The information contained in this document may be privileged and confidential and protected from disclosure. If the reader of this document is not the employee TOTVS, or an employee agent responsible for delivering this document to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.

public class WebTokenWebServiceHost : WebServiceHost
{
    protected WebTokenWebServiceHostConfiguration _configuration;
    protected WebSecurityTokenHandlerCollectionManager _manager;
    public WebTokenWebServiceHost(Type serviceType, WebSecurityTokenHandlerCollectionManager tokenManager, params Uri[] baseAddresses)
        : this(serviceType, tokenManager, new WebTokenWebServiceHostConfiguration(), baseAddresses)
    { }
    public WebTokenWebServiceHost(Type serviceType, WebSecurityTokenHandlerCollectionManager tokenManager, WebTokenWebServiceHostConfiguration configuration, params Uri[] baseAddresses)
        : base(serviceType, baseAddresses)
    {
      _configuration = configuration;
      _manager = tokenManager;
 
      // Configura o SAM personalizado
      Authorization.ServiceAuthorizationManager = new WebTokenServiceAuthorizationManager(tokenManager, configuration);
      Authorization.PrincipalPermissionMode = PrincipalPermissionMode.Custom;
     
      // ...
    }
    
    //...
  }
}

//...
private static WebTokenWebServiceHost CreateWebTokenServiceHost(Type serviceType, Uri baseAddress)
{
      var manager = SetupSecurityTokenHandler();
      var configuration = SetupServiceHostConfiguration();
      var restHost = new WebTokenWebServiceHost(serviceType,
          manager,
          configuration,
          baseAddress);
      
      return restHost;
}
    
private static WebTokenWebServiceHostConfiguration SetupServiceHostConfiguration()
{
      var configuration = new WebTokenWebServiceHostConfiguration
      {
        RequireSsl = false,
        EnableRequestAuthorization = false,
        AllowAnonymousAccess = true,
        
        ClaimsAuthenticationManager = new ClaimsTransformer()
      };
      return configuration;
}
private static WebSecurityTokenHandlerCollectionManager SetupSecurityTokenHandler()
{
      var manager = new WebSecurityTokenHandlerCollectionManager();
      
      // Requests anônimos
      manager.AddDefaultHandler();
      
      // Basic Authentication
      manager.AddBasicAuthenticationHandler((username, password) => RMSUsersManager.ValidateCredentials(username, password));
      
      // Bearer with JWT
      var jwtValidationOptions = new JwtValidationOptions()
      {
          IssuerName = Settings.Default.GetValue<string>(RMSCONFIGOPTIONSENUM.JWTISSUERNAME),
          Audience = Settings.Default.GetValue<string>(RMSCONFIGOPTIONSENUM.JWTAUDIENCE),
          SigningCertificateOptions = new JwtSigningCertificateOptions()
          {
              SigningCertificateName = Settings.Default.GetValue<string>(RMSCONFIGOPTIONSENUM.JWTCERTIFICATETHUMBPRINT),
              NameType = NameType.Thumbprint,
          },
          AllowedScopes = Settings.Default.GetValue<string>(RMSCONFIGOPTIONSENUM.JWTALLOWEDSCOPES)?.Split(',') ?? new string[] { }
      };
      manager.AddJsonWebTokenHandler(jwtValidationOptions);

      return manager;
}
//...

