540 lines
21 KiB
C#
540 lines
21 KiB
C#
using System.Diagnostics;
|
|
using System.Net;
|
|
using SGU.AuthBroker.Core.Authentication;
|
|
using SGU.AuthBroker.Core.Identity;
|
|
using SGU.AuthBroker.Core.Profiles;
|
|
using SGU.AuthBroker.Options;
|
|
|
|
namespace SGU.AuthBroker.Services;
|
|
|
|
public sealed class NtlmCredentialValidator : INtlmCredentialValidator
|
|
{
|
|
private readonly NtlmOptions options;
|
|
private readonly ILogger<NtlmCredentialValidator> logger;
|
|
private readonly Func<CredentialCache, CookieContainer, HttpMessageHandler> handlerFactory;
|
|
|
|
public NtlmCredentialValidator(
|
|
BrokerOptions options,
|
|
ILogger<NtlmCredentialValidator> logger)
|
|
: this(options, logger, CreateHandler)
|
|
{
|
|
}
|
|
|
|
internal NtlmCredentialValidator(
|
|
BrokerOptions options,
|
|
ILogger<NtlmCredentialValidator> logger,
|
|
Func<CredentialCache, CookieContainer, HttpMessageHandler> handlerFactory)
|
|
{
|
|
this.options = options.Ntlm;
|
|
this.logger = logger;
|
|
this.handlerFactory = handlerFactory;
|
|
}
|
|
|
|
public async Task<NtlmValidationResult> ValidateAsync(
|
|
UserIdentity identity,
|
|
string password,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Uri authenticationUri = new(
|
|
new Uri(options.Endpoint, UriKind.Absolute),
|
|
options.AuthenticationPath);
|
|
HashSet<string> allowedHosts = new(
|
|
this.options.AllowedRedirectHosts,
|
|
StringComparer.OrdinalIgnoreCase);
|
|
|
|
NetworkCredential credential = new(identity.UserName, password, this.options.Domain);
|
|
CredentialCache credentialCache = new();
|
|
CookieContainer cookieContainer = new();
|
|
|
|
using HttpMessageHandler handler = handlerFactory(credentialCache, cookieContainer);
|
|
using HttpClient client = new(handler)
|
|
{
|
|
Timeout = Timeout.InfiniteTimeSpan,
|
|
DefaultRequestVersion = HttpVersion.Version11,
|
|
DefaultVersionPolicy = HttpVersionPolicy.RequestVersionExact
|
|
};
|
|
client.DefaultRequestHeaders.UserAgent.ParseAdd("SGU-AuthBroker/1.0");
|
|
|
|
try
|
|
{
|
|
(NtlmValidationResult? authenticationFailure, Uri? continuationUri) = await ValidateCredentialsAsync(
|
|
client,
|
|
authenticationUri,
|
|
allowedHosts,
|
|
credentialCache,
|
|
credential,
|
|
cancellationToken).ConfigureAwait(false);
|
|
if (authenticationFailure is not null)
|
|
{
|
|
return authenticationFailure;
|
|
}
|
|
|
|
InstitutionalProfile? profile = await TryFetchProfileAsync(
|
|
client,
|
|
identity,
|
|
allowedHosts,
|
|
continuationUri,
|
|
cancellationToken).ConfigureAwait(false);
|
|
return NtlmValidationResult.Valid(profile);
|
|
}
|
|
finally
|
|
{
|
|
credential.Password = string.Empty;
|
|
}
|
|
}
|
|
|
|
private async Task<(NtlmValidationResult? Failure, Uri? ContinuationUri)> ValidateCredentialsAsync(
|
|
HttpClient client,
|
|
Uri authenticationUri,
|
|
HashSet<string> allowedHosts,
|
|
CredentialCache credentialCache,
|
|
NetworkCredential credential,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
if (!IsAllowedHttpsUri(authenticationUri, allowedHosts))
|
|
{
|
|
return (NtlmValidationResult.Unavailable("NTLM_AUTH_ENDPOINT_REJECTED"), null);
|
|
}
|
|
|
|
using CancellationTokenSource timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
|
|
timeout.CancelAfter(TimeSpan.FromSeconds(options.TimeoutSeconds));
|
|
Stopwatch elapsed = Stopwatch.StartNew();
|
|
|
|
try
|
|
{
|
|
Uri current = authenticationUri;
|
|
for (int hop = 0; hop <= options.MaxRedirects; hop++)
|
|
{
