| | 1 | | // Copyright (c) Microsoft. All rights reserved. |
| | 2 | | // Licensed under the MIT license. See LICENSE file in the project root for full license information. |
| | 3 | |
|
| | 4 | | namespace Microsoft.Azure.ServiceBus.Management |
| | 5 | | { |
| | 6 | | using System; |
| | 7 | | using System.Collections.Generic; |
| | 8 | | using System.Linq; |
| | 9 | | using System.Security.Cryptography; |
| | 10 | | using System.Text; |
| | 11 | | using System.Web; |
| | 12 | | using System.Xml; |
| | 13 | | using System.Xml.Linq; |
| | 14 | | using Microsoft.Azure.ServiceBus.Primitives; |
| | 15 | |
|
| | 16 | | /// <summary> |
| | 17 | | /// Defines the authorization rule for an entity using SAS. |
| | 18 | | /// </summary> |
| | 19 | | public class SharedAccessAuthorizationRule : AuthorizationRule |
| | 20 | | { |
| | 21 | | const int SupportedSASKeyLength = 44; |
| | 22 | | const string FixedClaimType = "SharedAccessKey"; |
| | 23 | |
|
| | 24 | | private string internalKeyName; |
| | 25 | | private string internalPrimaryKey; |
| | 26 | | private string internalSecondaryKey; |
| | 27 | | private List<AccessRights> internalRights; |
| | 28 | |
|
| 0 | 29 | | internal SharedAccessAuthorizationRule() |
| | 30 | | { |
| 0 | 31 | | } |
| | 32 | |
|
| | 33 | | /// <summary>Initializes a new instance of the <see cref="SharedAccessAuthorizationRule" /> class.</summary> |
| | 34 | | /// <param name="keyName">The authorization rule key name.</param> |
| | 35 | | /// <param name="rights">The list of rights.</param> |
| | 36 | | public SharedAccessAuthorizationRule(string keyName, IEnumerable<AccessRights> rights) |
| 0 | 37 | | : this(keyName, SharedAccessAuthorizationRule.GenerateRandomKey(), SharedAccessAuthorizationRule.GenerateRan |
| | 38 | | { |
| 0 | 39 | | } |
| | 40 | |
|
| | 41 | | /// <summary>Initializes a new instance of the <see cref="SharedAccessAuthorizationRule" /> class.</summary> |
| | 42 | | /// <param name="keyName">The authorization rule key name.</param> |
| | 43 | | /// <param name="primaryKey">The primary key for the authorization rule.</param> |
| | 44 | | /// <param name="rights">The list of rights.</param> |
| | 45 | | public SharedAccessAuthorizationRule(string keyName, string primaryKey, IEnumerable<AccessRights> rights) |
| 0 | 46 | | : this(keyName, primaryKey, SharedAccessAuthorizationRule.GenerateRandomKey(), rights) |
| | 47 | | { |
| 0 | 48 | | } |
| | 49 | |
|
| | 50 | | /// <summary>Initializes a new instance of the <see cref="SharedAccessAuthorizationRule" /> class.</summary> |
| | 51 | | /// <param name="keyName">The authorization rule key name.</param> |
| | 52 | | /// <param name="primaryKey">The primary key for the authorization rule.</param> |
| | 53 | | /// <param name="secondaryKey">The secondary key for the authorization rule.</param> |
| | 54 | | /// <param name="rights">The list of rights.</param> |
| 0 | 55 | | public SharedAccessAuthorizationRule(string keyName, string primaryKey, string secondaryKey, IEnumerable<AccessR |
| | 56 | | { |
| 0 | 57 | | this.PrimaryKey = primaryKey; |
| 0 | 58 | | this.SecondaryKey = secondaryKey; |
| 0 | 59 | | this.Rights = new List<AccessRights>(rights); |
| 0 | 60 | | this.KeyName = keyName; |
| 0 | 61 | | } |
| | 62 | |
|
| 0 | 63 | | public override string ClaimType => FixedClaimType; |
| | 64 | |
|
| 0 | 65 | | internal override string ClaimValue => "None"; |
| | 66 | |
|
| | 67 | | /// <summary>Gets or sets the authorization rule key name.</summary> |
| | 68 | | /// <value>The authorization rule key name.</value> |
