-
Notifications
You must be signed in to change notification settings - Fork 4.8k
/
ChallengeBasedAuthenticationPolicy.cs
205 lines (174 loc) · 8.87 KB
/
ChallengeBasedAuthenticationPolicy.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.
using Azure.Core;
using Azure.Core.Pipeline;
using System;
using System.Collections.Concurrent;
using System.Globalization;
using System.Threading.Tasks;
namespace Azure.Security.KeyVault
{
internal class ChallengeBasedAuthenticationPolicy : BearerTokenAuthenticationPolicy
{
private const string KeyVaultStashedContentKey = "KeyVaultContent";
private readonly bool _verifyChallengeResource;
/// <summary>
/// Challenges are cached using the Key Vault or Managed HSM endpoint URI authority as the key.
/// </summary>
private static readonly ConcurrentDictionary<string, ChallengeParameters> s_challengeCache = new();
private ChallengeParameters _challenge;
public ChallengeBasedAuthenticationPolicy(TokenCredential credential, bool disableChallengeResourceVerification) : base(credential, Array.Empty<string>())
{
_verifyChallengeResource = !disableChallengeResourceVerification;
}
/// <inheritdoc cref="BearerTokenAuthenticationPolicy.AuthorizeRequestAsync(Azure.Core.HttpMessage)" />
protected override ValueTask AuthorizeRequestAsync(HttpMessage message)
=> AuthorizeRequestInternal(message, true);
/// <inheritdoc cref="BearerTokenAuthenticationPolicy.AuthorizeRequest(Azure.Core.HttpMessage)" />
protected override void AuthorizeRequest(HttpMessage message)
=> AuthorizeRequestInternal(message, false).EnsureCompleted();
private async ValueTask AuthorizeRequestInternal(HttpMessage message, bool async)
{
if (message.Request.Uri.Scheme != Uri.UriSchemeHttps)
{
throw new InvalidOperationException("Bearer token authentication is not permitted for non TLS protected (https) endpoints.");
}
// If this policy doesn't have challenge parameters cached try to get it from the static challenge cache.
if (_challenge == null)
{
string authority = GetRequestAuthority(message.Request);
s_challengeCache.TryGetValue(authority, out _challenge);
}
if (_challenge != null)
{
// We fetched the challenge from the cache, but we have not initialized the Scopes in the base yet.
var context = new TokenRequestContext(_challenge.Scopes, parentRequestId: message.Request.ClientRequestId, tenantId: _challenge.TenantId);
if (async)
{
await AuthenticateAndAuthorizeRequestAsync(message, context).ConfigureAwait(false);
}
else
{
AuthenticateAndAuthorizeRequest(message, context);
}
return;
}
// The body is removed from the initial request because Key Vault supports other authentication schemes which also protect the body of the request.
// As a result, before we know the auth scheme we need to avoid sending an unprotected body to Key Vault.
// We don't currently support this enhanced auth scheme in the SDK but we still don't want to send any unprotected data to vaults which require it.
// Do not overwrite previous contents if retrying after initial request failed (e.g. timeout).
if (!message.TryGetProperty(KeyVaultStashedContentKey, out _))
{
message.SetProperty(KeyVaultStashedContentKey, message.Request.Content);
message.Request.Content = null;
}
}
/// <inheritdoc cref="BearerTokenAuthenticationPolicy.AuthorizeRequestOnChallengeAsync" />
protected override ValueTask<bool> AuthorizeRequestOnChallengeAsync(HttpMessage message)
=> AuthorizeRequestOnChallengeAsyncInternal(message, true);
/// <inheritdoc cref="BearerTokenAuthenticationPolicy.AuthorizeRequestOnChallenge" />
protected override bool AuthorizeRequestOnChallenge(HttpMessage message)
=> AuthorizeRequestOnChallengeAsyncInternal(message, false).EnsureCompleted();
private async ValueTask<bool> AuthorizeRequestOnChallengeAsyncInternal(HttpMessage message, bool async)
{
if (message.Request.Content == null && message.TryGetProperty(KeyVaultStashedContentKey, out var content))
{
message.Request.Content = content as RequestContent;
}
string authority = GetRequestAuthority(message.Request);
string scope = AuthorizationChallengeParser.GetChallengeParameterFromResponse(message.Response, "Bearer", "resource");
if (scope != null)
{
scope += "/.default";
}
else
{
scope = AuthorizationChallengeParser.GetChallengeParameterFromResponse(message.Response, "Bearer", "scope");
}
if (scope is null)
{
if (s_challengeCache.TryGetValue(authority, out _challenge))
{
return false;
}
}
else
{
// Verify the scope domain with leading "." matches the requested host domain.
if (_verifyChallengeResource)
{
if (!Uri.TryCreate(scope, UriKind.Absolute, out Uri scopeUri))
{
throw new InvalidOperationException($"The challenge contains invalid scope '{scope}'.");
}
if (!message.Request.Uri.Host.EndsWith($".{scopeUri.Host}", StringComparison.OrdinalIgnoreCase))
{
throw new InvalidOperationException($"The challenge resource '{scopeUri.Host}' does not match the requested domain. Set DisableChallengeResourceVerification to true in your client options to disable. See https://aka.ms/azsdk/blog/vault-uri for more information.");
}
}
string authorization = AuthorizationChallengeParser.GetChallengeParameterFromResponse(message.Response, "Bearer", "authorization");
if (authorization is null)
{
authorization = AuthorizationChallengeParser.GetChallengeParameterFromResponse(message.Response, "Bearer", "authorization_uri");
}
if (!Uri.TryCreate(authorization, UriKind.Absolute, out Uri authorizationUri))
{
throw new UriFormatException($"The challenge authorization URI '{authorization}' is invalid.");
}
_challenge = new ChallengeParameters(authorizationUri, new string[] { scope });
s_challengeCache[authority] = _challenge;
}
var context = new TokenRequestContext(_challenge.Scopes, parentRequestId: message.Request.ClientRequestId, tenantId: _challenge.TenantId);
if (async)
{
await AuthenticateAndAuthorizeRequestAsync(message, context).ConfigureAwait(false);
}
else
{
AuthenticateAndAuthorizeRequest(message, context);
}
return true;
}
internal class ChallengeParameters
{
internal ChallengeParameters(Uri authorizationUri, string[] scopes)
{
AuthorizationUri = authorizationUri;
TenantId = authorizationUri.Segments[1].Trim('/');
Scopes = scopes;
}
/// <summary>
/// Gets the "authorization" or "authorization_uri" parameter from the challenge response.
/// </summary>
public Uri AuthorizationUri { get; }
/// <summary>
/// Gets the "resource" or "scope" parameter from the challenge response. This should end with "/.default".
/// </summary>
public string[] Scopes { get; }
/// <summary>
/// Gets the tenant ID from <see cref="AuthorizationUri"/>.
/// </summary>
public string TenantId { get; }
}
internal static void ClearCache()
{
s_challengeCache.Clear();
}
/// <summary>
/// Gets the host name and port of the Key Vault or Managed HSM endpoint.
/// </summary>
/// <param name="request"></param>
/// <returns></returns>
private static string GetRequestAuthority(Request request)
{
Uri uri = request.Uri.ToUri();
string authority = uri.Authority;
if (!authority.Contains(":") && uri.Port > 0)
{
// Append port for complete authority.
authority = uri.Authority + ":" + uri.Port.ToString(CultureInfo.InvariantCulture);
}
return authority;
}
}
}