Skip to content

Implement NegotiateAuthentication API #70720

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wfurt merged 28 commits into from
Jun 21, 2022
+1,294 −1,020
Merged

Implement NegotiateAuthentication API #70720

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
4ac2501
WIP: Add implementation of NegotiateAuthentication
filipnavara Jun 3, 2022
c7a6bce
WIP: Update error code mapping
filipnavara Jun 4, 2022
5d5c61f
Spanify input of GetOutgoingBlob
filipnavara Jun 4, 2022
d0d1bba
Update comments
filipnavara Jun 4, 2022
982e7c3
Move NegotiateStreamPal.Encrypt/Decrypt to shared sources. Unix imple…
filipnavara Jun 4, 2022
cbd24a2
Revert accidental change
filipnavara Jun 4, 2022
9d4d557
Build fixes.
filipnavara Jun 4, 2022
c371515
Fix error handling condition
filipnavara Jun 4, 2022
3306c67
Update error mapping based on HttpListener usage.
filipnavara Jun 4, 2022
065d87c
WIP: HttpListener test
filipnavara Jun 7, 2022
447020a
Move workaround from HttpListener to low-level SSPI code
filipnavara Jun 7, 2022
bed08fa
Fix build
filipnavara Jun 14, 2022
318ca06
Clean up
filipnavara Jun 14, 2022
5474811
Revert "WIP: HttpListener test"
filipnavara Jun 14, 2022
4cdb8af
Convert System.Net.Http.FunctionalTests to use NegotiateAuthenticatio…
filipnavara Jun 14, 2022
34e47c4
Dispose the identity along NegotiateAuthentication
filipnavara Jun 14, 2022
73ac446
Modify unit tests to use the new API
filipnavara Jun 14, 2022
7e85f10
Add exceptions for invalid inputs/states
filipnavara Jun 14, 2022
7c870bd
Remove tvOS unsupported marker, managed NTLM is used on tvOS
filipnavara Jun 16, 2022
1bd0cde
Apply suggestions from code review
filipnavara Jun 14, 2022
e93f073
Fix typo
filipnavara Jun 14, 2022
5aae44d
Remove reference equality checks from IsNTLM/IsKerberos
filipnavara Jun 16, 2022
b746590
Remove NTAuthentication.AssociatedName to make it more obvious which …
filipnavara Jun 16, 2022
dd7dd9a
Add comment
filipnavara Jun 16, 2022
39a43b2
Add more tests, handle unsupported protocols
filipnavara Jun 16, 2022
9a4ccdf
Handle NotSupportedException from NTAuthentication constructor
filipnavara Jun 16, 2022
e86ce79
Add workaround for linker issue
filipnavara Jun 17, 2022
ffed0be
Apply suggestions from code review
filipnavara Jun 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Convert System.Net.Http.FunctionalTests to use NegotiateAuthenticatio… 
…n instead of NTAuthentication
  • Loading branch information
@filipnavara
filipnavara authored Jun 16, 2022
commit 4cdb8af803a0b2eeef0faf0f79f4615834ed57f8
21 changes: 9 additions & 12 deletions src/libraries/System.Net.Http/tests/FunctionalTests/NtAuthTests.Windows.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ internal static Task HandleNegotiateAuthenticationRequest(LoopbackServer.Connect
internal static async Task HandleAuthenticationRequest(LoopbackServer.Connection connection, bool useNtlm, bool useNegotiate, bool closeConnection)
{
HttpRequestData request = await connection.ReadRequestDataAsync();
NTAuthentication authContext = null;
NegotiateAuthentication authContext = null;
string authHeader = null;

foreach (HttpHeaderData header in request.Headers)
Expand Down Expand Up @@ -64,7 +64,7 @@ internal static async Task HandleAuthenticationRequest(LoopbackServer.Connection
request = await connection.ReadRequestDataAsync();
}

SecurityStatusPal statusCode;
NegotiateAuthenticationStatusCode statusCode;
do
{
foreach (HttpHeaderData header in request.Headers)
Expand All @@ -81,11 +81,11 @@ internal static async Task HandleAuthenticationRequest(LoopbackServer.Connection
// Should be type and base64 encoded blob
Assert.Equal(2, tokens.Length);

authContext ??= new NTAuthentication(isServer: true, tokens[0], CredentialCache.DefaultNetworkCredentials, null, ContextFlagsPal.Connection, null);
authContext ??= new NegotiateAuthentication(new NegotiateAuthenticationServerOptions { Package = tokens[0] });

byte[]? outBlob = authContext.GetOutgoingBlob(Convert.FromBase64String(tokens[1]), throwOnError: false, out statusCode);
byte[]? outBlob = authContext.GetOutgoingBlob(Convert.FromBase64String(tokens[1]), out statusCode);

