1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
|
//-----------------------------------------------------------------------
// <copyright file="TokenHandlingBindingElement.cs" company="Outercurve Foundation">
// Copyright (c) Outercurve Foundation. All rights reserved.
// </copyright>
//-----------------------------------------------------------------------
namespace DotNetOpenAuth.OAuth.ChannelElements {
using System;
using System.Collections.Generic;
using System.Diagnostics.CodeAnalysis;
using System.Linq;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using DotNetOpenAuth.Configuration;
using DotNetOpenAuth.Messaging;
using DotNetOpenAuth.OAuth.Messages;
using Validation;
/// <summary>
/// A binding element for Service Providers to manage the
/// callbacks and verification codes on applicable messages.
/// </summary>
internal class TokenHandlingBindingElement : IChannelBindingElement {
/// <summary>
/// The token manager offered by the service provider.
/// </summary>
private IServiceProviderTokenManager tokenManager;
/// <summary>
/// The security settings for this service provider.
/// </summary>
private ServiceProviderSecuritySettings securitySettings;
/// <summary>
/// Initializes a new instance of the <see cref="TokenHandlingBindingElement"/> class.
/// </summary>
/// <param name="tokenManager">The token manager.</param>
/// <param name="securitySettings">The security settings.</param>
[SuppressMessage("Microsoft.Globalization", "CA1303:Do not pass literals as localized parameters", MessageId = "System.Diagnostics.Contracts.__ContractsRuntime.Requires<System.ArgumentNullException>(System.Boolean,System.String,System.String)", Justification = "Code contract"), SuppressMessage("Microsoft.Naming", "CA2204:Literals should be spelled correctly", MessageId = "securitySettings", Justification = "Code contracts")]
internal TokenHandlingBindingElement(IServiceProviderTokenManager tokenManager, ServiceProviderSecuritySettings securitySettings) {
Requires.NotNull(tokenManager, "tokenManager");
Requires.NotNull(securitySettings, "securitySettings");
this.tokenManager = tokenManager;
this.securitySettings = securitySettings;
}
#region IChannelBindingElement Members
/// <summary>
/// Gets or sets the channel that this binding element belongs to.
/// </summary>
/// <remarks>
/// This property is set by the channel when it is first constructed.
/// </remarks>
public Channel Channel { get; set; }
/// <summary>
/// Gets the protection commonly offered (if any) by this binding element.
/// </summary>
/// <remarks>
/// This value is used to assist in sorting binding elements in the channel stack.
/// </remarks>
public MessageProtections Protection {
get { return MessageProtections.None; }
}
/// <summary>
/// Prepares a message for sending based on the rules of this channel binding element.
/// </summary>
/// <param name="message">The message to prepare for sending.</param>
/// <returns>
/// The protections (if any) that this binding element applied to the message.
/// Null if this binding element did not even apply to this binding element.
/// </returns>
/// <remarks>
/// Implementations that provide message protection must honor the
/// <see cref="MessagePartAttribute.RequiredProtection"/> properties where applicable.
/// </remarks>
public async Task<MessageProtections?> ProcessOutgoingMessageAsync(IProtocolMessage message, CancellationToken cancellationToken) {
var userAuthResponse = message as UserAuthorizationResponse;
if (userAuthResponse != null && userAuthResponse.Version >= Protocol.V10a.Version) {
var requestToken = this.tokenManager.GetRequestToken(userAuthResponse.RequestToken);
requestToken.VerificationCode = userAuthResponse.VerificationCode;
this.tokenManager.UpdateToken(requestToken);
return MessageProtections.None;
}
// Hook to store the token and secret on its way down to the Consumer.
var grantRequestTokenResponse = message as UnauthorizedTokenResponse;
if (grantRequestTokenResponse != null) {
this.tokenManager.StoreNewRequestToken(grantRequestTokenResponse.RequestMessage, grantRequestTokenResponse);
// The host may have already set these properties, but just to make sure...
var requestToken = this.tokenManager.GetRequestToken(grantRequestTokenResponse.RequestToken);
requestToken.ConsumerVersion = grantRequestTokenResponse.Version;
if (grantRequestTokenResponse.RequestMessage.Callback != null) {
requestToken.Callback = grantRequestTokenResponse.RequestMessage.Callback;
}
this.tokenManager.UpdateToken(requestToken);
return MessageProtections.None;
}
return null;
}
/// <summary>
/// Performs any transformation on an incoming message that may be necessary and/or
/// validates an incoming message based on the rules of this channel binding element.
