API.Authentication.cs

Go to the documentation of this file.

using System;
using System.Collections.Specialized;
using System.Diagnostics.CodeAnalysis;
using System.Linq;
using System.Net;
using System.Security.Authentication;
using System.Threading;
 
using AnalyzeRe.Authentication;
using AnalyzeRe.Properties;
using RestSharp;
 
namespace AnalyzeRe
{
    public static partial class API
    {
        private const string AUTH_HEADER = "Authorization";
 
        public delegate void AuthenticationRequestedHandler(
            ref IAccessToken ToAuthenticate,
            string RequestedAuthentication);
 
        [SuppressMessage("Microsoft.Design", "CA1009:DeclareEventHandlersCorrectly")]
        public static event AuthenticationRequestedHandler AuthenticationRequested;
 
        public static IAccessToken AuthenticationToken { get; set; }
 
        public static string GetCurrentAuthorizationString()
        {
            return AuthenticationToken == null ? null :
                AuthenticationToken.AuthorizationMethod + " " + AuthenticationToken.access_token;
        }
 
        public static bool TryHandleAuthenticationErrors(IRestResponse response,
            int sequentialAttempts = 0)
        {
            // There is nothing authentication-related about an incomplete response,
            // so if the response is not completed, we're done here.
            if (response.ResponseStatus != ResponseStatus.Completed)
            {
                // Special case. Due to an only recently patched Microsoft bug (KB3109853)
                // Rare SSL/TLS failures may occur that aren't actually indicative of a problem.
                // Retry unless we've had MaxRequestRetries failures in a row.
                if (response.ErrorException is WebException &&
                    response.ErrorException.Message.Contains("Could not create SSL/TLS secure channel"))
                {
                    // If this keeps happening, it's a real error, so throw.
                    // Otherwise, it may just be a sporadic error, so retry.
                    if (sequentialAttempts < MaxRequestRetries) return true;
                    throw new AuthenticationException(response.ErrorMessage, response.ErrorException);
                }
                return false;
            }
            // Otherwise, this request completed its round trip to the server.
            // Now determine whether this request's response was generally successful
            bool success = (int)response.StatusCode >= 200 && (int)response.StatusCode < 300;
 
            // There's nothing more to do if the request was successful and the
            // AuthenticationToken is either not set or already marked as valid.
            if (success && (AuthenticationToken == null ||
                AuthenticationToken.status == AccessTokenStatus.Valid))
                return false;
 
            // Otherwise, we want to capture the authentication status for future reference.
            // Get the currently configured global Authentication token
            string defaultAuthToken = GetCurrentAuthorizationString();
            // Get the authentication token supplied in this response's original request.
            string requestAuthenticationToken = response.Request.Parameters.Where(
                    p => p.Type == ParameterType.HttpHeader &&
                    p.Name.Equals(AUTH_HEADER, StringComparison.OrdinalIgnoreCase))
                .Select(p => p.Value.ToString()).FirstOrDefault();
 
            // Test to see whether the previous request used the global default authentication
            // token (as opposed to having supplied an overriding authentication header)
            bool usedDefaultAuth = requestAuthenticationToken == defaultAuthToken;
            // If they did use the global AuthenticationToken setting, set its status
            if (usedDefaultAuth && AuthenticationToken != null)
            {
                // Only mark is as valid if the request response was a success
                if (success)
                    AuthenticationToken.status = AccessTokenStatus.Valid;
                // Only mark it as unauthorized if that was the status code
                else if (response.StatusCode == HttpStatusCode.Unauthorized)
                    AuthenticationToken.status = AccessTokenStatus.Unauthorized;
                // Otherwise, leave the AuthenticationToken status unchanged
            }
 
            // Now, unless the response code was specifically an authorization error, we're done.
            if (response.StatusCode != HttpStatusCode.Unauthorized)
                return false;
            // Otherwise, the request failed authentication. We try to handle this.
 
            // Check if we have exceeded our maximum authentication attempts for a single request.
            if (sequentialAttempts > MaxRequestRetries)
            {
                throw new AuthenticationException("Request failed after " +
                    MaxRequestRetries + " failed authentication attempts.");
            }
 
            // If the user supplied their own Authorization header (rather than letting the client
            // library automatically fill in the API.AuthenticationToken), we cannot raise the
            // event that would prompt for new default authentication credentials, because it
            // doesn't impact requests with manually-supplied Authorization headers.
 