if (outBlob != null && statusCode.ErrorCode == SecurityStatusPalErrorCode.ContinueNeeded)
if (outBlob != null && statusCode == NegotiateAuthenticationStatusCode.ContinueNeeded)
{
authHeader = $"WWW-Authenticate: {tokens[0]} {Convert.ToBase64String(outBlob)}\r\n";
await connection.SendResponseAsync(HttpStatusCode.Unauthorized, authHeader);
Expand All @@ -94,15 +94,12 @@ internal static async Task HandleAuthenticationRequest(LoopbackServer.Connection
request = await connection.ReadRequestDataAsync();
}
}
while (statusCode.ErrorCode == SecurityStatusPalErrorCode.ContinueNeeded);
while (statusCode == NegotiateAuthenticationStatusCode.ContinueNeeded);

if (statusCode.ErrorCode == SecurityStatusPalErrorCode.OK)
if (statusCode == NegotiateAuthenticationStatusCode.Completed)
{
// If authentication succeeded ask Windows about the identity and send it back as custom header.
SecurityContextTokenHandle? userContext = null;
using SafeDeleteContext securityContext = authContext.GetContext(out SecurityStatusPal statusCodeNew)!;
SSPIWrapper.QuerySecurityContextToken(GlobalSSPI.SSPIAuth, securityContext, out userContext);
using WindowsIdentity identity = new WindowsIdentity(userContext.DangerousGetHandle(), authContext.ProtocolName);
IIdentity identity = authContext.RemoteIdentity;

authHeader = $"{UserHeaderName}: {identity.Name}\r\n";
if (closeConnection)
Expand All @@ -111,7 +108,7 @@ internal static async Task HandleAuthenticationRequest(LoopbackServer.Connection
}

