//******************************************************************************************************
//  SecurityPolicy.cs - Gbtc
//
//  Copyright © 2012, Grid Protection Alliance.  All Rights Reserved.
//
//  Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See
//  the NOTICE file distributed with this work for additional information regarding copyright ownership.
//  The GPA licenses this file to you under the MIT License (MIT), the "License"; you may
//  not use this file except in compliance with the License. You may obtain a copy of the License at:
//
//      http://www.opensource.org/licenses/MIT
//
//  Unless agreed to in writing, the subject software distributed under the License is distributed on an
//  "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the
//  License for the specific language governing permissions and limitations.
//
//  Code Modification History:
//  ----------------------------------------------------------------------------------------------------
//  04/22/2010 - Pinal C. Patel
//       Generated original version of source code.
//  05/27/2010 - Pinal C. Patel
//       Added usage example to code comments.
//       Modified Evaluate() to make use of IncludedResources and ExcludedResources config file settings.
//  06/02/2010 - Pinal C. Patel
//       Added authentication check to Evaluate() method.
//  08/11/2010 - Pinal C. Patel
//       Made key methods virtual for extensibility.
//  10/14/2010 - Pinal C. Patel
//       Modified GetResourceName() to return path and query for consistency across WCF hosting 
//       environments (i.e. ASP.NET, WAS, etc.).
//  12/20/2012 - Starlynn Danyelle Gilliam
//       Modified Header.
//
//******************************************************************************************************

using System;
using System.Collections.Generic;
using System.IdentityModel.Claims;
using System.IdentityModel.Policy;
using System.Security;
using System.Security.Principal;
using System.ServiceModel;
using System.Threading;
using GSF.Security;

namespace GSF.ServiceModel
{
    /// <summary>
    /// Represents an <see cref="IAuthorizationPolicy">authorization policy</see> that can be used by WCF services for enabling role-based security.
    /// </summary>
    /// <example>
    /// Common config file entries:
    /// <code>
    /// <![CDATA[
    /// <?xml version="1.0"?>
    /// <configuration>
    ///   <configSections>
    ///     <section name="categorizedSettings" type="GSF.Configuration.CategorizedSettingsSection, GSF.Core" />
    ///   </configSections>
    ///   <categorizedSettings>
    ///     <securityProvider>
    ///       <add name="ApplicationName" value="" description="Name of the application being secured as defined in the backend security datastore."
    ///         encrypted="false" />
    ///       <add name="ConnectionString" value="" description="Connection string to be used for connection to the backend security datastore."
    ///         encrypted="false" />
    ///       <add name="ProviderType" value="GSF.Security.LdapSecurityProvider, GSF.Security"
    ///         description="The type to be used for enforcing security." encrypted="false" />
    ///       <add name="IncludedResources" value="*/*.*=*" description="Semicolon delimited list of resources to be secured along with role names."
    ///         encrypted="false" />
    ///       <add name="ExcludedResources" value="*/SecurityService.svc*"
    ///         description="Semicolon delimited list of resources to be excluded from being secured."
    ///         encrypted="false" />
    ///       <add name="NotificationSmtpServer" value="localhost" description="SMTP server to be used for sending out email notification messages."
    ///         encrypted="false" />
    ///       <add name="NotificationSenderEmail" value="sender@company.com" description="Email address of the sender of email notification messages." 
    ///         encrypted="false" />
    ///     </securityProvider>
    ///     <activeDirectory>
    ///       <add name="PrivilegedDomain" value="" description="Domain of privileged domain user account."
    ///         encrypted="false" />
    ///       <add name="PrivilegedUserName" value="" description="Username of privileged domain user account."
    ///         encrypted="false" />
    ///       <add name="PrivilegedPassword" value="" description="Password of privileged domain user account."
    ///         encrypted="true" />
    ///     </activeDirectory>
    ///   </categorizedSettings>
    /// </configuration>
    /// ]]>
    /// </code>
    /// Internal WCF service configuration:
    /// <code>
    /// <![CDATA[
    /// <?xml version="1.0"?>
    /// <configuration>
    ///   <system.serviceModel>
    ///     <services>
    ///       <service name="WcfService1.Service1" behaviorConfiguration="serviceBehavior">
    ///         <endpoint address="" contract="WcfService1.IService1" binding="webHttpBinding" 
    ///                   bindingConfiguration="endpointBinding" behaviorConfiguration="endpointBehavior" />
    ///       </service>
    ///     </services>
    ///     <behaviors>
    ///       <endpointBehaviors>
    ///         <behavior name="endpointBehavior">
    ///           <webHttp/>
    ///         </behavior>
    ///       </endpointBehaviors>
    ///       <serviceBehaviors>
    ///         <behavior name="serviceBehavior">
    ///           <serviceAuthorization principalPermissionMode="Custom">
    ///             <authorizationPolicies>
    ///               <add policyType="GSF.ServiceModel.SecurityPolicy, GSF.ServiceModel" />
    ///             </authorizationPolicies>
    ///           </serviceAuthorization>
    ///         </behavior>
    ///       </serviceBehaviors>
    ///     </behaviors>
    ///     <bindings>
    ///       <webHttpBinding>
    ///         <binding name="endpointBinding">
    ///           <security mode="TransportCredentialOnly">
    ///             <transport clientCredentialType="Windows"/>
    ///           </security>
    ///         </binding>
    ///       </webHttpBinding>
    ///     </bindings>
    ///     <serviceHostingEnvironment aspNetCompatibilityEnabled="false" />
    ///   </system.serviceModel>
    /// </configuration>
    /// ]]>
    /// </code>
    /// External WCF service configuration:
    /// <code>
    /// <![CDATA[
    /// <?xml version="1.0"?>
    /// <configuration>
    ///   <system.web>
    ///     <httpModules>
    ///       <add name="SecurityModule" type="GSF.ServiceModel.SecurityModule, GSF.ServiceModel" />
    ///     </httpModules>
    ///   </system.web>
    ///   <system.serviceModel>
    ///     <services>
    ///       <service name="WcfService1.Service1" behaviorConfiguration="serviceBehavior">
    ///         <endpoint address="" contract="WcfService1.IService1" binding="webHttpBinding" 
    ///                   bindingConfiguration="endpointBinding" behaviorConfiguration="endpointBehavior"/>
    ///       </service>
    ///     </services>
    ///     <behaviors>
    ///       <endpointBehaviors>
    ///         <behavior name="endpointBehavior">
    ///           <webHttp/>
    ///         </behavior>
    ///       </endpointBehaviors>
    ///       <serviceBehaviors>
    ///         <behavior name="serviceBehavior">
    ///           <serviceAuthorization principalPermissionMode="Custom">
    ///             <authorizationPolicies>
    ///               <add policyType="GSF.ServiceModel.SecurityPolicy, GSF.ServiceModel" />
    ///             </authorizationPolicies>
    ///           </serviceAuthorization>
    ///         </behavior>
    ///       </serviceBehaviors>
    ///     </behaviors>
    ///     <bindings>
    ///       <webHttpBinding>
    ///         <binding name="endpointBinding">
    ///           <security mode="None" />
    ///         </binding>
    ///       </webHttpBinding>
    ///     </bindings>
    ///     <serviceHostingEnvironment aspNetCompatibilityEnabled="true" />
    ///   </system.serviceModel>
    /// </configuration>
    /// ]]>
    /// </code>
    /// </example>
    /// <seealso cref="ISecurityProvider"/>
    public class SecurityPolicy : IAuthorizationPolicy
    {
        #region [ Members ]