|
|
if (!IsAllowedHttpsUri(current, allowedHosts))
|
|
{
|
|
return (NtlmValidationResult.Unavailable("NTLM_AUTH_ENDPOINT_REJECTED"), null);
|
|
}
|
|
|
|
using HttpRequestMessage probeRequest = new(HttpMethod.Get, current);
|
|
using HttpResponseMessage probeResponse = await client
|
|
.SendAsync(probeRequest, HttpCompletionOption.ResponseHeadersRead, timeout.Token)
|
|
.ConfigureAwait(false);
|
|
|
|
int probeStatus = (int)probeResponse.StatusCode;
|
|
if (probeStatus is >= 300 and < 400)
|
|
{
|
|
Uri? redirect = ResolveAllowedRedirect(current, probeResponse, allowedHosts);
|
|
if (redirect is null)
|
|
{
|
|
return (NtlmValidationResult.Unavailable("NTLM_AUTH_REDIRECT_REJECTED"), null);
|
|
}
|
|
|
|
logger.LogDebug(
|
|
"SGU authentication discovery followed redirect hop {Hop} to {Path}.",
|
|
hop + 1,
|
|
redirect.AbsolutePath);
|
|
current = redirect;
|
|
continue;
|
|
}
|
|
|
|
if (probeResponse.StatusCode == HttpStatusCode.Unauthorized)
|
|
{
|
|
if (!OffersNtlmChallenge(probeResponse))
|
|
{
|
|
logger.LogWarning(
|
|
"SGU returned 401 without an NTLM challenge at {Path}.",
|
|
current.AbsolutePath);
|
|
return (NtlmValidationResult.Unavailable("NTLM_CHALLENGE_MISSING"), null);
|
|
}
|
|
|
|
await DrainResponseAsync(probeResponse, timeout.Token).ConfigureAwait(false);
|
|
AddCredential(current, credentialCache, credential);
|
|
(NtlmValidationResult? failure, Uri? continuationUri) = await AuthenticateChallengedEndpointAsync(
|
|
client,
|
|
current,
|
|
allowedHosts,
|
|
timeout.Token).ConfigureAwait(false);
|
|
if (failure is not null)
|
|
{
|
|
return (failure, null);
|
|
}
|
|
|
|
logger.LogInformation(
|
|
"SGU accepted credentials after an explicit NTLM challenge in {ElapsedMilliseconds} ms.",
|
|
elapsed.ElapsedMilliseconds);
|
|
return (null, continuationUri);
|
|
}
|
|
|
|
if (probeResponse.StatusCode == HttpStatusCode.Forbidden)
|
|
{
|
|
return (NtlmValidationResult.Unavailable("NTLM_CHALLENGE_REJECTED"), null);
|
|
}
|
|
|
|
if (probeStatus is >= 200 and < 300)
|
|
{
|
|
logger.LogWarning(
|
|
"SGU authentication discovery reached {StatusCode} at {Path} without an NTLM challenge; credentials were not accepted.",
|
|
probeStatus,
|
|
current.AbsolutePath);
|
|
return (NtlmValidationResult.Unavailable("NTLM_CHALLENGE_MISSING"), null);
|
|
}
|
|
|
|
return probeStatus is 429 or >= 500
|
|
? (NtlmValidationResult.Unavailable("NTLM_UPSTREAM_ERROR"), null)
|
|
: (NtlmValidationResult.Unavailable("NTLM_UNEXPECTED_RESPONSE"), null);
|
|
}
|
|
|
|
return (NtlmValidationResult.Unavailable("NTLM_REDIRECT_LIMIT"), null);
|
|
}
|
|
catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
|
|
{
|
|
logger.LogWarning(
|
|
"SGU NTLM authentication timed out after {ElapsedMilliseconds} ms.",
|
|
elapsed.ElapsedMilliseconds);
|
|
return (NtlmValidationResult.Unavailable("NTLM_TIMEOUT"), null);
|
|
}
|
|
catch (HttpRequestException exception)
|
|
{
|
|
logger.LogWarning(
|
|
exception,
|
|
"SGU NTLM authentication failed after {ElapsedMilliseconds} ms.",
|
|
elapsed.ElapsedMilliseconds);
|
|
return (NtlmValidationResult.Unavailable(), null);
|
|
}
|
|
}
|
|
|
|
private static async Task<(NtlmValidationResult? Failure, Uri? ContinuationUri)> AuthenticateChallengedEndpointAsync(
|
|
HttpClient client,
|
|
Uri challengeUri,
|
|
HashSet<string> allowedHosts,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
using HttpRequestMessage authenticationRequest = new(HttpMethod.Get, challengeUri);
|
|
