Forward-port WS-Trust support to dev

.gitignore

@@ -212,3 +212,4 @@ test/ApiChangeTest/Resource/devAssemblies
 test/ApiChangeTest/Resource/reports
 /benchmark/Microsoft.IdentityModel.Benchmarks/BenchmarkDotNet.Artifacts/results
 /benchmark/Microsoft.IdentityModel.Benchmarks/.vs
+local-nuget/

Wilson.sln

@@ -46,6 +46,10 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.IdentityModel.Pro
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.IdentityModel.Protocols.WsFederation.Tests", "test\Microsoft.IdentityModel.Protocols.WsFederation.Tests\Microsoft.IdentityModel.Protocols.WsFederation.Tests.csproj", "{A769FC73-E1EE-48D7-9C37-AFB2926EAAEF}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.IdentityModel.Protocols.WsTrust", "src\Microsoft.IdentityModel.Protocols.WsTrust\Microsoft.IdentityModel.Protocols.WsTrust.csproj", "{C0B42CDB-245E-4223-AC94-F196B5F5530F}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.IdentityModel.Protocols.WsTrust.Tests", "test\Microsoft.IdentityModel.Protocols.WsTrust.Tests\Microsoft.IdentityModel.Protocols.WsTrust.Tests.csproj", "{A1C9B9D0-3085-4A6E-A789-E79F9C19CE00}"
+EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.IdentityModel.Protocols.OpenIdConnect", "src\Microsoft.IdentityModel.Protocols.OpenIdConnect\Microsoft.IdentityModel.Protocols.OpenIdConnect.csproj", "{4B22E54A-CA65-4239-9B92-6F56B44BA079}"
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.IdentityModel.Protocols.OpenIdConnect.Tests", "test\Microsoft.IdentityModel.Protocols.OpenIdConnect.Tests\Microsoft.IdentityModel.Protocols.OpenIdConnect.Tests.csproj", "{69F54E38-ED15-4CCC-960D-02FEE7CB6A64}"
@@ -239,6 +243,14 @@ Global
 		{38185C55-DF58-4032-BB85-599BC1D92169}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{38185C55-DF58-4032-BB85-599BC1D92169}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{38185C55-DF58-4032-BB85-599BC1D92169}.Release|Any CPU.Build.0 = Release|Any CPU
+		{C0B42CDB-245E-4223-AC94-F196B5F5530F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{C0B42CDB-245E-4223-AC94-F196B5F5530F}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{C0B42CDB-245E-4223-AC94-F196B5F5530F}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{C0B42CDB-245E-4223-AC94-F196B5F5530F}.Release|Any CPU.Build.0 = Release|Any CPU
+		{A1C9B9D0-3085-4A6E-A789-E79F9C19CE00}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A1C9B9D0-3085-4A6E-A789-E79F9C19CE00}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A1C9B9D0-3085-4A6E-A789-E79F9C19CE00}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A1C9B9D0-3085-4A6E-A789-E79F9C19CE00}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -276,6 +288,8 @@ Global
 		{F1BB31E4-8865-4425-8BD4-94F1815C16E0} = {2F79F3C4-F4E3-46DD-8B34-8EF403A6F7F5}
 		{38D1BFCB-F8A9-488C-B930-58CA61DC3F08} = {BD2706C5-6C57-484D-89C8-A0CF5F8E3D19}
 		{38185C55-DF58-4032-BB85-599BC1D92169} = {8905D2E3-4499-4A86-BF3E-F098F228DD59}
+		{C0B42CDB-245E-4223-AC94-F196B5F5530F} = {BD2706C5-6C57-484D-89C8-A0CF5F8E3D19}
+		{A1C9B9D0-3085-4A6E-A789-E79F9C19CE00} = {8905D2E3-4499-4A86-BF3E-F098F228DD59}
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
 		SolutionGuid = {2F681326-7ED4-45F6-BD1D-1119EA388F42}

