GDS: implement ApplicationSelfAdmin privilege in GlobalDiscoverySampleServer

Libraries/Opc.Ua.Gds.Server.Common/IApplicationsDatabase.cs → Libraries/Opc.Ua.Gds.Server.Common/ApplicationsDatabase/IApplicationsDatabase.cs

@@ -1,4 +1,4 @@
-/* ========================================================================
+/* ========================================================================
  * Copyright (c) 2005-2020 The OPC Foundation, Inc. All rights reserved.
  *
  * OPC Foundation MIT License 1.00

Libraries/Opc.Ua.Gds.Server.Common/LinqApplicationsDatabase.cs → Libraries/Opc.Ua.Gds.Server.Common/ApplicationsDatabase/LinqApplicationsDatabase.cs

@@ -49,7 +49,7 @@ class Application
         public Application()
         {
             Certificate = new Dictionary<string, byte[]>();
-            TrustListId = new Dictionary<string, Guid>();
+            TrustListId = new Dictionary<string, string>();
         }
         public uint ID { get; set; }
         public Guid ApplicationId { get; set; }
@@ -59,7 +59,7 @@ public Application()
         public string ProductUri { get; set; }
         public string ServerCapabilities { get; set; }
         public Dictionary<string, byte[]> Certificate { get; }
-        public Dictionary<string, Guid> TrustListId { get; }
+        public Dictionary<string, string> TrustListId { get; }
     }
 
     [Serializable]
@@ -711,11 +711,7 @@ string trustListId
 
                 if (trustListId != null)
                 {
-                    var result2 = (from x in CertificateStores where x.Path == trustListId select x).SingleOrDefault();
-                    if (result2 != null)
-                    {
-                        result.TrustListId[certificateType] = result2.TrustListId;
-                    }
+                    result.TrustListId[certificateType] = trustListId;
                 }
                 SaveChanges();
             }
@@ -740,20 +736,8 @@ out string trustListId
                 {
                     return false;
                 }
-
-                Guid trustListGuid;
-                if (result.TrustListId.TryGetValue(certificateType, out trustListGuid))
-                {
-                    var result2 = (from x in CertificateStores where x.TrustListId == trustListGuid select x).SingleOrDefault();
-                    if (result2 != null)
-                    {
-                        trustListId = result2.Path;
-                        return true;
-                    }
-                }
+                return result.TrustListId.TryGetValue(certificateType, out trustListId);
             }
-
-            return false;
         }
         #endregion
 

Libraries/Opc.Ua.Gds.Server.Common/ApplicationsNodeManager.cs

@@ -162,33 +162,7 @@ public override NodeId New(ISystemContext context, NodeState node)
         }
         #endregion
 
-        #region Private Methods
-        private void HasApplicationAdminAccess(ISystemContext context)
-        {
-            if (context != null)
-            {
-                RoleBasedIdentity identity = context.UserIdentity as RoleBasedIdentity;
-
-                if ((identity == null) || (!identity.Roles.Contains(GdsRole.ApplicationAdmin)))
-                {
-                    throw new ServiceResultException(StatusCodes.BadUserAccessDenied, "Application Administrator access required.");
-                }
-            }
-        }
-
-        private void HasApplicationUserAccess(ISystemContext context)
-        {
-            if (context != null)
-            {
-                RoleBasedIdentity identity = context.UserIdentity as RoleBasedIdentity;
-
-                if (identity == null)
-                {
-                    throw new ServiceResultException(StatusCodes.BadUserAccessDenied, "Application User access required.");
-                }
-            }
-        }
-
+        #region Private methods
         private NodeId GetTrustListId(NodeId certificateGroupId)
         {
 
@@ -516,7 +490,7 @@ private ServiceResult OnRegisterApplication(
             ApplicationRecordDataType application,
             ref NodeId applicationId)
         {
-            HasApplicationAdminAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { GdsRole.DiscoveryAdmin });
 
             Utils.LogInfo("OnRegisterApplication: {0}", application.ApplicationUri);
 
@@ -531,7 +505,7 @@ private ServiceResult OnUpdateApplication(
             NodeId objectId,
             ApplicationRecordDataType application)
         {
-            HasApplicationAdminAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { GdsRole.DiscoveryAdmin });
 
             Utils.LogInfo("OnUpdateApplication: {0}", application.ApplicationUri);
 
