Imported Upstream version 3.6.0

Former-commit-id: da6be194a6b1221998fc28233f2503bd61dd9d14

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/AudienceUriMode.cs

@@ -0,0 +1,41 @@
+//
+// AudienceUriMode.cs
+//
+// Author:
+//	Igor Zelmanovich <igorz@mainsoft.com>
+//
+// Copyright (C) 2008 Mainsoft, Inc.  http://www.mainsoft.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+namespace System.IdentityModel.Selectors
+{
+	public enum AudienceUriMode
+	{
+		Never = 0,
+		Always = 1,
+		BearerKeyOnly = 2,
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/ChangeLog

@@ -0,0 +1,141 @@
+2010-07-28  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs : return false if property value is
+	  null in the internal dictionary (unlike Dictionary<K,V>).
+
+2007-11-27  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs : fill out parameter properly (gmcs
+	  does not report it; see bug #334258).
+
+2007-03-05  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs :
+	  Reject type-mismatch in TryGetProperty().
+
+2007-02-21  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenResolver.cs : fixed some error messages.
+
+2007-02-15  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* X509SecurityTokenAuthenticator.cs : message formatting fix.
+
+2006-09-27  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenResolver.cs : handle matchLocalId in the default impl.
+
+2006-09-19  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenProvider.cs : implemented cancel/renew stuff (not
+	  supported by default).
+	* KerberosSecurityTokenProvider.cs : somehow implemented for
+	  tests.
+	* SecurityTokenManager.cs,
+	  SecurityTokenVersion.cs : removed MonoTODOs.
+
+2006-09-15  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs : seems like KeyUsage does not exist
+	  by default.
+
+2006-09-14  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SamlSecurityTokenAuthenticator.cs : missing MonoTODOs.
+	* WindowsUserNameSecurityTokenAuthenticator.cs : fixed ctors.
+
+2006-09-14  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* UserNameSecurityTokenAuthenticator.cs,
+	  RsaSecurityTokenAuthenticator.cs,
+	  CustomUserNameSecurityTokenAuthenticator.cs,
+	  X509SecurityTokenAuthenticator.cs,
+	  UserNamePasswordValidator.cs : implemented.
+	  SamlSecurityTokenAuthenticator.cs : partly implemented.
+	* X509CertificateValidator.cs : "None" was causing error at any time.
+
+2006-09-12  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* X509SecurityTokenProvider.cs : implemented IDisposable. There I
+	  have no other idea than it affects on X509Store.
+
+2006-09-12  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* UserNameSecurityTokenProvider.cs, SecurityTokenProvider.cs :
+	  warning cleanup.
+
+2006-08-28  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* X509SecurityTokenProvider.cs : implemented another constructor.
+
+2006-08-23  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* X509CertificateValidator.cs : implemented.
+
+2006-08-23  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs : oops, please no infinite loop.
+	  Fixed default values.
+
+2006-08-23  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenResolver.cs : added missing members and implemented.
+	* SecurityTokenRequirement.cs : those properties should be accessible
+	  via Properties.
+
+2006-08-22  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs : don't access properties directly, it
+	  could be null.
+
+2006-08-14  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs : GetProperty() should return an
+	  instance of derived classes without problem.
+	* X509SecurityTokenProvider.cs : fixed .ctor().
+
+2006-07-04  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs : fixes from run-test.
+
+2006-07-04  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs : June CTP update.
+
+2006-03-24  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenResolver.cs : updated to Feb.CTP API.
+	  SecurityTokenVersion.cs
+	  X509CertificateValidator.cs
+	  KerberosSecurityTokenProvider.cs
+	  UserNameSecurityTokenProvider.cs
+	  SecurityTokenManager.cs
+	  UserNamePasswordValidator.cs
+	  X509SecurityTokenProvider.cs : stubs for SecurityTokenProvider and
+	  all derived classes.
+	* Dummy.cs : we don't need it anymore.
+
+2006-03-23  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenRequirement.cs : new file.
+	* SecurityTokenAuthenticator.cs
+	  WindowsUserNameSecurityTokenAuthenticator.cs
+	  WindowsSecurityTokenAuthenticator.cs
+	  SamlSecurityTokenAuthenticator.cs
+	  X509SecurityTokenAuthenticator.cs
+	  CustomUserNameSecurityTokenAuthenticator.cs
+	  KerberosSecurityTokenAuthenticator.cs
+	  UserNameSecurityTokenAuthenticator.cs
+	  RsaSecurityTokenAuthenticator.cs :
+	  new stubs for SecurityTokenAuthenticator and subclasses.
+
+2006-03-22  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* SecurityTokenSerializer.cs : new file.
+	* Dummy.cs : removed above. some API fix.
+	* SecurityTokenProvider.cs SecurityTokenResolver.cs :
+	  updated to Feb.CTP API.
+
+2006-02-23  Atsushi Enomoto  <atsushi@ximian.com>
+
+	* Dummy.cs : added.

