Changeset 3965


Ignore:
Timestamp:
06/26/10 15:56:15 (9 years ago)
Author:
jhaider
Message:

added support for Cryptography (#1046)

Location:
branches/HeuristicLab.Services.Authentication Prototype
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/HeuristicLab.Services.Authentication Prototype/Service/Provider/HeuristicLabMembershipProvider.cs

    r3962 r3965  
    33using System.Configuration;
    44using System.Configuration.Provider;
     5using System.IO;
    56using System.Linq;
    67using System.Security.Cryptography;
     
    2223    private int pMinRequiredPasswordLength;
    2324    private MembershipPasswordFormat pPasswordFormat = MembershipPasswordFormat.Clear;
    24     private MachineKeySection machineKey;
    25 
    2625
    2726    public override void Initialize(string name, NameValueCollection config) {
     
    7170          throw new ProviderException("Password format not supported.");
    7271      }
    73 
    74       // Get encryption and decryption key information from the configuration.
    75       Configuration cfg =
    76         WebConfigurationManager.OpenWebConfiguration(System.Web.Hosting.HostingEnvironment.ApplicationVirtualPath);
    77       machineKey = (MachineKeySection)cfg.GetSection("system.web/machineKey");
    78 
    79       if (machineKey.ValidationKey.Contains("AutoGenerate"))
    80         if (PasswordFormat != MembershipPasswordFormat.Clear)
    81           throw new ProviderException("Hashed or Encrypted passwords " +
    82                                       "are not supported with auto-generated keys.");
    8372    }
    8473
     
    154143          // create new user
    155144          HeuristicLabUser u = new HeuristicLabUser(username, email, passwordQuestion, "");
     145          password = EncodePassword(password);
    156146          u.ChangePassword("INIT", password);
    157147          u.ChangePasswordQuestionAndAnswer(password, passwordQuestion, passwordAnswer);
     
    346336          break;
    347337        case MembershipPasswordFormat.Hashed:
    348           HMACSHA1 hash = new HMACSHA1();
    349           hash.Key = HexToByte(machineKey.ValidationKey);
    350           encodedPassword =
    351             Convert.ToBase64String(hash.ComputeHash(Encoding.Unicode.GetBytes(password)));
     338          SHA512 sha512 = SHA512.Create();
     339          ASCIIEncoding encoder = new ASCIIEncoding();
     340          byte[] combined = encoder.GetBytes(password);
     341          sha512.ComputeHash(combined);
     342          encodedPassword = Convert.ToBase64String(sha512.Hash);
    352343          break;
    353344        default:
     
    358349    }
    359350
     351    private readonly byte[] _rgbKey = new byte[]
     352                           {
     353                             182, 140, 37, 101, 52, 157, 80, 17, 65, 35, 130, 208, 101, 68, 161, 45, 197, 102, 112, 190,
     354                             187, 177, 37, 76, 63, 38, 190, 117, 247, 122, 94, 17
     355                           };
     356    private readonly byte[] _rgbIv = new byte[] { 60, 121, 178, 142, 50, 160, 226, 84, 41, 66, 158, 180, 26, 232, 42, 113 };
     357
     358    protected override byte[] EncryptPassword(byte[] password) {
     359      SymmetricAlgorithm sa = Aes.Create();
     360      MemoryStream msEncrypt = new MemoryStream();
     361      CryptoStream csEncrypt = new CryptoStream(msEncrypt, sa.CreateEncryptor(_rgbKey, _rgbIv), CryptoStreamMode.Write);
     362      csEncrypt.Write(password, 0, password.Length);
     363      csEncrypt.Close();
     364      byte[] encryptedTextBytes = msEncrypt.ToArray();
     365      msEncrypt.Close();
     366      return encryptedTextBytes;
     367    }
     368
     369    protected override byte[] DecryptPassword(byte[] encodedPassword) {
     370      SymmetricAlgorithm sa = Aes.Create();
     371      MemoryStream msDecrypt = new MemoryStream(encodedPassword);
     372      CryptoStream csDecrypt = new CryptoStream(msDecrypt, sa.CreateDecryptor(_rgbKey, _rgbIv), CryptoStreamMode.Read);
     373      byte[] decryptedTextBytes = new Byte[encodedPassword.Length];
     374      csDecrypt.Read(decryptedTextBytes, 0, encodedPassword.Length);
     375      csDecrypt.Close();
     376      msDecrypt.Close();
     377      return decryptedTextBytes;
     378    }
    360379
    361380    /// <summary>
     
    372391        case MembershipPasswordFormat.Encrypted:
    373392          password =
    374             Encoding.Unicode.GetString(DecryptPassword(Convert.FromBase64String(password)));
     393            Encoding.Unicode.GetString(DecryptPassword(Convert.FromBase64String(password))).TrimEnd('\0');
     394
     395
    375396          break;
    376397        case MembershipPasswordFormat.Hashed:
     
    381402
    382403      return password;
    383     }
    384 
    385     /// <summary>
    386     /// returns byte array  of an HexString
    387     /// </summary>
    388     /// <param name="hexString"></param>
    389     /// <returns></returns>
    390     private static byte[] HexToByte(string hexString) {
    391       byte[] returnBytes = new byte[hexString.Length / 2];
    392       for (int i = 0; i < returnBytes.Length; i++)
    393         returnBytes[i] = Convert.ToByte(hexString.Substring(i * 2, 2), 16);
    394       return returnBytes;
    395404    }
    396405
  • branches/HeuristicLab.Services.Authentication Prototype/UnitTests/HeuristicLabMembershipProviderTest.cs

    r3961 r3965  
    202202    public void ValidateUserTestEncrypted() {
    203203      HeuristicLabMembershipProvider target = new HeuristicLabMembershipProvider();
     204      NameValueCollection config = new NameValueCollection();
     205      config.Add("passwordFormat", "Encrypted");
     206      target.Initialize("", config);
     207      MembershipCreateStatus status;
     208      target.CreateUser("testname", "newPassword", "testemail", "testquestion", "testanswer", true, null, out status);
     209      Assert.IsTrue(target.ValidateUser("testname", "newPassword"));
     210    }
     211
     212    /// <summary>
     213    ///A test for ValidateUser
     214    ///</summary>
     215    [TestMethod()]
     216    public void ValidateUserTestHashed() {
     217      HeuristicLabMembershipProvider target = new HeuristicLabMembershipProvider();
    204218      NameValueCollection  config = new NameValueCollection();
    205       config.Add("passwordFormat", "Encrypted");
     219      config.Add("passwordFormat", "Hashed");
    206220      target.Initialize("",config);
    207221      MembershipCreateStatus status;
Note: See TracChangeset for help on using the changeset viewer.