UrlAuthorizationModule.cs

//------------------------------------------------------------------------------
// <copyright file="UrlAuthorizationModule.cs" company="Microsoft">
//     Copyright (c) Microsoft Corporation.  All rights reserved.
// </copyright>
//------------------------------------------------------------------------------

/*
 * UrlAuthorizationModule class
 *
 * Copyright (c) 1999 Microsoft Corporation
 */

namespace System.Web.Security {
    using System.Runtime.Serialization;
    using System.Web;
    using System.Web.Util;
    using System.Collections;
    using System.Web.Configuration;
    using System.IO;
    using System.Security.Principal;
    using System.Security.Permissions;
    using System.Web.Management;
    using System.Web.Hosting;
    using System.Collections.Generic;



    /// <devdoc>
    ///    This module provides URL based
    ///    authorization services for allowing or denying access to specified resources
    /// </devdoc>
    public sealed class UrlAuthorizationModule : IHttpModule {


        /// <devdoc>
        ///    <para>
        ///       Initializes a new instance of the <see cref='System.Web.Security.UrlAuthorizationModule'/>
        ///       class.
        ///     </para>
        /// </devdoc>
        [SecurityPermission(SecurityAction.Demand, Unrestricted=true)]
        public UrlAuthorizationModule() {
        }


        /// <devdoc>
        ///    <para>[To be supplied.]</para>
        /// </devdoc>
        public void Init(HttpApplication app) {
            app.AuthorizeRequest += new EventHandler(this.OnEnter);
        }


        /// <devdoc>
        ///    <para>[To be supplied.]</para>
        /// </devdoc>
        public void Dispose() {
        }

        private static bool s_EnabledDetermined;
        private static bool s_Enabled;

        [SecurityPermission(SecurityAction.Demand, Unrestricted=true)]
        public static bool CheckUrlAccessForPrincipal(String virtualPath, IPrincipal user, string verb) {
            if (virtualPath == null)
                throw new ArgumentNullException("virtualPath");
            if (user == null)
                throw new ArgumentNullException("user");
            if (verb == null)
                throw new ArgumentNullException("verb");
            verb = verb.Trim();

            VirtualPath vPath = VirtualPath.Create(virtualPath);

            if (!vPath.IsWithinAppRoot)
                throw new ArgumentException(SR.GetString(SR.Virtual_path_outside_application_not_supported), "virtualPath");

            if (!s_EnabledDetermined) {
                if( !HttpRuntime.UseIntegratedPipeline) {
                    HttpModulesSection modulesSection = RuntimeConfig.GetConfig().HttpModules;
                    int len = modulesSection.Modules.Count;
                    for (int iter = 0; iter < len; iter++) {
                        HttpModuleAction module = modulesSection.Modules[iter];
                        if (Type.GetType(module.Type, false) == typeof(UrlAuthorizationModule)) {
                            s_Enabled = true;
                            break;
                        }
                    }
                }
                else {
                    List<ModuleConfigurationInfo> modules = HttpApplication.IntegratedModuleList;
                    foreach (ModuleConfigurationInfo mod in modules) {
                        if (Type.GetType(mod.Type, false) == typeof(UrlAuthorizationModule)) {
                            s_Enabled = true;
                            break;
                        }
                    }
                }
                s_EnabledDetermined = true;
            }
            if (!s_Enabled)
                return true;
            AuthorizationSection settings = RuntimeConfig.GetConfig(vPath).Authorization;

            // Check if the user is allowed, or the request is for the login page
            return settings.EveryoneAllowed || settings.IsUserAllowed(user, verb);
        }

        internal static void ReportUrlAuthorizationFailure(HttpContext context, object webEventSource) {
            // Deny access
            context.Response.StatusCode = 401;
            WriteErrorMessage(context);

            if (context.User != null && context.User.Identity.IsAuthenticated) {
                // We don't raise failure audit event for anonymous user
                WebBaseEvent.RaiseSystemEvent(webEventSource, WebEventCodes.AuditUrlAuthorizationFailure);
            }
            context.ApplicationInstance.CompleteRequest();
        }

        ////////////////////////////////////////////////////////////
        ////////////////////////////////////////////////////////////
        ////////////////////////////////////////////////////////////
        // Module Enter: Get the authorization configuration section
        //    and see if this user is allowed or not
        void OnEnter(Object source, EventArgs eventArgs) {
            HttpApplication    app;
            HttpContext        context;

            app = (HttpApplication)source;
            context = app.Context;
            if (context.SkipAuthorization)
            {
                if (context.User == null || !context.User.Identity.IsAuthenticated)
                    PerfCounters.IncrementCounter(AppPerfCounter.ANONYMOUS_REQUESTS);
                return;
            }

            // Get the authorization config object
            AuthorizationSection settings = RuntimeConfig.GetConfig(context).Authorization;

            // Check if the user is allowed, or the request is for the login page
            if (!settings.EveryoneAllowed && !settings.IsUserAllowed(context.User, context.Request.RequestType))
            {
                ReportUrlAuthorizationFailure(context, this);

            }
            else
            {
                if (context.User == null || !context.User.Identity.IsAuthenticated)
                    PerfCounters.IncrementCounter(AppPerfCounter.ANONYMOUS_REQUESTS);

                WebBaseEvent.RaiseSystemEvent(this, WebEventCodes.AuditUrlAuthorizationSuccess);
            }
        }

        /////////////////////////////////////////////////////////////////////////////
        static void WriteErrorMessage(HttpContext context) {
            context.Response.Write(UrlAuthFailedErrorFormatter.GetErrorText());
            // In Integrated pipeline, ask for handler headers to be generated.  This would be unnecessary
            // if we just threw an access denied exception, and used the standard error mechanism
            context.Response.GenerateResponseHeadersForHandler();
        }

        static internal bool RequestRequiresAuthorization(HttpContext context) {
            if (context.SkipAuthorization)
                return false;

            AuthorizationSection settings = RuntimeConfig.GetConfig(context).Authorization;

            // Check if the anonymous user is allowed
            if (_AnonUser == null)
                _AnonUser = new GenericPrincipal(new GenericIdentity(String.Empty, String.Empty), new String[0]);

            return !settings.IsUserAllowed(_AnonUser, context.Request.RequestType);
        }

        internal static bool IsUserAllowedToPath(HttpContext context, VirtualPath virtualPath)
        {
            AuthorizationSection settings = RuntimeConfig.GetConfig(context, virtualPath).Authorization;

            return settings.EveryoneAllowed || settings.IsUserAllowed(context.User, context.Request.RequestType);
        }

        static GenericPrincipal _AnonUser;
    }
}