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/CustomUserNameSecurityTokenAuthenticator.cs

@@ -0,0 +1,135 @@
+//
+// CustomUserNameSecurityTokenAuthenticator.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Claims;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+using System.Security.Principal;
+using System.Xml;
+
+namespace System.IdentityModel.Selectors
+{
+	public class CustomUserNameSecurityTokenAuthenticator
+		: UserNameSecurityTokenAuthenticator
+	{
+		UserNamePasswordValidator validator;
+
+		public CustomUserNameSecurityTokenAuthenticator (
+			UserNamePasswordValidator validator)
+		{
+			if (validator == null)
+				throw new ArgumentNullException ("validator");
+			this.validator = validator;
+		}
+
+		protected override ReadOnlyCollection<IAuthorizationPolicy>
+			ValidateUserNamePasswordCore (string userName, string password)
+		{
+			validator.Validate (userName, password);
+			IAuthorizationPolicy policy =
+				new AuthorizedCustomUserPolicy (userName);
+			return new ReadOnlyCollection<IAuthorizationPolicy> (new IAuthorizationPolicy [] {policy});
+		}
+
+		abstract class SystemIdentityAuthorizationPolicy : IAuthorizationPolicy
+		{
+			string id;
+
+			protected SystemIdentityAuthorizationPolicy (string id)
+			{
+				this.id = id;
+			}
+
+			public string Id {
+				get { return id; }
+			}
+
+			public ClaimSet Issuer {
+				get { return ClaimSet.System; }
+			}
+
+
+			// This method is expected to be thread safe
+			public bool Evaluate (EvaluationContext ec, ref object state)
+			{
+				lock (ec) {
+					ec.AddClaimSet (this, CreateClaims ());
+					List<IIdentity> list;
+					if (!ec.Properties.ContainsKey ("Identities")) {
+						list = new List<IIdentity> ();
+						ec.Properties ["Identities"] = list;
+					} else {
+						IList<IIdentity> ilist = (IList<IIdentity>) ec.Properties ["Identities"];
+						list = ilist as List<IIdentity>;
+						if (list == null) {
+							list = new List<IIdentity> (ilist);
+							ec.Properties ["Identities"] = list;
+						}
+					}
+					list.Add (CreateIdentity ());
+					ec.RecordExpirationTime (DateTime.MaxValue.AddDays (-1));
+				}
+				// FIXME: is it correct that this should always return true?
+				return true;
+			}
+
+			public abstract DateTime ExpirationTime { get; }
+
+			public abstract ClaimSet CreateClaims ();
+
+			public abstract IIdentity CreateIdentity ();
+		}
+
+		class AuthorizedCustomUserPolicy : SystemIdentityAuthorizationPolicy
+		{
+			string user;
+
+			public AuthorizedCustomUserPolicy (string user)
+				: base (new UniqueId ().ToString ())
+			{
+				this.user = user;
+			}
+
+			public override DateTime ExpirationTime {
+				get { return DateTime.MaxValue; }
+			}
+
+			public override ClaimSet CreateClaims ()
+			{
+				return new DefaultClaimSet (Claim.CreateNameClaim (user));
+			}
+
+			public override IIdentity CreateIdentity ()
+			{
+				return new GenericIdentity (user);
+			}
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/KerberosSecurityTokenAuthenticator.cs

@@ -0,0 +1,54 @@
+//
+// KerberosSecurityTokenAuthenticator.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public class KerberosSecurityTokenAuthenticator
+		: WindowsSecurityTokenAuthenticator
+	{
+		[MonoTODO]
+		public KerberosSecurityTokenAuthenticator ()
+		{
+		}
+
+		[MonoTODO]
+		public KerberosSecurityTokenAuthenticator (bool includeWindowsGroups)
+		{
+		}
+
+		[MonoTODO]
+		protected override bool CanValidateTokenCore (SecurityToken token)
+		{
+			throw new NotImplementedException ();
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/KerberosSecurityTokenProvider.cs

@@ -0,0 +1,78 @@
+//
+// KerberosSecurityTokenProvider.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Net;
+using System.Security.Principal;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public class KerberosSecurityTokenProvider : SecurityTokenProvider
+	{
+		public KerberosSecurityTokenProvider (string servicePrincipalName)
+			: this (servicePrincipalName, TokenImpersonationLevel.Identification)
+		{
+		}
+
+		[MonoTODO]
+		public KerberosSecurityTokenProvider (string servicePrincipalName, TokenImpersonationLevel tokenImpersonationLevel)
+			: this (servicePrincipalName, tokenImpersonationLevel, CredentialCache.DefaultNetworkCredentials)
+		{
+		}
+
+		[MonoTODO]
+		public KerberosSecurityTokenProvider (string servicePrincipalName, TokenImpersonationLevel tokenImpersonationLevel, NetworkCredential credential)
+		{
+			name = servicePrincipalName;
+			impersonation_level = tokenImpersonationLevel;
+			this.credential = credential;
+		}
+
+		string name;
+		TokenImpersonationLevel impersonation_level;
+		NetworkCredential credential;
+
+		public string ServicePrincipalName {
+			get { return name; }
+		}
+
+		public TokenImpersonationLevel TokenImpersonationLevel {
+			get { return impersonation_level; }
+		}
+
+		public NetworkCredential NetworkCredential {
+			get { return credential; }
+		}
+
+		[MonoTODO]
+		protected override SecurityToken GetTokenCore (TimeSpan timeout)
+		{
+			throw new NotImplementedException ();
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/RsaSecurityTokenAuthenticator.cs

