Imported Upstream version 4.6.0.125

Former-commit-id: a2155e9bd80020e49e72e86c44da02a8ac0e57a4

mcs/class/referencesource/System.ServiceModel/System/ServiceModel/ServiceAuthorizationManager.cs

@@ -0,0 +1,88 @@
+//-----------------------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.  All rights reserved.
+//-----------------------------------------------------------------------------
+
+namespace System.ServiceModel
+{
+    using System.Collections.Generic;
+    using System.ServiceModel.Channels;
+    using System.ServiceModel.Description;
+    using System.Collections.ObjectModel;
+    using System.Diagnostics;
+    using System.IdentityModel.Policy;
+    using System.ServiceModel.Diagnostics;
+    using System.ServiceModel.Security;
+
+    public class ServiceAuthorizationManager
+    {
+        // This is the API called by framework to perform CheckAccess.
+        // The API is responsible for ...
+        // 1) Evaluate all policies (Forward\Backward)
+        // 2) Optionally wire up the resulting AuthorizationContext 
+        //    to ServiceSecurityContext.
+        // 3) An availability of message content to make an authoritive decision. 
+        // 4) Return the authoritive decision true/false (allow/deny).
+        public virtual bool CheckAccess(OperationContext operationContext, ref Message message)
+        {
+            return CheckAccess(operationContext);
+        }
+
+        public virtual bool CheckAccess(OperationContext operationContext)
+        {
+            if (operationContext == null)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("operationContext");
+            }
+
+            // default to forward-chaining implementation
+            // 1) Get policies that will participate in chain process.
+            //    We provide a safe default policies set below.
+            ReadOnlyCollection<IAuthorizationPolicy> authorizationPolicies = GetAuthorizationPolicies(operationContext);
+
+            // 2) Do forward chaining and wire the new ServiceSecurityContext
+            operationContext.IncomingMessageProperties.Security.ServiceSecurityContext =
+                new ServiceSecurityContext(authorizationPolicies ?? EmptyReadOnlyCollection<IAuthorizationPolicy>.Instance);
+
+            // 3) Call the CheckAccessCore
+            return CheckAccessCore(operationContext);
+        }
+
+        // Define the set of policies taking part in chaining.  We will provide
+        // the safe default set (primary token + all supporting tokens except token with
+        // with SecurityTokenAttachmentMode.Signed + transport token).  Implementor
+        // can override and provide different selection of policies set.
+        protected virtual ReadOnlyCollection<IAuthorizationPolicy> GetAuthorizationPolicies(OperationContext operationContext)
+        {
+            SecurityMessageProperty security = operationContext.IncomingMessageProperties.Security;
+            if (security == null)
+            {
+                return EmptyReadOnlyCollection<IAuthorizationPolicy>.Instance;
+            }
+
+            ReadOnlyCollection<IAuthorizationPolicy> externalPolicies = security.ExternalAuthorizationPolicies;
+            if (security.ServiceSecurityContext == null)
+            {
+                return externalPolicies ?? EmptyReadOnlyCollection<IAuthorizationPolicy>.Instance;
+            }
+
+            ReadOnlyCollection<IAuthorizationPolicy> authorizationPolicies = security.ServiceSecurityContext.AuthorizationPolicies;
+            if (externalPolicies == null || externalPolicies.Count <= 0)
+            {
+                return authorizationPolicies;
+            }
+
+            // Combine 
+            List<IAuthorizationPolicy> policies = new List<IAuthorizationPolicy>(authorizationPolicies);
+            policies.AddRange(externalPolicies);
+            return policies.AsReadOnly();
+        }
+
+        // Implementor overrides this API to make authoritive decision.
+        // The AuthorizationContext in opContext is generally the result from forward chain.
+        protected virtual bool CheckAccessCore(OperationContext operationContext)
+        {
+            return true;
+        }
+    }
+}
+