From 6d53580b148a0ea6117fee3b6d6eca143ec34195 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakob=20Aar=C3=B8e=20Dam?= Date: Thu, 23 Apr 2015 12:40:27 +0200 Subject: [PATCH] Refactoring smstoken --- .../RDWeb/Pages/en-US/smstoken.apsx.cs | 173 ++++++++++++++++++ RDSFactorWeb/RDWeb/Pages/en-US/smstoken.aspx | Bin 11831 -> 4362 bytes 2 files changed, 173 insertions(+) create mode 100644 RDSFactorWeb/RDWeb/Pages/en-US/smstoken.apsx.cs diff --git a/RDSFactorWeb/RDWeb/Pages/en-US/smstoken.apsx.cs b/RDSFactorWeb/RDWeb/Pages/en-US/smstoken.apsx.cs new file mode 100644 index 0000000..0f5a359 --- /dev/null +++ b/RDSFactorWeb/RDWeb/Pages/en-US/smstoken.apsx.cs @@ -0,0 +1,173 @@ +using System; +using System.IO; +using System.Collections.Generic; +using System.Web; +using System.Web.UI; +using System.Web.UI.WebControls; +using System.Web.Helpers; +using System.Configuration; + +using RADAR; + +public partial class SMSToken : System.Web.UI.Page +{ + String radiusServer; + String radiusSecret; + + // + // Localizable Text + // + public const string L_SmsToken_Text = "Enter SMS Token:"; + public const string L_LogonFailureLabel_Text = "The user name or password that you entered is not valid. Try typing it again."; + public const string L_SubmitLabel_Text = "Submit"; + public const string L_CancelLabel_Text = "Cancel"; + // + // Page Variables + // + + public string sHelpSourceServer, sLocalHelp, strWorksSpaceName; + public Uri baseUrl; + + public SMSToken() { + radiusServer = ConfigurationManager.AppSettings["RadiusServer"]; + radiusSecret = ConfigurationManager.AppSettings["RadiusSecret"]; + } + + public void btnSignIn_Click(object sender, EventArgs e){ + String username = (string)Session["DomainUserName"]; + RADIUSAttributes atts = new RADIUSAttributes(); + RADIUSAttribute state = (RADIUSAttribute)Session["state"]; + RADIUSClient client = new RADIUSClient(radiusServer, 1812, radiusSecret); + + atts.Add(state); + + String encryptedChallangeResult = Crypto.SHA256(username + SmsToken.Text + radiusSecret); + RADIUSPacket response = client.Authenticate(username, encryptedChallangeResult, atts); + + onRadiusResponse(response); + } + + public void btnCancel_Click(object sender, EventArgs e){ + SafeRedirect("logoff.aspx"); + } + + void onRadiusResponse(RADIUSPacket response) { + if (response.Code == RadiusPacketCode.AccessChallenge) { + onRadiusChallange(response); + } + else if (response.Code == RadiusPacketCode.AccessAccept) { + onRadiusAccept(response); + } + else { + Session["UserPass"] = ""; + Session["DomainUserName"] = ""; + SafeRedirect("logoff.aspx?Error=LoginSMSFailed"); + } + } + + void onRadiusChallange(RADIUSPacket response){ + RADIUSAttribute state = response.Attributes.GetFirstAttribute(RadiusAttributeType.State); + Session["State"] = state; + } + + void onRadiusAccept(RADIUSPacket response){ + string sessionGuid = response.Attributes.GetFirstAttribute(RadiusAttributeType.ReplyMessage).GetString(); + Session["SESSIONGUID"] = sessionGuid; + + HttpCookie myCookie = new HttpCookie("RadiusSessionId"); + DateTime now = DateTime.Now; + myCookie.Value = sessionGuid; + myCookie.Expires = now.AddMinutes(480); + Response.Cookies.Add(myCookie); + + Session["SMSTOKEN"] = "SMS_AUTH"; + SafeRedirect("default.aspx"); + } + + void SafeRedirect(string strRedirectUrl){ + string strRedirectSafeUrl = null; + + if (!String.IsNullOrEmpty(strRedirectUrl)){ + Uri redirectUri = new Uri(GetRealRequestUri(), strRedirectUrl); + + if (redirectUri.Authority.Equals(Request.Url.Authority) && redirectUri.Scheme.Equals(Request.Url.Scheme)){ + strRedirectSafeUrl = redirectUri.AbsoluteUri; + } + } + + if (strRedirectSafeUrl == null){ + strRedirectSafeUrl = "default.aspx"; + } + + Response.Redirect(strRedirectSafeUrl, false); + } + + public static Uri GetRealRequestUri(HttpRequest request){ + if (String.IsNullOrEmpty(request.Headers["Host"])) + return request.Url; + + UriBuilder ub = new UriBuilder(request.Url); + string[] realHost = request.Headers["Host"].Split(':'); + string host = realHost[0]; + ub.Host = host; + string portString = realHost.Length > 1 ? realHost[1] : ""; + int port; + if (int.TryParse(portString, out port)) + ub.Port = port; + return ub.Uri; + } + + public static Uri GetRealRequestUri() + { + if ((HttpContext.Current == null) || (HttpContext.Current.Request == null)) + throw new ApplicationException("Cannot get current request."); + return GetRealRequestUri(HttpContext.Current.Request); + } + + void Page_PreInit(object Sender, EventArgs e){ + // Deny requests with "additional path information" + if (Request.PathInfo.Length != 0) + { + Response.StatusCode = 404; + Response.End(); + } + + // gives us https:///rdweb/pages// + baseUrl = new