@@ -0,0 +1,91 @@
+//
+// RsaSecurityTokenAuthenticator.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Claims;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+using System.Security.Principal;
+using System.Security.Cryptography;
+using System.Xml;
+
+namespace System.IdentityModel.Selectors
+{
+	public class RsaSecurityTokenAuthenticator
+		: SecurityTokenAuthenticator
+	{
+		public RsaSecurityTokenAuthenticator ()
+		{
+		}
+
+		protected override bool CanValidateTokenCore (SecurityToken token)
+		{
+			return token is RsaSecurityToken;
+		}
+
+		[MonoTODO ("hmm, what to validate?")]
+		protected override ReadOnlyCollection<IAuthorizationPolicy>
+			ValidateTokenCore (SecurityToken token)
+		{
+			RsaSecurityToken rt = token as RsaSecurityToken;
+			if (rt == null)
+				throw new InvalidOperationException ("Security token '{0}' cannot be validated by this security token authenticator.");
+
+			IAuthorizationPolicy policy =
+				new RsaAuthorizationPolicy (rt.Rsa);
+			return new ReadOnlyCollection<IAuthorizationPolicy> (new IAuthorizationPolicy [] {policy});
+		}
+
+		class RsaAuthorizationPolicy : IAuthorizationPolicy
+		{
+			string id;
+			RSA rsa;
+
+			public RsaAuthorizationPolicy (RSA rsa)
+			{
+				id = new UniqueId ().ToString ();
+			}
+
+			public ClaimSet Issuer {
+				get { return ClaimSet.System; }
+			}
+
+			public string Id {
+				get { return id; }
+			}
+
+			public bool Evaluate (EvaluationContext ec, ref Object state)
+			{
+				ec.AddClaimSet (this, new DefaultClaimSet (Claim.CreateRsaClaim (rsa)));
+				ec.RecordExpirationTime (DateTime.MaxValue.AddDays (-1));
+				return true;
+			}
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/SamlSecurityTokenAuthenticator.cs

@@ -0,0 +1,124 @@
+//
+// SamlSecurityTokenAuthenticator.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Claims;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+using System.Security.Principal;
+using System.Xml;
+
+namespace System.IdentityModel.Selectors
+{
+	public class SamlSecurityTokenAuthenticator
+		: SecurityTokenAuthenticator
+	{
+		IList<SecurityTokenAuthenticator> authenticators;
+		TimeSpan max_clock_skew;
+
+		public SamlSecurityTokenAuthenticator (
+			IList<SecurityTokenAuthenticator> supportingAuthenticators)
+			: this (supportingAuthenticators, TimeSpan.MaxValue)
+		{
+		}
+
+		public SamlSecurityTokenAuthenticator (
+			IList<SecurityTokenAuthenticator> supportingAuthenticators,
+			TimeSpan maxClockSkew)
+		{
+			if (supportingAuthenticators == null)
+				throw new ArgumentNullException ("supportingAuthenticators");
+			authenticators = supportingAuthenticators;
+			max_clock_skew = maxClockSkew;
+		}
+
+		protected override bool CanValidateTokenCore (SecurityToken token)
+		{
+			return token is SamlSecurityToken;
+		}
+
+		[MonoTODO]
+		protected override ReadOnlyCollection<IAuthorizationPolicy>
+			ValidateTokenCore (SecurityToken token)
+		{
+			throw new NotImplementedException ();
+		}
+
+		[MonoTODO]
+		public virtual ClaimSet ResolveClaimSet (SecurityKeyIdentifier keyIdentifier)
+		{
+			throw new NotImplementedException ();
+		}
+
+		public virtual ClaimSet ResolveClaimSet (SecurityToken token)
+		{
+			return ResolveClaimSet (new SecurityKeyIdentifier (
+				token.CreateKeyIdentifierClause<SamlAssertionKeyIdentifierClause> ()));
+		}
+
+		[MonoTODO]
+		public virtual IIdentity ResolveIdentity (SecurityKeyIdentifier keyIdentifier)
+		{
+			throw new NotImplementedException ();
+		}
+
+		public virtual IIdentity ResolveIdentity (SecurityToken token)
+		{
+			return ResolveIdentity (new SecurityKeyIdentifier (
+				token.CreateKeyIdentifierClause<SamlAssertionKeyIdentifierClause> ()));
+		}
+
+		class SamlAuthorizationPolicy : SystemIdentityAuthorizationPolicy
+		{
+			SamlSecurityTokenAuthenticator authenticator;
+			SamlSecurityToken token;
+
+			public SamlAuthorizationPolicy (SamlSecurityTokenAuthenticator authenticator, SamlSecurityToken token)
+				: base (new UniqueId ().ToString ())
+			{
+				this.authenticator = authenticator;
+				this.token = token;
+			}
+
+			public override DateTime ExpirationTime {
+				get { return token.ValidTo; }
+			}
+
+			public override ClaimSet CreateClaims ()
+			{
+				return authenticator.ResolveClaimSet (token);
+			}
+
+			public override IIdentity CreateIdentity ()
+			{
+				return authenticator.ResolveIdentity (token);
+			}
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/SecurityTokenAuthenticator.cs