| | 69 | | public override sealed string KeyName |
| | 70 | | { |
| 0 | 71 | | get { return this.internalKeyName; } |
| | 72 | | set |
| | 73 | | { |
| 0 | 74 | | if (string.IsNullOrWhiteSpace(value)) |
| | 75 | | { |
| 0 | 76 | | throw new ArgumentNullException(nameof(KeyName)); |
| | 77 | | } |
| | 78 | |
|
| 0 | 79 | | if (value.Length > SharedAccessSignatureToken.MaxKeyNameLength) |
| | 80 | | { |
| 0 | 81 | | throw new ArgumentOutOfRangeException( |
| 0 | 82 | | nameof(KeyName), $"The argument cannot exceed {SharedAccessSignatureToken.MaxKeyNameLength} char |
| | 83 | | } |
| | 84 | |
|
| 0 | 85 | | if (!string.Equals(value, HttpUtility.UrlEncode(value))) |
| | 86 | | { |
| 0 | 87 | | throw new ArgumentException("The key name specified contains invalid characters"); |
| | 88 | | } |
| | 89 | |
|
| 0 | 90 | | this.internalKeyName = value; |
| 0 | 91 | | } |
| | 92 | | } |
| | 93 | |
|
| | 94 | | /// <summary>Gets or sets the primary key for the authorization rule.</summary> |
| | 95 | | /// <value>The primary key for the authorization rule.</value> |
| | 96 | | public string PrimaryKey |
| | 97 | | { |
| 0 | 98 | | get { return this.internalPrimaryKey; } |
| | 99 | | set |
| | 100 | | { |
| 0 | 101 | | if (string.IsNullOrWhiteSpace(value)) |
| | 102 | | { |
| 0 | 103 | | throw new ArgumentNullException(nameof(PrimaryKey)); |
| | 104 | | } |
| | 105 | |
|
| 0 | 106 | | if (Encoding.ASCII.GetByteCount(value) != SupportedSASKeyLength) |
| | 107 | | { |
| 0 | 108 | | throw new ArgumentOutOfRangeException(nameof(PrimaryKey), $"{nameof(SharedAccessAuthorizationRule)} |
| | 109 | | } |
| | 110 | |
|
| 0 | 111 | | if (!CheckBase64(value)) |
| | 112 | | { |
| 0 | 113 | | throw new ArgumentException(nameof(PrimaryKey), $"{nameof(SharedAccessAuthorizationRule)} only suppo |
| | 114 | | } |
| | 115 | |
|
| 0 | 116 | | this.internalPrimaryKey = value; |
| 0 | 117 | | } |
| | 118 | | } |
| | 119 | |
|
| | 120 | | /// <summary>Gets or sets the secondary key for the authorization rule.</summary> |
| | 121 | | /// <value>The secondary key for the authorization rule.</value> |
| | 122 | | public string SecondaryKey |
| | 123 | | { |
| 0 | 124 | | get { return this.internalSecondaryKey; } |
| | 125 | | set |
| | 126 | | { |
| 0 | 127 | | if (string.IsNullOrWhiteSpace(value)) |
| | 128 | | { |
| 0 | 129 | | throw new ArgumentNullException(nameof(SecondaryKey)); |
| | 130 | | } |
| | 131 | |
|
| 0 | 132 | | if (Encoding.ASCII.GetByteCount(value) != SupportedSASKeyLength) |
| | 133 | | { |
| 0 | 134 | | throw new ArgumentOutOfRangeException(nameof(SecondaryKey), $"{nameof(SharedAccessAuthorizationRule) |
| | 135 | | } |
| | 136 | |
|
| 0 | 137 | | if (!CheckBase64(value)) |
| | 138 | | { |
| 0 | 139 | | throw new ArgumentException(nameof(SecondaryKey), $"{nameof(SharedAccessAuthorizationRule)} only sup |
| | 140 | | } |
| | 141 | |
|
| 0 | 142 | | this.internalSecondaryKey = value; |
| 0 | 143 | | } |
| | 144 | | } |
| | 145 | |
|
| | 146 | | public override List<AccessRights> Rights |
| | 147 | | { |
| 0 | 148 | | get => this.internalRights; |
| | 149 | | set |
| | 150 | | { |
| 0 | 151 | | if (value == null || value.Count < 0 || value.Count > ManagementClientConstants.SupportedClaimsCount) |
| | 152 | | { |
| 0 | 153 | | throw new ArgumentException($"Rights cannot be null, empty or greater than {ManagementClientConstant |
| | 154 | | } |
| | 155 | |
|
| 0 | 156 | | HashSet<AccessRights> dedupedAccessRights = new HashSet<AccessRights>(value); |
| 0 | 157 | | if (value.Count != dedupedAccessRights.Count) |
| | 158 | | { |