            // Invoke AuthenticationRequested if the user did not override the global default
            // authentication parameters for this request.
            if (usedDefaultAuth)
            {
                // Get the authentication header returned by the server
                Parameter authenticateHeader =
                    response.Headers.FirstOrDefault(h => h.Name == "WWW-Authenticate");
                string strAuthenticateHeader = authenticateHeader?.Value?.ToString();
 
                // Invoke a request to authenticate and set the global authentication token
                InvokeAuthenticationRequested(requestAuthenticationToken, strAuthenticateHeader);
                // Return true to indicate that the authentication event was handled
                // and the original request can be retried with the new authentication information.
                return true;
            }
 
            // Otherwise, the user manually supplied an Authentication header, in which case they
            // are not using the 'AuthenticationRequested' event, so we must return an error.
            string exceptionMessage = "The current request included an authentication token (" +
                requestAuthenticationToken + ") which was rejected by the server";
            // If there was an existing global default authentication token that the user
            // overrode for this request, and authentication failed, give a special error.
            if (defaultAuthToken != null)
            {
                exceptionMessage += ", and which differs from the currently configured default " +
                    "authentication token (" + defaultAuthToken + "). Either correct the \"" +
                    AUTH_HEADER + "\" header parameter supplied to this request, or exclude it " +
                    "entirely and the default authentication token will be used.";
            }
            // Otherwise, throw an AuthenticationException with a slightly different message.
            else
            {
                exceptionMessage += ". Either correct the \"" + AUTH_HEADER + "\" header parameter " +
                    "supplied to this request, or exclude it entirely and use the " +
                    "'API.AuthenticationRequested' event or 'API.AuthenticationToken' " +
                    "to automatically handle authentication for Analyze Re API requests.";
            }
            throw new AuthenticationException(exceptionMessage);
        }
 
        // Prevent more than one thread prompting the client for authentication at a time.
        private static readonly object InvokeAuthenticationRequestedLock = new object();
 
        private static void InvokeAuthenticationRequested(
            string authenticationTokenUsed,
            string RequestedAuthentication)
        {
            if (RequestedAuthentication == null)
            {
                throw new AuthenticationException("Authentication requested, but no " +
                    "authentication type was specified. This is a server error.");
            }
 
            bool lockTaken = false;
            try
            {
                // If more than one thread is waiting on authentication, the other threads will
                // time out after 30 seconds (in case the first thread gets hung).
                Monitor.TryEnter(InvokeAuthenticationRequestedLock, 30000, ref lockTaken);
                if (AuthenticationToken != null &&
                    authenticationTokenUsed != GetCurrentAuthorizationString())
                {
                    // Global configured authentication credentials have already been updated since
                    // the request that fired this event. Do not prompt for credentials again.
                    return;
                }
                if (!lockTaken)
                {
                    throw new AuthenticationException(
                        "Timed out while waiting for another thread to complete authentication.");
                }
 
                if (AuthenticationRequested == null)
                {
                    if (AuthenticationToken != null)
                    {
                        // This indicates that the user is setting the AuthenticationToken directly
                        // so they are setting it incorrectly.
                        throw new AuthenticationException("The server requires authentication, " +
                            "and the current authentication token (" +
                            GetCurrentAuthorizationString() + ") was rejected. " +
                            "Please verify the credentials supplied.");
                    }
                    // Otherwise, they have not supplied any form of authentication and should be
                    // informed of the various ways they can do so.
                    throw new AuthenticationException("The server requires authorization, " +
                        "but no authentication settings have been configured. Please either " +
                        "handle the API.AuthenticationRequested event appropriately, " +
                        "or set the global default API.AuthenticationToken directly.");
                }
 
                // Prepare a new authentication token to pass by reference to the event handler
                IAccessToken newAuthenticationToken;
                // Create the appropriate authentication token type.
                if (RequestedAuthentication.Trim().StartsWith("Basic",
                    StringComparison.InvariantCultureIgnoreCase))
                {
                    newAuthenticationToken = new BasicAuthenticationToken();
                }
                else if (RequestedAuthentication.Trim().StartsWith("OAuth",
                    StringComparison.InvariantCultureIgnoreCase))
                {
                    newAuthenticationToken = new OauthAccessToken().Post();
                }
                else
                {
                    throw new AuthenticationException(
                        "Unrecognized authentication type requested: " + RequestedAuthentication);
                }
 
                try
                {
                    AuthenticationRequested(ref newAuthenticationToken, RequestedAuthentication);
                }
                catch (Exception ex)
                {
                    throw new AuthenticationException("Error while invoking the " +
                        "AuthenticationRequested event: " + ex.Message, ex);
                }
                // AuthenticationToken was not configured correctly by the handler of the event
                if (newAuthenticationToken?.access_token == null)
                {
                    throw new AuthenticationException("The server requires authentication.");
                }
                // Otherwise, overwrite the current global authentication token with the new one.
                AuthenticationToken = newAuthenticationToken;
                CacheAuthentication();
            }
            finally
            {
                if (lockTaken)
                    Monitor.Exit(InvokeAuthenticationRequestedLock);
            }
        }
 