Uri(new Uri(GetRealRequestUri(), Request.FilePath), "."); + sLocalHelp = ConfigurationManager.AppSettings["LocalHelp"]; + if ((sLocalHelp != null) && (sLocalHelp == "true")){ + sHelpSourceServer = "./rap-help.htm"; + } + else{ + sHelpSourceServer = "http://go.microsoft.com/fwlink/?LinkId=141038"; + } + } + + void Page_Load(object sender, EventArgs e){ + btnSignIn.Text = L_SubmitLabel_Text; + btnCancel.Text = L_CancelLabel_Text; + + if (Page.IsPostBack){ + return; + } + + String username = (string)Session["DomainUserName"]; + String password = (string)Session["UserPass"]; + deliveryLabel.Text = (string)Session["Delivery"]; + + RADIUSClient client = new RADIUSClient(radiusServer, 1812, radiusSecret); + RADIUSAttributes atts = new RADIUSAttributes(); + try{ + VendorSpecificAttribute vsa = new VendorSpecificAttribute(VendorSpecificType.Generic, (string)Session["Delivery"]); + vsa.SetRADIUSAttribute(ref atts); + RADIUSPacket response = client.Authenticate(username, password, atts); + onRadiusResponse(response); + } + catch (Exception ex){ + Session["UserPass"] = ""; + Session["DomainUserName"] = ""; + + SafeRedirect("logoff.aspx?Error=LoginRadiusFailed"); + } + } +} \ No newline at end of file diff --git a/RDSFactorWeb/RDWeb/Pages/en-US/smstoken.aspx b/RDSFactorWeb/RDWeb/Pages/en-US/smstoken.aspx index 3f9da4f04f854f2149343d87430a9164e52396bb..3fd5a97760b344d20824dc21a80bcb5adb0f1ae2 100644 GIT binary patch literal 4362 zcmcInYflqV5S`B^{)Y_)qaWA`#7DG%3N$t;VrY?%q%WYcv`x3w;*VF)nc3TYbaz_{ zhS0~}xo2k1%$a-p_fJ_4WG1)L7f*glSH==ZPlhs(J=u_L@#PiXJ**6*jprS#4&+)_ z&!r(1*^+m#IFNmLDo-TB+XB)=?tt9IryIO>@!ivBBYYkrTc)z;YI&tSa$6 zsltvG7%P*3a$A=ZFxvpq55=J+ahZ8Vv$h%q=nhuW+4;zAgeS9*74F*%s~=~jihay! zjJ=+G#jaZ*GtVa2H0(MeCw3QWahx&`$?SbGeC#-VB%}*O)k2P6@ZMK`sSV@P<-2~I zb)dG<0alT_wPQX(rP@FlBDNtqWP*qrz#fB9Dz%B&>1zyi(~=eN(XmtH*2fbn(-h68 zRxR%F(F6Q;E1zIH(e7cd5u>T^?7($v_P?Tz$78*CCP#9C93qYKIW@t*7ILBDSckr< zf)(9U#^TjE#wvT%^yWjMf$~7ry_ln%D~b8OaqpBiJ`Rc(${Hy=F6to;>ZnJ}jvJ4*sm`qTRIT zx|9Zf3(X z<_cEEe|GfQT21G_I_pX8rE%=L**NXwMNs53>1DBk#r<#UUYs<`J1prpncZR(%XOF+ ziJN&@n9gfi`-=U@n`}$FDC$Mddro*eJ?>&Q%gz~Z-rwxA2%G!91Cd?G`-t@zZ{0ix zcsow^S+p~+!sKW5Iqvdy?^fgJJmu-~S=GS%?*K6|;v(Oi@l;U!BwT$q6!XuU@)&c$ z{f=19`eSoTo}w7z%tT$%LX-o{ExQSDDlLzbw}bdhb2po~2cnz;?NGUG<5vrNY0=wd z%z}IPS1PF4>Ny>vuKX2D6)ex`VHw4Jr88nSj5<%r_fbF=M)9Px36yoK+6`}25Akn% Zv*$S1TxXaDUG!X8|lfX|d7x4WC}Y)S<1e|`k;pMU+k_wr#8vU@IM5J!FIz}JxKdEtiG2d%1nStq%VR*v9O|Skw%{COHj@QG{^AicC#lt zNu`Px!LQypSQ_z%g!