| 0 | 159 | | throw new ArgumentException("Access rights on an authorization rule must be unique"); |
| | 160 | | } |
| | 161 | |
|
| 0 | 162 | | if (value.Contains(AccessRights.Manage) && value.Count != 3) |
| | 163 | | { |
| 0 | 164 | | throw new ArgumentException(nameof(Rights), "Manage permission should also include Send and Listen") |
| | 165 | | } |
| | 166 | |
|
| 0 | 167 | | this.internalRights = value; |
| 0 | 168 | | } |
| | 169 | | } |
| | 170 | |
|
| | 171 | | /// <summary>Returns the hash code for this instance.</summary> |
| | 172 | | public override int GetHashCode() |
| | 173 | | { |
| 0 | 174 | | int hash = 13; |
| | 175 | | unchecked |
| | 176 | | { |
| 0 | 177 | | hash = (hash * 7) + this.KeyName?.GetHashCode() ?? 0; |
| 0 | 178 | | hash = (hash * 7) + this.PrimaryKey?.GetHashCode() ?? 0; |
| 0 | 179 | | hash = (hash * 7) + this.SecondaryKey?.GetHashCode() ?? 0; |
| 0 | 180 | | hash = (hash * 7) + this.Rights.GetHashCode(); |
| | 181 | | } |
| | 182 | |
|
| 0 | 183 | | return hash; |
| | 184 | | } |
| | 185 | |
|
| | 186 | | public override bool Equals(object obj) |
| | 187 | | { |
| 0 | 188 | | var other = obj as AuthorizationRule; |
| 0 | 189 | | return this.Equals(other); |
| | 190 | | } |
| | 191 | |
|
| | 192 | | /// <summary>Determines whether the specified object is equal to the current object.</summary> |
| | 193 | | /// <param name="other">The object to compare with the current object.</param> |
| | 194 | | /// <returns>true if the specified object is equal to the current object; otherwise, false.</returns> |
| | 195 | | public override bool Equals(AuthorizationRule other) |
| | 196 | | { |
| 0 | 197 | | if (!(other is SharedAccessAuthorizationRule)) |
| | 198 | | { |
| 0 | 199 | | return false; |
| | 200 | | } |
| | 201 | |
|
| 0 | 202 | | SharedAccessAuthorizationRule comparand = (SharedAccessAuthorizationRule)other; |
| 0 | 203 | | if (!string.Equals(this.KeyName, comparand.KeyName, StringComparison.OrdinalIgnoreCase) || |
| 0 | 204 | | !string.Equals(this.PrimaryKey, comparand.PrimaryKey, StringComparison.Ordinal) || |
| 0 | 205 | | !string.Equals(this.SecondaryKey, comparand.SecondaryKey, StringComparison.Ordinal)) |
| | 206 | | { |
| 0 | 207 | | return false; |
| | 208 | | } |
| | 209 | |
|
| 0 | 210 | | if ((this.Rights != null && comparand.Rights == null) || |
| 0 | 211 | | (this.Rights == null && comparand.Rights != null)) |
| | 212 | | { |
| 0 | 213 | | return false; |
| | 214 | | } |
| | 215 | |
|
| 0 | 216 | | if (this.Rights != null && comparand.Rights != null) |
| | 217 | | { |
| 0 | 218 | | HashSet<AccessRights> thisRights = new HashSet<AccessRights>(this.Rights); |
| 0 | 219 | | if (comparand.Rights.Count != thisRights.Count) |
| | 220 | | { |
| 0 | 221 | | return false; |
| | 222 | | } |
| | 223 | |
|
| 0 | 224 | | return thisRights.SetEquals(comparand.Rights); |
| | 225 | | } |
| | 226 | |
|
| 0 | 227 | | return true; |
| | 228 | | } |
| | 229 | |
|
| | 230 | | public static bool operator ==(SharedAccessAuthorizationRule o1, SharedAccessAuthorizationRule o2) |
| | 231 | | { |
| 0 | 232 | | if (ReferenceEquals(o1, o2)) |
| | 233 | | { |
| 0 | 234 | | return true; |
| | 235 | | } |
| | 236 | |
|
| 0 | 237 | | if (ReferenceEquals(o1, null) || ReferenceEquals(o2, null)) |
| | 238 | | { |
| 0 | 239 | | return false; |
| | 240 | | } |
| | 241 | |
|
| 0 | 242 | | return o1.Equals(o2); |
| | 243 | | } |
| | 244 | |
|
| | 245 | | public static bool operator !=(SharedAccessAuthorizationRule o1, SharedAccessAuthorizationRule o2) |
| | 246 | | { |
| 0 | 247 | | return !(o1 == o2); |
| | 248 | | } |
| | 249 | |
|
