public void InitializeFrom(EndpointIdentity identity)
 {
     if (identity == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("identity");
     }
     Claim identityClaim = identity.IdentityClaim;
     if (ClaimTypes.Dns.Equals(identityClaim.ClaimType))
     {
         this.Dns.Value = (string) identityClaim.Resource;
     }
     else if (ClaimTypes.Spn.Equals(identityClaim.ClaimType))
     {
         this.ServicePrincipalName.Value = (string) identityClaim.Resource;
     }
     else if (ClaimTypes.Upn.Equals(identityClaim.ClaimType))
     {
         this.UserPrincipalName.Value = (string) identityClaim.Resource;
     }
     else if (ClaimTypes.Rsa.Equals(identityClaim.ClaimType))
     {
         this.Rsa.Value = ((RSA) identityClaim.Resource).ToXmlString(false);
     }
     else if (identity is X509CertificateEndpointIdentity)
     {
         X509Certificate2Collection certificates = ((X509CertificateEndpointIdentity) identity).Certificates;
         this.Certificate.EncodedValue = Convert.ToBase64String(certificates.Export((certificates.Count == 1) ? X509ContentType.SerializedCert : X509ContentType.SerializedStore));
     }
 }

			public override bool CheckAccess (
				EndpointIdentity identity,
				AuthorizationContext authContext)
			{
				// FIXME: implement
				throw new NotImplementedException ();
			}

			public override bool TryGetIdentity (
				EndpointAddress reference,
				out EndpointIdentity identity)
			{
				// FIXME: implement
				throw new NotImplementedException ();
			}

        public override bool CheckAccess(EndpointIdentity identity, System.IdentityModel.Policy.AuthorizationContext authContext)
        {
            bool returnvalue = false;

            foreach (ClaimSet claimset in authContext.ClaimSets)
            {
                foreach (Claim claim in claimset)
                {
                   // if (claim.ClaimType == "http://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname")
                   // {
                   //     X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                        //if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                       // {
                           // Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                          //  Console.WriteLine("Right: {0}", claim.Right);
                          //  Console.WriteLine("Resource: {0}", claim.Resource);
                          //  Console.WriteLine();
                            returnvalue = true;
                            break;
                    //}
                    //}
                }

            }
            return returnvalue;
        }

 public EndpointAddress(System.Uri uri, EndpointIdentity identity, params AddressHeader[] addressHeaders)
 {
     if (uri == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("uri");
     }
     this.Init(uri, identity, addressHeaders);
 }

 public EndpointIdentityExtension(EndpointIdentity identity)
 {
     if (identity == null)
     {
         throw FxTrace.Exception.ArgumentNull("identity");
     }
     this.ClaimType = identity.IdentityClaim.ClaimType;
     this.ClaimRight = identity.IdentityClaim.Right;
     this.ClaimResource = identity.IdentityClaim.Resource;
 }

 public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
 {
     if (reference == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("reference");
     }
     identity = reference.Identity;
     if (identity == null)
     {
         identity = new PeerEndpointIdentity();
     }
     return true;
 }

		public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authzContext) {
			List<Claim> dnsClaims = new List<Claim>();
			foreach( ClaimSet claimSet in authzContext.ClaimSets ) {
				foreach( Claim claim in claimSet ) {
					if ( ClaimTypes.Dns == claim.ClaimType ) {
						dnsClaims.Add(claim);
					}
				}
			}
			if ( 1 != dnsClaims.Count ) {
				throw new InvalidOperationException(String.Format("Found {0} DNS claims in authorization context.", dnsClaims.Count));
			}
			return String.Equals((string) this.expectedIdentity.IdentityClaim.Resource, (string) dnsClaims[0].Resource, StringComparison.OrdinalIgnoreCase);
		}

