Skip to content

Commit 46b88bf

Browse files
twsouthwicktwsouthwick
authored
Expose SspiAuthenticationParameters on SspiContextProvider (#2454)
This adds a specialized authentication parameters for SSPI and plumbs that through. As part of this change, the SSPIContextProvider base class now iterates through all the server names similar to what NegotiateSSPIContextProvider did.
1 parent 17621da commit 46b88bf

File tree

14 files changed

+181
-128
lines changed

14 files changed

+181
-128
lines changed

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -656,11 +656,14 @@
656656
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SqlUtil.cs">
657657
<Link>Microsoft\Data\SqlClient\SqlUtil.cs</Link>
658658
</Compile>
659-
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\NegotiateSSPIContextProvider.cs">
660-
<Link>Microsoft\Data\SqlClient\SSPI\NegotiateSSPIContextProvider.cs</Link>
659+
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\NegotiateSspiContextProvider.cs">
660+
<Link>Microsoft\Data\SqlClient\SSPI\NegotiateSspiContextProvider.cs</Link>
661661
</Compile>
662-
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\SSPIContextProvider.cs">
663-
<Link>Microsoft\Data\SqlClient\SSPI\SSPIContextProvider.cs</Link>
662+
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\SspiContextProvider.cs">
663+
<Link>Microsoft\Data\SqlClient\SSPI\SspiContextProvider.cs</Link>
664+
</Compile>
665+
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\SspiAuthenticationParameters.cs">
666+
<Link>Microsoft\Data\SqlClient\SSPI\SspiAuthenticationParameters.cs</Link>
664667
</Compile>
665668
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\Utilities\ObjectPool.cs">
666669
<Link>Microsoft\Data\SqlClient\Utilities\ObjectPool.cs</Link>
@@ -887,8 +890,8 @@
887890
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SqlColumnEncryptionCspProvider.Windows.cs">
888891
<Link>Microsoft\Data\SqlClient\SqlColumnEncryptionCspProvider.Windows.cs</Link>
889892
</Compile>
890-
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\NativeSSPIContextProvider.cs">
891-
<Link>Microsoft\Data\SqlClient\SSPI\NativeSSPIContextProvider.cs</Link>
893+
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\NativeSspiContextProvider.cs">
894+
<Link>Microsoft\Data\SqlClient\SSPI\NativeSspiContextProvider.cs</Link>
892895
</Compile>
893896
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SqlColumnEncryptionCertificateStoreProvider.Windows.cs">
894897
<Link>Microsoft\Data\SqlClient\SqlColumnEncryptionCertificateStoreProvider.Windows.cs</Link>

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParser.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ internal sealed partial class TdsParser
4444
private static int _objectTypeCount; // EventSource counter
4545
private readonly SqlClientLogger _logger = new SqlClientLogger();
4646

47-
private SSPIContextProvider _authenticationProvider;
47+
private SspiContextProvider _authenticationProvider;
4848

4949
internal readonly int _objectID = Interlocked.Increment(ref _objectTypeCount);
5050
internal int ObjectID => _objectID;
@@ -413,7 +413,7 @@ internal void Connect(ServerInfo serverInfo,
413413
// AD Integrated behaves like Windows integrated when connecting to a non-fedAuth server
414414
if (integratedSecurity || authType == SqlAuthenticationMethod.ActiveDirectoryIntegrated)
415415
{
416-
_authenticationProvider = _physicalStateObj.CreateSSPIContextProvider();
416+
_authenticationProvider = _physicalStateObj.CreateSspiContextProvider();
417417
SqlClientEventSource.Log.TryTraceEvent("TdsParser.Connect | SEC | SSPI or Active Directory Authentication Library loaded for SQL Server based integrated authentication");
418418
}
419419

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParserStateObjectManaged.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -407,7 +407,7 @@ private SNIHandle GetSessionSNIHandleHandleOrThrow()
407407
[MethodImpl(MethodImplOptions.NoInlining)] // this forces the exception throwing code not to be inlined for performance
408408
private void ThrowClosedConnection() => throw ADP.ClosedConnectionError();
409409

