Rory Primrose

[TestMethod]
[DeploymentItem(@"Communication\Security\Neovolve.Toolkit.pfx")]
public void PasswordSecurityOnThreadTest()
{
}

using System;
using System.Security.Cryptography.X509Certificates;
 
namespace Neovolve.Toolkit.UnitTests.Communication.Security
{
    /// <summary>
    /// The <see cref="CertificateDetails"/>
    /// struct is used to store information about a certificate for installing and uninstalling a certificate in a certificate store.
    /// </summary>
    internal struct CertificateDetails
    {
        /// <summary>
        /// Stores the Filepath of the certificate.
        /// </summary>
        public String Filepath;
 
        /// <summary>
        /// Stores the password of the certificate.
        /// </summary>
        public String Password;
 
        /// <summary>
        /// Stores the store location of the certificate when the certificate is installed.
        /// </summary>
        public StoreLocation StoreLocation;
 
        /// <summary>
        /// Stores the store name of the certificate when the certificate is installed.
        /// </summary>
        public StoreName StoreName;
 
        /// <summary>
        /// Stores the subject of the certificate.
        /// </summary>
        public String Subject;
 
        /// <summary>
        /// Initializes a new instance of the <see cref="CertificateDetails"/> struct.
        /// </summary>
        /// <param name="filePath">The file path.</param>
        /// <param name="subject">The subject.</param>
        /// <param name="password">The password.</param>
        /// <param name="storeName">Name of the store.</param>
        /// <param name="storeLocation">The store location.</param>
        public CertificateDetails(
            String filePath, String subject, String password, StoreName storeName, StoreLocation storeLocation)
        {
            Filepath = filePath;
            Subject = subject;
            Password = password;
            StoreName = storeName;
            StoreLocation = storeLocation;
        }
    }
}

using System;
using System.Collections.Generic;
using System.Security.Cryptography.X509Certificates;
 
namespace Neovolve.Toolkit.UnitTests.Communication.Security
{
    /// <summary>
    /// The <see cref="CertificateManager"/>
    /// class is used to install and uninstall certificates in the certificate store.
    /// </summary>
    internal class CertificateManager
    {
        /// <summary>
        /// Initializes a new instance of the <see cref="CertificateManager"/> class.
        /// </summary>
        public CertificateManager()
        {
            Certificates = new List<CertificateDetails>();
        }
 
        /// <summary>
        /// Installs the certificates.
        /// </summary>
        public void InstallCertificates()
        {
            // Loop through each configured certificate
            for (Int32 index = 0; index < Certificates.Count; index++)
            {
                CertificateDetails certificate = Certificates[index];
 
                // Install this certificate
                InstallCertificate(certificate);
            }
        }
 
        /// <summary>
        /// Uninstalls the certificates.
        /// </summary>
        public void UninstallCertificates()
        {
            // Loop through each configured certificate
            for (Int32 index = 0; index < Certificates.Count; index++)
            {
                CertificateDetails certificate = Certificates[index];
 
                // Uninstall this certificate
                UninstallCertificate(certificate);
            }
        }
 
        /// <summary>
        /// Installs the certificate.
        /// </summary>
        /// <param name="certificateDetails">The certificate information.</param>
        private static void InstallCertificate(CertificateDetails certificateDetails)
        {
            X509Certificate2 certificate = new X509Certificate2(
                certificateDetails.Filepath, certificateDetails.Password, X509KeyStorageFlags.PersistKeySet);
            X509Store store = new X509Store(certificateDetails.StoreName, certificateDetails.StoreLocation);
 
            try
            {
                store.Open(OpenFlags.ReadWrite | OpenFlags.OpenExistingOnly);
 
                store.Add(certificate);
            }
            finally
            {
                store.Close();
            }
        }
 
        /// <summary>
        /// Uninstalls the certificate.
        /// </summary>
        /// <param name="certificateDetails">The certificate information.</param>
        private static void UninstallCertificate(CertificateDetails certificateDetails)
        {
            X509Store store = new X509Store(certificateDetails.StoreName, certificateDetails.StoreLocation);
 
            try
            {
                store.Open(OpenFlags.ReadWrite | OpenFlags.OpenExistingOnly);
 
                // Loop through each certificate in the store in reverse order
                for (Int32 index = store.Certificates.Count - 1; index >= 0; index--)
                {
                    X509Certificate2 certificate = store.Certificates[index];
 
                    // Check if the subject names match
                    if (certificate.Subject
                        == certificateDetails.Subject)
                    {
                        store.Remove(certificate);
                    }
                }
            }
            finally
            {
                store.Close();
            }
        }
 
