Imported Upstream version 4.6.0.125

Former-commit-id: a2155e9bd80020e49e72e86c44da02a8ac0e57a4

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Policy/AuthorizationContext.cs

@@ -0,0 +1,24 @@
+//------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.  All rights reserved.
+//------------------------------------------------------------
+
+namespace System.IdentityModel.Policy
+{
+    using System.Collections;
+    using System.Collections.ObjectModel;
+    using System.Collections.Generic;
+    using System.IdentityModel.Claims;
+
+    public abstract class AuthorizationContext : IAuthorizationComponent
+    {
+        public abstract string Id { get; }
+        public abstract ReadOnlyCollection<ClaimSet> ClaimSets { get; }
+        public abstract DateTime ExpirationTime { get; }
+        public abstract IDictionary<string, object> Properties { get; }
+
+        public static AuthorizationContext CreateDefaultAuthorizationContext(IList<IAuthorizationPolicy> authorizationPolicies)
+        {
+            return SecurityUtils.CreateDefaultAuthorizationContext(authorizationPolicies);
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Policy/DefaultAuthorizationContext.cs

@@ -0,0 +1,68 @@
+//------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.  All rights reserved.
+//------------------------------------------------------------
+
+namespace System.IdentityModel.Policy
+{
+    using System.Collections.Generic;
+    using System.Collections.ObjectModel;
+    using System.IdentityModel.Claims;
+
+    class DefaultAuthorizationContext : AuthorizationContext
+    {
+        static DefaultAuthorizationContext empty;
+        SecurityUniqueId id;
+        ReadOnlyCollection<ClaimSet> claimSets;
+        DateTime expirationTime;
+        IDictionary<string, object> properties;
+
+        public DefaultAuthorizationContext(DefaultEvaluationContext evaluationContext)
+        {
+            this.claimSets = evaluationContext.ClaimSets;
+            this.expirationTime = evaluationContext.ExpirationTime;
+            this.properties = evaluationContext.Properties;
+        }
+
+        public static DefaultAuthorizationContext Empty
+        {
+            get
+            {
+                if (LocalAppContextSwitches.EnableCachedEmptyDefaultAuthorizationContext)
+                {
+                    if (empty == null)
+                        empty = new DefaultAuthorizationContext(new DefaultEvaluationContext());
+                    return empty;
+                }
+                else
+                {
+                    return new DefaultAuthorizationContext(new DefaultEvaluationContext());
+                }
+            }
+        }
+
+        public override string Id
+        {
+            get
+            {
+                if (this.id == null)
+                    this.id = SecurityUniqueId.Create();
+                return this.id.Value;
+            }
+        }
+
+        public override ReadOnlyCollection<ClaimSet> ClaimSets
+        {
+            get { return this.claimSets; }
+        }
+
+        public override DateTime ExpirationTime
+        {
+            get { return this.expirationTime; }
+        }
+
+        public override IDictionary<string, object> Properties
+        {
+            get { return this.properties; }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Policy/DefaultEvaluationContext.cs

@@ -0,0 +1,74 @@
+//------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.  All rights reserved.
+//------------------------------------------------------------
+
+namespace System.IdentityModel.Policy
+{
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Collections.ObjectModel;
+    using System.IdentityModel.Claims;
+
+    class DefaultEvaluationContext : EvaluationContext
+    {
+        List<ClaimSet> claimSets;
+        Dictionary<string, object> properties;
+        DateTime expirationTime = SecurityUtils.MaxUtcDateTime;
+        int generation;
+
+        ReadOnlyCollection<ClaimSet> readOnlyClaimSets;
+
+        public DefaultEvaluationContext()
+        {
+            this.properties = new Dictionary<string, object>();
+            this.generation = 0;
+        }
+
+        public override int Generation
+        {
+            get { return this.generation; }
+        }
+
+        public override ReadOnlyCollection<ClaimSet> ClaimSets
+        {
+            get 
+            {
+                if (this.claimSets == null)
+                    return EmptyReadOnlyCollection<ClaimSet>.Instance;
+
+                if (this.readOnlyClaimSets == null)
+                    this.readOnlyClaimSets = new ReadOnlyCollection<ClaimSet>(this.claimSets);
+
+                return this.readOnlyClaimSets; 
+            }
+        }
+
+        public override IDictionary<string, object> Properties
+        {
+            get { return this.properties; }
+        }
+
+        public DateTime ExpirationTime
+        {
+            get { return this.expirationTime; }
+        }
+
+        public override void AddClaimSet(IAuthorizationPolicy policy, ClaimSet claimSet)
+        {
+            if (claimSet == null)
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("claimSet");
+
+            if (this.claimSets == null)
+                this.claimSets = new List<ClaimSet>();
+
+            this.claimSets.Add(claimSet);
+            ++this.generation;
+        }
+
+        public override void RecordExpirationTime(DateTime expirationTime)
+        {
+            if (this.expirationTime > expirationTime)
+                this.expirationTime = expirationTime;
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Policy/EvaluationContext.cs