        // Use application settings to cache authenticated tokens.
        // Does not store passwords, just URLs and server access tokens.
        private static void CacheAuthentication()
        {
            try
            {
                if (AuthenticationToken == null)
                {
                    return;
                }
                TrySaveLibrarySettings(() =>
                {
                    if (Settings.Default.CachedCredentials == null)
                        Settings.Default.CachedCredentials = new StringCollection();
                    // Check for prior credentials to be overwritten
                    string prior = Settings.Default.CachedCredentials.Cast<string>()
                        .FirstOrDefault(s => s.StartsWith(ServerURL));
                    if (prior != null) Settings.Default.CachedCredentials.Remove(prior);
 
                    Settings.Default.CachedCredentials.Add(String.Join("|", new[]
                    {
                        ServerURL,
                        AuthenticationToken is BasicAuthenticationToken ? "Basic" : "OAuth",
                        AuthenticationToken.access_token
                    }));
                });
            }
            catch (Exception e)
            {
                throw new Exception("Error storing authentication credentials: " + e.Message, e);
            }
        }
 
        // Check if the current server has cached credentials, and attempt to restore them.
        private static void RestoreCachedAuthentication()
        {
            // Don't override active credentials if they've already been specified.
            if (AuthenticationToken != null) return;
            StringCollection cachedCredentials =
                TryGetLibrarySettingObj(() => Settings.Default.CachedCredentials);
            // Nothing we can do if the cache is empty
            if (cachedCredentials == null) return;
            // Search the cached credentials for this server URL.
            string found = cachedCredentials.Cast<string>()
                .FirstOrDefault(s => s.StartsWith(ServerURL + "|"));
            if (found == null) return;
            string[] credentials = found.Split('|');
            // Create an instance of the correct AccessToken type
            AuthenticationToken = credentials[1] == "Basic"
                ? (IAccessToken)new BasicAuthenticationToken()
                : new OauthAccessToken();
            AuthenticationToken.access_token = credentials[2];
            AuthenticationToken.status = AccessTokenStatus.Unknown;
            // Verify these credentials are still valid
            // First, ensure that we can connect to the server.
            if (!IsAReServerActive(ServerURL))
            {
                return;
            }
            // Check if these credentials result in successful authentication
            AuthenticationStatus authenticationStatus = GetAuthenticationStatus();
            if (authenticationStatus != AuthenticationStatus.Authenticated)
            {
                AuthenticationToken = null;
                TrySaveLibrarySettings(() =>
                {
                    // These credentials are invalid or not necessary, remove them from our cache.
                    Settings.Default.CachedCredentials.Remove(found);
                });
            }
        }
 
        public static void TryPromptForAuthentication()
        {
            // Hack: Make a small request that will require authentication.
            // If not already authenticated, this should trigger the API request's
            // `TryHandleAuthenticationErrors` to see the `Unauthorized` status and kick off
            // the AuthenticationRequested event, which the client should be handling.
            ExecuteRestRequest("", Method.HEAD);
        }
 
        public static AuthenticationStatus GetAuthenticationStatus(bool force_request = false)
        {
            if (!force_request && AuthenticationToken != null &&
                AuthenticationToken.status == AccessTokenStatus.Valid)
                return AuthenticationStatus.Authenticated;
            // Make a small request that will require authentication, but return
            // the IRestResponse directly rather than letting the API handle the
            // 'Unauthorized' error, so we can test whether authentication is required or not.
            IRestResponse response;
            try
            {
                response = ExecuteRestRequest("", Method.HEAD, returnRawResponse: true);
            }
            catch (Exception)
            {
                return AuthenticationStatus.Error;
            }
 
            if (response.ResponseStatus != ResponseStatus.Completed)
                return AuthenticationStatus.Error;
 
            if (response.StatusCode == HttpStatusCode.Unauthorized)
            {
                if (AuthenticationToken == null)
                    return AuthenticationStatus.AuthenticationRequired;
                AuthenticationToken.status = AccessTokenStatus.Unauthorized;
                return AuthenticationStatus.InvalidCredentials;
            }
            // Any 200 code indicates a success
            if (((int)response.StatusCode) / 100 == 2)
            {
                if (AuthenticationToken == null)
                    return AuthenticationStatus.NoAuthenticationRequired;
                AuthenticationToken.status = AccessTokenStatus.Valid;
                return AuthenticationStatus.Authenticated;
            }
 
            // The request completed, but returned an error other than Unauthorized.
            return AuthenticationStatus.Unknown;
        }
 
        public static void ClearCachedAuthenticationCredentials(string server = null)
        {
            TrySaveLibrarySettings(() =>
            {
                // Nothing to do if the cache is empty
                if (Settings.Default.CachedCredentials == null)
                    return;
                if (server == null)
                    Settings.Default.CachedCredentials.Clear();
                else
                {
                    // Search the cached credentials for this server URL.
                    string found = Settings.Default.CachedCredentials.Cast<string>()
                        .FirstOrDefault(s => s.StartsWith(server + "|"));
                    if (found == null) return;
                    Settings.Default.CachedCredentials.Remove(found);
                }
            });
        }
    }
}