        /// <summary>
        /// Gets the certificates.
        /// </summary>
        /// <value>The certificates.</value>
        public List<CertificateDetails> Certificates
        {
            get;
            private set;
        }
    }
}

using System;
using System.Diagnostics;
using System.Security.Cryptography.X509Certificates;
using System.ServiceModel;
using System.ServiceModel.Description;
using System.ServiceModel.Security;
using Microsoft.VisualStudio.TestTools.UnitTesting;
using Neovolve.Toolkit.Communication.Security;
 
namespace Neovolve.Toolkit.UnitTests.Communication.Security
{
    /// <summary>
    /// The <see cref="PasswordServiceCredentialsTests"/>
    /// class contains unit tests for the 
    /// <see cref="PasswordServiceCredentials"/> implementation.
    /// </summary>
    [TestClass]
    public class PasswordServiceCredentialsTests
    {
        /// <summary>
        /// Stores the certificate manager.
        /// </summary>
        private static readonly CertificateManager certificateManager = new CertificateManager();
 
        #region Setup/Teardown
 
        /// <summary>
        /// Initializes the class.
        /// </summary>
        /// <param name="context">The context.</param>
        [ClassInitialize]
        public static void InitializeClass(TestContext context)
        {
            certificateManager.Certificates.Add(
                new CertificateDetails(
                    "Neovolve.Toolkit.pfx",
                    "CN=Neovolve.Toolkit",
                    "Neovolve.Toolkit",
                    StoreName.My,
                    StoreLocation.CurrentUser));
 
            certificateManager.UninstallCertificates();
            certificateManager.InstallCertificates();
        }
 
        /// <summary>
        /// Cleans up the class.
        /// </summary>
        [ClassCleanup]
        public static void CleanupClass()
        {
            certificateManager.UninstallCertificates();
        }
 
        #endregion
    }
}

const String ServiceAddress = "net.tcp://localhost/PasswordServiceCredentialsTests";

Uri address = new Uri(ServiceAddress);
NetTcpBinding binding = new NetTcpBinding();

binding.Security.Mode = SecurityMode.TransportWithMessageCredential;
binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;

ServiceHost host = new ServiceHost(typeof(PasswordService));

// Add debug support to the host
ServiceDebugBehavior debugBehaviour = new ServiceDebugBehavior();

debugBehaviour.IncludeExceptionDetailInFaults = true;
host.Description.Behaviors.Remove<ServiceDebugBehavior>();
host.Description.Behaviors.Add(debugBehaviour);

// Create the service credentials
PasswordServiceCredentials credentials = new PasswordServiceCredentials();

credentials.UserNameAuthentication.UserNamePasswordValidationMode = UserNamePasswordValidationMode.Custom;

// Assign the certificate from the CurrentUser store using the subject name of the certificate
credentials.ServiceCertificate.SetCertificate(
    StoreLocation.CurrentUser, StoreName.My, X509FindType.FindBySubjectName, "Neovolve.Toolkit");

host.Description.Behaviors.Remove<ServiceCredentials>();
host.Description.Behaviors.Add(credentials);

ServiceAuthorizationBehavior authorization = new ServiceAuthorizationBehavior();

authorization.PrincipalPermissionMode = PrincipalPermissionMode.Custom;
host.Description.Behaviors.Remove<ServiceAuthorizationBehavior>();
host.Description.Behaviors.Add(authorization);

host.AddServiceEndpoint(typeof(IPasswordService), binding, address);

try
{
    host.Open();

    // We need to identify that the identity of the certificate is valid for the address of the service
    EndpointAddress endpointAddress = new EndpointAddress(
        address, EndpointIdentity.CreateDnsIdentity("Neovolve.Toolkit"));

    ChannelFactory<IPasswordService> factory = new ChannelFactory<IPasswordService>(
        binding, endpointAddress);

    try
    {
        // We need to ignore certificate validation errors
        // Because the certificate was created with makecert, there is no chain of trust on this certificate
        factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode =
            X509CertificateValidationMode.None;

        String userName = Guid.NewGuid().ToString();
        String password = Guid.NewGuid().ToString();

        factory.Credentials.UserName.UserName = userName;
        factory.Credentials.UserName.Password = password;

        factory.Open();

        IPasswordService channel = factory.CreateChannel();

