Skip to content

Commit 43cd046

Browse files
Tu-STu-S
committed
DEV-454
1 parent 928cab0 commit 43cd046

8 files changed

Lines changed: 529 additions & 2 deletions

File tree

‎.editorconfig‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
root = true
2+
3+
[*.{cs,vb}]
4+
dotnet_style_operator_placement_when_wrapping = beginning_of_line
5+
tab_width = 4
6+
indent_style = space
7+
indent_size = 4
8+
end_of_line = crlf
9+
max_line_length = 160
10+
dotnet_style_coalesce_expression = true:suggestion
11+
dotnet_style_null_propagation = true:suggestion
12+
dotnet_style_prefer_is_null_check_over_reference_equality_method = true:suggestion
13+
dotnet_style_prefer_auto_properties = true:silent
14+
dotnet_style_object_initializer = true:suggestion
15+
dotnet_style_prefer_collection_expression = true:suggestion
16+
dotnet_style_collection_initializer = true:suggestion
17+
dotnet_style_prefer_simplified_boolean_expressions = true:suggestion
18+
dotnet_style_prefer_conditional_expression_over_assignment = true:silent
19+
dotnet_style_prefer_conditional_expression_over_return = true:silent
20+
dotnet_style_explicit_tuple_names = true:suggestion
21+
dotnet_style_prefer_inferred_tuple_names = true:suggestion
22+
dotnet_style_prefer_inferred_anonymous_type_member_names = false:suggestion
23+
dotnet_style_prefer_compound_assignment = true:suggestion
24+
dotnet_style_prefer_simplified_interpolation = true:warning
25+
dotnet_style_namespace_match_folder = true:suggestion
26+
dotnet_diagnostic.CA1851.severity = error
27+
#### Naming styles ####
28+
29+
# Naming rules
30+
31+
dotnet_naming_rule.interface_should_be_begins_with_i.severity = warning
32+
dotnet_naming_rule.interface_should_be_begins_with_i.symbols = interface
33+
dotnet_naming_rule.interface_should_be_begins_with_i.style = begins_with_i
34+
35+
dotnet_naming_rule.types_should_be_pascal_case.severity = warning
36+
dotnet_naming_rule.types_should_be_pascal_case.symbols = types
37+
dotnet_naming_rule.types_should_be_pascal_case.style = pascal_case
38+
39+
dotnet_naming_rule.non_field_members_should_be_pascal_case.severity = suggestion
40+
dotnet_naming_rule.non_field_members_should_be_pascal_case.symbols = non_field_members
41+
dotnet_naming_rule.non_field_members_should_be_pascal_case.style = pascal_case
42+
43+
# Symbol specifications
44+
45+
dotnet_naming_symbols.interface.applicable_kinds = interface
46+
dotnet_naming_symbols.interface.applicable_accessibilities = public, internal, private, protected, protected_internal, private_protected
47+
dotnet_naming_symbols.interface.required_modifiers =
48+
49+
dotnet_naming_symbols.types.applicable_kinds = class, struct, interface, enum
50+
dotnet_naming_symbols.types.applicable_accessibilities = public, internal, private, protected, protected_internal, private_protected
51+
dotnet_naming_symbols.types.required_modifiers =
52+
53+
dotnet_naming_symbols.non_field_members.applicable_kinds = property, event, method
54+
dotnet_naming_symbols.non_field_members.applicable_accessibilities = public, internal, private, protected, protected_internal, private_protected
55+
dotnet_naming_symbols.non_field_members.required_modifiers =
56+
57+
# Naming styles
58+
59+
dotnet_naming_style.begins_with_i.required_prefix = I
60+
dotnet_naming_style.begins_with_i.required_suffix =
61+
dotnet_naming_style.begins_with_i.word_separator =
62+
dotnet_naming_style.begins_with_i.capitalization = pascal_case
63+
64+
dotnet_naming_style.pascal_case.required_prefix =
65+
dotnet_naming_style.pascal_case.required_suffix =
66+
dotnet_naming_style.pascal_case.word_separator =
67+
dotnet_naming_style.pascal_case.capitalization = pascal_case
68+
69+
dotnet_style_predefined_type_for_locals_parameters_members = true:silent
70+
dotnet_style_readonly_field = true:error
71+
dotnet_style_predefined_type_for_member_access = true:silent
72+
dotnet_style_require_accessibility_modifiers = for_non_interface_members:silent
73+
dotnet_style_allow_statement_immediately_after_block_experimental = false:suggestion
74+
dotnet_style_allow_multiple_blank_lines_experimental = true:silent
75+
dotnet_code_quality_unused_parameters = all:silent
76+
dotnet_style_parentheses_in_other_binary_operators = always_for_clarity:silent
77+
dotnet_style_parentheses_in_arithmetic_binary_operators = always_for_clarity:silent
78+
dotnet_style_parentheses_in_relational_binary_operators = always_for_clarity:silent
79+
dotnet_style_parentheses_in_other_operators = never_if_unnecessary:silent
80+
dotnet_style_qualification_for_field = false:silent
81+
dotnet_style_qualification_for_property = false:silent
82+
dotnet_style_qualification_for_method = false:silent
83+
dotnet_style_qualification_for_event = false:silent
84+
insert_final_newline = true
85+
dotnet_diagnostic.CA1069.severity = warning
86+
87+
[*.cs]
88+
89+
# CA1822: Mark members as static
90+
resharper_redundant_empty_object_creation_argument_list_highlighting=error