        // Fields
        private Guid m_id;

        #endregion

        #region [ Constructors ]

        /// <summary>
        /// Initializes a new instance of the <see cref="SecurityPolicy"/> class.
        /// </summary>
        public SecurityPolicy()
        {
            m_id = Guid.NewGuid();
        }

        #endregion

        #region [ Properties ]

        /// <summary>
        /// Gets the identifier of this <see cref="SecurityPolicy"/> instance.
        /// </summary>
        public string Id
        {
            get
            {
                return m_id.ToString();
            }
        }

        /// <summary>
        /// Gets a claim set that represents the issuer of this <see cref="SecurityPolicy"/>.
        /// </summary>
        public ClaimSet Issuer
        {
            get
            {
                return ClaimSet.System;
            }
        }

        #endregion

        #region [ Methods ]

        /// <summary>
        /// Evaluates the <paramref name="evaluationContext"/> and initializes security.
        /// </summary>
        /// <param name="evaluationContext">An <see cref="EvaluationContext"/> object.</param>
        /// <param name="state">Custom state of the <see cref="SecurityPolicy"/>.</param>
        /// <returns></returns>
        public virtual bool Evaluate(EvaluationContext evaluationContext, ref object state)
        {
            // In order for this to work properly security on the binding must be configured to use windows security.
            // When this is done the caller's windows identity is available to us here and can be used to derive from 
            // it the security principal that can be used by WCF service code downstream for implementing security.
            object property;

            if (evaluationContext.Properties.TryGetValue("Identities", out property))
            {
                // Extract and assign the caller's windows identity to current thread if available.
                IList<IIdentity> identities = property as List<IIdentity>;

                if ((object)identities == null)
                    throw new SecurityException(string.Format("Null Identities in Evaluation Context for '{0}'", Thread.CurrentPrincipal.Identity));

                foreach (IIdentity identity in identities)
                {
                    if (identity is WindowsIdentity)
                    {
                        Thread.CurrentPrincipal = new WindowsPrincipal((WindowsIdentity)identity);
                        break;
                    }
                }
            }

            string resource = GetResourceName();

            if (SecurityProviderUtility.IsResourceSecurable(resource))
            {
                // Initialize the security principal from caller's windows identity if uninitialized.
                SecurityProviderCache.ValidateCurrentProvider();

                // Setup the principal to be attached to the thread on which WCF service will execute.
                evaluationContext.Properties["Principal"] = Thread.CurrentPrincipal;

                // Verify that the current thread principal has been authenticated.
                if (!Thread.CurrentPrincipal.Identity.IsAuthenticated)
                    throw new SecurityException(string.Format("Authentication failed for user '{0}'", Thread.CurrentPrincipal.Identity.Name));

                // Perform a top-level permission check on the resource being accessed.
                if (!SecurityProviderUtility.IsResourceAccessible(resource))
                    throw new SecurityException(string.Format("Access to '{0}' is denied", resource));

                return true;
            }

            // Setup the principal to be attached to the thread on which WCF service will execute.
            evaluationContext.Properties["Principal"] = Thread.CurrentPrincipal;
            return true;
        }

        /// <summary>
        /// Gets the name of resource being accessed.
        /// </summary>
        /// <returns><see cref="OperationContext.IncomingMessageHeaders"/>.<see cref="System.ServiceModel.Channels.MessageHeaders.To"/>.<see cref="Uri.PathAndQuery"/> property value.</returns>
        protected virtual string GetResourceName()
        {
            return OperationContext.Current.IncomingMessageHeaders.To.PathAndQuery;
        }

        #endregion
    }
}