class WebTokenServiceAuthorizationManager : ServiceAuthorizationManager
{
    WebSecurityTokenHandlerCollectionManager _manager;
    WebTokenWebServiceHostConfiguration _configuration;
    public WebTokenServiceAuthorizationManager(WebSecurityTokenHandlerCollectionManager manager, WebTokenWebServiceHostConfiguration configuration)
    {
      _manager = manager;
      _configuration = configuration;
    }
    protected override bool CheckAccessCore(OperationContext operationContext)
    {
      var properties = operationContext.ServiceSecurityContext.AuthorizationContext.Properties;
      var to = operationContext.IncomingMessageHeaders.To.AbsoluteUri;
      ClaimsPrincipal principal;
      if (TryGetPrincipal(out principal))
      {
        // set the IClaimsPrincipal
        if (_configuration.ClaimsAuthenticationManager != null)
        {
          principal = _configuration.ClaimsAuthenticationManager.Authenticate(to, principal);
        }
        properties["Principal"] = principal;
      }
      else
      {
        if (_configuration.AllowAnonymousAccess)
        {
          // set anonymous principal
          principal = new ClaimsPrincipal(); //ClaimsPrincipal.AnonymousPrincipal;
          properties["Principal"] = principal;
        }
        else
        {
          return false;
        }
      }
      if (!_configuration.EnableRequestAuthorization)
      {
        return true;
      }
      return CallClaimsAuthorization(principal, operationContext);
    }
    private bool TryGetPrincipal(out ClaimsPrincipal principal)
    {
      principal = null;
      // check headers - authorization and x-authorization
      var headers = WebOperationContext.Current.IncomingRequest.Headers;
      if (headers != null)
      {
        var authZheader = headers[HttpRequestHeader.Authorization] ?? headers["X-Authorization"];
        if (!string.IsNullOrEmpty(authZheader))
        {
          int sep = authZheader.IndexOf(' ');
          if (sep != -1)
          {
            var scheme = authZheader.Substring(0, sep);
            var token = authZheader.Substring(sep + 1);
            try
            {
              principal = _manager.ValidateWebToken(scheme, token);
            }
            catch
            {
              throw new WebFaultException(HttpStatusCode.Unauthorized);
            }
            return (principal != null);
          }
          else
          {
            throw new SecurityTokenValidationException("Malformed authorization header");
          }
        }
        else
        {
          try
          {
            principal = _manager.ValidateWebToken("*", string.Empty);
            return (principal != null);
          }
          catch
          {
            throw new WebFaultException(HttpStatusCode.Unauthorized);
          }
        }
      }
      return false;
    }
    bool CallClaimsAuthorization(ClaimsPrincipal principal, OperationContext operationContext)
    {
      string action = string.Empty;
      var property = operationContext.IncomingMessageProperties[HttpRequestMessageProperty.Name] as HttpRequestMessageProperty;
      if (property != null)
      {
        action = property.Method;
      }
      Uri to = operationContext.IncomingMessageHeaders.To;
      if (to == null || string.IsNullOrEmpty(action))
      {
        return false;
      }
      var context = new AuthorizationContext(principal, to.AbsoluteUri, action);
      if (_configuration.ClaimsAuthorizationManager != null)
      {
        return _configuration.ClaimsAuthorizationManager.CheckAccess(context);
      }
      return false;
    }
    // ...
}

public class WebUserNameSecurityTokenHandler : UserNameSecurityTokenHandler, IWebSecurityTokenHandler
{
    public ClaimsPrincipal ValidateWebToken(string token)
    {
      var decoded = DecodeBasicAuthenticationHeader(token);
      var securityToken = new UserNameSecurityToken(decoded.Item1, decoded.Item2);
      return new ClaimsPrincipal(ValidateToken(securityToken));
    }
    protected virtual Tuple<string, string> DecodeBasicAuthenticationHeader(string basicAuthToken)
    {
      Encoding encoding = Encoding.GetEncoding("iso-8859-1");
      string userPass = encoding.GetString(Convert.FromBase64String(basicAuthToken));
      int separator = userPass.IndexOf(':');
      var credential = new Tuple<string, string>(
          userPass.Substring(0, separator),
          userPass.Substring(separator + 1));
      return credential;
    }
    /// <summary>
    /// Callback type for validating the credential
    /// </summary>
    /// <param name="username">The username.</param>
    /// <param name="password">The password.</param>
    /// <returns>True when the credential could be validated succesfully. Otherwise false.</returns>
    public delegate bool ValidateUserNameCredentialDelegate(string username, string password);
    /// <summary>
    /// Gets or sets the credential validation callback
    /// </summary>
    /// <value>
    /// The credential validation callback.
    /// </value>
    public ValidateUserNameCredentialDelegate ValidateUserNameCredential { get; set; }
    /// <summary>
    /// Initializes a new instance of the <see cref="WebUserNameSecurityTokenHandler"/> class.
    /// </summary>
    public WebUserNameSecurityTokenHandler()
    { }
    /// <summary>
    /// Initializes a new instance of the <see cref="WebUserNameSecurityTokenHandler"/> class.
    /// </summary>
    /// <param name="validateUserNameCredential">The credential validation callback.</param>
    public WebUserNameSecurityTokenHandler(ValidateUserNameCredentialDelegate validateUserNameCredential)
    {
      if (validateUserNameCredential == null)
      {
        throw new ArgumentNullException("ValidateUserNameCredential");
      }
      ValidateUserNameCredential = validateUserNameCredential;
    }
    /// <summary>
    /// Validates the user name credential core.
    /// </summary>
    /// <param name="userName">Name of the user.</param>
    /// <param name="password">The password.</param>
    /// <returns></returns>
    protected virtual bool ValidateUserNameCredentialCore(string userName, string password)
    {
      if (ValidateUserNameCredential == null)
      {
        throw new InvalidOperationException("ValidateUserNameCredentialDelegate not set");
      }
      return ValidateUserNameCredential(userName, password);
    }
    /// <summary>
    /// Validates the username and password.
    /// </summary>
    /// <param name="token">The token.</param>
    /// <returns>A ClaimsIdentityCollection representing the identity in the token</returns>
    public override ReadOnlyCollection<ClaimsIdentity> ValidateToken(SecurityToken token)
    {
      if (token == null)
      {
        throw new ArgumentNullException("token");
      }
      if (base.Configuration == null)
      {
        throw new InvalidOperationException("No Configuration set");
      }
      UserNameSecurityToken unToken = token as UserNameSecurityToken;
      if (unToken == null)
      {
        throw new ArgumentException("SecurityToken is no UserNameSecurityToken");
      }
      if (!ValidateUserNameCredentialCore(unToken.UserName, unToken.Password))
      {
        throw new SecurityTokenValidationException(unToken.UserName);
      }
      var claims = new List<Claim>
            {
                new Claim(JwtClaimTypes.Subject, unToken.UserName),
                new Claim(JwtClaimTypes.Name, unToken.UserName),
                new Claim(JwtClaimTypes.AuthenticationMethod, OidcConstants.AuthenticationMethods.Password),
                AuthenticationInstantClaim.Now
            };
      var identity = new ClaimsIdentity(claims, AuthenticationTypes.Basic);
      if (Configuration.SaveBootstrapContext)
      {
        if (RetainPassword)
        {
          identity.BootstrapContext = new BootstrapContext(unToken, this);
        }
        else
        {
          identity.BootstrapContext = new BootstrapContext(new UserNameSecurityToken(unToken.UserName, null), this);
        }
      }
      return new ReadOnlyCollection<ClaimsIdentity>(new[] { identity });
    }
    /// <summary>
    /// Gets a value indicating whether this instance can validate a token.
    /// </summary>
    /// <value>
    /// 	<c>true</c> if this instance can validate a token; otherwise, <c>false</c>.
    /// </value>
    public override bool CanValidateToken
    {
      get
      {
        return true;
      }
    }
}

