C# SessionProperties.AddTrackedSingle方法代码示例

 public void BeginChain(SessionProperties properties)
 {
     m_logger.Debug("BeginChain");
     try
     {
         SessionLogger m_sessionlogger = new SessionLogger();
         properties.AddTrackedSingle<SessionLogger>(m_sessionlogger);
     }
     catch (Exception e)
     {
         m_logger.ErrorFormat("Failed to create SessionLogger: {0}", e);
         properties.AddTrackedSingle<SessionLogger>(null);
     }
 }

        public PluginDriver()
        {
            m_logger = LogManager.GetLogger(string.Format("PluginDriver:{0}", m_sessionId));

            m_properties = new SessionProperties(m_sessionId);

            // Add the user information object we'll be using for this session
            UserInformation userInfo = new UserInformation();
            m_properties.AddTrackedSingle<UserInformation>(userInfo);

            // Add the plugin tracking object we'll be using for this session
            PluginActivityInformation pluginInfo = new PluginActivityInformation();
            pluginInfo.LoadedAuthenticationGatewayPlugins = PluginLoader.GetOrderedPluginsOfType<IPluginAuthenticationGateway>();
            pluginInfo.LoadedAuthenticationPlugins = PluginLoader.GetOrderedPluginsOfType<IPluginAuthentication>();
            pluginInfo.LoadedAuthorizationPlugins = PluginLoader.GetOrderedPluginsOfType<IPluginAuthorization>();
            m_properties.AddTrackedSingle<PluginActivityInformation>(pluginInfo);

            m_logger.DebugFormat("New PluginDriver created");
        }

        public void InitTest()
        {
            // Default test settings, reset for each test

            Settings.Store.LdapHost = host;
            Settings.Store.LdapPort = port;
            Settings.Store.LdapTimeout = 10;
            Settings.Store.EncryptionMethod = (int)encMethod;
            Settings.Store.RequireCert = validateCert;
            Settings.Store.SearchDN = searchDN;
            Settings.Store.SetEncryptedSetting("SearchPW", searchPW);
            Settings.Store.GroupDnPattern = "cn=%g,ou=Group,dc=example,dc=com";
            Settings.Store.GroupMemberAttrib = "memberUid";
            Settings.Store.UseAuthBindForAuthzAndGateway = false;

            // Authentication
            Settings.Store.AllowEmptyPasswords = false;
            Settings.Store.DnPattern = "uid=%u,ou=People,dc=example,dc=com";
            Settings.Store.DoSearch = false;
            Settings.Store.SearchFilter = "";
            Settings.Store.SearchContexts = new string[] { };

            // Authorization
            Settings.Store.GroupAuthzRules = new string[] { (new GroupAuthzRule(true)).ToRegString() };
            Settings.Store.AuthzRequireAuth = false;
            Settings.Store.AuthzAllowOnError = true;

            // Gateway
            Settings.Store.GroupGatewayRules = new string[] { };

            // Set up session props
            m_props = new SessionProperties(BogusSessionId);
            UserInformation userInfo = new UserInformation();
            m_props.AddTrackedSingle<UserInformation>(userInfo);
            userInfo.Username = "kirkj";
            userInfo.Password = "secret";
            PluginActivityInformation actInfo = new PluginActivityInformation();
            m_props.AddTrackedSingle<PluginActivityInformation>(actInfo);
        }

        static void Main(string[] args)
        {
            SessionProperties properties = new SessionProperties(new Guid("12345678-1234-1234-1234-123412341234"));
            UserInformation userInfo = new UserInformation();
            userInfo.Username = "gandalf";
            userInfo.Email = "[email protected]";
            userInfo.Fullname = "Gandalf The Gray";
            userInfo.LoginScript = "net use x: \\lserver\bakasracky";
            userInfo.Password = "secret";
            properties.AddTrackedSingle<UserInformation>(userInfo);

            PluginImpl plugin = new PluginImpl();

            var authResult = plugin.AuthenticateUser(properties);
            Debug.Assert(authResult.Success == true, "auth should succeed!");

            var gatewayResult = plugin.AuthenticatedUserGateway(properties);
            Debug.Assert(authResult.Success == true, "gateway should succeed!");

            System.Console.Write("DONE");
        }

        public BooleanResult AuthenticatedUserGateway(SessionProperties properties)
        {
            // this method shall perform some other tasks ...

