Table of Contents

Class EndpointSignedAuthentication

Namespace
The.Security
Assembly
Instagile.dll

Authenticates with authentication, except that operation signatures come from endpointAuthentication, typically the shared secret of a SigningProxyEndpoint in front of this server.

public sealed class EndpointSignedAuthentication : IAuthentication
Inheritance
EndpointSignedAuthentication
Implements
Inherited Members

Constructors

EndpointSignedAuthentication(IAuthentication, IAuthentication)

Authenticates with authentication, except that operation signatures come from endpointAuthentication, typically the shared secret of a SigningProxyEndpoint in front of this server.

public EndpointSignedAuthentication(IAuthentication authentication, IAuthentication endpointAuthentication)

Parameters

authentication IAuthentication
endpointAuthentication IAuthentication

Properties

CanEncrypt

true if the authenticator supports secured key exchange

public bool CanEncrypt { get; }

Property Value

bool

Remarks

this is used to establish shared secrets. implementations could be based on public key cryptography, diffie-helmann, or out of band methods

CanLookup

true if the authenticator supports looking up an IUserAccount for an authenticator-specific username

public bool CanLookup { get; }

Property Value

bool

CanSign

true if the authenticator supports digital signatures (not necessarily cryptographic)

public bool CanSign { get; }

Property Value

bool

Remarks

signature doesn't have to be based on the operation; it can use some other capability like ambient windows logon

IsAuthoritative

If true, the returned identity should be accepted without server verification

public bool IsAuthoritative { get; }

Property Value

bool

Remarks

May depend on ambient state - don't cache the result. As well as enabling automatic login, this is used by SecurityService to decide whether it's ok to perform purely-local authentication without calling IEntityStore.Connect.

Realm

Describes identities within the purview of this authenticator

public string Realm { get; }

Property Value

string

RequiresCredentials

Expects non-empty Credentials in order to perform client-side identity operations

public bool RequiresCredentials { get; }

Property Value

bool

Methods

AnswerSessionChallengeAsync(IAlgorithmProvider, Credentials, byte[])

Answer a challenge issued by CreateSessionChallengeAsync(IEntityContext, Identity), using the supplied credentials.

public Task<AuthenticationResult<byte[]>> AnswerSessionChallengeAsync(IAlgorithmProvider algorithmProvider, Credentials credentials, byte[] challenge)

Parameters

algorithmProvider IAlgorithmProvider
credentials Credentials
challenge byte[]

Returns

Task<AuthenticationResult<byte[]>>

CheckSignatureAsync(IEntityContext, Identity, byte[], byte[])

check a signature by the specified identity (which may be from various realms)

public Task<AuthenticationResult> CheckSignatureAsync(IEntityContext scopedContext, Identity subject, byte[] operation, byte[] token)

Parameters

scopedContext IEntityContext
subject Identity
operation byte[]
token byte[]

Returns

Task<AuthenticationResult>

(signature found for user, null/reason for failure)

CreateSessionChallengeAsync(IEntityContext, Identity)

Issue a challenge which the client must answer before a session is prepared for the subject, or null if the session needs no answer.

public Task<AuthenticationResult<byte[]?>> CreateSessionChallengeAsync(IEntityContext scopedContext, Identity subject)

Parameters

scopedContext IEntityContext
subject Identity

Returns

Task<AuthenticationResult<byte[]>>

CreateSignatureAsync(Credentials, byte[])

sign a message using the supplied credentials

public Task<AuthenticationResult<byte[]>> CreateSignatureAsync(Credentials credentials, byte[] operation)

Parameters

credentials Credentials
operation byte[]

Returns

Task<AuthenticationResult<byte[]>>

opaque signature

DecryptDataAsync(IAlgorithmProvider, Credentials, byte[])

decrypt a message addressed to the supplied credentials

public Task<AuthenticationResult<byte[]>> DecryptDataAsync(IAlgorithmProvider algorithmProvider, Credentials credentials, byte[] data)

Parameters

algorithmProvider IAlgorithmProvider
credentials Credentials
data byte[]

Returns

Task<AuthenticationResult<byte[]>>

(decrypted message/null, null/reason for failure)

EncryptDataAsync(IAlgorithmProvider, object?, byte[])

create an encrypted message which can only be decrypted by the specified subject (which will be an account username if CanLookup)

public Task<AuthenticationResult<byte[]>> EncryptDataAsync(IAlgorithmProvider algorithmProvider, object? state, byte[] data)

Parameters

algorithmProvider IAlgorithmProvider
state object
data byte[]

Returns

Task<AuthenticationResult<byte[]>>

encrypted message

GetIdentity(Credentials)

Extract a subject from the environment or the supplied credentials.

public AuthenticationResult<string> GetIdentity(Credentials credentials)

Parameters

credentials Credentials

Returns

AuthenticationResult<string>

subject name, unverified - from local knowledge only

GetIdentity2(Credentials)

Extract an identity, including its realm, from the environment or the supplied credentials.

public AuthenticationResult<Identity> GetIdentity2(Credentials credentials)

Parameters

credentials Credentials

Returns

AuthenticationResult<Identity>

identity, unverified - from local knowledge only

Remarks

The default places the GetIdentity(Credentials) subject in this authenticator's AuthenticatedRealm, which is correct for most authenticators. Override to place subjects in another realm, e.g. AnonymousRealm.

LookupAccount(string)

Find the username of an IUserAccount for a username produced by this authenticator. Available synchronously only if IsAuthoritative returns true.

public AuthenticationResult<string> LookupAccount(string subject)

Parameters

subject string

Returns

AuthenticationResult<string>

LookupAccountAsync(IEntityContext, string)

Find the username of an IUserAccount for a username produced by this authenticator.

public Task<AuthenticationResult<string>> LookupAccountAsync(IEntityContext scopedContext, string subject)

Parameters

scopedContext IEntityContext
subject string

Returns

Task<AuthenticationResult<string>>

PrepareSessionAsync(IEntityContext, Identity, byte[]?, byte[]?)

Prepare an encrypted session with the specified subject by looking up their account and retrieving authentication state.

public Task<AuthenticationResult<Handshake<object?>>> PrepareSessionAsync(IEntityContext scopedContext, Identity subject, byte[]? challenge, byte[]? answer)

Parameters

scopedContext IEntityContext

A preauthenticated context for plugin operations.

subject Identity

The identity for which to prepare a session.

challenge byte[]

The challenge issued by CreateSessionChallengeAsync(IEntityContext, Identity), if any.

answer byte[]

The client's answer to the challenge, if any.

Returns

Task<AuthenticationResult<Handshake<object>>>

A handshake containing the session type and associated state for use in subsequent encryption operations.

VerifyIdentity(Credentials, string)

Verify that the subject matches the supplied credentials. Available synchronously only if IsAuthoritative returns true.

public AuthenticationResult VerifyIdentity(Credentials credentials, string subject)

Parameters

credentials Credentials
subject string

Returns

AuthenticationResult

(true/false for authentication state, null/reason for failure)

VerifyIdentityAsync(Credentials, IEntityContext, string)

verify that the subject matches the supplied credentials

public Task<AuthenticationResult> VerifyIdentityAsync(Credentials credentials, IEntityContext scopedContext, string subject)

Parameters

credentials Credentials
scopedContext IEntityContext
subject string

Returns

Task<AuthenticationResult>

(true/false for authentication state, null/reason for failure)