WilsonUnix.sln

@@ -88,6 +88,10 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.IdentityModel.Dpo
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.IdentityModel.Dpop.Tests", "test\Microsoft.IdentityModel.Dpop.Tests\Microsoft.IdentityModel.Dpop.Tests.csproj", "{D06F19FF-038D-4666-9048-1E5BFA580B4E}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.IdentityModel.Protocols.WsTrust", "src\Microsoft.IdentityModel.Protocols.WsTrust\Microsoft.IdentityModel.Protocols.WsTrust.csproj", "{CD77D609-9680-488B-8DD3-57040909D2B7}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.IdentityModel.Protocols.WsTrust.Tests", "test\Microsoft.IdentityModel.Protocols.WsTrust.Tests\Microsoft.IdentityModel.Protocols.WsTrust.Tests.csproj", "{7B38242E-51CA-4928-A199-66D9E0CC3973}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -446,6 +450,30 @@ Global
 		{D06F19FF-038D-4666-9048-1E5BFA580B4E}.Release|x64.Build.0 = Release|Any CPU
 		{D06F19FF-038D-4666-9048-1E5BFA580B4E}.Release|x86.ActiveCfg = Release|Any CPU
 		{D06F19FF-038D-4666-9048-1E5BFA580B4E}.Release|x86.Build.0 = Release|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Debug|x64.Build.0 = Debug|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Debug|x86.Build.0 = Debug|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Release|Any CPU.Build.0 = Release|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Release|x64.ActiveCfg = Release|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Release|x64.Build.0 = Release|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Release|x86.ActiveCfg = Release|Any CPU
+		{CD77D609-9680-488B-8DD3-57040909D2B7}.Release|x86.Build.0 = Release|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Debug|x64.Build.0 = Debug|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Debug|x86.Build.0 = Debug|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Release|Any CPU.Build.0 = Release|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Release|x64.ActiveCfg = Release|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Release|x64.Build.0 = Release|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Release|x86.ActiveCfg = Release|Any CPU
+		{7B38242E-51CA-4928-A199-66D9E0CC3973}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -481,6 +509,8 @@ Global
 		{17116E4B-B3FE-40A9-A733-1BC00FF5963D} = {8905D2E3-4499-4A86-BF3E-F098F228DD59}
 		{3A1BEDB6-D6B8-43F4-899A-83D9DDA193EC} = {BD2706C5-6C57-484D-89C8-A0CF5F8E3D19}
 		{D06F19FF-038D-4666-9048-1E5BFA580B4E} = {8905D2E3-4499-4A86-BF3E-F098F228DD59}
+		{CD77D609-9680-488B-8DD3-57040909D2B7} = {BD2706C5-6C57-484D-89C8-A0CF5F8E3D19}
+		{7B38242E-51CA-4928-A199-66D9E0CC3973} = {8905D2E3-4499-4A86-BF3E-F098F228DD59}
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
 		SolutionGuid = {2F681326-7ED4-45F6-BD1D-1119EA388F42}

build/credscan-exclusion.json

@@ -60,6 +60,10 @@
         {
             "file": "References.cs",
             "_justification": "File contains tokens that are used only for testing purposes."
+        },
+        {
+            "file": "ComputedKeyReferences.cs",
+            "_justification": "File contains base64 PSHA1 key derivation test vectors that are used only for testing purposes."
         }
     ]
 }

buildConfiguration.xml

@@ -12,6 +12,7 @@
       <project name="Microsoft.IdentityModel.Tokens.Saml" />
       <project name="Microsoft.IdentityModel.Protocols" />
       <project name="Microsoft.IdentityModel.Protocols.WsFederation" />
+      <project name="Microsoft.IdentityModel.Protocols.WsTrust" />
       <project name="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
       <project name="Microsoft.IdentityModel.Protocols.SignedHttpRequest" />
       <project name="Microsoft.IdentityModel.Validators" />
@@ -30,6 +31,7 @@
       <project name="Microsoft.IdentityModel.Tokens.Saml.Tests" test="yes" />
       <project name="Microsoft.IdentityModel.Protocols.Tests" test="yes" />
       <project name="Microsoft.IdentityModel.Protocols.WsFederation.Tests" test="yes" />
+      <project name="Microsoft.IdentityModel.Protocols.WsTrust.Tests" test="yes" />
       <project name="Microsoft.IdentityModel.Protocols.OpenIdConnect.Tests" test="yes" />
       <project name="Microsoft.IdentityModel.Protocols.SignedHttpRequest.Tests" test="yes" />
       <project name="Microsoft.IdentityModel.Validators.Tests" test="yes" />