using HttpResponseMessage authenticationResponse = await client
|
|
.SendAsync(authenticationRequest, HttpCompletionOption.ResponseHeadersRead, cancellationToken)
|
|
.ConfigureAwait(false);
|
|
|
|
if (authenticationResponse.StatusCode is HttpStatusCode.Unauthorized or HttpStatusCode.Forbidden)
|
|
{
|
|
return (NtlmValidationResult.Invalid(), null);
|
|
}
|
|
|
|
int statusCode = (int)authenticationResponse.StatusCode;
|
|
if (statusCode is >= 200 and < 300)
|
|
{
|
|
await DrainResponseAsync(authenticationResponse, cancellationToken).ConfigureAwait(false);
|
|
return (null, null);
|
|
}
|
|
|
|
if (statusCode is >= 300 and < 400)
|
|
{
|
|
Uri? continuationUri = ResolveAllowedRedirect(
|
|
challengeUri,
|
|
authenticationResponse,
|
|
allowedHosts);
|
|
if (continuationUri is null)
|
|
{
|
|
return (NtlmValidationResult.Unavailable("NTLM_AUTH_REDIRECT_REJECTED"), null);
|
|
}
|
|
|
|
await DrainResponseAsync(authenticationResponse, cancellationToken).ConfigureAwait(false);
|
|
return (null, continuationUri);
|
|
}
|
|
|
|
return statusCode is 429 or >= 500
|
|
? (NtlmValidationResult.Unavailable("NTLM_UPSTREAM_ERROR"), null)
|
|
: (NtlmValidationResult.Unavailable("NTLM_UNEXPECTED_RESPONSE"), null);
|
|
}
|
|
|
|
private async Task<InstitutionalProfile?> TryFetchProfileAsync(
|
|
HttpClient client,
|
|
UserIdentity identity,
|
|
HashSet<string> allowedHosts,
|
|
Uri? continuationUri,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Stopwatch elapsed = Stopwatch.StartNew();
|
|
try
|
|
{
|
|
Uri originalProfileUri = GetProfileUri(identity.Role);
|
|
Uri menuUri = GetProfileUri(InstitutionalRole.Professor);
|
|
Uri current = continuationUri ?? originalProfileUri;
|
|
bool bootstrappingSession = continuationUri is not null;
|
|
bool retriedAfterSessionBootstrap = continuationUri is not null;
|
|
using CancellationTokenSource timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
|
|
timeout.CancelAfter(TimeSpan.FromSeconds(options.ProfileTimeoutSeconds));
|
|
|
|
for (int hop = 0; hop <= options.MaxRedirects; hop++)
|
|
{
|
|
if (!IsAllowedHttpsUri(current, allowedHosts))
|
|
{
|
|
return null;
|
|
}
|
|
|
|
using HttpRequestMessage request = new(HttpMethod.Get, current);
|
|
using HttpResponseMessage response = await client
|
|
.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, timeout.Token)
|
|
.ConfigureAwait(false);
|
|
|
|
int statusCode = (int)response.StatusCode;
|
|
logger.LogDebug(
|
|
"SGU profile response for role {Role} returned HTTP {StatusCode} at hop {Hop} after {ElapsedMilliseconds} ms.",
|
|
identity.Role,
|
|
statusCode,
|
|
hop,
|
|
elapsed.ElapsedMilliseconds);
|
|
if (statusCode is >= 300 and < 400)
|
|
{
|
|
Uri? redirect = ResolveAllowedRedirect(current, response, allowedHosts);
|
|
if (redirect is null)
|
|
{
|
|
logger.LogWarning(
|
|
"SGU profile redirect was rejected for role {Role} at hop {Hop}.",
|
|
identity.Role,
|
|
hop + 1);
|
|
return null;
|
|
}
|
|
|
|
await DrainResponseAsync(response, timeout.Token).ConfigureAwait(false);
|
|
current = redirect;
|
|
continue;
|
|
}
|
|
|
|
if (statusCode is >= 200 and < 300)
|
|
{
|
|
if (bootstrappingSession)
|
|
{
|
|
await DrainResponseAsync(response, timeout.Token).ConfigureAwait(false);
|
|
bootstrappingSession = false;
|
|
current = originalProfileUri;
|
|
logger.LogInformation(
|
|
"SGU post-authentication session bootstrap completed for role {Role}; requesting the original profile page.",
|
|
identity.Role);