91+
dotnet_diagnostic.CA1822.severity = none
92+
csharp_indent_labels = one_less_than_current
93+
csharp_space_around_binary_operators = before_and_after
94+
csharp_using_directive_placement = outside_namespace:silent
95+
csharp_prefer_simple_using_statement = true:suggestion
96+
csharp_prefer_braces = true:error
97+
csharp_style_namespace_declarations = block_scoped:silent
98+
csharp_style_prefer_method_group_conversion = true:silent
99+
csharp_style_prefer_top_level_statements = true:silent
100+
csharp_style_prefer_primary_constructors = true:suggestion
101+
csharp_style_expression_bodied_methods = false:silent
102+
csharp_style_expression_bodied_constructors = false:silent
103+
csharp_style_expression_bodied_operators = false:silent
104+
csharp_style_expression_bodied_properties = true:silent
105+
csharp_style_expression_bodied_indexers = true:silent
106+
csharp_style_expression_bodied_accessors = true:silent
107+
csharp_style_expression_bodied_lambdas = true:silent
108+
csharp_style_expression_bodied_local_functions = false:silent
109+
csharp_style_throw_expression = true:suggestion
110+
csharp_style_prefer_null_check_over_type_check = true:suggestion
111+
csharp_prefer_simple_default_expression = true:suggestion
112+
csharp_style_prefer_local_over_anonymous_function = true:suggestion
113+
csharp_style_prefer_index_operator = true:suggestion
114+
csharp_style_prefer_range_operator = true:suggestion
115+
csharp_style_implicit_object_creation_when_type_is_apparent = true:suggestion
116+
csharp_style_prefer_tuple_swap = true:suggestion
117+
csharp_style_prefer_utf8_string_literals = true:suggestion
118+
csharp_style_inlined_variable_declaration = true:suggestion
119+
csharp_style_deconstructed_variable_declaration = true:suggestion
120+
csharp_style_unused_value_assignment_preference = discard_variable:suggestion
121+
csharp_new_line_before_else = true
122+
csharp_new_line_before_catch = true
123+
csharp_new_line_before_finally = true
124+
csharp_new_line_before_members_in_object_initializers = true
125+
csharp_new_line_before_members_in_anonymous_types = true
126+
csharp_new_line_between_query_expression_clauses = true
127+
csharp_new_line_before_open_brace = all
128+
#### Naming styles ####
129+
130+
# Naming rules
131+
132+
dotnet_naming_rule.private_or_internal_field_should_be__fieldname.severity = suggestion
133+
dotnet_naming_rule.private_or_internal_field_should_be__fieldname.symbols = private_or_internal_field
134+
dotnet_naming_rule.private_or_internal_field_should_be__fieldname.style = _fieldname
135+
136+
# Symbol specifications
137+
138+
dotnet_naming_symbols.private_or_internal_field.applicable_kinds = field
139+
dotnet_naming_symbols.private_or_internal_field.applicable_accessibilities = internal, private, private_protected
140+
dotnet_naming_symbols.private_or_internal_field.required_modifiers =
141+
142+
# Naming styles
143+
144+
dotnet_naming_style._fieldname.required_prefix = _
145+
dotnet_naming_style._fieldname.word_separator =
146+
dotnet_naming_style._fieldname.capitalization = camel_case
147+
dotnet_diagnostic.xUnit2008.severity = error
148+
dotnet_diagnostic.xUnit2009.severity = error
149+
dotnet_diagnostic.ASP0000.severity = error
150+
csharp_style_unused_value_expression_statement_preference = discard_variable:silent
151+
csharp_style_prefer_readonly_struct = true:suggestion
152+
csharp_prefer_static_local_function = true:suggestion
153+
csharp_style_prefer_readonly_struct_member = true:suggestion
154+
csharp_style_allow_blank_lines_between_consecutive_braces_experimental = true:silent
155+
csharp_style_allow_embedded_statements_on_same_line_experimental = false:error
156+
csharp_style_allow_blank_line_after_token_in_conditional_expression_experimental = true:silent
157+
csharp_style_allow_blank_line_after_colon_in_constructor_initializer_experimental = true:silent
158+
csharp_style_allow_blank_line_after_token_in_arrow_expression_clause_experimental = true:silent
159+
csharp_style_prefer_switch_expression = false:silent
160+
csharp_style_conditional_delegate_call = true:suggestion
161+
csharp_style_pattern_matching_over_as_with_null_check = true:suggestion
162+
csharp_style_prefer_pattern_matching = true:silent
163+
csharp_style_pattern_matching_over_is_with_cast_check = true:suggestion
164+
csharp_style_prefer_not_pattern = true:suggestion
165+
csharp_style_prefer_extended_property_pattern = true:suggestion
166+
csharp_style_var_for_built_in_types = false:silent
167+
csharp_style_var_when_type_is_apparent = false:silent
168+
csharp_style_var_elsewhere = false:silent
169+
csharp_preserve_single_line_blocks = true
170+
csharp_preserve_single_line_statements = true
171+
csharp_space_before_dot = false
172+
csharp_space_after_dot = false
173+
dotnet_diagnostic.xUnit2000.severity = error
174+
175+
#### Custom rules ####
176+
dotnet_diagnostic.Multifactor_EnforceNamedArgumentsForLiterals.severity = warning