src/Microsoft.IdentityModel.Protocols.WsTrust/BinaryExchange.cs

@@ -0,0 +1,73 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using Microsoft.IdentityModel.Logging;
+using Microsoft.IdentityModel.Protocols.WsSecurity;
+
+namespace Microsoft.IdentityModel.Protocols.WsTrust
+{
+    /// <summary>
+    /// Represents the contents of the BinaryExchange element.
+    /// see: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-os.html
+    /// </summary>
+    internal class BinaryExchange
+    {
+        private byte[] _binaryData;
+
+        /// <summary>
+        /// Creates an instance of <see cref="BinaryExchange"/>
+        /// </summary>
+        /// <param name="binaryData">Binary data exchanged.</param>
+        /// <param name="valueType">Uri representing the value type of the binary data.</param>
+        /// <exception cref="ArgumentNullException">if <paramref name="binaryData"/> or <paramref name="valueType"/>.</exception>
+        /// <remarks>Default encoding type is: "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1/#Base64Binary".
+        /// for possible values see: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-os.html#wssecurity".</remarks>
+        public BinaryExchange(byte[] binaryData, Uri valueType)
+            : this(binaryData, valueType, new Uri(WsSecurityEncodingTypes.WsSecurity11.Base64))
+        {
+        }
+
+        /// <summary>
+        /// Creates an instance of <see cref="BinaryExchange"/>
+        /// </summary>
+        /// <param name="binaryData">Binary data exchanged.</param>
+        /// <param name="valueType">Uri representing the value type of the binary data.</param>
+        /// <param name="encodingType">Encoding type to be used for encoding teh </param>
+        /// <exception cref="ArgumentNullException">if <paramref name="binaryData"/>, <paramref name="valueType"/> or <paramref name="encodingType"/> is null.</exception>
+        public BinaryExchange(byte[] binaryData, Uri valueType, Uri encodingType)
+        {
+            BinaryData = binaryData ?? throw LogHelper.LogArgumentNullException(nameof(binaryData));
+            ValueType = valueType ?? throw LogHelper.LogArgumentNullException(nameof(valueType)); ;
+            EncodingType = encodingType ?? throw LogHelper.LogArgumentNullException(nameof(encodingType)); ;
+        }
+
+        /// <summary>
+        /// Gets the Binary Data.
+        /// </summary>
+        public byte[] BinaryData
+        {
+            get
+            {
+                byte[] binaryCopy = new byte[_binaryData.Length];
+                Array.Copy(_binaryData, binaryCopy, _binaryData.Length);
+                return binaryCopy;
+            }
+
+            private set
+            {
+                _binaryData = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets the ValueType Uri.
+        /// </summary>
+        public Uri ValueType { get; }
+
+        /// <summary>
+        /// Gets the EncodingType Uri.
+        /// </summary>
+        public Uri EncodingType { get; }
+    }
+}

src/Microsoft.IdentityModel.Protocols.WsTrust/BinarySecret.cs

@@ -0,0 +1,92 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Xml;
+using Microsoft.IdentityModel.Logging;
+
+namespace Microsoft.IdentityModel.Protocols.WsTrust
+{
+    /// <summary>
+    /// Represents the contents of a BinarySecret element.
+    /// A binary secret represents key material that will be serialized with a request.
+    /// see: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-os.html
+    /// </summary>
+    public class BinarySecret
+    {
+        private byte[] _data;
+        private string _encodingType;
+
+        /// <summary>
+        /// Creates an instance of <see cref="BinarySecret"/>.
+        /// This constructor is useful when deserializing from xml.
+        /// </summary>
+        internal BinarySecret()
+        {
+        }
+
+        /// <summary>
+        /// Creates an instance of <see cref="BinarySecret"/>.
+        /// </summary>
+        /// <param name="data">the bytes of the key material.</param>
+        /// <exception cref="ArgumentNullException">if <paramref name="data"/> is null.</exception>
+        public BinarySecret(byte[] data)
+        {
+            Data = data;
+        }
+
+        /// <summary>
+        /// Creates an instance of <see cref="BinarySecret"/>.
+        /// </summary>
+        /// <param name="data">the bytes of the key material.</param>
+        /// <param name="encodingType">the encoding type to use when writing data.</param>
+        /// <exception cref="ArgumentNullException">if <paramref name="data"/> is null.</exception>
+        /// <exception cref="ArgumentNullException">if <paramref name="encodingType"/> is null or an empty string.</exception>
+        public BinarySecret(byte[] data, string encodingType)
+        {
+            Data = data;
+            EncodingType = encodingType;
+        }
+
+        /// <summary>
+        /// Gets or sets the binary data.
+        /// </summary>
+        /// <exception cref="ArgumentNullException">if Data is null.</exception>
+        public byte[] Data
+        {
+            get
+            {
+                byte[] binaryCopy = new byte[_data.Length];
+                Array.Copy(_data, binaryCopy, _data.Length);
+                return binaryCopy;
+            }
+
+            internal set
+            {
+                _data = value ?? throw LogHelper.LogArgumentNullException(nameof(Data));
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the encoding type.
+        /// </summary>
+        /// <exception cref="ArgumentNullException">thrown if value is null or empty.</exception>
+        public string EncodingType
+        {
+            get => _encodingType;
+            set => _encodingType = string.IsNullOrEmpty(value) ? throw LogHelper.LogArgumentNullException(nameof(EncodingType)) : value;
+        }
+
+        /// <summary>
+        /// A collection of additional attributes.
+        /// </summary>
+        public ICollection<string> AdditionalAttributes { get; } = new Collection<string>();
+
+        /// <summary>
+        /// A collection of additional XML attributes.
+        /// </summary>
+        public ICollection<XmlAttribute> AdditionalXmlAttributes { get; } = new Collection<XmlAttribute>();
+    }
+}