[ErrorHandler(typeof(KnownErrorHandler), typeof(UnknownErrorHandler))]
public class TestService : ITestService
{
}

using System; 
using System.Collections.ObjectModel; 
using System.Diagnostics; 
using System.ServiceModel; 
using System.ServiceModel.Channels; 
using System.ServiceModel.Description; 
using System.ServiceModel.Dispatcher; 
namespace Neovolve.Toolkit.Communication 
{ 
    /// <summary> 
    /// The <see cref="ErrorHandlerAttribute"/> 
    /// class is used to decorate WCF service implementations with a 
    /// <see cref="IServiceBehavior"/> that identifies <see cref="IErrorHandler"/> references to invoke 
    /// when the service encounters errors. 
    /// </summary> 
    /// <remarks> 
    /// <para> 
    /// The constructor of the attribute instance takes a <c>params</c> array of strings or types. 
    /// This allows the attribute to attach one or more error handlers to the service implementation. 
    /// </para> 
    /// <para> 
    /// <see cref="IErrorHandler"/> implementations are often set up for services using configuration. 
    /// This may create risks in cases where configuration is not correctly defined or configuration values are missing. 
    /// The result of this may be that exception shielding and error handling are not functioning as intended. 
    /// </para> 
    /// <para> 
    /// Lack of exception shielding may be a security risk because exception information crosses the service boundary 
    /// that was not intended. The details of the exception may contain sensitive information that the consumers of 
    /// the services should not be able to read. 
    /// </para> 
    /// <para> 
    /// Lack of error handling may not be a security risk, but will produce an unexpected behaviour for clients as 
    /// they consume the service. According to the contract, the client may expect to see a particular fault exception 
    /// being raised, but may instead receive a different fault. 
    /// </para> 
    /// <example> 
    /// The following example demonstrates how to use this attribute on a service implementation. 
    /// <code lang="C#"> 
    ///    // In this case, the ErrorHandler attribute is used to assign multiple error handlers 
    ///    [ErrorHandler(typeof(KnownErrorHandler), typeof(UnknownErrorHandler))] 
    ///    public class TestService : ITestService 
    ///    { 
    ///    } 
    /// </code> 
    /// </example> 
    /// </remarks> 
    [AttributeUsage(AttributeTargets.Class)] 
    [CLSCompliant(false)] 
    public sealed class ErrorHandlerAttribute : Attribute, IServiceBehavior 
    { 
        /// <summary> 
        /// Initializes a new instance of the <see cref="ErrorHandlerAttribute"/> class. 
        /// </summary> 
        /// <param name="errorHandlerTypes">The error handler types.</param> 
        public ErrorHandlerAttribute(params Type[] errorHandlerTypes) 
        { 
            const String ErrorHandlerTypeParameterName = "errorHandlerTypes"; 

            // Checks whether the errorHandlerType parameter has been supplied 
            if (errorHandlerTypes == null) 
            { 
                throw new ArgumentNullException(ErrorHandlerTypeParameterName); 
            } 

            if (errorHandlerTypes.Length == 0) 
            { 
                throw new ArgumentOutOfRangeException(ErrorHandlerTypeParameterName); 
            } 

            // Loop through each item supplied 
            for (Int32 index = 0; index < errorHandlerTypes.Length; index++) 
            { 
                Type errorHandlerType = errorHandlerTypes[index]; 

                // Check if the item supplied is null 
                if (errorHandlerType == null) 
                { 
                    throw new ArgumentNullException(ErrorHandlerTypeParameterName); 
                } 
            } 

            // Store the types 
            ErrorHandlerTypes = errorHandlerTypes; 
            ValidateHandlerTypes(); 
        } 

        /// <summary> 
        /// Initializes a new instance of the <see cref="ErrorHandlerAttribute"/> class. 
        /// </summary> 
        /// <param name="errorHandlerTypeNames">The error handler type names.</param> 
        public ErrorHandlerAttribute(params String[] errorHandlerTypeNames) 
        { 
            const String ErrorHandlerTypeNamesParameterName = "errorHandlerTypeNames"; 

            // Checks whether the errorHandlerTypeName parameter has been supplied 
            if (errorHandlerTypeNames == null) 
            { 
                throw new ArgumentNullException(ErrorHandlerTypeNamesParameterName); 
            } 

            if (errorHandlerTypeNames.Length == 0) 
            { 
                throw new ArgumentOutOfRangeException(ErrorHandlerTypeNamesParameterName); 
            } 

            // Loop through each item supplied 
            for (Int32 index = 0; index < errorHandlerTypeNames.Length; index++) 
            { 
                String errorHandlerTypeName = errorHandlerTypeNames[index]; 