‎ActiveSync/Module.cs‎

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
using System;
2+
using System.Linq;
3+
using System.Net;
4+
using System.Security.Principal;
5+
using System.Web;
6+
using MultiFactor.IIS.Adapter.Extensions;
7+
using MultiFactor.IIS.Adapter.Owa;
8+
using MultiFactor.IIS.Adapter.Services;
9+
using System.Runtime.Caching;
10+
11+
namespace MultiFactor.IIS.Adapter.ActiveSync
12+
{
13+
public class Module : IHttpModule
14+
{
15+
private MemoryCache _memoryCache;
16+
private readonly string _applicationName = "/microsoft-server-activesync";
17+
18+
public void Init(HttpApplication context)
19+
{
20+
context.PostAuthorizeRequest += (sender, e) =>
21+
OnPostAuthorizeRequest(new HttpContextWrapper(((HttpApplication)sender).Context));
22+
_memoryCache = MemoryCache.Default;
23+
}
24+
25+
public void OnPostAuthorizeRequest(HttpContextBase context)
26+
{
27+
var path = context.Request.Url?.GetComponents(UriComponents.Path, UriFormat.Unescaped);
28+
29+
if (string.IsNullOrWhiteSpace(path))
30+
{
31+
return;
32+
}
33+
34+
if (context.Request.ApplicationPath?.ToLower().StartsWith(_applicationName) != true)
35+
{
36+
return;
37+
}
38+
39+
//static resources
40+
if (WebUtil.IsStaticResourceRequest(context.Request.Url))
41+
{
42+
return;
43+
}
44+
45+
if (!context.User.Identity.IsAuthenticated)
46+
//not yet authenticated with login/pwd
47+
{
48+
return;
49+
}
50+
51+
var user = context.User.Identity.Name;
52+
if (user.StartsWith("S-1-5-21")) //SID
53+
{
54+
user = TryGetUpnFromSid(context.User.Identity);
55+
}
56+
57+
var canonicalUserName = Util.CanonicalizeUserName(user);
58+
if (Constants.EXCHANGE_SYSTEM_MAILBOX_PREFIX.Any(sm => canonicalUserName.StartsWith(sm)))
59+
//system mailbox
60+
{
61+
return;
62+
}
63+
64+
var ad = new ActiveDirectoryService(context.GetCacheAdapter(), Logger.ActiveSync);
65+
var secondFactorRequired = new UserRequiredSecondFactor(ad);
66+
if (!secondFactorRequired.Execute(canonicalUserName))
67+
//bypass 2fa
68+
{
69+
return;
70+
}
71+
72+
if (WebUtil.IsXhrRequest(context.Request))
73+
{
74+
AccessDenied(context);
75+
return;
76+
}
77+
78+
if (WebUtil.IsInitialProvisionCommand(context.Request))
79+
{
80+
var cacheKey = BuildCacheKey(context);
81+
var cachedValue = _memoryCache.Get(cacheKey);
82+
var val = cachedValue as int?;
83+
84+
if (val == 0)
85+
{
86+
AccessDenied(context);
87+
return;
88+
}
89+
90+
if (val == 1 || context.HasApiUnreachableFlag())
91+
{
92+
return;
93+
}
94+
95+
//call to mfa
96+
var secondFactorIsSuccessed = StartSecondFactorAuth(context);
97+
if (secondFactorIsSuccessed)
98+
{
99+
_memoryCache.Set(cacheKey, 1, DateTimeOffset.Now.AddSeconds(5));
100+
return;
101+
}
102+
103+
_memoryCache.Set(cacheKey, 0, DateTimeOffset.Now.AddSeconds(5));
104+
AccessDenied(context);
105+
}
106+
}
107+
108+
private bool StartSecondFactorAuth(HttpContextBase context)
109+
{
110+
var ad = new ActiveDirectoryService(context.GetCacheAdapter(), Logger.ActiveSync);
111+
112+
var userName = context.User.Identity.Name;
113+
114+
var identity = Util.CanonicalizeUserName(userName);
115+