src/Microsoft.IdentityModel.Protocols.WsTrust/Claims.cs

@@ -0,0 +1,41 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using System.Collections.Generic;
+using Microsoft.IdentityModel.Logging;
+using Microsoft.IdentityModel.Protocols.WsFed;
+
+namespace Microsoft.IdentityModel.Protocols.WsTrust
+{
+    /// <summary>
+    /// Represents the contents of the Claims element.
+    /// The Claims element contains specific claims that are being requested.
+    /// see: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-os.html
+    /// </summary>
+    public class Claims
+    {
+        /// <summary>
+        /// Creates an instance of <see cref="Claims"/>
+        /// </summary>
+        /// <param name="dialect">a uri that defines the dialect of the claims.</param>
+        /// <param name="claimTypes">a list of <see cref="ClaimType"/>.</param>
+        /// <exception cref="ArgumentNullException">thrown if <paramref name="dialect"/> is null or empty</exception>
+        /// <exception cref="ArgumentNullException">thrown if <paramref name="claimTypes"/> is null.</exception>
+        public Claims(string dialect, IList<ClaimType> claimTypes)
+        {
+            Dialect = string.IsNullOrEmpty(dialect) ? throw LogHelper.LogArgumentNullException(nameof(dialect)) : dialect;
+            ClaimTypes = claimTypes ?? throw LogHelper.LogArgumentNullException(nameof(claimTypes));
+        }
+
+        /// <summary>
+        /// Gets the list of <see cref="ClaimType"/>.
+        /// </summary>
+        public IList<ClaimType> ClaimTypes { get; }
+
+        /// <summary>
+        /// Gets the dialect of these claims.
+        /// </summary>
+        public string Dialect { get; }
+    }
+}

src/Microsoft.IdentityModel.Protocols.WsTrust/Entropy.cs

@@ -0,0 +1,69 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using Microsoft.IdentityModel.Logging;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Microsoft.IdentityModel.Protocols.WsTrust
+{
+    /// <summary>
+    /// This type is used when creating a WsTrust request to specify entropy used to create a security key used to secure the request.
+    /// <para>see: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-os.html </para>
+    /// </summary>
+    public class Entropy
+    {
+        /// <summary>
+        /// 
+        /// </summary>
+        internal Entropy()
+        {
+        }
+
+        /// <summary>
+        /// Instantiates an <see cref="Entropy"/> with a <see cref="BinarySecret"/>.
+        /// </summary>
+        /// <param name="binarySecret">the entropy to use on the WsTrust request.</param>
+        /// <exception cref="ArgumentNullException">thrown if <paramref name="binarySecret"/> is null.</exception>
+        public Entropy(BinarySecret binarySecret)
+        {
+            BinarySecret = binarySecret;
+        }
+
+        /// <summary>
+        /// Gets the <see cref="BinarySecret"/> passed to the constructor.
+        /// </summary>
+        public BinarySecret BinarySecret { get; internal set; }
+
+        /// <summary>
+        /// Constructs an entropy instance with the protected key.
+        /// </summary>
+        /// <param name="protectedKey">The protected key which can be either binary secret or encrypted key.</param>
+        /// <exception cref="ArgumentNullException">thrown if <paramref name="protectedKey"/> is null.</exception>
+        public Entropy(ProtectedKey protectedKey)
+        {
+            ProtectedKey = protectedKey ?? throw LogHelper.LogArgumentNullException(nameof(protectedKey));
+        }
+
+        /// <summary>
+        /// Get the <see cref="ProtectedKey"/> passed to the constructor.
+        /// </summary>
+        public ProtectedKey ProtectedKey { get; }
+
+        static byte[] GetKeyBytesFromProtectedKey(ProtectedKey protectedKey)
+        {
+            if (protectedKey == null)
+                throw LogHelper.LogArgumentNullException(nameof(protectedKey));
+
+            return protectedKey.Secret;
+        }
+
+        static EncryptingCredentials GetWrappingCredentialsFromProtectedKey(ProtectedKey protectedKey)
+        {
+            if (protectedKey == null)
+                throw LogHelper.LogArgumentNullException(nameof(protectedKey));
+
+            return protectedKey.WrappingCredentials;
+        }
+    }
+}