@@ -553,7 +527,7 @@ private ServiceResult OnUnregisterApplication(
             NodeId objectId,
             NodeId applicationId)
         {
-            HasApplicationAdminAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { GdsRole.DiscoveryAdmin });
 
             Utils.LogInfo("OnUnregisterApplication: {0}", applicationId.ToString());
 
@@ -588,7 +562,7 @@ private ServiceResult OnFindApplications(
             string applicationUri,
             ref ApplicationRecordDataType[] applications)
         {
-            HasApplicationUserAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { Role.AuthenticatedUser });
             Utils.LogInfo("OnFindApplications: {0}", applicationUri);
             applications = m_database.FindApplications(applicationUri);
             return ServiceResult.Good;
@@ -601,7 +575,7 @@ private ServiceResult OnGetApplication(
             NodeId applicationId,
             ref ApplicationRecordDataType application)
         {
-            HasApplicationUserAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { Role.AuthenticatedUser, GdsRole.ApplicationSelfAdmin }, applicationId); ;
             Utils.LogInfo("OnGetApplication: {0}", applicationId);
             application = m_database.GetApplication(applicationId);
             return ServiceResult.Good;
@@ -761,7 +735,7 @@ private ServiceResult OnStartNewKeyPairRequest(
             string privateKeyPassword,
             ref NodeId requestId)
         {
-            HasApplicationAdminAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { GdsRole.CertificateAuthorityAdmin, GdsRole.ApplicationSelfAdmin }, applicationId); ;
 
             var application = m_database.GetApplication(applicationId);
 
@@ -880,7 +854,7 @@ private ServiceResult OnStartSigningRequest(
             byte[] certificateRequest,
             ref NodeId requestId)
         {
-            HasApplicationAdminAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { GdsRole.CertificateAuthorityAdmin, GdsRole.ApplicationSelfAdmin }, applicationId); ;
 
             var application = m_database.GetApplication(applicationId);
 
@@ -961,7 +935,7 @@ private ServiceResult OnFinishRequest(
             signedCertificate = null;
             issuerCertificates = null;
             privateKey = null;
-            HasApplicationAdminAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { GdsRole.CertificateAuthorityAdmin, GdsRole.ApplicationSelfAdmin }, applicationId); ;
 
             var application = m_database.GetApplication(applicationId);
             if (application == null)
@@ -1115,6 +1089,8 @@ out privateKeyPassword
 
             m_database.SetApplicationCertificate(applicationId, m_certTypeMap[certificateGroup.CertificateType], signedCertificate);
 
+            m_database.SetApplicationTrustLists(applicationId, m_certTypeMap[certificateGroup.CertificateType], certificateGroup.Configuration.TrustedListPath);
+
             m_request.AcceptRequest(requestId, signedCertificate);
 
             return ServiceResult.Good;
@@ -1127,7 +1103,7 @@ public ServiceResult OnGetCertificateGroups(
             NodeId applicationId,
             ref NodeId[] certificateGroupIds)
         {
-            HasApplicationUserAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { GdsRole.CertificateAuthorityAdmin, GdsRole.ApplicationSelfAdmin }, applicationId);
 
             var application = m_database.GetApplication(applicationId);
 
@@ -1155,7 +1131,7 @@ public ServiceResult OnGetTrustList(
             NodeId certificateGroupId,
             ref NodeId trustListId)
         {
-            HasApplicationUserAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { GdsRole.CertificateAuthorityAdmin, GdsRole.ApplicationSelfAdmin }, applicationId);
 
             var application = m_database.GetApplication(applicationId);
 
@@ -1188,7 +1164,7 @@ public ServiceResult OnGetCertificateStatus(
             NodeId certificateTypeId,
             ref Boolean updateRequired)
         {
-            HasApplicationUserAccess(context);
+            AuthorizationHelper.HasAuthorization(context, new List<Role> { Role.AuthenticatedUser, GdsRole.ApplicationSelfAdmin }, applicationId);
 
             var application = m_database.GetApplication(applicationId);
 
@@ -1354,11 +1330,19 @@ protected void SetCertificateGroupNodes(ICertificateGroup certificateGroup)
                     certificateGroup.DefaultTrustList,
                     certificateGroup.Configuration.TrustedListPath,
                     certificateGroup.Configuration.IssuerListPath,
-                    new TrustList.SecureAccess(HasApplicationUserAccess),
-                    new TrustList.SecureAccess(HasApplicationAdminAccess));
+                    new TrustList.SecureAccess(HasTrustListAccess),
+                    new TrustList.SecureAccess(HasTrustListAccess));
             }
         }
 
