Merge pull request #31 from docker/add-user-identity

Add user identity in Owin context - merging with authority :)

Author: simonferquel

src/HttpOverStream.NamedPipe/NamedPipeDialer.cs

@@ -2,6 +2,7 @@
 using System.IO;
 using System.IO.Pipes;
 using System.Net.Http;
+using System.Security.Principal;
 using System.Threading;
 using System.Threading.Tasks;
 
@@ -13,6 +14,7 @@ public class NamedPipeDialer : IDial
         private readonly string _serverName;
         private readonly PipeOptions _pipeOptions;
         private readonly int _timeoutMs;
+        private readonly TokenImpersonationLevel _impersonationLevel;
 
         public NamedPipeDialer(string pipeName)
             : this(pipeName, ".", PipeOptions.Asynchronous, 0)
@@ -24,17 +26,18 @@ public NamedPipeDialer(string pipeName, int timeoutMs)
         {
         }
 
-        public NamedPipeDialer(string pipeName, string serverName, PipeOptions pipeOptions, int timeoutMs)
+        public NamedPipeDialer(string pipeName, string serverName, PipeOptions pipeOptions, int timeoutMs, TokenImpersonationLevel impersonationLevel = TokenImpersonationLevel.Identification)
         {
             _pipeName = pipeName;
             _serverName = serverName;
             _pipeOptions = pipeOptions;
             _timeoutMs = timeoutMs;
+            _impersonationLevel = impersonationLevel;
         }
 
         public async ValueTask<Stream> DialAsync(HttpRequestMessage request, CancellationToken cancellationToken)
         {
-            var pipeStream = new NamedPipeClientStream(_serverName, _pipeName, PipeDirection.InOut, _pipeOptions);
+            var pipeStream = new NamedPipeClientStream(_serverName, _pipeName, PipeDirection.InOut, _pipeOptions, _impersonationLevel);
             await pipeStream.ConnectAsync(_timeoutMs, cancellationToken).ConfigureAwait(false);
             if (cancellationToken.CanBeCanceled)
             {

src/HttpOverStream.NamedPipe/NamedPipeHttpClientBuilder.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Net.Http;
+using System.Security.Principal;
 using HttpOverStream.Client;
 using HttpOverStream.Logging;
 
@@ -13,6 +14,7 @@ public class NamedPipeHttpClientBuilder
         private TimeSpan? _perRequestTimeout;
         private Version _httpVersion;
         private TimeSpan? _namedPipeConnectionTimeout;
+        private TokenImpersonationLevel _impersonationLevel = TokenImpersonationLevel.Identification;
 
         public NamedPipeHttpClientBuilder(string pipeName)
         {
@@ -49,11 +51,21 @@ public NamedPipeHttpClientBuilder WithNamedPipeConnectionTimeout(TimeSpan timeSp
             return this;
         }
 
+        public NamedPipeHttpClientBuilder WithImpersonationLevel(TokenImpersonationLevel impersonationLevel)
+        {
+            _impersonationLevel = impersonationLevel;
+            return this;
+        }
+
         public HttpClient Build()
         {
-            var dialer = _namedPipeConnectionTimeout == null
-                ? new NamedPipeDialer(_pipeName)
-                : new NamedPipeDialer(_pipeName, (int)_namedPipeConnectionTimeout.Value.TotalMilliseconds);
+            var connectionTimeout = 0;
+            if (_namedPipeConnectionTimeout.HasValue)
+            {
+                connectionTimeout = (int)_namedPipeConnectionTimeout.Value.TotalMilliseconds;
+            }
+
+            var dialer = new NamedPipeDialer(_pipeName, ".", System.IO.Pipes.PipeOptions.Asynchronous, connectionTimeout, _impersonationLevel);
 
             var innerHandler = new DialMessageHandler(dialer, _logger, _httpVersion);
             HttpClient httpClient;

src/HttpOverStream.NamedPipe/NamedPipeListener.cs

@@ -4,6 +4,7 @@
 using System.IO;
 using System.IO.Pipes;
 using System.Linq;
+using System.Security.Principal;
 using System.Threading;
 using System.Threading.Tasks;
 using HttpOverStream.Logging;
@@ -188,6 +189,31 @@ private async Task DisposeWhenCancelled(IDisposable disposable, string threadNam
                 _logger.LogError($"Exception disposing dummy {threadName} stream: {e}");
             }
         }
+
+        public IPrincipal GetTransportIdentity(Stream connection)
+        {
+            var serverStream = connection as NamedPipeServerStream;
+            if (serverStream == null)
+            {
+                throw new InvalidOperationException("connection should be a NamedPipeServerStream");
+            }
+
+            WindowsPrincipal principal = null;
+            try
+            {
+                serverStream.RunAsClient(() =>
+                {
+                    principal = new WindowsPrincipal(WindowsIdentity.GetCurrent());
+                });
+            }
+            catch
+            {
+                // this can fail if client explicitly connected with ImpersonationLevel.None.
+                // default is ImpersonationLevel.Identify which runs fine.
+            }
+
+            return principal;
+        }
     }
 
     internal static class CancellationTokenExtensions

src/HttpOverStream.Server.Owin/CustomListenerHost.cs

@@ -53,6 +53,12 @@ private async void OnAccept(Stream stream)
 
                     _logger.WriteVerbose("Server: reading message..");
                     await PopulateRequestAsync(stream, owinContext.Request, CancellationToken.None).ConfigureAwait(false);
+
+                    // some transports (shuch as Named Pipes) may require the server to read some data before being able to get the
+                    // client identity. So we get the client identity after reading the request headers
+                    var transportIdentity = _listener.GetTransportIdentity(stream);
+                    owinContext.Request.User = transportIdentity;
+
                     _logger.WriteVerbose("Server: finished reading message");
                     Func<Task> sendHeadersAsync = async () =>
                     {

src/HttpOverStream/IListen.cs

@@ -1,5 +1,6 @@
 using System;
 using System.IO;
+using System.Security.Principal;
 using System.Threading;
 using System.Threading.Tasks;
 
@@ -9,5 +10,6 @@ public interface IListen
     {
         Task StartAsync(Action<Stream> onConnection, CancellationToken cancellationToken);
         Task StopAsync(CancellationToken cancellationToken);
+        IPrincipal GetTransportIdentity(Stream connection);
     }
 }