Logger.ActiveSync.Info($"Applying identity canonicalization: {userName}->{identity}");
116+
117+
var profile = ad.GetProfile(identity);
118+
119+
if (profile == null)
120+
{
121+
// redirect to (custom?) error page
122+
throw new Exception($"Profile {identity} not found");
123+
}
124+
125+
if (Configuration.Current.HasTwoFaIdentityAttribute && !string.IsNullOrEmpty(profile.TwoFAIdentity))
126+
{
127+
Logger.ActiveSync.Info($"Applying 2fa identity attribute: {identity}->{profile.TwoFAIdentity}");
128+
identity = profile.TwoFAIdentity;
129+
}
130+
131+
var response = CreateAccessRequest(context, identity, profile?.Phone);
132+
133+
return response.Granted;
134+
}
135+
136+
private MultiFactorAccessRequest CreateAccessRequest(HttpContextBase context, string identity, string phone)
137+
{
138+
var api = new MultiFactorApiClient(Logger.ActiveSync, MfTraceIdFactory.CreateTraceActiveSync);
139+
140+
try
141+
{
142+
var response = api.CreateNonInteractiveAccessRequest("/access/requests/ex", identity, phone);
143+
return response;
144+
}
145+
catch (WebException wex) when (Configuration.Current.BypassSecondFactorWhenApiUnreachable)
146+
{
147+
if (wex.Response != null)
148+
{
149+
var httpStatusCode = ((HttpWebResponse)wex.Response).StatusCode;
150+
if ((int)httpStatusCode == 429)
151+
{
152+
Logger.ActiveSync.Error($"Too many requests. Please try again later.");
153+
}
154+
155+
Logger.ActiveSync.Error(wex.Message);
156+
157+
return new MultiFactorAccessRequest { Status = "Denied" };
158+
}
159+
160+
var errmsg = $"Multifactor API host unreachable: {Configuration.Current.ApiUrl}. Reason: {wex.Message}";
161+
Logger.ActiveSync.Error(errmsg);
162+
Logger.ActiveSync.Warn($"Bypassing the second factor for user '{identity}'.");
163+
context
164+
.GetCacheAdapter()
165+
.SetApiUnreachable(Util.CanonicalizeUserName(identity), true);
166+
return new MultiFactorAccessRequest { Status = "Granted" };
167+
}
168+
catch (Exception ex)
169+
{
170+
Logger.ActiveSync.Error(ex.Message);
171+
}
172+
173+
return new MultiFactorAccessRequest { Status = "Denied" };
174+
}
175+
176+
public static string TryGetUpnFromSid(IIdentity identity)
177+
{
178+
//for download domains exchange uses OAuthIdentity with SID name
179+
//lets try find UPN with reflection
180+
var actAsUser = GetPropValue(identity, "ActAsUser");
181+
var upn = GetPropValue(actAsUser, "UserPrincipalName");
182+
return upn as string;
183+
}
184+
185+
public static object GetPropValue(object src, string propName)
186+
{
187+
try
188+
{
189+
if (src == null)
190+
{
191+
return null;
192+
}
193+
194+
return src.GetType().GetProperty(propName).GetValue(src, null);
195+
}
196+
catch
197+
{
198+
return null;
199+
}
200+
}
201+
202+
private void AccessDenied(HttpContextBase context)
203+
{
204+
context.Response.StatusCode = 440;
205+
context.Response.End();
206+
}
207+
208+
private string BuildCacheKey(HttpContextBase context)
209+
{
210+
var userName = context.User.Identity.Name;
211+
var deviceId = context.Request.Params["DeviceId"];
212+
return $"{userName}-{deviceId}";
213+
}
214+
215+
public void Dispose()
216+
{
217+
}
218+
}
219+
}

0 commit comments

Comments
 (0)