+        #region AuthorizationHelpers
+        private void HasTrustListAccess(ISystemContext context, string trustedStorePath)
+        {
+                AuthorizationHelper.HasTrustListAccess(context, trustedStorePath, m_certTypeMap, m_database);
+        }
+        #endregion
+
+
         private ServiceResult VerifyApprovedState(CertificateRequestState state)
         {
             switch (state)

Libraries/Opc.Ua.Gds.Server.Common/GlobalDiscoverySampleServer.cs

@@ -30,11 +30,11 @@
 using System;
 using System.Collections.Generic;
 using System.Security.Cryptography.X509Certificates;
-using System.Threading;
 using Opc.Ua.Server;
 using Opc.Ua.Gds.Server.Database;
 using Opc.Ua.Server.UserDatabase;
 using System.Linq;
+using Opc.Ua.Security.Certificates;
 
 namespace Opc.Ua.Gds.Server
 {
@@ -117,8 +117,7 @@ protected override MasterNodeManager CreateMasterNodeManager(IServerInternal ser
         /// </remarks>
         protected override ServerProperties LoadServerProperties()
         {
-            ServerProperties properties = new ServerProperties
-            {
+            ServerProperties properties = new ServerProperties {
                 ManufacturerName = "Some Company Inc",
                 ProductName = "Global Discovery Server",
                 ProductUri = "http://somecompany.com/GlobalDiscoveryServer",
@@ -201,28 +200,10 @@ private void SessionManager_ImpersonateUser(Session session, ImpersonateEventArg
             {
                 if (VerifyPassword(userNameToken))
                 {
-                    if (userNameToken.UserName == "sysadmin")
-                    {
-                        // Server configuration administrator, manages the GDS server security
-                        args.Identity = new SystemConfigurationIdentity(new UserIdentity(userNameToken));
-                        Utils.LogInfo("SystemConfigurationAdmin Token Accepted: {0}", args.Identity.DisplayName);
-                        return;
-                    }
                     IEnumerable<Role> roles = m_userDatabase.GetUserRoles(userNameToken.UserName);
-                    //GdsAdmin
-                    if (roles.Contains(GdsRole.ApplicationAdmin))
-                    {
-                        args.Identity = new RoleBasedIdentity(new UserIdentity(userNameToken), new List<Role> { GdsRole.ApplicationAdmin });
-                        Utils.LogInfo("ApplicationAdmin Token Accepted: {0}", args.Identity.DisplayName);
-                        return;
-                    }
-                    //GdsUser
-                    if (roles.Contains(GdsRole.ApplicationUser))
-                    {
-                        args.Identity = new RoleBasedIdentity(new UserIdentity(userNameToken), new List<Role> { GdsRole.ApplicationUser });
-                        Utils.LogInfo("ApplicationUser Token Accepted: {0}", args.Identity.DisplayName);
-                        return;
-                    }                   
+
+                    args.Identity = new GdsRoleBasedIdentity(new UserIdentity(userNameToken), roles);
+                    return;
                 }
             }
 
@@ -235,10 +216,61 @@ private void SessionManager_ImpersonateUser(Session session, ImpersonateEventArg
                 // todo: is cert listed in admin list? then 
                 // role = GdsRole.ApplicationAdmin;
 