		public EndpointAddress (
			Uri uri, EndpointIdentity identity,
			AddressHeaderCollection headers,
			XmlDictionaryReader metadataReader,
			XmlDictionaryReader extensionReader)
		{	
			if (uri == null)
				throw new ArgumentNullException ("uri");
			if (!uri.IsAbsoluteUri)
				throw new ArgumentException ("The argument uri must be absolute");
			this.address = uri;
			this.identity = identity;
			this.headers = headers;
			metadata_reader = metadataReader;
			extension_reader = extensionReader;
		}

 private Exception CreateIdentityCheckException(EndpointIdentity identity, AuthorizationContext authorizationContext, string errorString, EndpointAddress serviceReference)
 {
     if (((identity.IdentityClaim == null) || !(identity.IdentityClaim.ClaimType == ClaimTypes.Dns)) || (!(identity.IdentityClaim.Right == Rights.PossessProperty) || !(identity.IdentityClaim.Resource is string)))
     {
         return new MessageSecurityException(System.ServiceModel.SR.GetString(errorString, new object[] { identity, serviceReference }));
     }
     string resource = (string) identity.IdentityClaim.Resource;
     string str2 = null;
     for (int i = 0; i < authorizationContext.ClaimSets.Count; i++)
     {
         ClaimSet set = authorizationContext.ClaimSets[i];
         foreach (Claim claim in set.FindClaims(ClaimTypes.Dns, Rights.PossessProperty))
         {
             if (claim.Resource is string)
             {
                 str2 = (string) claim.Resource;
                 break;
             }
         }
         if (str2 != null)
         {
             break;
         }
     }
     if ("IdentityCheckFailedForIncomingMessage".Equals(errorString))
     {
         if (str2 == null)
         {
             return new MessageSecurityException(System.ServiceModel.SR.GetString("DnsIdentityCheckFailedForIncomingMessageLackOfDnsClaim", new object[] { resource }));
         }
         return new MessageSecurityException(System.ServiceModel.SR.GetString("DnsIdentityCheckFailedForIncomingMessage", new object[] { resource, str2 }));
     }
     if ("IdentityCheckFailedForOutgoingMessage".Equals(errorString))
     {
         if (str2 == null)
         {
             return new MessageSecurityException(System.ServiceModel.SR.GetString("DnsIdentityCheckFailedForOutgoingMessageLackOfDnsClaim", new object[] { resource }));
         }
         return new MessageSecurityException(System.ServiceModel.SR.GetString("DnsIdentityCheckFailedForOutgoingMessage", new object[] { resource, str2 }));
     }
     return new MessageSecurityException(System.ServiceModel.SR.GetString(errorString, new object[] { identity, serviceReference }));
 }

        // Code to be added.
        public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
        {
            StreamWriter file = new StreamWriter("c:\\temp\\TestClient.CustomIdentityVerifier - CheckAccess.txt", true);
            file.WriteLine("_________________________________________");
            file.WriteLine("DateTime: " + DateTime.Now.ToString());

            bool returnvalue = false;

            foreach (ClaimSet claimset in authContext.ClaimSets)
            {
                foreach (Claim claim in claimset)
                {
                    file.WriteLine("claim.ClaimType: " + claim.ClaimType);
                    file.WriteLine("\tclaim.Right: " + claim.Right);
                    file.WriteLine("\t\tclaim.Resource: " + claim.Resource.ToString());

                    if (claim.ClaimType == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishedname")
                    {
                        X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                        file.WriteLine("X500DistinguishedName: " + name.Name);

                        //if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                        //if ("CN=zpatlittrs239.ittl.gtri.org" == name.Name)
                        if ("[email protected], CN=HA50WSP, O=Hawaii Five0, L=Honolulu, S=Hawaii, C=US" == name.Name)
                        {
                            file.WriteLine("\tClaim Type: {0}", claim.ClaimType);
                            file.WriteLine("\tRight: {0}", claim.Right);
                            file.WriteLine("\tResource: {0}", claim.Resource);
                            file.WriteLine();
                            returnvalue = true;
                        }
                    }
                }