|
|
continue;
|
|
}
|
|
|
|
if (identity.Role != InstitutionalRole.Professor &&
|
|
!retriedAfterSessionBootstrap &&
|
|
HasSamePath(current, menuUri))
|
|
{
|
|
await DrainResponseAsync(response, timeout.Token).ConfigureAwait(false);
|
|
retriedAfterSessionBootstrap = true;
|
|
current = originalProfileUri;
|
|
logger.LogInformation(
|
|
"SGU ASP.NET session bootstrap completed for role {Role}; retrying the original profile page.",
|
|
identity.Role);
|
|
continue;
|
|
}
|
|
|
|
InstitutionalProfile? profile = await TryReadProfileAsync(
|
|
response,
|
|
identity,
|
|
timeout.Token).ConfigureAwait(false);
|
|
if (profile is null)
|
|
{
|
|
logger.LogWarning(
|
|
"SGU returned a profile page for role {Role}, but no supported profile fields were found after {ElapsedMilliseconds} ms.",
|
|
identity.Role,
|
|
elapsed.ElapsedMilliseconds);
|
|
}
|
|
else
|
|
{
|
|
logger.LogInformation(
|
|
"SGU profile enrichment completed for role {Role} in {ElapsedMilliseconds} ms.",
|
|
identity.Role,
|
|
elapsed.ElapsedMilliseconds);
|
|
}
|
|
|
|
return profile;
|
|
}
|
|
|
|
logger.LogWarning(
|
|
"SGU profile request for role {Role} returned HTTP {StatusCode} after {ElapsedMilliseconds} ms.",
|
|
identity.Role,
|
|
statusCode,
|
|
elapsed.ElapsedMilliseconds);
|
|
return null;
|
|
}
|
|
|
|
logger.LogWarning(
|
|
"SGU profile request for role {Role} exceeded the redirect limit after {ElapsedMilliseconds} ms.",
|
|
identity.Role,
|
|
elapsed.ElapsedMilliseconds);
|
|
}
|
|
catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
|
|
{
|
|
throw;
|
|
}
|
|
catch (OperationCanceledException)
|
|
{
|
|
logger.LogWarning(
|
|
"SGU profile request for role {Role} timed out after {ElapsedMilliseconds} ms.",
|
|
identity.Role,
|
|
elapsed.ElapsedMilliseconds);
|
|
}
|
|
catch (Exception exception)
|
|
{
|
|
logger.LogWarning(
|
|
exception,
|
|
"SGU profile enrichment failed for role {Role} after {ElapsedMilliseconds} ms.",
|
|
identity.Role,
|
|
elapsed.ElapsedMilliseconds);
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
private static void AddCredential(
|
|
Uri uri,
|
|
CredentialCache credentialCache,
|
|
NetworkCredential credential)
|
|
{
|
|
string authority = uri.GetLeftPart(UriPartial.Authority);
|
|
credentialCache.Add(new Uri(authority + "/"), "NTLM", credential);
|
|
}
|
|
|
|
private static bool OffersNtlmChallenge(HttpResponseMessage response) =>
|
|
response.Headers.WwwAuthenticate.Any(value =>
|
|
string.Equals(value.Scheme, "NTLM", StringComparison.OrdinalIgnoreCase));
|
|
|
|
private static Uri? ResolveAllowedRedirect(
|
|
Uri current,
|
|
HttpResponseMessage response,
|
|
HashSet<string> allowedHosts)
|
|
{
|
|
Uri? location = response.Headers.Location;
|
|
Uri? redirect = location is null
|
|
? null
|
|
: location.IsAbsoluteUri ? location : new Uri(current, location);
|
|
return redirect is not null && IsAllowedHttpsUri(redirect, allowedHosts)
|
|
? redirect
|
|
: null;
|
|
}
|
|
|
|
private static HttpMessageHandler CreateHandler(
|
|
CredentialCache credentialCache,
|
|
CookieContainer cookieContainer) =>
|
|
new HttpClientHandler
|
|
{
|
|
AllowAutoRedirect = false,
|
|
AutomaticDecompression = DecompressionMethods.All,
|
|
CheckCertificateRevocationList = true,
|
|
CookieContainer = cookieContainer,
|
|
Credentials = credentialCache,
|
|
MaxConnectionsPerServer = 4,
|
|
MaxResponseHeadersLength = 64,
|
|
PreAuthenticate = false,
|
|
UseCookies = true,
|
|
UseDefaultCredentials = false,