@@ -0,0 +1,19 @@
+//------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.  All rights reserved.
+//------------------------------------------------------------
+
+namespace System.IdentityModel.Policy
+{
+    using System.Collections.Generic;
+    using System.Collections.ObjectModel;
+    using System.IdentityModel.Claims;
+
+    public abstract class EvaluationContext
+    {
+        public abstract ReadOnlyCollection<ClaimSet> ClaimSets { get; }
+        public abstract IDictionary<string, object> Properties { get; }
+        public abstract int Generation { get; }
+        public abstract void AddClaimSet(IAuthorizationPolicy policy, ClaimSet claimSet);
+        public abstract void RecordExpirationTime(DateTime expirationTime);
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Policy/IAuthorizationComponent.cs

@@ -0,0 +1,12 @@
+//------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.  All rights reserved.
+//------------------------------------------------------------
+
+namespace System.IdentityModel.Policy
+{
+    public interface IAuthorizationComponent
+    {
+        string Id { get; }
+    }
+}
+

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Policy/IAuthorizationPolicy.cs

@@ -0,0 +1,21 @@
+//------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.  All rights reserved.
+//------------------------------------------------------------
+
+namespace System.IdentityModel.Policy
+{
+    using System.IdentityModel.Claims;
+
+    // Issues claimsets whose conditions (if any) have been evaluated.
+    public interface IAuthorizationPolicy : IAuthorizationComponent
+    {
+        ClaimSet Issuer { get; }
+
+        // Evaluates conditions (if any) against the context, may add grants to the context
+        // Return 'false' if for this evaluation, should be called again if claims change. (eg. not done)
+        // Return 'true' if no more claims will be added regardless of changes for this evaluation (eg. done).
+        // 'state' is good for this evaluation only. Will be null if starting again.
+        // Implementations should expect to be called multiple times on different threads.
+        bool Evaluate(EvaluationContext evaluationContext, ref object state);
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Policy/UnconditionalPolicy.cs