            }

            file.Close();

            return returnvalue;
        }

    static ClousotWCFServiceCommon()
    {
      Identity = new DnsEndpointIdentity("research.microsoft.com"); // Used by the client to be sure that we are who we say we are

#if DEBUG
      SecurityMode = SecurityMode.None;  // Mehdi: "Very complex things", we ignore them
#else
      SecurityMode = SecurityMode.None; // TODO
#endif

#if WS_HTTP_BINDING
#if DEBUG
      // This address does not need administrator privilege
      // Namespace created during the installation of Visual Studio
      BaseAddress = "http://localhost:8732/Design_Time_Addresses/ClousotService/";
#else
      // Need administrator privilege
      BaseAddress = "http://localhost:8732/Microsoft.Research/ClousotService/";
#endif
#elif NET_TCP_BINDING
      BaseAddress = "net.tcp://localhost:9922/ClousotService/";
#endif
      BaseUri = new Uri(BaseAddress);
    }

        Exception CreateIdentityCheckException(EndpointIdentity identity, AuthorizationContext authorizationContext, string errorString, EndpointAddress serviceReference)
        {
            Exception result;

            if (identity.IdentityClaim != null
                && identity.IdentityClaim.ClaimType == ClaimTypes.Dns
                && identity.IdentityClaim.Right == Rights.PossessProperty
                && identity.IdentityClaim.Resource is string)
            {
                string expectedDnsName = (string)identity.IdentityClaim.Resource;
                string actualDnsName = null;
                for (int i = 0; i < authorizationContext.ClaimSets.Count; ++i)
                {
                    ClaimSet claimSet = authorizationContext.ClaimSets[i];
                    foreach (Claim claim in claimSet.FindClaims(ClaimTypes.Dns, Rights.PossessProperty))
                    {
                        if (claim.Resource is string)
                        {
                            actualDnsName = (string)claim.Resource;
                            break;
                        }
                    }
                    if (actualDnsName != null)
                    {
                        break;
                    }
                }
                if (SR.IdentityCheckFailedForIncomingMessage.Equals(errorString))
                {
                    if (actualDnsName == null)
                    {
                        result = new MessageSecurityException(SR.GetString(SR.DnsIdentityCheckFailedForIncomingMessageLackOfDnsClaim, expectedDnsName));
                    }
                    else
                    {
                        result = new MessageSecurityException(SR.GetString(SR.DnsIdentityCheckFailedForIncomingMessage, expectedDnsName, actualDnsName));
                    }
                }
                else if (SR.IdentityCheckFailedForOutgoingMessage.Equals(errorString))
                {
                    if (actualDnsName == null)
                    {
                        result = new MessageSecurityException(SR.GetString(SR.DnsIdentityCheckFailedForOutgoingMessageLackOfDnsClaim, expectedDnsName));
                    }
                    else
                    {
                        result = new MessageSecurityException(SR.GetString(SR.DnsIdentityCheckFailedForOutgoingMessage, expectedDnsName, actualDnsName));
                    }
                }
                else
                {
                    result = new MessageSecurityException(SR.GetString(errorString, identity, serviceReference));
                }
            }
            else
            {
                result = new MessageSecurityException(SR.GetString(errorString, identity, serviceReference));
            }

            return result;
        }

        public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
        {
            bool returnvalue = false;

            foreach (ClaimSet claimset in authContext.ClaimSets)
            {
                foreach (Claim claim in claimset)
                {
                    if (claim.ClaimType == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishedname")
                    {
                        X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                        if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                        {
                            Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                            Console.WriteLine("Right: {0}", claim.Right);
                            Console.WriteLine("Resource: {0}", claim.Resource);
                            Console.WriteLine();
                            returnvalue = true;
                        }
                    }
                }