>92;RK(}J;`Dp-a=B+VuPp>!SBh^As;oT-xOq~B3`gD zr_!7LTp6`^I45vcJZ{J|ucO#L~-FU{l@v^~pdy9~Jp0174&#yZ}VWIz^D`#|7;RM-FdV4#DqapLVOhUx%zc$A1s`soHjd+vjmaEyr||;Or+t`W8-=#^QANQN zLq_42rYl%%Dh+E8M8!=mya-Ac?s1X~xgzhDAD!|7=aa=$1Lg~OIG8Z9=i5uc2T`Cp@%SHzFHGv{XOEpxTsjsr$@s1T{5g|= z$xWz!q7@VT7kHSGCWJWNWD-!$_Cka*#FQYKBA=TyZlKWOV9GjIW}$nDX#>o1&v`V% zim&=?-y)=`KuQn$$x1ADs63U*lX$`*uIKyDtvKt`&Z0?Yw>0+88Vj@F9^oOCY_3!y z54+vo!t+s$@T0DnEcv)g@mO|yR0$j*+5d?USW^Y!h%Xt8x05~JaCODK(6UA&yL(9N zT0-t?_%AVwSB~qHsVe+pE8XW_lq;U7BAIqdkRZn>4Z~gb%{Q$4zK?=KiIh9LYo*L& z-FHEk<93CYJek9L-MLz1DV9(}s`Q`_M;gLJkNnXc$jex&SDt^jTeE&Rn@U9%!ie~i%(@mk$QW)S=OO$}tTftUmCkRv zl>%Ne&5{&N5IYG21S95~hw;1eNT(cI_t?RUgQxI28=xsfmc6YO7bWu)!dDq+9y4Vn zco_6g%-4Z!r4+$DqWnmo|ADmU2aooh%xnR{V~?7|xkMUX6)dJ@7s0%J+3 zG=Vws;o=S zPh@qwwo!RPTqm{xr4jm2V1AU)43JF{Gc(qR%U~`3+d@a0K=dX>_0ea4K!jI330Jnd z-X*aQb*Tu4tyv_IP>A(xI2^ox_vU(VYJ^*m)1vgZNKGekd>3%GSlKToP81`Zyspy` zc2G?o8ULry_b5Q?9K}oUo&9v*#mg4F88Y{S7p7!sC8=$ij&?49QDOnmxW|*p1==6Q zW#{>e{Wfd6vi=GGAtog)>14>;78G*47>?fm{p_6ZPG_J()Z>d%BZ>)@o|28Mijy&t)&nX(iXxX7b0*?oe^(pT$dy|T;Q92Vj~M(a_8)U921F{@rQg$Nj7^CL}3#t<5-1D@8t=OlZ^Gh(%*JAhJI4h#jz(Ie8xsKC#1UbO@k( zf>44>W{KA>b}cVGA$h03u*YaOihkFGOH^LsHAtvIvtq|MWSn8ijl(!Y)~xI1rQ(^E zM?A7fL@H=_Qga$X!BkQuECqP0ZugauSj~`XXi8r7xmZp*ArHp}rVi!wJvW$6i{I0stO%yd;QJ(iV9Kq;PNXGi(j9 z5I_Ne_H1Yu51kwJ{2d~5w~@Iq*VW6gSHU|On=EZm~e_3s|F zb&)kuAhy{G>K#uiCurwXH|~Y9vM#1m>j#Uy0zIR$MNq6Zi$L!Gu`j1;&_nO8%T`Tn zIl)-N!U?iiB{+r2`#V@Vs!z!4ga%@F`1bhe_dn#_C@ds9KQkK{-+f^x;jzu`I*N+U zw-7T00#Q`ywA;D1%e4(#vA7u=$joKY@<0YT@Vr6Ywujxi0m}>4;nvMp!2^XBQ*!;$ zHY^JUUv9y&4rq(^E1&w9)+-OS>)Ng=`-S|rYPu>#L^bx8-J=w?H}2W4!T#?3=yqM( zSET^Kar^G6M3oW3hLCA?Q-4RuTuWcx0RU^SYc2uMg%jkRV@f(UZP6BZD#E_g+vzuU z%6E<&I}OLk0(J{1bl8v~TeIGtN4UpDu|WWg z0QF6UUU4>zqx}n$hwUAP9yaqshO0M`>^pO_8NXaE-Q_bk7PIcbk3as{eV{pxT|h3` zo1@_<{nqamTzUE+HW@8uWP0hKGW;gi0h5x$*K-`ey|xT#tV>|y`;Xtp7#?C$(JXa zGx;qin?v&YG%x`l8m3MLkMZ$}sB7dZN~>d>SXy!GgSjs=sx^I9y< zX=B4-=BkT>!U5a$r1#Qvr7uY=gNd5=ooCZMRc78MroPMt!6<)v4L-6_;>XJF;6))YK^!{9z_RK?-;>Y=Ugxz1*k7@@DU|X= zs~U@`DyM87J$u-eJEUUwRs6sPr?`q{Zxca%A{UCgIfZTbCHZvU(Sr{A5Xb=X zM9|lFSFK;_!5Vri{klS}z0+v+Da^$RA~TwrTw3iVOC4+Dla5OTlMuH)fNik(NX|%f zhCVI3ycKW2&7vQrOS8aX?<3u?_nmy1DMxY1meorcl9J}3ip^B94Qw{lu0vL?eVrCm zRU6slCbgN3Xj+bZ&yawt^NFeEn@#v=1${8bI&`tV*Cl>|f?m;IuiLC$Q0v%o925Tw D9C|Vv