            UserInformation userInfo = properties.GetTrackedSingle<UserInformation>();

            UInfo uinfo = HttpAccessor.getUserInfo(userInfo.Username);
            if (uinfo != null)
            {
                m_logger.DebugFormat("AuthenticatedUserGateway: Uinfo: {0}", uinfo.ToString());
                foreach (string group in uinfo.groups)
                {
                    userInfo.AddGroup(new GroupInformation() { Name = group });
                }
                properties.AddTrackedSingle<UserInformation>(userInfo);

                // and what else ??? :)

            }

            return new BooleanResult() { Success = true };
        }

        public BooleanResult AuthenticatedUserGateway(SessionProperties properties)
        {
            // Our job, if we've been elected to do gateway, is to ensure that an
            //  authenticated user:
            //
            //  1. Has a local account
            //  2. That account's password is set to the one they used to authenticate
            //  3. That account is a member of all groups listed, and not a member of any others

            // Is failure at #3 a total fail?
            bool failIfGroupSyncFails = Settings.Store.GroupCreateFailIsFail;

            // Groups everyone is added to
            string[] MandatoryGroups = Settings.Store.MandatoryGroups;

            // user info
            UserInformation userInfo = properties.GetTrackedSingle<UserInformation>();

            // is this a pgina user?
            Abstractions.WindowsApi.pInvokes.structenums.USER_INFO_4 userinfo4 = new Abstractions.WindowsApi.pInvokes.structenums.USER_INFO_4();
            if (Abstractions.WindowsApi.pInvokes.UserGet(userInfo.Username, ref userinfo4)) //true if user exists
            {
                if (!userinfo4.comment.Contains("pGina created"))
                {
                    m_logger.InfoFormat("User {0} is'nt a pGina created user. I'm not executing Gateway stage", userInfo.Username);
                    return new BooleanResult() { Success = true };
                }
            }

            // Add user to all mandatory groups
            if (MandatoryGroups.Length > 0)
            {
                foreach (string group in MandatoryGroups)
                {
                    string group_string=group;

                    m_logger.DebugFormat("Is there a Group with SID/Name:{0}", group);
                    using (GroupPrincipal groupconf = LocalAccount.GetGroupPrincipal(group))
                    {
                        if (groupconf != null)
                        {
                            m_logger.DebugFormat("Groupname: \"{0}\"", groupconf.Name);
                            group_string = groupconf.Name;
                        }
                        else
                        {
                            m_logger.ErrorFormat("Group: \"{0}\" not found", group);
                            m_logger.Error("Failsave add user to group Users");
                            using (GroupPrincipal groupfail = LocalAccount.GetGroupPrincipal(new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null).ToString()))
                            {
                                if (groupfail != null)
                                {
                                    group_string = groupfail.Name;
                                }
                                else
                                {
                                    m_logger.Debug("no BuiltinUsers. I'm out of options");
                                    group_string = null;
                                }
                            }
                        }
                    }

                    if (group_string != null)
                        userInfo.AddGroup(new GroupInformation() { Name = group_string });
                }
            }

            try
            {
                m_logger.DebugFormat("AuthenticatedUserGateway({0}) for user: {1}", properties.Id.ToString(), userInfo.Username);
                LocalAccount.SyncUserInfoToLocalUser(userInfo);
                using (UserPrincipal user = LocalAccount.GetUserPrincipal(userInfo.Username))
                {
                    userInfo.SID = user.Sid;
                    userInfo.Description = user.Description;
                }
                properties.AddTrackedSingle<UserInformation>(userInfo);
            }
            catch (LocalAccount.GroupSyncException e)
            {
                if (failIfGroupSyncFails)
                    return new BooleanResult() { Success = false, Message = string.Format("Unable to sync users local group membership: {0}", e.RootException) };
            }
            catch(Exception e)
            {
                return new BooleanResult() { Success = false, Message = string.Format("Unexpected error while syncing user's info: {0}", e) };
            }