@@ -0,0 +1,57 @@
+//
+// SecurityTokenAuthenticator.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public abstract class SecurityTokenAuthenticator
+	{
+		protected SecurityTokenAuthenticator ()
+		{
+		}
+
+		public bool CanValidateToken (SecurityToken token)
+		{
+			return CanValidateTokenCore (token);
+		}
+
+		protected abstract bool CanValidateTokenCore (SecurityToken token);
+
+		public ReadOnlyCollection<IAuthorizationPolicy>
+			ValidateToken (SecurityToken token)
+		{
+			return ValidateTokenCore (token);
+		}
+
+		protected abstract ReadOnlyCollection<IAuthorizationPolicy>
+			ValidateTokenCore (SecurityToken token);
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/SecurityTokenManager.cs

@@ -0,0 +1,53 @@
+//
+// SecurityTokenManager.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+using System.Net.Security;
+
+namespace System.IdentityModel.Selectors
+{
+	public abstract class SecurityTokenManager
+	{
+		protected SecurityTokenManager ()
+		{
+		}
+
+		public abstract SecurityTokenAuthenticator 
+			CreateSecurityTokenAuthenticator (
+			SecurityTokenRequirement requirement,
+			out SecurityTokenResolver resolver);
+
+		public abstract SecurityTokenProvider 
+			CreateSecurityTokenProvider(SecurityTokenRequirement requirement);
+
+		public abstract SecurityTokenSerializer 
+			CreateSecurityTokenSerializer (SecurityTokenVersion version);
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/SecurityTokenProvider.cs

@@ -0,0 +1,149 @@
+//
+// SecurityTokenProvider.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2005 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public abstract class SecurityTokenProvider
+	{
+		protected SecurityTokenProvider ()
+		{
+		}
+
+		public virtual bool SupportsTokenCancellation {
+			get { return false; }
+		}
+
+		public virtual bool SupportsTokenRenewal {
+			get { return false; }
+		}
+
+		public SecurityToken GetToken (TimeSpan timeout)
+		{
+			return GetTokenCore (timeout);
+		}
+
+		public IAsyncResult BeginGetToken (
+			TimeSpan timeout, AsyncCallback callback, object state)
+		{
+			return BeginGetTokenCore (timeout, callback, state);
+		}
+
+		public SecurityToken EndGetToken (IAsyncResult result)
+		{
+			return EndGetTokenCore (result);
+		}
+
+		public void CancelToken (TimeSpan timeout, SecurityToken token)
+		{
+			CancelTokenCore (timeout, token);
+		}
+
+		public IAsyncResult BeginCancelToken (
+			TimeSpan timeout, SecurityToken token,
+			AsyncCallback callback, object state)
+		{
+			return BeginCancelTokenCore (timeout, token, callback, state);
+		}
+
+		public void EndCancelToken (IAsyncResult result)
+		{
+			EndCancelTokenCore (result);
+		}
+
+		public SecurityToken RenewToken (TimeSpan timeout, SecurityToken token)
+		{
+			return RenewTokenCore (timeout, token);
+		}
+
+		public IAsyncResult BeginRenewToken (
+			TimeSpan timeout, SecurityToken token,
+			AsyncCallback callback, object state)
+		{
+			return BeginRenewTokenCore (timeout, token, callback, state);
+		}
+
+		public SecurityToken EndRenewToken (IAsyncResult result)
+		{
+			return EndRenewTokenCore (result);
+		}
+
+		protected abstract SecurityToken GetTokenCore (TimeSpan timeout);
+
+		protected virtual void CancelTokenCore (TimeSpan timeout, SecurityToken token)
+		{
+			throw new NotSupportedException (String.Format ("Token cancellation on this security token provider '{0}' is not supported.", this));
+		}
+
+		protected virtual SecurityToken RenewTokenCore (TimeSpan timeout, SecurityToken token)
+		{
+			throw new NotSupportedException (String.Format ("Token renewal on this security token provider '{0}' is not supported.", this));
+		}
+
+		[MonoTODO]
+		protected virtual IAsyncResult BeginGetTokenCore (
+			TimeSpan timeout,
+			AsyncCallback callback, object state)
+		{
+			throw new NotImplementedException ();
+		}
+
+		protected virtual IAsyncResult BeginCancelTokenCore (
+			TimeSpan timeout,
+			SecurityToken token,
+			AsyncCallback callback, object state)
+		{
+			throw new NotSupportedException (String.Format ("Token cancellation on this security token provider '{0}' is not supported.", this));
+		}
+
+		protected virtual IAsyncResult BeginRenewTokenCore (
+			TimeSpan timeout,
+			SecurityToken token,
+			AsyncCallback callback, object state)
+		{
+			throw new NotSupportedException (String.Format ("Token renewal on this security token provider '{0}' is not supported.", this));
+		}
+
+		[MonoTODO]
+		protected virtual SecurityToken EndGetTokenCore (IAsyncResult result)
+		{
+			throw new NotImplementedException ();
+		}
+
+		protected virtual void EndCancelTokenCore (IAsyncResult result)
+		{
+			throw new NotSupportedException (String.Format ("Token cancellation on this security token provider '{0}' is not supported.", this));
+		}
+
+		protected virtual SecurityToken EndRenewTokenCore (IAsyncResult result)
+		{
+			throw new NotSupportedException (String.Format ("Token renewal on this security token provider '{0}' is not supported.", this));
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/SecurityTokenRequirement.cs

