| | | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | | 2 | | // Licensed under the MIT License. See License.txt in the project root for |
| | | 3 | | // license information. |
| | | 4 | | |
| | | 5 | | using System; |
| | | 6 | | using System.Linq; |
| | | 7 | | using System.Net; |
| | | 8 | | using System.Net.Http; |
| | | 9 | | using System.Net.Http.Headers; |
| | | 10 | | using System.Threading; |
| | | 11 | | using System.Threading.Tasks; |
| | | 12 | | using Microsoft.Rest; |
| | | 13 | | |
| | | 14 | | namespace Microsoft.Azure.KeyVault |
| | | 15 | | { |
| | | 16 | | /// <summary> |
| | | 17 | | /// The Key Vault credential class that implements <see cref="ServiceClientCredentials"/> |
| | | 18 | | /// </summary> |
| | | 19 | | public class KeyVaultCredential : ServiceClientCredentials |
| | | 20 | | { |
| | | 21 | | private KeyVaultClient _client = null; |
| | | 22 | | |
| | | 23 | | /// <summary> |
| | | 24 | | /// The authentication callback |
| | | 25 | | /// </summary> |
| | | 26 | | public event KeyVaultClient.AuthenticationCallback OnAuthenticate = null; |
| | | 27 | | |
| | | 28 | | /// <summary> |
| | | 29 | | /// Bearer token |
| | | 30 | | /// </summary> |
| | 0 | 31 | | public string Token { get; set; } |
| | | 32 | | |
| | | 33 | | /// <summary> |
| | | 34 | | /// Constructor. |
| | | 35 | | /// </summary> |
| | | 36 | | /// <param name="authenticationCallback"> the authentication callback. </param> |
| | 122 | 37 | | public KeyVaultCredential(KeyVaultClient.AuthenticationCallback authenticationCallback) |
| | | 38 | | { |
| | 122 | 39 | | OnAuthenticate = authenticationCallback; |
| | 122 | 40 | | } |
| | | 41 | | |
| | | 42 | | /// <summary> |
| | | 43 | | /// Clones the current KeyVaultCredential object. |
| | | 44 | | /// </summary> |
| | | 45 | | /// <returns>A new KeyVaultCredential instance using the same authentication callback as the current instance.</ |
| | | 46 | | internal KeyVaultCredential Clone() |
| | | 47 | | { |
| | 2 | 48 | | return new KeyVaultCredential(OnAuthenticate); |
| | | 49 | | } |
| | | 50 | | |
| | | 51 | | private async Task<string> PreAuthenticate(Uri url) |
| | | 52 | | { |
| | 2 | 53 | | if (OnAuthenticate != null) |
| | | 54 | | { |
| | 2 | 55 | | var challenge = HttpBearerChallengeCache.GetInstance().GetChallengeForURL(url); |
| | | 56 | | |
| | 2 | 57 | | if (challenge != null) |
| | | 58 | | { |
| | 0 | 59 | | return await OnAuthenticate(challenge.AuthorizationServer, challenge.Resource, challenge.Scope).Conf |
| | | 60 | | } |
| | | 61 | | } |
| | | 62 | | |
| | 2 | 63 | | return null; |
| | 2 | 64 | | } |
| | | 65 | | |
| | | 66 | | protected async Task<string> PostAuthenticate(HttpResponseMessage response) |
| | | 67 | | { |
| | | 68 | | // An HTTP 401 Not Authorized error; handle if an authentication callback has been supplied |
| | 0 | 69 | | if (OnAuthenticate != null) |
| | | 70 | | { |
| | | 71 | | // Extract the WWW-Authenticate header and determine if it represents an OAuth2 Bearer challenge |
| | 0 | 72 | | var authenticateHeader = response.Headers.WwwAuthenticate.ElementAt(0).ToString(); |
| | | 73 | | |
| | 0 | 74 | | if (HttpBearerChallenge.IsBearerChallenge(authenticateHeader)) |
| | | 75 | | { |
| | 0 | 76 | | var challenge = new HttpBearerChallenge(response.RequestMessage.RequestUri, authenticateHeader); |
| | | 77 | | |
| | 0 | 78 | | if (challenge != null) |
| | | 79 | | { |
| | | 80 | | // Update challenge cache |
| | 0 | 81 | | HttpBearerChallengeCache.GetInstance().SetChallengeForURL(response.RequestMessage.RequestUri, ch |
| | | 82 | | |
| | | 83 | | // We have an authentication challenge, use it to get a new authorization token |
| | 0 | 84 | | return await OnAuthenticate(challenge.AuthorizationServer, challenge.Resource, challenge.Scope). |
| | | 85 | | } |
| | | 86 | | } |
| | | 87 | | } |
| | | 88 | | |
| | 0 | 89 | | return null; |
| | 0 | 90 | | } |
| | | 91 | | |
| | | 92 | | public override void InitializeServiceClient<T>(ServiceClient<T> client) |
| | | 93 | | { |
| | 120 | 94 | | base.InitializeServiceClient(client); |
| | | 95 | | |
| | 120 | 96 | | var kvClient = client as KeyVaultClient; |
| | | 97 | | |
| | 120 | 98 | | if (kvClient == null) |
| | | 99 | | { |
| | 0 | 100 | | throw new ArgumentException("KeyVaultCredential credentials are only for use with the KeyVaultClient ser |
| | | 101 | | } |
| | | 102 | | |
| | 120 | 103 | | _client = kvClient; |
| | 120 | 104 | | } |
| | | 105 | | |
| | | 106 | | public override async Task ProcessHttpRequestAsync(HttpRequestMessage request, CancellationToken cancellationTok |
| | | 107 | | { |
| | 2 | 108 | | if (request == null) |
| | | 109 | | { |
| | 0 | 110 | | throw new ArgumentNullException("request"); |
| | | 111 | | } |
| | | 112 | | |
| | 2 | 113 | | var accessToken = await PreAuthenticate(request.RequestUri).ConfigureAwait(false); |
| | 2 | 114 | | if (!string.IsNullOrEmpty(accessToken)) |
| | 0 | 115 | | request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken); |
| | | 116 | | else |
| | | 117 | | { |
| | | 118 | | HttpResponseMessage response; |
| | | 119 | | |
| | | 120 | | // if this credential is tied to a specific KeyVaultClient reuse it's HttpClient to send the |
| | | 121 | | // initial unauthed request to get the challange, otherwise create a new HttpClient |
| | 2 | 122 | | HttpClient client = _client?.HttpClient ?? new HttpClient(); |
| | | 123 | | |
| | 2 | 124 | | using (var r = new HttpRequestMessage(request.Method, request.RequestUri)) |
| | | 125 | | { |
| | 2 | 126 | | response = await client.SendAsync(r).ConfigureAwait(false); |
| | 2 | 127 | | } |
| | | 128 | | |
| | 2 | 129 | | if (response.StatusCode == HttpStatusCode.Unauthorized) |
| | | 130 | | { |
| | 0 | 131 | | accessToken = await PostAuthenticate(response).ConfigureAwait(false); |
| | | 132 | | |
| | 0 | 133 | | if (!string.IsNullOrEmpty(accessToken)) |
| | | 134 | | { |
| | 0 | 135 | | request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken); |
| | | 136 | | } |
| | | 137 | | } |
| | | 138 | | } |
| | 2 | 139 | | } |
| | | 140 | | } |
| | | 141 | | } |