/// </summary>
/// <param name="message">The incoming message to process.</param>
/// <returns>
/// The protections (if any) that this binding element applied to the message.
/// Null if this binding element did not even apply to this binding element.
/// </returns>
/// <exception cref="ProtocolException">
/// Thrown when the binding element rules indicate that this message is invalid and should
/// NOT be processed.
/// </exception>
/// <remarks>
/// Implementations that provide message protection must honor the
/// <see cref="MessagePartAttribute.RequiredProtection"/> properties where applicable.
/// </remarks>
public async Task<MessageProtections?> ProcessIncomingMessageAsync(IProtocolMessage message, CancellationToken cancellationToken) {
var authorizedTokenRequest = message as AuthorizedTokenRequest;
if (authorizedTokenRequest != null) {
if (authorizedTokenRequest.Version >= Protocol.V10a.Version) {
string expectedVerifier = this.tokenManager.GetRequestToken(authorizedTokenRequest.RequestToken).VerificationCode;
ErrorUtilities.VerifyProtocol(string.Equals(authorizedTokenRequest.VerificationCode, expectedVerifier, StringComparison.Ordinal), OAuthStrings.IncorrectVerifier);
return MessageProtections.None;
}
this.VerifyThrowTokenTimeToLive(authorizedTokenRequest);
}
var userAuthorizationRequest = message as UserAuthorizationRequest;
if (userAuthorizationRequest != null) {
this.VerifyThrowTokenTimeToLive(userAuthorizationRequest);
}
var accessResourceRequest = message as AccessProtectedResourceRequest;
if (accessResourceRequest != null) {
this.VerifyThrowTokenNotExpired(accessResourceRequest);
}
return null;
}
#endregion
/// <summary>
/// Ensures that access tokens have not yet expired.
/// </summary>
/// <param name="message">The incoming message carrying the access token.</param>
private void VerifyThrowTokenNotExpired(AccessProtectedResourceRequest message) {
Requires.NotNull(message, "message");
try {
IServiceProviderAccessToken token = this.tokenManager.GetAccessToken(message.AccessToken);
if (token.ExpirationDate.HasValue && DateTime.Now >= token.ExpirationDate.Value.ToLocalTimeSafe()) {
Logger.OAuth.ErrorFormat(
"OAuth access token {0} rejected because it expired at {1}, and it is now {2}.",
token.Token,
token.ExpirationDate.Value,
DateTime.Now);
ErrorUtilities.ThrowProtocol(OAuthStrings.TokenNotFound);
}
} catch (KeyNotFoundException ex) {
throw ErrorUtilities.Wrap(ex, OAuthStrings.TokenNotFound);
}
}
/// <summary>
/// Ensures that short-lived request tokens included in incoming messages have not expired.
/// </summary>
/// <param name="message">The incoming message.</param>
/// <exception cref="ProtocolException">Thrown when the token in the message has expired.</exception>
private void VerifyThrowTokenTimeToLive(ITokenContainingMessage message) {
ErrorUtilities.VerifyInternal(!(message is AccessProtectedResourceRequest), "We shouldn't be verifying TTL on access tokens.");
if (message == null || string.IsNullOrEmpty(message.Token)) {
return;
}
try {
IServiceProviderRequestToken token = this.tokenManager.GetRequestToken(message.Token);
TimeSpan ttl = this.securitySettings.MaximumRequestTokenTimeToLive;
if (DateTime.Now >= token.CreatedOn.ToLocalTimeSafe() + ttl) {
Logger.OAuth.ErrorFormat(
"OAuth request token {0} rejected because it was originally issued at {1}, expired at {2}, and it is now {3}.",
token.Token,
token.CreatedOn,
token.CreatedOn + ttl,
DateTime.Now);
ErrorUtilities.ThrowProtocol(OAuthStrings.TokenNotFound);
}
} catch (KeyNotFoundException ex) {
throw ErrorUtilities.Wrap(ex, OAuthStrings.TokenNotFound);
}
}
}
}
|