            }
            return returnvalue;
        }

 public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
 {
     return IdentityVerifier.CreateDefault().TryGetIdentity(reference, out identity);
 }

 public abstract bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity);

 public abstract bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext);

 internal static bool IsMatch(EndpointIdentity identity)
 {
     return (identity.IdentityClaim.ClaimType == "http://schemas.microsoft.com/net/2006/05/peer/peer");
 }

        /// <summary>
        /// Processes the Auth Context to get the IdentityClaims
        /// </summary>
        /// <returns></returns>
        protected void FindIdentityClaims()
        {
            // Pick up the claim type to use for generating the UniqueID claim
            string identificationClaimType = System.Configuration.ConfigurationManager.AppSettings["IdentityClaimType"];

            // Or, default to PPID
            if (string.IsNullOrEmpty(identificationClaimType))
                identificationClaimType = System.IdentityModel.Claims.ClaimTypes.PPID;

            ClaimSet result = null;
            m_endpointIdentity = null;

            foreach (ClaimSet claimSet in m_authorizationContext.ClaimSets)
            {
                //
                // This loops through the claims looking for the configured claim type
                // that will be used as part of the generation of the unique id.
                //
                foreach (Claim claim in claimSet.FindClaims(identificationClaimType, Rights.PossessProperty))
                {
                    // found a matching claim. This is good.
                    m_issuer = CreateIdentityFromClaimSet(claimSet.Issuer);
                    byte[] issuerkey;

                    // we need to get a byte array that represents the issuer's key
                    // to use as part of the hash to generate a unique id. 
                    // currently supported: (byte[]) or an RSACryptoServiceProvider,
                    // This could be expanded to support other types. The key just 
                    // needs to be extracted as a byte array.
                    issuerkey = m_issuer.IdentityClaim.Resource as byte[];
                    if (null == issuerkey)
                    {
                        RSACryptoServiceProvider csp = m_issuer.IdentityClaim.Resource as RSACryptoServiceProvider;
                        if (null != csp)
                            issuerkey = csp.ExportCspBlob(false);

                        // Can't use this claim to get the key.
                        if (null == issuerkey)
                            throw new Exception("Unsupported IdentityClaim resource type");
                    }

                    // It doesn't matter what encoding type we use, as long as it is consistent.
                    // this conversion is just to get a consistent set of bytes from the claim.
                    byte[] uniqueClaim = Encoding.UTF8.GetBytes(GetResourceValue(claim));

                    // copy the thumbprint data and the uniqueClaim together.
                    byte[] thumbprintData = new byte[uniqueClaim.Length + issuerkey.Length];
                    issuerkey.CopyTo(thumbprintData, 0);
                    uniqueClaim.CopyTo(thumbprintData, issuerkey.Length);

                    // generate a hash.
                    using (SHA256 sha = new SHA256Managed())
                    {
                        Claim thumbprintClaim = new Claim(ClaimTypes.Thumbprint, Convert.ToBase64String(sha.ComputeHash(thumbprintData)), Rights.Identity);
                        m_endpointIdentity = EndpointIdentity.CreateIdentity(thumbprintClaim);
                    }

                    m_identityClaims = claimSet;
                    return;
                }


                if (null == m_endpointIdentity)
                {
                    //
                    // check for identity claim, if found, hold on to it, we may need to use it :)
                    //
                    result = claimSet;
                    m_endpointIdentity = CreateIdentityFromClaimSet(claimSet);
                }
            }

            if (null != m_endpointIdentity)
            {
                m_identityClaims = result;
                return;
            }

            //
            // we have looped all claim sets with out finding an identity claim.
            // we will return the ppidIdentity and claimset if they were found.
            //
            throw new Exception("The XML Token data provided no Identity claim.");
        }

		public EndpointAddressBuilder (EndpointAddress address)
		{
			identity = address.Identity;
			uri = address.Uri;
			foreach (AddressHeader h in address.Headers)
				headers.Add (h);
		}