@@ -0,0 +1,252 @@
+//------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.  All rights reserved.
+//------------------------------------------------------------
+
+namespace System.IdentityModel.Policy
+{
+    using System.Collections.Generic;
+    using System.Collections.ObjectModel;
+    using System.IdentityModel.Claims;
+    using System.Security.Principal;
+
+    interface IIdentityInfo
+    {
+        IIdentity Identity { get; }
+    }
+
+    class UnconditionalPolicy : IAuthorizationPolicy, IDisposable
+    {
+        SecurityUniqueId id;
+        ClaimSet issuer;
+        ClaimSet issuance;
+        ReadOnlyCollection<ClaimSet> issuances;
+        DateTime expirationTime;
+        IIdentity primaryIdentity;
+        bool disposable = false;
+        bool disposed = false;
+
+        public UnconditionalPolicy(ClaimSet issuance)
+            : this(issuance, SecurityUtils.MaxUtcDateTime)
+        {
+        }
+
+        public UnconditionalPolicy(ClaimSet issuance, DateTime expirationTime)
+        {
+            if (issuance == null)
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("issuance");
+
+            Initialize(ClaimSet.System, issuance, null, expirationTime);
+        }
+
+        public UnconditionalPolicy(ReadOnlyCollection<ClaimSet> issuances, DateTime expirationTime)
+        {
+            if (issuances == null)
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("issuances");
+
+            Initialize(ClaimSet.System, null, issuances, expirationTime);
+        }
+
+        internal UnconditionalPolicy(IIdentity primaryIdentity, ClaimSet issuance)
+            : this(issuance)
+        {
+            this.primaryIdentity = primaryIdentity;
+        }
+
+        internal UnconditionalPolicy(IIdentity primaryIdentity, ClaimSet issuance, DateTime expirationTime)
+            : this(issuance, expirationTime)
+        {
+            this.primaryIdentity = primaryIdentity;
+        }
+
+        internal UnconditionalPolicy(IIdentity primaryIdentity, ReadOnlyCollection<ClaimSet> issuances, DateTime expirationTime)
+            : this(issuances, expirationTime)
+        {
+            this.primaryIdentity = primaryIdentity;
+        }
+
+        UnconditionalPolicy(UnconditionalPolicy from)
+        {
+            this.disposable = from.disposable;
+            this.primaryIdentity = from.disposable ? SecurityUtils.CloneIdentityIfNecessary(from.primaryIdentity) : from.primaryIdentity;
+            if (from.issuance != null)
+            {
+                this.issuance = from.disposable ? SecurityUtils.CloneClaimSetIfNecessary(from.issuance) : from.issuance;
+            }
+            else
+            {
+                this.issuances = from.disposable ? SecurityUtils.CloneClaimSetsIfNecessary(from.issuances) : from.issuances;
+            }
+            this.issuer = from.issuer;
+            this.expirationTime = from.expirationTime;
+        }
+
+        void Initialize(ClaimSet issuer, ClaimSet issuance, ReadOnlyCollection<ClaimSet> issuances, DateTime expirationTime)
+        {
+            this.issuer = issuer;
+            this.issuance = issuance;
+            this.issuances = issuances;
+            this.expirationTime = expirationTime;
+            if (issuance != null)
+            {
+                this.disposable = issuance is WindowsClaimSet;
+            }
+            else
+            {
+                for (int i = 0; i < issuances.Count; ++i)
+                {
+                    if (issuances[i] is WindowsClaimSet)
+                    {
+                        this.disposable = true;
+                        break;
+                    }
+                }
+            }
+        }
+
+        public string Id
+        {
+            get
+            {
+                if (this.id == null)
+                    this.id = SecurityUniqueId.Create();
+                return this.id.Value; 
+            }
+        }
+
+        public ClaimSet Issuer
+        {
+            get { return this.issuer; }
+        }
+
+        internal IIdentity PrimaryIdentity
+        {
+            get 
+            {
+                ThrowIfDisposed();
+                if (this.primaryIdentity == null)
+                {
+                    IIdentity identity = null;
+                    if (this.issuance != null)
+                    {
+                        if (this.issuance is IIdentityInfo)
+                        {
+                            identity = ((IIdentityInfo)this.issuance).Identity;
+                        }
+                    }
+                    else
+                    {
+                        for (int i = 0; i < this.issuances.Count; ++i)
+                        {
+                            ClaimSet issuance = this.issuances[i];
+                            if (issuance is IIdentityInfo)
+                            {
+                                identity = ((IIdentityInfo)issuance).Identity;
+                                // Preferably Non-Anonymous
+                                if (identity != null && identity != SecurityUtils.AnonymousIdentity)
+                                {
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                    this.primaryIdentity = identity ?? SecurityUtils.AnonymousIdentity;
+                }
+                return this.primaryIdentity;
+            }
+        }
+
+        internal ReadOnlyCollection<ClaimSet> Issuances
+        {
+            get 
+            {
+                ThrowIfDisposed();
+                if (this.issuances == null)
+                {
+                    List<ClaimSet> issuances = new List<ClaimSet>(1);
+                    issuances.Add(issuance);
+                    this.issuances = issuances.AsReadOnly();
+                }
+                return this.issuances; 
+            }
+        }
+
+        public DateTime ExpirationTime
+        {
+            get { return this.expirationTime; }
+        }
+
+        internal bool IsDisposable
+        {
+            get { return this.disposable; }
+        }
+
+        internal UnconditionalPolicy Clone()
+        {
+            ThrowIfDisposed();
+            return (this.disposable) ? new UnconditionalPolicy(this) : this;
+        }
+
+        public virtual void Dispose()
+        {
+            if (this.disposable && !this.disposed)
+            {
+                this.disposed = true;
+                SecurityUtils.DisposeIfNecessary(this.primaryIdentity as WindowsIdentity);
+                SecurityUtils.DisposeClaimSetIfNecessary(this.issuance);
+                SecurityUtils.DisposeClaimSetsIfNecessary(this.issuances);
+            }
+        }
+
+        void ThrowIfDisposed()
+        {
+            if (this.disposed)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ObjectDisposedException(this.GetType().FullName));
+            }
+        }
+
+        public virtual bool Evaluate(EvaluationContext evaluationContext, ref object state)
+        {
+            ThrowIfDisposed();
+            if (this.issuance != null)
+            {
+                evaluationContext.AddClaimSet(this, this.issuance);
+            }
+            else
+            {
+                for (int i = 0; i < this.issuances.Count; ++i)
+                {
+                    if (this.issuances[i] != null)
+                    {
+                        evaluationContext.AddClaimSet(this, this.issuances[i]);
+                    }
+                }
+            }
+
+            // Preferably Non-Anonymous
+            if (this.PrimaryIdentity != null && this.PrimaryIdentity != SecurityUtils.AnonymousIdentity)
+            {
+                IList<IIdentity> identities;
+                object obj;
+                if (!evaluationContext.Properties.TryGetValue(SecurityUtils.Identities, out obj))
+                {
+                    identities = new List<IIdentity>(1);
+                    evaluationContext.Properties.Add(SecurityUtils.Identities, identities);
+                }
+                else
+                {
+                    // null if other overrides the property with something else
+                    identities = obj as IList<IIdentity>;
+                }
+
+                if (identities != null)
+                {
+                    identities.Add(this.PrimaryIdentity);
+                }
+            }
+
+            evaluationContext.RecordExpirationTime(this.expirationTime);
+            return true;
+        }
+    }
+}