@@ -0,0 +1,152 @@
+//
+// SecurityTokenRequirement.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.Generic;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public class SecurityTokenRequirement
+	{
+		// huh, why not const?
+
+		public static string KeySizeProperty {
+			get { return "http://schemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/KeySize"; }
+		}
+
+		public static string KeyTypeProperty {
+			get { return "http://schemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/KeyType"; }
+		}
+
+		public static string KeyUsageProperty {
+			get { return "http://schemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/KeyUsage"; }
+		}
+
+		public static string RequireCryptographicTokenProperty {
+			get { return "http://schemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/RequireCryptographicToken"; }
+		}
+
+		public static string TokenTypeProperty {
+			get { return "http://schemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/TokenType"; }
+		}
+
+		// Instance members
+
+		public SecurityTokenRequirement ()
+		{
+		}
+
+		Dictionary<string,object> properties;
+
+		public int KeySize {
+			get {
+				int ret;
+				if (TryGetProperty<int> (KeySizeProperty, out ret))
+					return ret;
+				return default (int);
+			}
+			set { Properties [KeySizeProperty] = value; }
+		}
+
+		public SecurityKeyType KeyType {
+			get {
+				SecurityKeyType ret;
+				if (TryGetProperty<SecurityKeyType> (KeyTypeProperty, out ret))
+					return ret;
+				return default (SecurityKeyType);
+			}
+			set { Properties [KeyTypeProperty] = value; }
+		}
+
+		public string TokenType {
+			get {
+				string ret;
+				if (TryGetProperty<string> (TokenTypeProperty, out ret))
+					return ret;
+				return default (string);
+			}
+			set { Properties [TokenTypeProperty] = value; }
+		}
+
+		public SecurityKeyUsage KeyUsage {
+			get {
+				SecurityKeyUsage ret;
+				if (TryGetProperty<SecurityKeyUsage> (KeyUsageProperty, out ret))
+					return ret;
+				return SecurityKeyUsage.Signature;// not default!!
+			}
+			set { Properties [KeyUsageProperty] = value; }
+		}
+
+		public bool RequireCryptographicToken {
+			get {
+				bool ret;
+				if (TryGetProperty<bool> (RequireCryptographicTokenProperty, out ret))
+					return ret;
+				return default (bool);
+			}
+			set { Properties [RequireCryptographicTokenProperty] = value; }
+		}
+
+		public IDictionary<string,object> Properties {
+			get {
+				if (properties == null) {
+					properties = new Dictionary<string,object> ();
+					properties [KeyTypeProperty] = SecurityKeyType.SymmetricKey;
+					properties [KeySizeProperty] = 0;
+					properties [RequireCryptographicTokenProperty] = false;
+				}
+				return properties;
+			}
+		}
+
+		public TValue GetProperty<TValue> (string property)
+		{
+			TValue ret;
+			if (TryGetProperty<TValue> (property, out ret))
+				return ret;
+			throw new ArgumentException (String.Format ("Property '{0}' was not found.", property));
+		}
+
+		public bool TryGetProperty<TValue> (string property, out TValue value)
+		{
+			object tmp;
+			value = default (TValue);
+
+			if (!Properties.TryGetValue (property, out tmp))
+				return false;
+			if (tmp == null && !typeof (TValue).IsValueType)
+				value = default (TValue);
+			else if (tmp is TValue)
+				value = (TValue) tmp;
+			else
+				throw new ArgumentException (String.Format ("The value of property '{0}' is of type '{1}', while '{2}' is expected.", property, tmp.GetType (), typeof (TValue)));
+			return value != null;
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/SecurityTokenResolver.cs