| | 250 | | /// <summary>Generates the random key for the authorization rule.</summary> |
| | 251 | | private static string GenerateRandomKey() |
| | 252 | | { |
| 0 | 253 | | byte[] key256 = new byte[32]; |
| 0 | 254 | | using (var rngCryptoServiceProvider = new RNGCryptoServiceProvider()) |
| | 255 | | { |
| 0 | 256 | | rngCryptoServiceProvider.GetBytes(key256); |
| 0 | 257 | | } |
| | 258 | |
|
| 0 | 259 | | return Convert.ToBase64String(key256); |
| | 260 | | } |
| | 261 | |
|
| | 262 | | private static bool CheckBase64(string base64EncodedString) |
| | 263 | | { |
| | 264 | | try |
| | 265 | | { |
| 0 | 266 | | Convert.FromBase64String(base64EncodedString); |
| 0 | 267 | | return true; |
| | 268 | | } |
| 0 | 269 | | catch (Exception) |
| | 270 | | { |
| 0 | 271 | | return false; |
| | 272 | | } |
| 0 | 273 | | } |
| | 274 | |
|
| | 275 | | internal static new SharedAccessAuthorizationRule ParseFromXElement(XElement xElement) |
| | 276 | | { |
| 0 | 277 | | var rule = new SharedAccessAuthorizationRule(); |
| 0 | 278 | | foreach (var element in xElement.Elements()) |
| | 279 | | { |
| 0 | 280 | | switch (element.Name.LocalName) |
| | 281 | | { |
| | 282 | | case "CreatedTime": |
| 0 | 283 | | rule.CreatedTime = XmlConvert.ToDateTime(element.Value, XmlDateTimeSerializationMode.Utc); |
| 0 | 284 | | break; |
| | 285 | | case "ModifiedTime": |
| 0 | 286 | | rule.ModifiedTime = XmlConvert.ToDateTime(element.Value, XmlDateTimeSerializationMode.Utc); |
| 0 | 287 | | break; |
| | 288 | | case "KeyName": |
| 0 | 289 | | rule.KeyName = element.Value; |
| 0 | 290 | | break; |
| | 291 | | case "PrimaryKey": |
| 0 | 292 | | rule.PrimaryKey = element.Value; |
| 0 | 293 | | break; |
| | 294 | | case "SecondaryKey": |
| 0 | 295 | | rule.SecondaryKey = element.Value; |
| 0 | 296 | | break; |
| | 297 | | case "Rights": |
| 0 | 298 | | var rights = new List<AccessRights>(); |
| 0 | 299 | | var xRights = element.Elements(XName.Get("AccessRights", ManagementClientConstants.ServiceBusNam |
| 0 | 300 | | foreach (var xRight in xRights) |
| | 301 | | { |
| 0 | 302 | | rights.Add((AccessRights)Enum.Parse(typeof(AccessRights), xRight.Value)); |
| | 303 | | } |
| 0 | 304 | | rule.Rights = rights; |
| | 305 | | break; |
| | 306 | | } |
| | 307 | | } |
| | 308 | |
|
| 0 | 309 | | return rule; |
| | 310 | | } |
| | 311 | |
|
| | 312 | | internal override XElement Serialize() |
| | 313 | | { |
| 0 | 314 | | XElement rule = new XElement( |
| 0 | 315 | | XName.Get("AuthorizationRule", ManagementClientConstants.ServiceBusNamespace), |
| 0 | 316 | | new XAttribute(XName.Get("type", ManagementClientConstants.XmlSchemaInstanceNamespace), nameof(SharedAcc |
| 0 | 317 | | new XElement(XName.Get("ClaimType", ManagementClientConstants.ServiceBusNamespace), this.ClaimType), |
| 0 | 318 | | new XElement(XName.Get("ClaimValue", ManagementClientConstants.ServiceBusNamespace), this.ClaimValue), |
| 0 | 319 | | new XElement(XName.Get("Rights", ManagementClientConstants.ServiceBusNamespace), |
| 0 | 320 | | this.Rights.Select(right => new XElement(XName.Get("AccessRights", ManagementClientConstants.Service |
| 0 | 321 | | new XElement(XName.Get("KeyName", ManagementClientConstants.ServiceBusNamespace), this.KeyName), |
| 0 | 322 | | new XElement(XName.Get("PrimaryKey", ManagementClientConstants.ServiceBusNamespace), this.PrimaryKey), |
| 0 | 323 | | new XElement(XName.Get("SecondaryKey", ManagementClientConstants.ServiceBusNamespace), this.SecondaryKey |
| 0 | 324 | | ); |
| | 325 | |
|
| 0 | 326 | | return rule; |
| | 327 | | } |
| | 328 | | } |
| | 329 | | } |