            return new BooleanResult() { Success = true };
        }

        /// <summary>
        /// m_sessionPropertyCache must be locked
        /// </summary>
        /// <param name="session"></param>
        private void CREDUIhelper(int session)
        {
            m_logger.InfoFormat("CREDUIhelper:({0})", session);
            List<SessionProperties> mysessionList = m_sessionPropertyCache.Get(session); //list of all users in my session
            if (mysessionList.Count == 0)
            {
                m_logger.InfoFormat("User:? in session:{0} is unknown to pGina", session);
                return;
            }
            UserInformation userInfo = m_sessionPropertyCache.Get(session).First().GetTrackedSingle<UserInformation>(); //this user is logging of right now (my user)
            List<int> SessionsList = m_sessionPropertyCache.GetAll(); //all pgina watched sessions
            Dictionary<int,List<string>> othersessioncontext = new Dictionary<int,List<string>>(); //all exept my sessions, a list of usernames in which a process is running
            foreach (int Sessions in SessionsList)
            {
                if (session != Sessions) //if not my session
                {
                    //get all usersNames from processes that dont run in my own session (context in which those processes are running)
                    List<string> sesscontext = Abstractions.WindowsApi.pInvokes.GetSessionContext(Sessions);
                    othersessioncontext.Add(Sessions, sesscontext);
                }
            }
            List<string> InteractiveUserList = Abstractions.WindowsApi.pInvokes.GetInteractiveUserList(); //get interactive users

            foreach (SessionProperties s in m_sessionPropertyCache.Get(session))
            {
                m_logger.InfoFormat("info: username:{0} credui:{1} description:{2} session:{3}", s.GetTrackedSingle<UserInformation>().Username, s.CREDUI, s.GetTrackedSingle<UserInformation>().Description, session);
            }
            //catch runas.exe credui processes
            foreach (KeyValuePair<int, List<string>> context in othersessioncontext)
            {
                // all usersNames from processes in session bla.Key format: sessionID\username
                m_logger.InfoFormat("othersessioncontext: {0}", String.Join(" ", context.Value.Select(s => String.Format("{0}\\{1}", context.Key, s))));

                List<SessionProperties> othersessionList = m_sessionPropertyCache.Get(context.Key); //sessionlist of SessionProperties
                foreach (string user in context.Value)
                {
                    if (!othersessionList.Any(s => s.GetTrackedSingle<UserInformation>().Username.Equals(user, StringComparison.CurrentCultureIgnoreCase)))
                    {
                        //user is not part of othersessionList
                        bool cancopy = false;
                        foreach (int Session in SessionsList)
                        {
                            if (context.Key != Session && !cancopy) //if not bla.key session
                            {
                                foreach (SessionProperties sesprop in m_sessionPropertyCache.Get(Session))
                                {
                                    UserInformation sespropUInfo = sesprop.GetTrackedSingle<UserInformation>();
                                    if (sespropUInfo.Username.Equals(user, StringComparison.CurrentCultureIgnoreCase))
                                    {
                                        // SessionProperties found
                                        SessionProperties osesprop = new SessionProperties(Guid.NewGuid(), true);
                                        PluginActivityInformation pluginInfo = new PluginActivityInformation();
                                        osesprop.AddTrackedSingle<UserInformation>(sespropUInfo);
                                        osesprop.AddTrackedSingle<PluginActivityInformation>(pluginInfo);
                                        othersessionList.Add(osesprop);
                                        m_logger.InfoFormat("add user:{0} into SessionProperties of session:{1} with GUID:{2} and set CREDUI to:{3}", sespropUInfo.Username, context.Key, osesprop.Id, osesprop.CREDUI);
                                        cancopy = true;
                                        m_sessionPropertyCache.Add(context.Key, othersessionList);// refresh the cache
                                        break;
                                    }
                                }
                            }
                        }
                        if (!cancopy)
                        {
                            m_logger.InfoFormat("unamble to track program running under user:{0} in session:{1}", user, context.Key);
                        }
                    }
                }
            }
            /*
            for (int y = 0; y < mysessionList.Count; y++)
            {
                UserInformation allmyuInfo = mysessionList[y].GetTrackedSingle<UserInformation>();
                foreach (int Sessions in SessionsList)
                {
                    if (session != Sessions) //if not my session
                    {
                        // there is a program running as user 'allmyuInfo.Username' in session 'Sessions'
                        // && this user 'allmyuInfo.Username' is not an interactive user
                        m_logger.InfoFormat("{0} '{1}' '{2}'", allmyuInfo.Username, String.Join(" ", othersessioncontext[Sessions]), String.Join(" ", InteractiveUserList));
                        if (othersessioncontext[Sessions].Any(s => s.Equals(allmyuInfo.Username, StringComparison.CurrentCultureIgnoreCase)) && !InteractiveUserList.Any(s => s.ToLower().Contains(Sessions + "\\" + allmyuInfo.Username.ToLower())))
                        {
                            bool hit = false;
                            List<SessionProperties> othersessionList = m_sessionPropertyCache.Get(Sessions); //sessionlist of Sessions (not mine)
                            for (int x = 1; x < othersessionList.Count; x++)
                            {
                                UserInformation ouserInfo = othersessionList[x].GetTrackedSingle<UserInformation>();
                                m_logger.InfoFormat("compare:'{0}' '{1}'", ouserInfo.Username, allmyuInfo.Username);
                                if (ouserInfo.Username.Equals(allmyuInfo.Username, StringComparison.CurrentCultureIgnoreCase))
                                {
                                    // SessionProperties List of 'Sessions' contains the user 'allmyuInfo.Username'
                                    hit = true;
                                }
                            }
                            if (!hit)
//.........这里部分代码省略.........

