WindowsSystemIdentityFactory.cs

Go to the documentation of this file.

using Microsoft.Extensions.Logging;
using Microsoft.Win32.SafeHandles;
using System;
using System.DirectoryServices.AccountManagement;
using System.Security.Principal;
using System.Threading;
using System.Threading.Tasks;
using Tgstation.Server.Host.Models;

namespace Tgstation.Server.Host.Security
{
    sealed class WindowsSystemIdentityFactory : ISystemIdentityFactory
    {
        readonly ILogger<WindowsSystemIdentityFactory> logger;

        static void GetUserAndDomainName(string input, out string username, out string domainName)
        {
            var splits = input.Split('\\');
            username = splits.Length > 1 ? splits[1] : splits[0];
            domainName = splits.Length > 1 ? splits[0] : null;
        }

        public WindowsSystemIdentityFactory(ILogger<WindowsSystemIdentityFactory> logger)
        {
            this.logger = logger ?? throw new ArgumentNullException(nameof(logger));
        }

        public ISystemIdentity GetCurrent() => new WindowsSystemIdentity(WindowsIdentity.GetCurrent());

        public Task<ISystemIdentity> CreateSystemIdentity(User user, CancellationToken cancellationToken) => Task.Factory.StartNew(() =>
        {
            if (user == null)
                throw new ArgumentNullException(nameof(user));

            if (user.SystemIdentifier == null)
                throw new InvalidOperationException("User's SystemIdentifier must not be null!");

            PrincipalContext pc = null;
            UserPrincipal principal = null;

            bool TryGetPrincipalFromContextType(ContextType contextType)
            {
                try
                {
                    pc = new PrincipalContext(contextType);
                    cancellationToken.ThrowIfCancellationRequested();
                    principal = UserPrincipal.FindByIdentity(pc, user.SystemIdentifier);
                }
                catch (OperationCanceledException)
                {
                    throw;
                }
                catch (Exception e)
                {
                    logger.LogWarning("Error loading user for context type {0}! Exception: {1}", contextType, e);
                }
                finally
                {
                    if (principal == null)
                    {
                        pc?.Dispose();
                        cancellationToken.ThrowIfCancellationRequested();
                    }
                }

                return principal != null;
            }

            if (!TryGetPrincipalFromContextType(ContextType.Machine) && !TryGetPrincipalFromContextType(ContextType.Domain))
                return null;
            return (ISystemIdentity)new WindowsSystemIdentity(principal);
        },
            cancellationToken, TaskCreationOptions.LongRunning, TaskScheduler.Current);

        public Task<ISystemIdentity> CreateSystemIdentity(string username, string password, CancellationToken cancellationToken) => Task.Factory.StartNew(() =>
        {
            if (username == null)
                throw new ArgumentNullException(nameof(username));
            if (password == null)
                throw new ArgumentNullException(nameof(password));

            var originalUsername = username;
            GetUserAndDomainName(originalUsername, out username, out var domainName);

            var res = NativeMethods.LogonUser(username, domainName, password, 3 /*LOGON32_LOGON_NETWORK*/, 0 /*LOGON32_PROVIDER_DEFAULT*/, out var token);
            if (!res)
            {
                logger.LogTrace("Invalid system identity/password combo for username {0}!", originalUsername);
                return null;
            }

            logger.LogTrace("Authenticated username {0} using system identity!", originalUsername);

            using (var handle = new SafeAccessTokenHandle(token)) // checked internally, windows identity always duplicates the handle when constructed with a userToken
                return (ISystemIdentity)new WindowsSystemIdentity(new WindowsIdentity(handle.DangerousGetHandle()));   // https://github.com/dotnet/corefx/blob/6ed61acebe3214fcf79b4274f2bb9b55c0604a4d/src/System.Security.Principal.Windows/src/System/Security/Principal/WindowsIdentity.cs#L271
        }, cancellationToken, TaskCreationOptions.LongRunning, TaskScheduler.Current);
    }
}