                // Ensure that a value has been supplied 
                if (String.IsNullOrEmpty(errorHandlerTypeName)) 
                { 
                    throw new ArgumentNullException(ErrorHandlerTypeNamesParameterName); 
                } 
            } 

            ErrorHandlerTypes = new Type[errorHandlerTypeNames.Length]; 

            // Loop through each type 
            for (Int32 index = 0; index < errorHandlerTypeNames.Length; index++) 
            { 
                // Get a reference to the type 
                String errorHandlerTypeName = errorHandlerTypeNames[index]; 
                Type handlerType = Type.GetType(errorHandlerTypeName, true, true); 

                ErrorHandlerTypes[index] = handlerType; 
            } 

            ValidateHandlerTypes(); 
        } 

        /// <summary> 
        /// Provides the ability to pass custom data to binding elements to support the contract implementation. 
        /// </summary> 
        /// <param name="serviceDescription">The service description of the service.</param> 
        /// <param name="serviceHostBase">The host of the service.</param> 
        /// <param name="endpoints">The service endpoints.</param> 
        /// <param name="bindingParameters">Custom objects to which binding elements have access.</param> 
        public void AddBindingParameters( 
            ServiceDescription serviceDescription, 
            ServiceHostBase serviceHostBase, 
            Collection<ServiceEndpoint> endpoints, 
            BindingParameterCollection bindingParameters) 
        { 
            // Nothing to do here 
        } 

        /// <summary> 
        /// Provides the ability to change run-time property values or insert custom extension objects such as error handlers, message or parameter interceptors, security extensions, and other custom extension objects. 
        /// </summary> 
        /// <param name="serviceDescription">The service description.</param> 
        /// <param name="serviceHostBase">The host that is currently being built.</param> 
        public void ApplyDispatchBehavior(ServiceDescription serviceDescription, ServiceHostBase serviceHostBase) 
        { 
            // Loop through each channel dispatcher 
            for (Int32 dispatcherIndex = 0; 
                dispatcherIndex < serviceHostBase.ChannelDispatchers.Count; 
                dispatcherIndex++) 
            { 
                // Get the dispatcher for this index and cast to the type we are after 
                ChannelDispatcher dispatcher = serviceHostBase.ChannelDispatchers[dispatcherIndex] as ChannelDispatcher; 
                Debug.Assert(dispatcher != null, "The dispatcher collection returned an item of an incorrect type"); 

                // Loop through each error handler 
                for (Int32 typeIndex = 0; typeIndex < ErrorHandlerTypes.Length; typeIndex++) 
                { 
                    Type errorHandlerType = ErrorHandlerTypes[typeIndex]; 

                    // Create a new error handler instance 
                    IErrorHandler handler = Activator.CreateInstance(errorHandlerType) as IErrorHandler; 
                    Debug.Assert(handler != null, "Failed to create the IErrorHandler instance"); 

                    // Add the handler to the dispatcher 
                    dispatcher.ErrorHandlers.Add(handler); 
                } 
            } 
        } 

        /// <summary> 
        /// Provides the ability to inspect the service host and the service description to confirm that the service can run successfully. 
        /// </summary> 
        /// <param name="serviceDescription">The service description.</param> 
        /// <param name="serviceHostBase">The service host that is currently being constructed.</param> 
        public void Validate(ServiceDescription serviceDescription, ServiceHostBase serviceHostBase) 
        { 
            // Nothing to do here 
        } 

        /// <summary> 
        /// Validates the handler types. 
        /// </summary> 
        private void ValidateHandlerTypes() 
        { 
            Debug.Assert(ErrorHandlerTypes != null, "No ErrorHandlerTypes is null"); 
            Debug.Assert(ErrorHandlerTypes.Length > 0, "No error handler types are available"); 

            // Loop through each handler 
            for (Int32 index = 0; index < ErrorHandlerTypes.Length; index++) 
            { 
                Type errorHandlerType = ErrorHandlerTypes[index]; 

                // Check if the type doesn't define the IErrorHandler interface 
                if (typeof(IErrorHandler).IsAssignableFrom(errorHandlerType) == false) 
                { 
                    // We can't use this type 
                    throw new InvalidCastException(); 
                } 
            } 
        } 

        /// <summary> 
        /// Gets or sets the error handler types. 
        /// </summary> 
        /// <value>The error handler types.</value> 
        private Type[] ErrorHandlerTypes 
        { 
            get; 
            set; 
        } 
    } 
}