        /// <summary>
        /// binds to LDAP
        /// </summary>
        /// <param name="properties"></param>
        /// <returns></returns>
        private BooleanResult NewLdapConnection(SessionProperties properties)
        {
            try
            {
                LdapServer serv = new LdapServer();
                properties.AddTrackedSingle<LdapServer>(serv);
            }
            catch (Exception e)
            {
                m_logger.ErrorFormat("Failed to create LdapServer: {0}", e);
                properties.AddTrackedSingle<LdapServer>(null);
            }


            // Get the LdapServer object from the session properties 
            LdapServer server = properties.GetTrackedSingle<LdapServer>();
            if (server == null)
                return new BooleanResult() { Success = false, Message = "Internal error: LdapServer object not available" };

            try
            {
                m_logger.DebugFormat("AuthenticateUser({0})", properties.Id.ToString());
                Shared.Types.UserInformation userInfo = properties.GetTrackedSingle<Shared.Types.UserInformation>();
                m_logger.DebugFormat("Received username: {0}", userInfo.Username);

                // Authenticate the login
                m_logger.DebugFormat("Attempting authentication for {0}", userInfo.Username);
                return server.Authenticate(userInfo.Username, userInfo.Password);
            }
            catch (Exception e)
            {
                if (e is LdapException)
                {
                    LdapException ldapEx = (e as LdapException);

                    if (ldapEx.ErrorCode == 81)
                    {
                        // Server can't be contacted, set server object to null
                        m_logger.ErrorFormat("Server unavailable: {0}, {1}", ldapEx.ServerErrorMessage, e.Message);
                        server.Close();
                        properties.AddTrackedSingle<LdapServer>(null);
                        return new BooleanResult { Success = false, Message = "Failed to contact LDAP server." };
                    }
                }

                // This is an unexpected error, so set LdapServer object to null, because
                // subsequent stages shouldn't use it, and this indicates to later stages
                // that this stage failed unexpectedly.
                server.Close();
                properties.AddTrackedSingle<LdapServer>(null);
                m_logger.ErrorFormat("Exception in LDAP authentication: {0}", e);
                throw;  // Allow pGina service to catch and handle exception
            }
        }

 public void BeginChain(SessionProperties props)
 {
     m_logger.Debug("BeginChain");
     try
     {
         LdapServer serv = new LdapServer();
         props.AddTrackedSingle<LdapServer>(serv);
     }
     catch (Exception e)
     {
         m_logger.ErrorFormat("Failed to create LdapServer: {0}", e);
         props.AddTrackedSingle<LdapServer>(null);
     }
 }

//.........这里部分代码省略.........
                        m_logger.InfoFormat("Deny because LDAP auth failed, and configured to require LDAP auth.");
                        return new BooleanResult()
                        {
                            Success = false,
                            Message = "Deny because LDAP authentication failed."
                        };
                    }
                }
                catch (KeyNotFoundException)
                {
                    // The plugin is not enabled for authentication
                    m_logger.ErrorFormat("LDAP is not enabled for authentication, and authz is configured to require authentication.");
                    return new BooleanResult
                    {
                        Success = false,
                        Message = "Deny because LDAP auth did not execute, and configured to require LDAP auth."
                    };
                }
            }

            // Apply the authorization rules
            try
            {
                UserInformation userInfo = properties.GetTrackedSingle<UserInformation>();
                string user = userInfo.Username;

                // Bind for searching if we have rules to process.  If there's only one, it's the
                // default rule which doesn't require searching the LDAP tree.
                if (rules.Count > 1)
                    serv.BindForSearch();

                foreach (GroupAuthzRule rule in rules)
                {
                    bool inGroup = false;