410-
internal override SSPIContextProvider CreateSSPIContextProvider()
411-
=> new NegotiateSSPIContextProvider();
410+
internal override SspiContextProvider CreateSspiContextProvider()
411+
=> new NegotiateSspiContextProvider();
412412
}
413413
}

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParserStateObjectNative.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,7 @@ internal override void DisposePacketCache()
449449
}
450450
}
451451

452-
internal override SSPIContextProvider CreateSSPIContextProvider() => new NativeSSPIContextProvider();
452+
internal override SspiContextProvider CreateSspiContextProvider() => new NativeSspiContextProvider();
453453

454454
internal sealed class WritePacketCache : IDisposable
455455
{

‎src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -354,14 +354,17 @@
354354
<Compile Include="$(CommonSourceRoot)Resources\ResCategoryAttribute.cs">
355355
<Link>Resources\ResCategoryAttribute.cs</Link>
356356
</Compile>
357-
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\NativeSSPIContextProvider.cs">
358-
<Link>Microsoft\Data\SqlClient\SSPI\NativeSSPIContextProvider.cs</Link>
357+
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\NativeSspiContextProvider.cs">
358+
<Link>Microsoft\Data\SqlClient\SSPI\NativeSspiContextProvider.cs</Link>
359359
</Compile>
360-
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\NegotiateSSPIContextProvider.cs">
361-
<Link>Microsoft\Data\SqlClient\SSPI\NegotiateSSPIContextProvider.cs</Link>
360+
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\NegotiateSspiContextProvider.cs">
361+
<Link>Microsoft\Data\SqlClient\SSPI\NegotiateSspiContextProvider.cs</Link>
362362
</Compile>
363-
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\SSPIContextProvider.cs">
364-
<Link>Microsoft\Data\SqlClient\SSPI\SSPIContextProvider.cs</Link>
363+
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\SspiContextProvider.cs">
364+
<Link>Microsoft\Data\SqlClient\SSPI\SspiContextProvider.cs</Link>
365+
</Compile>
366+
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\SSPI\SspiAuthenticationParameters.cs">
367+
<Link>Microsoft\Data\SqlClient\SSPI\SspiAuthenticationParameters.cs</Link>
365368
</Compile>
366369
<Compile Include="$(CommonSourceRoot)Microsoft\Data\SqlClient\TdsParser.cs">
367370
<Link>Microsoft\Data\SqlClient\TdsParser.cs</Link>

‎src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/TdsParser.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ internal sealed partial class TdsParser
4444
private static int _objectTypeCount; // EventSource counter
4545
private readonly SqlClientLogger _logger = new SqlClientLogger();
4646

47-
private SSPIContextProvider _authenticationProvider;
47+
private SspiContextProvider _authenticationProvider;
4848

4949
internal readonly int _objectID = Interlocked.Increment(ref _objectTypeCount);
5050
internal int ObjectID => _objectID;
@@ -411,7 +411,7 @@ internal void Connect(ServerInfo serverInfo,
411411
// AD Integrated behaves like Windows integrated when connecting to a non-fedAuth server
412412
if (integratedSecurity || authType == SqlAuthenticationMethod.ActiveDirectoryIntegrated)
413413
{
414-
_authenticationProvider = _physicalStateObj.CreateSSPIContextProvider();
414+
_authenticationProvider = _physicalStateObj.CreateSspiContextProvider();
415415

416416
if (!string.IsNullOrEmpty(serverInfo.ServerSPN))
417417
{

‎src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/TdsParserStateObjectNative.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,6 @@ internal override uint EnableMars(ref uint info)
3131
internal override uint SetConnectionBufferSize(ref uint unsignedPacketSize)
3232
=> SniNativeWrapper.SniSetInfo(Handle, QueryType.SNI_QUERY_CONN_BUFSIZE, ref unsignedPacketSize);
3333

34-
internal override SSPIContextProvider CreateSSPIContextProvider() => new NativeSSPIContextProvider();
34+
internal override SspiContextProvider CreateSspiContextProvider() => new NativeSspiContextProvider();
3535
}
3636
}

