//******************************************************************************************************//  SecurityPrincipal.cs - Gbtc////  Copyright © 2012, Grid Protection Alliance.  All Rights Reserved.////  Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See//  the NOTICE file distributed with this work for additional information regarding copyright ownership.//  The GPA licenses this file to you under the MIT License (MIT), the "License"; you may//  not use this file except in compliance with the License. You may obtain a copy of the License at:////      http://www.opensource.org/licenses/MIT////  Unless agreed to in writing, the subject software distributed under the License is distributed on an//  "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the//  License for the specific language governing permissions and limitations.////  Code Modification History://  ----------------------------------------------------------------------------------------------------//  03/22/2010 - Pinal C. Patel//       Generated original version of source code.//  12/03/2010 - Pinal C. Patel//       Modified IsInRole() to allow for translation of role name before applying security using it.//  12/20/2012 - Starlynn Danyelle Gilliam//       Modified Header.////****************************************************************************************************** using System;using System.Linq;using System.Security.Principal; namespace GSF.Security{    /// <summary>    /// A class that implements <see cref="IPrincipal"/> interface to facilitate custom role-based security.    /// </summary>    /// <seealso cref="SecurityIdentity"/>    /// <seealso cref="ISecurityProvider"/>    public class SecurityPrincipal : IPrincipal    {        #region [ Members ]         // Fields        private readonly SecurityIdentity m_identity;         #endregion         #region [ Constructors ]         /// <summary>        /// Initializes a new instance of the <see cref="SecurityPrincipal"/> class.        /// </summary>        /// <param name="identity">An <see cref="SecurityIdentity"/> object.</param>        /// <exception cref="ArgumentNullException">Value specified for <paramref name="identity"/> is null.</exception>        public SecurityPrincipal(SecurityIdentity identity)        {            if (identity == null)                throw new ArgumentNullException(nameof(identity));             m_identity = identity;        }         #endregion         #region [ Properties ]         /// <summary>        /// Gets the <see cref="SecurityIdentity"/> object of the user.        /// </summary>        public SecurityIdentity Identity        {            get            {                return m_identity;            }        }         /// <summary>        /// Gets the <see cref="IIdentity"/> object of the user.        /// </summary>        IIdentity IPrincipal.Identity        {            get            {                return m_identity;            }        }         #endregion         #region [ Methods ]         /// <summary>        /// Determines whether the user is a member of either of the specified <paramref name="roles"/>.        /// </summary>        /// <param name="roles">Comma separated list of roles to check.</param>        /// <returns>true if the user is a member of either of the specified <paramref name="roles"/>, otherwise false.</returns>        public bool IsInRole(string roles)        {            if (!m_identity.Provider.UserData.IsDefined || !m_identity.Provider.IsUserAuthenticated ||                m_identity.Provider.UserData.IsDisabled || m_identity.Provider.UserData.IsLockedOut)            {                // No need to check user roles.                return false;            }             // Check if user has any one of the specified roles.            foreach (string role in roles.Split(','))            {                if (m_identity.Provider.UserData.Roles.FirstOrDefault(currentRole => (SecurityProviderUtility.IsRegexMatch(m_identity.Provider.TranslateRole(role.Trim()), currentRole))) != null)                    return true;            }             return false;        }         #endregion         #region [ Static ]         // Static Methods         /// <summary>        /// Gets the reason phrase to return for an unauthorized response.        /// </summary>        /// <param name="securityPrincipal">Security principal being authenticated, can be <c>null</c>.</param>        /// <param name="authorizationScheme">Authentication scheme in use.</param>        /// <param name="useProviderReason"><c>true</c> to use detailed response from security provider.</param>        /// <returns>Reason phrase to return for an unauthorized response.</returns>        /// <remarks>        /// Detailed provider response should normally only be used for diagnostics, a more obscure reason is considered        /// more secure since it limits knowledge about the successful elements of an authentication attempt.        /// </remarks>        public static string GetFailureReasonPhrase(SecurityPrincipal securityPrincipal, string authorizationScheme = "Basic", bool useProviderReason = false)        {            if ((object)securityPrincipal == null)                return "Invalid user name or password";             if (useProviderReason)            {                // The security provider should be able to provide a reason for the failure                string failureReason = securityPrincipal.Identity.Provider?.AuthenticationFailureReason;                 if (!string.IsNullOrEmpty(failureReason))                    return failureReason;            }             if (authorizationScheme == "Basic")                return "Invalid user name or password";             return "Missing credentials";        }         #endregion    }}