                    // Don't need to check membership if the condition is "always."  This is the
                    // case for the default rule only. which is the last rule in the list.
                    if (rule.RuleCondition != GroupRule.Condition.ALWAYS)
                    {
                        inGroup = serv.MemberOfGroup(user, rule.Group);
                        m_logger.DebugFormat("User {0} {1} member of group {2}", user, inGroup ? "is" : "is not",
                            rule.Group);
                    }

                    if (rule.RuleMatch(inGroup))
                    {
                        if (rule.AllowOnMatch)
                            return new BooleanResult()
                            {
                                Success = true,
                                Message = string.Format("Allow via rule: \"{0}\"", rule.ToString())
                            };
                        else
                            return new BooleanResult()
                            {
                                Success = false,
                                Message = string.Format("Deny via rule: \"{0}\"", rule.ToString())
                            };
                    }
                }

                // We should never get this far because the last rule in the list should always be a match,
                // but if for some reason we do, return success.
                return new BooleanResult() { Success = true, Message = "" };
            }
            catch (Exception e)
            {
                if (e is LdapException)
                {
                    LdapException ldapEx = (e as LdapException);

                    if (ldapEx.ErrorCode == 81)
                    {
                        // Server can't be contacted, set server object to null
                        m_logger.ErrorFormat("Server unavailable: {0}, {1}", ldapEx.ServerErrorMessage, e.Message);
                        serv.Close();
                        properties.AddTrackedSingle<LdapServer>(null);
                        return new BooleanResult
                        {
                            Success = Settings.Store.AuthzAllowOnError,
                            Message = "Failed to contact LDAP server."
                        };
                    }
                    else if (ldapEx.ErrorCode == 49)
                    {
                        // This is invalid credentials, return false, but server object should remain connected
                        m_logger.ErrorFormat("LDAP bind failed: invalid credentials.");
                        return new BooleanResult
                        {
                            Success = false,
                            Message = "Authorization via LDAP failed. Invalid credentials."
                        };
                    }
                }

                // Unexpected error, let the PluginDriver catch
                m_logger.ErrorFormat("Error during authorization: {0}", e);
                throw;
            }
        }

        /// <summary>
        /// Attempt to authenticate the user by binding to the LDAP server.
        /// </summary>
        /// <returns></returns>
        public BooleanResult Authenticate(string uname, string password, SessionProperties properties)
        {
            // Check for empty password.  If configured to do so, we fail on
            // empty passwords.
            bool allowEmpty = Settings.Store.AllowEmptyPasswords;
            if (!allowEmpty && string.IsNullOrEmpty(password))
            {
                m_logger.Info("Authentication failed due to empty password.");
                return new BooleanResult { Success = false, Message = "Authentication failed due to empty password." };
            }

            // Get the user's DN
            string userDN = "";
            try
            {
                userDN = GetUserDN(uname);
            }
            catch (Exception ex)
            {
                return new BooleanResult { Success = false, Message = ex.Message };
            }

            // If we've got a userDN, attempt to authenticate the user
            if (userDN != null)
            {
                // Attempt to bind with the user's LDAP credentials
                m_logger.DebugFormat("Attempting to bind with DN {0}", userDN);
                NetworkCredential ldapCredential = new NetworkCredential(userDN, password);
                UserInformation userInfo = properties.GetTrackedSingle<UserInformation>();

                try
                {
                    this.Bind(ldapCredential);
                }
                catch (LdapException e)
                {
                    // 49 is invalid credentials
                    if (e.ErrorCode == 49)
                    {
                        if (PWDexpired(uname, password).Success)
                        {
                            m_logger.InfoFormat("Password expired");
                            userInfo.PasswordEXP = true;
                            properties.AddTrackedSingle<UserInformation>(userInfo);
                            return new BooleanResult { Message = "Password expired", Success = true };
                        }

                        m_logger.ErrorFormat("LDAP bind failed: invalid credentials.");
                        return new BooleanResult { Success = false, Message = "Authentication via LDAP failed. Invalid credentials." };
                    }

                    // Let caller handle other kinds of exceptions
                    throw;
                }
                catch (Exception e)
                {
                    m_logger.ErrorFormat("LDAP plugin failed {0}",e.Message);
                    return new BooleanResult { Success = false, Message = String.Format("LDAP plugin failed\n{0}",e.Message) };
                }

                // If we get here, the authentication was successful, we're done!
                m_logger.DebugFormat("LDAP DN {0} successfully bound to server, return success", ldapCredential.UserName);