|
|
UseProxy = false
|
|
};
|
|
|
|
private static bool HasSamePath(Uri left, Uri right) =>
|
|
string.Equals(
|
|
left.AbsolutePath.TrimEnd('/'),
|
|
right.AbsolutePath.TrimEnd('/'),
|
|
StringComparison.OrdinalIgnoreCase);
|
|
|
|
private static async Task DrainResponseAsync(
|
|
HttpResponseMessage response,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
const int maximumDrainBytes = 64 * 1024;
|
|
if (response.Content.Headers.ContentLength is > maximumDrainBytes)
|
|
{
|
|
return;
|
|
}
|
|
|
|
await using Stream stream = await response.Content
|
|
.ReadAsStreamAsync(cancellationToken)
|
|
.ConfigureAwait(false);
|
|
byte[] buffer = new byte[8192];
|
|
int total = 0;
|
|
while (total <= maximumDrainBytes)
|
|
{
|
|
int read = await stream
|
|
.ReadAsync(buffer.AsMemory(), cancellationToken)
|
|
.ConfigureAwait(false);
|
|
if (read == 0)
|
|
{
|
|
return;
|
|
}
|
|
|
|
total += read;
|
|
}
|
|
}
|
|
|
|
private Uri GetProfileUri(InstitutionalRole role)
|
|
{
|
|
Uri endpoint = new(options.Endpoint, UriKind.Absolute);
|
|
string path = role switch
|
|
{
|
|
InstitutionalRole.Administrative => options.AdministrativeProfilePath,
|
|
InstitutionalRole.Student => options.StudentProfilePath,
|
|
InstitutionalRole.Professor => options.MenuProfilePath,
|
|
_ => throw new ArgumentOutOfRangeException(nameof(role), role, null)
|
|
};
|
|
return new Uri(endpoint, path);
|
|
}
|
|
|
|
private async Task<InstitutionalProfile?> TryReadProfileAsync(
|
|
HttpResponseMessage response,
|
|
UserIdentity identity,
|
|
CancellationToken timeoutToken)
|
|
{
|
|
string html = await ReadLimitedStringAsync(
|
|
response.Content,
|
|
options.MaxProfileBytes,
|
|
timeoutToken).ConfigureAwait(false);
|
|
return identity.Role switch
|
|
{
|
|
InstitutionalRole.Administrative =>
|
|
SguProfileParser.ParseAdministrative(html, identity.NumericId) ??
|
|
SguProfileParser.ParseMenu(html),
|
|
InstitutionalRole.Student =>
|
|
SguProfileParser.ParseStudent(html, identity.NumericId) ??
|
|
SguProfileParser.ParseMenu(html),
|
|
InstitutionalRole.Professor => SguProfileParser.ParseMenu(html),
|
|
_ => null
|
|
};
|
|
}
|
|
|
|
private static async Task<string> ReadLimitedStringAsync(
|
|
HttpContent content,
|
|
int maximumBytes,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
if (content.Headers.ContentLength is long contentLength && contentLength > maximumBytes)
|
|
{
|
|
throw new InvalidDataException("The SGU profile response exceeded the configured limit.");
|
|
}
|
|
|
|
await using Stream stream = await content
|
|
.ReadAsStreamAsync(cancellationToken)
|
|
.ConfigureAwait(false);
|
|
using MemoryStream buffer = new(Math.Min(maximumBytes, 64 * 1024));
|
|
byte[] chunk = new byte[8192];
|
|
while (true)
|
|
{
|
|
int read = await stream
|
|
.ReadAsync(chunk.AsMemory(), cancellationToken)
|
|
.ConfigureAwait(false);
|
|
if (read == 0)
|
|
{
|
|
break;
|
|
}
|
|
|
|
if (buffer.Length + read > maximumBytes)
|
|
{
|
|
throw new InvalidDataException("The SGU profile response exceeded the configured limit.");
|
|
}
|
|
|
|
buffer.Write(chunk, 0, read);
|
|
}
|
|
|
|
return SguHtmlDecoder.Decode(
|
|
buffer.GetBuffer().AsSpan(0, checked((int)buffer.Length)),
|
|
content.Headers.ContentType?.CharSet);
|
|
}
|
|
|
|
private static bool IsAllowedHttpsUri(Uri uri, HashSet<string> allowedHosts) =>
|
|
uri.Scheme == Uri.UriSchemeHttps &&
|
|
string.IsNullOrEmpty(uri.UserInfo) &&
|
|
allowedHosts.Contains(uri.IdnHost);
|
|
}
|