
            //
            NTAuthentication authSession = httpWebRequest.CurrentAuthenticationState.GetSecurityContext(this); 
            GlobalLog.Print("KerberosClient::Update() key:" + ValidationHelper.HashString(httpWebRequest.CurrentAuthenticationState) + " retrieved authSession:" + ValidationHelper.HashString(authSession)); 

            if (authSession==null) { 
                GlobalLog.Print("KerberosClient::Update() null session returning true");
                return true;
            }
 
            GlobalLog.Print("KerberosClient::Update() authSession.IsCompleted:" + authSession.IsCompleted.ToString());
 
            if (httpWebRequest.CurrentAuthenticationState.StatusCodeMatch==httpWebRequest.ResponseStatusCode) { 
                GlobalLog.Print("KerberosClient::Update() still handshaking (based on status code) returning false");
                return false; 
            }

            //
            // the whole point here is to to close the Security Context (this will complete the authentication handshake 
            // with server authentication for schemese that support it such as Kerberos)
            // 
            int index = challenge==null ? -1 : AuthenticationManager.FindSubstringNotInQuotes(challenge, Signature); 
            if (index>=0) {
                int blobBegin = index + SignatureSize; 
                string incoming = null;

                //
                // there may be multiple challenges. If the next character after the 
                // package name is not a comma then it is challenge data
                // 
                if (challenge.Length > blobBegin && challenge[blobBegin] != ',') { 
                    ++blobBegin;
                } else { 
                    index = -1;
                }
                if (index >= 0 && challenge.Length > blobBegin) {
                    incoming = challenge.Substring(blobBegin); 
                }
                GlobalLog.Print("KerberosClient::Update() closing security context using last incoming blob:[" + ValidationHelper.ToString(incoming) + "]"); 
                string clientResponse = authSession.GetOutgoingBlob(incoming); 
                httpWebRequest.CurrentAuthenticationState.Authorization.MutuallyAuthenticated = authSession.IsMutualAuthFlag;
                GlobalLog.Print("KerberosClient::Update() GetOutgoingBlob() returns clientResponse:[" + ValidationHelper.ToString(clientResponse) + "] IsCompleted:" + authSession.IsCompleted.ToString()); 
            }
            GlobalLog.Print("KerberosClient::Update() session removed and ConnectionGroup released returning true");
            ClearSession(httpWebRequest);
            return true; 
        }
 
        public void ClearSession(WebRequest webRequest) { 
            HttpWebRequest httpWebRequest = webRequest as HttpWebRequest;
            GlobalLog.Assert(httpWebRequest != null, "KerberosClient::ClearSession()|httpWebRequest == null"); 
            httpWebRequest.CurrentAuthenticationState.ClearSession();
        }

        public bool CanUseDefaultCredentials { 
            get {
                return true; 
            } 
        }
 
    }; // class KerberosClient


} // namespace System.Net 

// File provided for Reference Use Only by Microsoft Corporation (c) 2007.
                        

                        

                        
                        

Link Menu

This book is available now!
Buy at Amazon US or
Buy at Amazon UK

• ErrorRuntimeConfig.cs
• ValidatingPropertiesEventArgs.cs
• ConfigXmlDocument.cs
• ColumnWidthChangingEvent.cs
• DependencyObjectPropertyDescriptor.cs
• AsymmetricKeyExchangeDeformatter.cs
• AdvancedBindingPropertyDescriptor.cs
• FunctionMappingTranslator.cs
• IntegrationExceptionEventArgs.cs
• WindowPatternIdentifiers.cs
• EntityCollectionChangedParams.cs
• TransactionContextValidator.cs
• WsdlBuildProvider.cs
• XmlDocumentType.cs
• MsmqTransportSecurityElement.cs
• FormViewDeletedEventArgs.cs
• NetworkInformationException.cs
• IPCCacheManager.cs
• WizardForm.cs
• AsymmetricSignatureDeformatter.cs
• VerbConverter.cs
• NonSerializedAttribute.cs
• ExtendedPropertyCollection.cs
• AppDomainAttributes.cs
• CheckBox.cs
• XamlPointCollectionSerializer.cs
• WinHttpWebProxyFinder.cs
• SplineQuaternionKeyFrame.cs
• AutomationPeer.cs
• DataGridViewCellStyleContentChangedEventArgs.cs
• TextBox.cs
• Span.cs
• EdmComplexTypeAttribute.cs
• StyleSelector.cs
• GifBitmapDecoder.cs
• _ChunkParse.cs
• HtmlElementCollection.cs
• ToolStripItemRenderEventArgs.cs
• SqlStatistics.cs
• OdbcConnectionStringbuilder.cs
• TableCell.cs
• InvalidCommandTreeException.cs
• WebPartDisplayMode.cs
• regiisutil.cs
• ProjectionPlanCompiler.cs
• CursorConverter.cs
• ErrorHandlerModule.cs
• DetailsViewCommandEventArgs.cs
• DashStyles.cs
• CharEntityEncoderFallback.cs
• PingOptions.cs
• ValidationPropertyAttribute.cs
• controlskin.cs
• QualifiedCellIdBoolean.cs
• basevalidator.cs
• DelegatedStream.cs
• HtmlMeta.cs
• PathBox.cs
• VisualStyleRenderer.cs
• XsltException.cs
• DataRowExtensions.cs
• ToolStripGripRenderEventArgs.cs
• XmlAttributes.cs
• TokenizerHelper.cs
• XmlQueryTypeFactory.cs
• SqlConnectionHelper.cs
• ProviderCollection.cs
• ObjectDataSourceFilteringEventArgs.cs
• EventLogStatus.cs
• DrawingCollection.cs
• ResolvedKeyFrameEntry.cs
• EditorZoneAutoFormat.cs
• ProxyWebPartConnectionCollection.cs
• serverconfig.cs
• ComPlusServiceLoader.cs
• VersionPair.cs
• DataGridViewControlCollection.cs
• DurableErrorHandler.cs
• MaskedTextProvider.cs
• FontCacheLogic.cs
• DBConcurrencyException.cs
• CharEnumerator.cs
• HashCodeCombiner.cs
• MeasurementDCInfo.cs
• FlowNode.cs
• ScrollChangedEventArgs.cs
• ImageIndexConverter.cs
• UnconditionalPolicy.cs
• MetadataItem_Static.cs
• TaiwanLunisolarCalendar.cs
• SocketStream.cs
• ListViewUpdatedEventArgs.cs
• HandlerMappingMemo.cs
• XmlLanguage.cs
• XmlSerializerAssemblyAttribute.cs
• InternalBufferOverflowException.cs
• PropertyPathWorker.cs
• WindowsListView.cs
• TdsRecordBufferSetter.cs
• AutomationPeer.cs