-                Utils.LogInfo("X509 Token Accepted: {0} as {1}", args.Identity.DisplayName, GdsRole.ApplicationUser);
-                args.Identity = new RoleBasedIdentity(new UserIdentity(x509Token), new List<Role> { GdsRole.ApplicationUser });
+                Utils.LogInfo("X509 Token Accepted: {0} as {1}", args.Identity.DisplayName, Role.AuthenticatedUser);
+                args.Identity = new GdsRoleBasedIdentity(new UserIdentity(x509Token), new List<Role> { Role.AuthenticatedUser });
                 return;
             }
+
+            //check if applicable for application self admin privilege
+            if (session.ClientCertificate != null)
+            {
+                if (VerifiyApplicationRegistered(session))
+                {
+                    ImpersonateAsApplicationSelfAdmin(session, args);
+                }
+            }
+        }
+
+        /// <summary>
+        /// Verifies if an Application is registered with the provided certificate at at the GDS
+        /// </summary>
+        /// <param name="session">the session</param>
+        /// <returns></returns>
+        private bool VerifiyApplicationRegistered(Session session)
+        {
+            X509Certificate2 applicationInstanceCertificate = session.ClientCertificate;
+            bool applicationRegistered = false;
+
+            Uri applicationUri = Utils.ParseUri(session.SessionDiagnostics.ClientDescription.ApplicationUri);
+            X509Utils.DoesUrlMatchCertificate(applicationInstanceCertificate, applicationUri);
+
+            //get access to GDS configuration section to find out ApplicationCertificatesStorePath
+            GlobalDiscoveryServerConfiguration configuration = Configuration.ParseExtension<GlobalDiscoveryServerConfiguration>();
+            if (configuration == null)
+            {
+                configuration = new GlobalDiscoveryServerConfiguration();
+            }
+            //check if application certificate is in the Store of the GDS
+            using (ICertificateStore ApplicationsStore = CertificateStoreIdentifier.OpenStore(configuration.ApplicationCertificatesStorePath))
+            {
+                var matchingCerts = ApplicationsStore.FindByThumbprint(applicationInstanceCertificate.Thumbprint).Result;
+
+                if (matchingCerts.Contains(applicationInstanceCertificate))
+                    applicationRegistered = true;
+            }
+            //check if application certificate is revoked
+            using (ICertificateStore AuthoritiesStore = CertificateStoreIdentifier.OpenStore(configuration.AuthoritiesStorePath))
+            {
+                var crls = AuthoritiesStore.EnumerateCRLs().Result;
+                foreach (X509CRL crl in crls)
+                {
+                    if (crl.IsRevoked(applicationInstanceCertificate))
+                    {
+                        applicationRegistered = false;
+                    }
+                }
+            }
+            return applicationRegistered;
         }
 
         /// <summary>
@@ -295,10 +327,35 @@ private bool VerifyPassword(UserNameIdentityToken userNameToken)
         /// </summary>
         private void RegisterDefaultUsers()
         {
-            m_userDatabase.CreateUser("sysadmin", "demo", new List<Role> { GdsRole.ApplicationAdmin, Role.SecurityAdmin, Role.ConfigureAdmin });
-            m_userDatabase.CreateUser("appadmin", "demo", new List<Role> { GdsRole.ApplicationAdmin });
-            m_userDatabase.CreateUser("appuser", "demo", new List<Role> { GdsRole.ApplicationUser });
+            m_userDatabase.CreateUser("sysadmin", "demo", new List<Role> { GdsRole.CertificateAuthorityAdmin, GdsRole.DiscoveryAdmin, Role.SecurityAdmin, Role.ConfigureAdmin });
+            m_userDatabase.CreateUser("appadmin", "demo", new List<Role> { Role.AuthenticatedUser, GdsRole.CertificateAuthorityAdmin, GdsRole.DiscoveryAdmin });
+            m_userDatabase.CreateUser("appuser", "demo", new List<Role> { Role.AuthenticatedUser });
+
+            m_userDatabase.CreateUser("DiscoveryAdmin", "demo", new List<Role> { Role.AuthenticatedUser, GdsRole.DiscoveryAdmin });
+            m_userDatabase.CreateUser("CertificateAuthorityAdmin", "demo", new List<Role> { Role.AuthenticatedUser, GdsRole.CertificateAuthorityAdmin });
+        }
+
+        /// <summary>
+        /// Impersonates the current Session as ApplicationSelfAdmin
+        /// </summary>
+        /// <param name="session">the current session</param>
+        /// <param name="args">the impersonateEventArgs</param>
+        private void ImpersonateAsApplicationSelfAdmin(Session session, ImpersonateEventArgs args)
+        {
+            string applicationUri = session.SessionDiagnostics.ClientDescription.ApplicationUri;
+            ApplicationRecordDataType[] application = m_database.FindApplications(applicationUri);
+            if (application == null || application.Length != 1)
+            {
+                Utils.LogInfo("Cannot login based on ApplicationInstanceCertificate, no uniqure result for Application with URI: {0}", applicationUri);
+                return;
+            }
+            NodeId applicationId = application.FirstOrDefault().ApplicationId;
+            Utils.LogInfo("Application {0} accepted based on ApplicationInstanceCertificate as ApplicationSelfAdmin",
+                applicationUri);
+            args.Identity = new GdsRoleBasedIdentity(new UserIdentity(), new List<Role> { GdsRole.ApplicationSelfAdmin }, applicationId);
+            return;
         }
+
         #endregion
 
         #region Private Fields