‎src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/NativeSSPIContextProvider.cs‎ renamed to ‎src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/NativeSspiContextProvider.cs‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
namespace Microsoft.Data.SqlClient
88
{
9-
internal sealed class NativeSSPIContextProvider : SSPIContextProvider
9+
internal sealed class NativeSspiContextProvider : SspiContextProvider
1010
{
1111
private static readonly object s_tdsParserLock = new();
1212

@@ -49,7 +49,7 @@ private void LoadSSPILibrary()
4949
}
5050
}
5151

52-
protected override void GenerateSspiClientContext(ReadOnlySpan<byte> incomingBlob, IBufferWriter<byte> outgoingBlobWriter, ReadOnlySpan<string> serverSpns)
52+
protected override bool GenerateSspiClientContext(ReadOnlySpan<byte> incomingBlob, IBufferWriter<byte> outgoingBlobWriter, SspiAuthenticationParameters authParams)
5353
{
5454
#if NETFRAMEWORK
5555
SNIHandle handle = _physicalStateObj.Handle;
@@ -62,9 +62,9 @@ protected override void GenerateSspiClientContext(ReadOnlySpan<byte> incomingBlo
6262
var sendLength = s_maxSSPILength;
6363
var outBuff = outgoingBlobWriter.GetSpan((int)sendLength);
6464

65-
if (0 != SniNativeWrapper.SniSecGenClientContext(handle, incomingBlob, outBuff, ref sendLength, serverSpns[0]))
65+
if (0 != SniNativeWrapper.SniSecGenClientContext(handle, incomingBlob, outBuff, ref sendLength, authParams.Resource))
6666
{
67-
throw new InvalidOperationException(SQLMessage.SSPIGenerateError());
67+
return false;
6868
}
6969

7070
if (sendLength > int.MaxValue)
@@ -73,6 +73,8 @@ protected override void GenerateSspiClientContext(ReadOnlySpan<byte> incomingBlo
7373
}
7474

7575
outgoingBlobWriter.Advance((int)sendLength);
76+
77+
return true;
7678
}
7779
}
7880
}

‎src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/NegotiateSSPIContextProvider.cs‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/NegotiateSspiContextProvider.cs‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#if NET
2+
3+
using System;
4+
using System.Buffers;
5+
using System.Net.Security;
6+
7+
#nullable enable
8+
9+
namespace Microsoft.Data.SqlClient
10+
{
11+
internal sealed class NegotiateSspiContextProvider : SspiContextProvider
12+
{
13+
private NegotiateAuthentication? _negotiateAuth = null;
14+
15+
protected override bool GenerateSspiClientContext(ReadOnlySpan<byte> incomingBlob, IBufferWriter<byte> outgoingBlobWriter, SspiAuthenticationParameters authParams)
16+
{
17+
NegotiateAuthenticationStatusCode statusCode = NegotiateAuthenticationStatusCode.UnknownCredentials;
18+
19+
_negotiateAuth ??= new(new NegotiateAuthenticationClientOptions { Package = "Negotiate", TargetName = authParams.Resource });
20+
var sendBuff = _negotiateAuth.GetOutgoingBlob(incomingBlob, out statusCode)!;
21+
22+
// Log session id, status code and the actual SPN used in the negotiation
23+
SqlClientEventSource.Log.TryTraceEvent("{0}.{1} | Info | Session Id {2}, StatusCode={3}, SPN={4}", nameof(NegotiateSspiContextProvider),
24+
nameof(GenerateSspiClientContext), _physicalStateObj.SessionId, statusCode, _negotiateAuth.TargetName);
25+
26+
if (statusCode == NegotiateAuthenticationStatusCode.Completed || statusCode == NegotiateAuthenticationStatusCode.ContinueNeeded)
27+
{
28+
outgoingBlobWriter.Write(sendBuff);
29+
return true;
30+
}
31+
32+
return false;
33+
}
34+
}
35+
}
36+
#endif

0 commit comments

Comments
 (0)