@@ -0,0 +1,182 @@
+//
+// SecurityTokenResolver.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2005-2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public abstract class SecurityTokenResolver
+	{
+		protected SecurityTokenResolver ()
+		{
+		}
+
+		public static SecurityTokenResolver  CreateDefaultSecurityTokenResolver (
+			ReadOnlyCollection<SecurityToken> tokens,
+			bool canMatchLocalId)
+		{
+			return new DefaultSecurityTokenResolver (tokens, canMatchLocalId);
+		}
+
+		public SecurityKey ResolveSecurityKey (
+			SecurityKeyIdentifierClause keyIdentifierClause)
+		{
+			if (keyIdentifierClause == null)
+				throw new ArgumentNullException ("keyIdentifierClause");
+			SecurityKey ret;
+			if (!TryResolveSecurityKey (keyIdentifierClause, out ret))
+				throw new InvalidOperationException (String.Format ("Could not resolve security key with the key identifier clause '{0}'", keyIdentifierClause));
+			return ret;
+		}
+
+		public SecurityToken ResolveToken (
+			SecurityKeyIdentifier keyIdentifier)
+		{
+			if (keyIdentifier == null)
+				throw new ArgumentNullException ("keyIdentifierClause");
+			SecurityToken ret;
+			if (!TryResolveToken (keyIdentifier, out ret))
+				throw new InvalidOperationException (String.Format ("Could not resolve security token from the key identifier '{0}'", keyIdentifier));
+			return ret;
+		}
+
+		public SecurityToken ResolveToken (
+			SecurityKeyIdentifierClause keyIdentifierClause)
+		{
+			if (keyIdentifierClause == null)
+				throw new ArgumentNullException ("keyIdentifierClause");
+			SecurityToken ret;
+			if (!TryResolveToken (keyIdentifierClause, out ret))
+				throw new InvalidOperationException (String.Format ("Could not resolve security token from the key identifier clause '{0}'", keyIdentifierClause));
+			return ret;
+		}
+
+		public bool TryResolveSecurityKey (
+			SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key)
+		{
+			return TryResolveSecurityKeyCore (keyIdentifierClause, out key);
+		}
+
+		public bool TryResolveToken (
+			SecurityKeyIdentifier keyIdentifier,
+			out SecurityToken token)
+		{
+			return TryResolveTokenCore (keyIdentifier, out token);
+		}
+
+		public bool TryResolveToken (
+			SecurityKeyIdentifierClause keyIdentifierClause,
+			out SecurityToken token)
+		{
+			return TryResolveTokenCore (keyIdentifierClause, out token);
+		}
+
+		protected abstract bool TryResolveSecurityKeyCore (
+			SecurityKeyIdentifierClause keyIdentifierClause,
+			out SecurityKey key);
+
+		protected abstract bool TryResolveTokenCore (
+			SecurityKeyIdentifier keyIdentifier,
+			out SecurityToken token);
+
+		protected abstract bool TryResolveTokenCore (
+			SecurityKeyIdentifierClause keyIdentifierClause,
+			out SecurityToken token);
+
+
+		class DefaultSecurityTokenResolver : SecurityTokenResolver
+		{
+			ReadOnlyCollection<SecurityToken> tokens;
+			bool match_local;
+
+			public DefaultSecurityTokenResolver (
+				ReadOnlyCollection<SecurityToken> tokens,
+				bool canMatchLocalId)
+			{
+				this.tokens = tokens;
+				this.match_local = canMatchLocalId;
+			}
+
+			protected override bool TryResolveSecurityKeyCore (
+				SecurityKeyIdentifierClause clause,
+				out SecurityKey key)
+			{
+				if (clause == null)
+					throw new ArgumentNullException ("clause");
+				foreach (SecurityToken token in tokens)
+					if (TokenMatchesClause (token, clause)) {
+						key = token.ResolveKeyIdentifierClause (clause);
+						if (key != null)
+							return true;
+					}
+				key = null;
+				return false;
+			}
+
+			protected override bool TryResolveTokenCore (
+				SecurityKeyIdentifier keyIdentifier,
+				out SecurityToken token)
+			{
+				if (keyIdentifier == null)
+					throw new ArgumentNullException ("keyIdentifier");
+				foreach (SecurityKeyIdentifierClause kic in keyIdentifier)
+					if (TryResolveTokenCore (kic, out token))
+						return true;
+				token = null;
+				return false;
+			}
+
+			protected override bool TryResolveTokenCore (
+				SecurityKeyIdentifierClause clause,
+				out SecurityToken token)
+			{
+				if (clause == null)
+					throw new ArgumentNullException ("clause");
+				foreach (SecurityToken t in tokens)
+					if (TokenMatchesClause (t, clause)) {
+						token = t;
+						return true;
+					}
+				token = null;
+				return false;
+			}
+
+			bool TokenMatchesClause (SecurityToken token, SecurityKeyIdentifierClause clause)
+			{
+				if (token.MatchesKeyIdentifierClause (clause))
+					return true;
+				if (!match_local)
+					return false;
+				LocalIdKeyIdentifierClause l =
+					clause as LocalIdKeyIdentifierClause;
+				return l != null && l.Matches (token.Id, token.GetType ());
+			}
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/SecurityTokenSerializer.cs