public class WebJwtSecurityTokenHandler : JwtSecurityTokenHandler, IWebSecurityTokenHandler
{
    string _issuer = null;
    string _audience = null;
    X509Certificate2 _signingCert = null;
    private readonly ICollection<string> _allowedScopes;
    private WebJwtSecurityTokenHandler()
        : base()
    {
      JwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>();
    }
    public WebJwtSecurityTokenHandler(JwtValidationOptions options)
       : this()
    {
      // Certificate
      var signOptions = options.SigningCertificateOptions;
      var certificate = signOptions.SigningCertificate;
      if (certificate == null)
        certificate = FindCertificate(signOptions.SigningCertificateName, signOptions.StoreLocation, signOptions.NameType);
      if (certificate == null) throw new ArgumentNullException(nameof(certificate));
      if (!certificate.HasPrivateKey)
      {
        throw new InvalidOperationException("X509 certificate does not have a private key.");
      }
      // Scopes
      var allowedScopes = new string[] { };
      if (options.ValidateScope && options.AllowedScopes.Any())
      {
        allowedScopes = options.AllowedScopes.ToArray();
      }
      
      _issuer = options.IssuerName;
      _signingCert = certificate;
      _audience = options.Audience;
      _allowedScopes = allowedScopes;
    }
    public ClaimsPrincipal ValidateWebToken(string token)
    {
      ClaimsPrincipal principal = null;
      if (token != null)
      {
        // seems to be a JWT
        if (token.Contains('.'))
        {
          var parameters = new TokenValidationParameters
          {
            IssuerSigningKey = new X509SecurityKey(_signingCert),
            ValidIssuer = _issuer,
            ValidateIssuer = true,
            ValidAudience = _audience,
            ValidateAudience = true,
            RequireSignedTokens = true,
            RequireExpirationTime = true
          };
          if (string.IsNullOrWhiteSpace(_audience))
            parameters.ValidateAudience = false;
          try
          {
            SecurityToken validatedToken;
            principal = ValidateToken(token, parameters, out validatedToken);
          }
          catch (Exception ex)
          {
            throw new SecurityTokenValidationException("Error validating token", ex);
          }
          if (_allowedScopes.Any())
          {
            bool found = false;
            foreach (var scope in _allowedScopes)
            {
              if (principal.HasClaim("scope", scope))
              {
                found = true;
                break;
              }
            }
            if (found == false)
            {
              throw new SecurityTokenValidationException("Insufficient Scope");
            }
          }
        }
      }
      return principal;
    }
	//...
}

[RMSRestRawService("rest/", RequireAuthentication = true)]
public class RMSAnnonymousRestServer : RMSServer, IRMSAnnonymousRestServer
{
    [AllowAnonymous]
    public Stream Annonymous()
    {
      return new MemoryStream(Encoding.UTF8.GetBytes("Annonymous"));
    }
}