Microsoft Learn

AuthenticationServer Class

Provides support for authentication servers.

Namespace: System.Net.Security
Assembly: System.Net.Primitives (in System.Net.Primitives.dll)

Syntax

public abstract class AuthenticationServer

Remarks

The AuthenticationServer class is an abstract base class that provides a common interface for implementing authentication protocols on the server side. It defines the fundamental operations and properties required for a server to participate in an authentication exchange with a client.

Derived classes can implement specific authentication mechanisms, such as Kerberos, NTLM, or custom protocols, by inheriting from this class and overriding its virtual methods. The server-side authentication process typically involves receiving credentials or challenges from the client, processing them, and sending back appropriate responses to establish a secure connection or verify the client's identity.

Key aspects of server-side authentication handled by this class include:

• Managing the authentication state.
• Processing client authentication messages.
• Generating server authentication messages.
• Validating client credentials.
• Determining the success or failure of the authentication process.

This class is part of the .NET Framework's networking stack and is used in scenarios where secure communication between clients and servers is required, such as in web applications, remote procedure calls (RPC), and other network services.

Inheritance Hierarchy

Derived Classes

Members

Example

The following example demonstrates a conceptual usage of an AuthenticationServer derived class (e.g., NtlmServer).

using System;
using System.Net;
using System.Net.Security;
using System.Security.Principal;

public class MyNtlmServer : AuthenticationServer
{
    private NetworkCredential _serverCredential;
    private IIdentity _authenticatedIdentity;
    private bool _isAuthenticated = false;

    public MyNtlmServer(NetworkCredential serverCredential)
    {
        _serverCredential = serverCredential;
    }

    public override bool IsAuthenticated => _isAuthenticated;
    public override IIdentity Identity => _authenticatedIdentity;

    protected override bool AuthenticateAsServer(NetworkCredential clientCredential, NetworkCredential serverCredential, IIdentity identity, object principal)
    {
        // In a real scenario, you'd perform NTLM or Kerberos negotiation here.
        // For simplicity, let's assume success if credentials match.
        // This is highly simplified and not production-ready.
        if (clientCredential.UserName == _serverCredential.UserName &&
            clientCredential.Password == _serverCredential.Password)
        {
            _authenticatedIdentity = new GenericIdentity(clientCredential.UserName, "NTLM");
            _isAuthenticated = true;
            return true;
        }

        return false;
    }

    public override byte[] ProcessAuthentication(byte[] incomingBuffer, int offset, int size)
    {
        // Implement logic to process client messages (e.g., NTLM Type 1 message)
        // and prepare server responses (e.g., NTLM Type 2 message).
        return null; // Placeholder
    }

    public override byte[] CreateAuthenticationResponse()
    {
        // Implement logic to create initial server response (e.g., NTLM Type 1 message or challenge).
        return null; // Placeholder
    }
}

public class ExampleUsage
{
    public static void Main(string[] args)
    {
        // Example Server Credentials
        NetworkCredential serverCreds = new NetworkCredential("myServerUser", "mySecurePassword");
        MyNtlmServer authServer = new MyNtlmServer(serverCreds);

        if (!authServer.IsAuthenticated)
        {
            Console.WriteLine("Server authentication not yet complete.");

            // In a real scenario, you would send the initial response to the client.
            byte[] initialResponse = authServer.CreateAuthenticationResponse();
            if (initialResponse != null)
            {
                Console.WriteLine("Sent initial authentication challenge to client.");
            }

            while (!authServer.IsAuthenticated)
            {
                // Simulate receiving client response (e.g., NTLM Type 2 message)
                // For demonstration, we'll bypass the actual message exchange and call AuthenticateAsServer directly.

                NetworkCredential clientCreds = new NetworkCredential("clientUser", "clientPassword");

                bool success = authServer.AuthenticateAsServer(clientCreds, serverCreds, null, null);

                if (success)
                {
                    Console.WriteLine($"Authentication successful for user: {authServer.Identity.Name}");
                    break;
                }
                else
                {
                    Console.WriteLine("Authentication failed. Please try again.");
                    break; // Exit loop for demonstration
                }
            }
        }
    }
}