@@ -0,0 +1,160 @@
+//
+// SecurityTokenSerializer.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2005 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.Generic;
+using System.IdentityModel.Selectors;
+using System.IdentityModel.Tokens;
+using System.Xml;
+
+namespace System.IdentityModel.Selectors
+{
+	public abstract class SecurityTokenSerializer
+	{
+		protected SecurityTokenSerializer ()
+		{
+		}
+
+		[MonoTODO]
+		public bool CanReadKeyIdentifier (XmlReader reader)
+		{
+			return CanReadKeyIdentifierCore (reader);
+		}
+
+		[MonoTODO]
+		public bool CanReadKeyIdentifierClause (XmlReader reader)
+		{
+			return CanReadKeyIdentifierClauseCore (reader);
+		}
+
+		[MonoTODO]
+		public bool CanReadToken (XmlReader reader)
+		{
+			return CanReadTokenCore (reader);
+		}
+
+		[MonoTODO]
+		public SecurityKeyIdentifier ReadKeyIdentifier (
+			XmlReader reader)
+		{
+			return ReadKeyIdentifierCore (reader);
+		}
+
+		[MonoTODO]
+		public SecurityKeyIdentifierClause ReadKeyIdentifierClause (
+			XmlReader reader)
+		{
+			return ReadKeyIdentifierClauseCore (reader);
+		}
+
+		[MonoTODO]
+		public SecurityToken ReadToken (
+			XmlReader reader,
+			SecurityTokenResolver tokenResolver)
+		{
+			return ReadTokenCore (reader, tokenResolver);
+		}
+
+		[MonoTODO]
+		public bool CanWriteKeyIdentifier (
+			SecurityKeyIdentifier keyIdentifier)
+		{
+			return CanWriteKeyIdentifierCore (keyIdentifier);
+		}
+
+		[MonoTODO]
+		public bool CanWriteKeyIdentifierClause (
+			SecurityKeyIdentifierClause keyIdentifierClause)
+		{
+			return CanWriteKeyIdentifierClauseCore (keyIdentifierClause);
+		}
+
+		[MonoTODO]
+		public bool CanWriteToken (SecurityToken token)
+		{
+			return CanWriteTokenCore (token);
+		}
+
+		[MonoTODO]
+		public void WriteKeyIdentifier (
+			XmlWriter writer,
+			SecurityKeyIdentifier keyIdentifier)
+		{
+			WriteKeyIdentifierCore (writer, keyIdentifier);
+		}
+
+		[MonoTODO]
+		public void WriteKeyIdentifierClause (
+			XmlWriter writer,
+			SecurityKeyIdentifierClause keyIdentifierClause)
+		{
+			WriteKeyIdentifierClauseCore (writer, keyIdentifierClause);
+		}
+
+		[MonoTODO]
+		public void WriteToken (
+			XmlWriter writer, SecurityToken token)
+		{
+			WriteTokenCore (writer, token);
+		}
+
+		protected abstract bool CanReadKeyIdentifierClauseCore (XmlReader reader);
+
+		protected abstract bool CanReadKeyIdentifierCore (XmlReader reader);
+
+		protected abstract bool CanReadTokenCore (XmlReader reader);
+
+		protected abstract SecurityKeyIdentifier ReadKeyIdentifierCore (
+			XmlReader reader);
+
+		protected abstract SecurityKeyIdentifierClause ReadKeyIdentifierClauseCore (
+			XmlReader reader);
+
+		protected abstract SecurityToken ReadTokenCore (
+			XmlReader reader,
+			SecurityTokenResolver tokenResolver);
+
+		protected abstract bool CanWriteKeyIdentifierCore (
+			SecurityKeyIdentifier keyIdentifier);
+
+		protected abstract bool CanWriteKeyIdentifierClauseCore (
+			SecurityKeyIdentifierClause keyIdentifierClause);
+
+		protected abstract bool CanWriteTokenCore (SecurityToken token);
+
+		protected abstract void WriteKeyIdentifierCore (
+			XmlWriter writer,
+			SecurityKeyIdentifier keyIdentifier);
+
+		protected abstract void WriteKeyIdentifierClauseCore (
+			XmlWriter writer,
+			SecurityKeyIdentifierClause keyIdentifierClause);
+
+		protected abstract void WriteTokenCore (
+			XmlWriter writer, SecurityToken token);
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/SecurityTokenVersion.cs

@@ -0,0 +1,45 @@
+//
+// SecurityTokenVersion.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+using System.Net.Security;
+
+namespace System.IdentityModel.Selectors
+{
+	public abstract class SecurityTokenVersion
+	{
+		protected SecurityTokenVersion ()
+		{
+		}
+
+		public abstract ReadOnlyCollection<string>
+			GetSecuritySpecifications ();
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/SystemIdentityAuthorizationPolicy.cs

@@ -0,0 +1,87 @@
+//
+// SystemIdentityAuthorizationPolicy.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Claims;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+using System.Security.Principal;
+using System.Xml;
+
+namespace System.IdentityModel.Selectors
+{
+	abstract class SystemIdentityAuthorizationPolicy : IAuthorizationPolicy
+	{
+		string id;
+
+		protected SystemIdentityAuthorizationPolicy (string id)
+		{
+			this.id = id;
+		}
+
+		public string Id {
+			get { return id; }
+		}
+
+		public ClaimSet Issuer {
+			get { return ClaimSet.System; }
+		}
+
+
+		// This method is expected to be thread safe
+		public bool Evaluate (EvaluationContext ec, ref object state)
+		{
+			lock (ec) {
+				ec.AddClaimSet (this, CreateClaims ());
+				List<IIdentity> list;
+				if (!ec.Properties.ContainsKey ("Identities")) {
+					list = new List<IIdentity> ();
+					ec.Properties ["Identities"] = list;
+				} else {
+					IList<IIdentity> ilist = (IList<IIdentity>) ec.Properties ["Identities"];
+					list = ilist as List<IIdentity>;
+					if (list == null) {
+						list = new List<IIdentity> (ilist);
+						ec.Properties ["Identities"] = list;
+					}
+				}
+				list.Add (CreateIdentity ());
+				ec.RecordExpirationTime (ExpirationTime);
+			}
+			// FIXME: is it correct that this should always return true?
+			return true;
+		}
+
+		public abstract DateTime ExpirationTime { get; }
+
+		public abstract ClaimSet CreateClaims ();
+
+		public abstract IIdentity CreateIdentity ();
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/UserNamePasswordValidator.cs