await connection.SendResponseAsync(HttpStatusCode.OK, authHeader, "foo");
userContext.Dispose();
authContext.Dispose();
}
else
{
Expand Down
102 changes: 0 additions & 102 deletions src/libraries/System.Net.Http/tests/FunctionalTests/System.Net.Http.Functional.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,108 +225,6 @@
</ItemGroup>
<!-- Windows specific files -->
<ItemGroup Condition=" '$(TargetPlatformIdentifier)' == 'windows'">
<Compile Include="$(CommonPath)Interop\Windows\Interop.Libraries.cs"
Link="Common\Interop\Windows\Interop.Libraries.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Interop.UNICODE_STRING.cs"
Link="Common\Interop\Windows\Interop.UNICODE_STRING.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Interop.BOOL.cs"
Link="Common\Interop\Windows\Interop.BOOL.cs" />
<Compile Include="$(CommonPath)System\Net\DebugSafeHandle.cs"
Link="Common\System\Net\DebugSafeHandle.cs" />
<Compile Include="$(CommonPath)System\Net\InternalException.cs"
Link="Common\System\Net\InternalException.cs" />
<Compile Include="$(CommonPath)System\Net\ExceptionCheck.cs"
Link="Common\System\Net\ExceptionCheck.cs" />
<!-- Add NTAuthentication -->
<Compile Include="$(CommonPath)System\Net\DebugSafeHandleZeroOrMinusOneIsInvalid.cs"
Link="Common\System\Net\DebugSafeHandleZeroOrMinusOneIsInvalid.cs" />
<Compile Include="$(CommonPath)System\Collections\Generic\BidirectionalDictionary.cs"
Link="Common\System\Collections\Generic\BidirectionalDictionary.cs" />
<Compile Include="$(CommonPath)System\NotImplemented.cs"
Link="Common\System\NotImplemented.cs" />
<Compile Include="$(CommonPath)System\Net\ContextFlagsPal.cs"
Link="Common\System\Net\ContextFlagsPal.cs" />
<Compile Include="$(CommonPath)System\Net\NegotiationInfoClass.cs"
Link="Common\System\Net\NegotiationInfoClass.cs" />
<Compile Include="$(CommonPath)System\Net\NTAuthentication.Common.cs"
Link="Common\System\Net\NTAuthentication.Common.cs" />
<Compile Include="$(CommonPath)System\Net\SecurityStatusPal.cs"
Link="Common\System\Net\SecurityStatusPal.cs" />
<Compile Include="$(CommonPath)System\Net\Security\SecurityBuffer.Windows.cs"
Link="Common\System\Net\Security\SecurityBuffer.Windows.cs" />
<Compile Include="$(CommonPath)System\Net\Security\SecurityBufferType.Windows.cs"
Link="Common\System\Net\Security\SecurityBufferType.Windows.cs" />
<Compile Include="$(CommonPath)System\Net\Security\SafeCredentialReference.cs"
Link="Common\System\Net\Security\SafeCredentialReference.cs" />
<Compile Include="$(CommonPath)System\Net\Security\SSPIHandleCache.cs"
Link="Common\System\Net\Security\SSPIHandleCache.cs" />
<Compile Include="$(CommonPath)System\Net\Security\NetEventSource.Security.cs"
Link="Common\System\Net\Security\NetEventSource.Security.cs" />
<!-- Windows specific NTAuthentication -->
<Compile Include="$(CommonPath)System\Net\Security\SecurityContextTokenHandle.cs"
Link="Common\System\Net\Security\SecurityContextTokenHandle.cs" />
<Compile Include="$(CommonPath)System\Net\SecurityStatusAdapterPal.Windows.cs"
Link="Common\System\Net\SecurityStatusAdapterPal.Windows.cs" />
<Compile Include="$(CommonPath)System\Net\ContextFlagsAdapterPal.Windows.cs"
Link="Common\System\Net\ContextFlagsAdapterPal.Windows.cs" />
<Compile Include="$(CommonPath)System\Net\Security\NegotiateStreamPal.Windows.cs"
Link="Common\System\Net\Security\NegotiateStreamPal.Windows.cs" />
<Compile Include="$(CommonPath)System\Net\Security\NetEventSource.Security.Windows.cs"
Link="Common\System\Net\Security\NetEventSource.Security.Windows.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CERT_CONTEXT.cs"
Link="Common\Interop\Windows\Crypt32\Interop.CERT_CONTEXT.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CertFreeCertificateContext.cs"
Link="Common\Interop\Windows\Crypt32\Interop.Interop.CertFreeCertificateContext.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CERT_INFO.cs"
Link="Common\Interop\Windows\Crypt32\Interop.CERT_INFO.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CERT_PUBLIC_KEY_INFO.cs"
Link="Common\Interop\Windows\Crypt32\Interop.CERT_PUBLIC_KEY_INFO.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CRYPT_ALGORITHM_IDENTIFIER.cs"
Link="Common\Interop\Windows\Crypt32\Interop.Interop.CRYPT_ALGORITHM_IDENTIFIER.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CRYPT_BIT_BLOB.cs"
Link="Common\Interop\Windows\Crypt32\Interop.Interop.CRYPT_BIT_BLOB.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.DATA_BLOB.cs"
Link="Common\Interop\Windows\Crypt32\Interop.DATA_BLOB.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.MsgEncodingType.cs"
Link="Common\Interop\Windows\Crypt32\Interop.Interop.MsgEncodingType.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SecPkgContext_Bindings.cs"
Link="Common\Interop\Windows\SspiCli\SecPkgContext_Bindings.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SChannel\Interop.SECURITY_STATUS.cs"
Link="Common\Interop\Windows\SChannel\Interop.SECURITY_STATUS.cs" />
<Compile Include="$(CommonPath)Interop\Windows\Kernel32\Interop.CloseHandle.cs"
Link="Common\Interop\Windows\Kernel32\Interop.CloseHandle.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SecPkgContext_StreamSizes.cs"
Link="Common\Interop\Windows\SspiCli\SecPkgContext_StreamSizes.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SecPkgContext_NegotiationInfoW.cs"
Link="Common\Interop\Windows\SspiCli\SecPkgContext_NegotiationInfoW.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\NegotiationInfoClass.cs"
Link="Common\Interop\Windows\SspiCli\NegotiationInfoClass.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SChannel\SecPkgContext_ConnectionInfo.cs"
Link="Common\Interop\Windows\SChannel\SecPkgContext_ConnectionInfo.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SChannel\SecPkgContext_CipherInfo.cs"
Link="Common\Interop\Windows\SChannel\SecPkgContext_CipherInfo.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SSPISecureChannelType.cs"
Link="Common\Interop\Windows\SspiCli\SSPISecureChannelType.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\ISSPIInterface.cs"
Link="Common\Interop\Windows\SspiCli\ISSPIInterface.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SSPIAuthType.cs"
Link="Common\Interop\Windows\SspiCli\SSPIAuthType.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SecurityPackageInfoClass.cs"
Link="Common\Interop\Windows\SspiCli\SecurityPackageInfoClass.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SecurityPackageInfo.cs"
Link="Common\Interop\Windows\SspiCli\SecurityPackageInfo.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SecPkgContext_Sizes.cs"
Link="Common\Interop\Windows\SspiCli\SecPkgContext_Sizes.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SafeDeleteContext.cs"
Link="Common\Interop\Windows\SspiCli\SafeDeleteContext.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\GlobalSSPI.cs"
Link="Common\Interop\Windows\SspiCli\GlobalSSPI.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\Interop.SSPI.cs"
Link="Common\Interop\Windows\SspiCli\Interop.SSPI.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SecuritySafeHandles.cs"
Link="Common\Interop\Windows\SspiCli\SecuritySafeHandles.cs" />
<Compile Include="$(CommonPath)Interop\Windows\SspiCli\SSPIWrapper.cs"
Link="Common\Interop\Windows\SspiCli\SSPIWrapper.cs" />
<Compile Include="NtAuthTests.Windows.cs" />
<Compile Include="ImpersonatedAuthTests.cs" />
</ItemGroup>
Expand Down