@@ -0,0 +1,82 @@
+//
+// UserNamePasswordValidator.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+using System.Web.Security;
+
+namespace System.IdentityModel.Selectors
+{
+	public abstract class UserNamePasswordValidator
+	{
+		protected UserNamePasswordValidator ()
+		{
+		}
+
+		static UserNamePasswordValidator none_validator =
+			new NoneValidator ();
+
+		public static UserNamePasswordValidator None {
+			get { return none_validator; }
+		}
+
+		public static UserNamePasswordValidator
+			CreateMembershipProviderValidator (MembershipProvider provider)
+		{
+			if (provider == null)
+				throw new ArgumentNullException ("provider");
+			return new MembershipUserNameValidator (provider);
+		}
+
+		public abstract void Validate (string userName, string password);
+
+		class NoneValidator : UserNamePasswordValidator
+		{
+			public override void Validate (string user, string pass)
+			{
+			}
+		}
+
+		class MembershipUserNameValidator : UserNamePasswordValidator
+		{
+			MembershipProvider provider;
+
+			public MembershipUserNameValidator (MembershipProvider provider)
+			{
+				this.provider = provider;
+			}
+
+			public override void Validate (string user, string pass)
+			{
+				if (!provider.ValidateUser (user, pass))
+					throw new SecurityTokenException ("The user does not exist or was not validated with the given password.");
+			}
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/UserNameSecurityTokenAuthenticator.cs

@@ -0,0 +1,63 @@
+//
+// UserNameSecurityTokenAuthenticator.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public abstract class UserNameSecurityTokenAuthenticator
+		: SecurityTokenAuthenticator
+	{
+		protected UserNameSecurityTokenAuthenticator ()
+		{
+		}
+
+		protected override bool CanValidateTokenCore (SecurityToken token)
+		{
+			if (token == null)
+				throw new ArgumentNullException ("token");
+			return token is UserNameSecurityToken;
+		}
+
+		protected override ReadOnlyCollection<IAuthorizationPolicy>
+			ValidateTokenCore (SecurityToken token)
+		{
+			if (token == null)
+				throw new ArgumentNullException ("token");
+			UserNameSecurityToken ut = token as UserNameSecurityToken;
+			if (ut == null)
+				throw new InvalidOperationException (String.Format ("Security token '{0}' is not supported", token));
+			return ValidateUserNamePasswordCore (ut.UserName, ut.Password);
+		}
+
+		protected abstract ReadOnlyCollection<IAuthorizationPolicy>
+			ValidateUserNamePasswordCore (string userName, string password);
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/UserNameSecurityTokenProvider.cs

@@ -0,0 +1,48 @@
+//
+// UserNameSecurityTokenProvider.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public class UserNameSecurityTokenProvider : SecurityTokenProvider
+	{
+		public UserNameSecurityTokenProvider (string userName, string password)
+		{
+			user = userName;
+			pass = password;
+		}
+
+		string user, pass;
+
+		protected override SecurityToken GetTokenCore (TimeSpan timeout)
+		{
+			return new UserNameSecurityToken (user, pass);
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/WindowsSecurityTokenAuthenticator.cs

@@ -0,0 +1,61 @@
+//
+// WindowsSecurityTokenAuthenticator.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public class WindowsSecurityTokenAuthenticator
+		: SecurityTokenAuthenticator
+	{
+		[MonoTODO]
+		public WindowsSecurityTokenAuthenticator ()
+		{
+		}
+
+		[MonoTODO]
+		public WindowsSecurityTokenAuthenticator (bool includeWindowsGroups)
+		{
+		}
+
+		[MonoTODO]
+		protected override bool CanValidateTokenCore (SecurityToken token)
+		{
+			throw new NotImplementedException ();
+		}
+
+		[MonoTODO]
+		protected override ReadOnlyCollection<IAuthorizationPolicy>
+			ValidateTokenCore (SecurityToken token)
+		{
+			throw new NotImplementedException ();
+		}
+	}
+}

mcs/class/System.IdentityModel/System.IdentityModel.Selectors/WindowsUserNameSecurityTokenAuthenticator.cs

@@ -0,0 +1,57 @@
+//
+// WindowsUserNameSecurityTokenAuthenticator.cs
+//
+// Author:
+//	Atsushi Enomoto <atsushi@ximian.com>
+//
+// Copyright (C) 2006 Novell, Inc.  http://www.novell.com
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+// 
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+using System;
+using System.Collections.ObjectModel;
+using System.IdentityModel.Policy;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Selectors
+{
+	public class WindowsUserNameSecurityTokenAuthenticator
+		: UserNameSecurityTokenAuthenticator
+	{
+		bool include_win_groups;
+
+		public WindowsUserNameSecurityTokenAuthenticator ()
+			: this (true)
+		{
+		}
+
+		public WindowsUserNameSecurityTokenAuthenticator (bool includeWindowsGroups)
+		{
+			this.include_win_groups = includeWindowsGroups;
+		}
+
+		[MonoTODO]
+		protected override ReadOnlyCollection<IAuthorizationPolicy>
+			ValidateUserNamePasswordCore (string userName, string password)
+		{
+			throw new NotImplementedException ();
+		}
+	}
+}