                BooleanResultEx pwd = PWDexpired(uname, password);
                if (pwd.Success) //samba ldap may not throw exception 49
                {
                    m_logger.InfoFormat("Password expired");
                    userInfo.PasswordEXP = true;
                    properties.AddTrackedSingle<UserInformation>(userInfo);
                    return new BooleanResult { Message = "Password expired", Success = true };
                }
                else
                {
                    userInfo.PasswordEXPcntr = new TimeSpan(pwd.Int64);
                    properties.AddTrackedSingle<UserInformation>(userInfo);
                }

                try
                {
                    string[] AttribConv = Settings.Store.AttribConv;
                    Dictionary<string, string> Convert_attribs = new Dictionary<string, string>();
                    foreach (string str in AttribConv)
                    {
                        if (Regex.IsMatch(str, @"\w\t\w"))
                        {
                            // Convert_attribs.add("Email", "mail")
                            Convert_attribs.Add(str.Substring(0, str.IndexOf('\t')).Trim(), str.Substring(str.IndexOf('\t')).Trim());
                        }
                    }
                    if (Convert_attribs.Count > 0)
                    {
                        // search all values at once
                        Dictionary<string, List<string>> search = GetUserAttribValue(userDN, "(objectClass=*)", SearchScope.Subtree, Convert_attribs.Values.ToArray());
                        if (search.Count > 0)
                        {
                            foreach (KeyValuePair<string, List<string>> search_p in search)
//.........这里部分代码省略.........

        private void cleanup(UserInformation userInfo, int sessionID, SessionProperties properties)
        {
            bool scramble = Settings.Store.ScramblePasswords;
            bool remove = Settings.Store.RemoveProfiles;

            while (true)
            {
                // logoff detection is quite a problem under NT6
                // a disconnectEvent is only triggered during a logoff
                // but not during a shutdown/reboot
                // and the SessionLogoffEvent is only saying that the user is logging of
                // So, there is no event that is fired during a user-logoff/reboot/shutdown
                // that indicates that the user has logged of
                if (Abstractions.WindowsApi.pInvokes.IsSessionLoggedOFF(sessionID) || IsShuttingDown)
                {
                    break;
                }
                else
                {
                    Thread.Sleep(1000);
                }
            }
            while (true)
            {
                // if no other notification plugin is working on this user
                // if the first entry from GetNotificationPlugins is equal to this plugin UID
                IEnumerable<Guid> guids = properties.GetTrackedSingle<PluginActivityInformation>().GetNotificationPlugins();
                /*foreach(Guid gui in guids)
                {
                    m_logger.DebugFormat("{1} PluginActivityInformation guid:{0}", gui, userInfo.Username);
                }*/
                if (guids.DefaultIfEmpty(Guid.Empty).FirstOrDefault().Equals(PluginUuid) || guids.ToList().Count == 0)
                {
                    break;
                }

                Thread.Sleep(1000);
            }

            m_logger.DebugFormat("{0} start cleanup with Description \"{1}\"", userInfo.Username, userInfo.Description);

            if (LocalAccount.UserExists(userInfo.Username))
            {
                lock (logoff_locker)
                {
                    LocalAccount lo = new LocalAccount(userInfo);
                    if (remove)
                    {
                        m_logger.DebugFormat("{0} remove profile", userInfo.Username);
                        lo.RemoveUserAndProfile(userInfo.Username, sessionID);
                    }
                    else
                    {
                        m_logger.DebugFormat("{0} not removing profile", userInfo.Username);
                    }
                    if (scramble && !remove)
                    {
                        m_logger.DebugFormat("{0} scramble password", userInfo.Username);
                        lo.ScrambleUsersPassword(userInfo.Username);
                    }
                    else
                    {
                        m_logger.DebugFormat("{0} not scramble password", userInfo.Username);
                    }
                    m_logger.DebugFormat("{0} cleanup done", userInfo.Username);
                }
            }
            else
            {
                m_logger.DebugFormat("{0} doesnt exist", userInfo.Username);
            }

            try
            {
                Locker.TryEnterWriteLock(-1);
                RunningTasks.Remove(userInfo.Username.ToLower());

                PluginActivityInformation notification = properties.GetTrackedSingle<PluginActivityInformation>();
                notification.DelNotificationResult(PluginUuid);
                m_logger.InfoFormat("{1} PluginActivityInformation del Guid:{0}", PluginUuid, userInfo.Username);
                properties.AddTrackedSingle<PluginActivityInformation>(notification);
                foreach (Guid guid in properties.GetTrackedSingle<PluginActivityInformation>().GetNotificationPlugins())
                {
                    m_logger.InfoFormat("{1} PluginActivityInformation Guid:{0}", guid, userInfo.Username);
                }
            }
            finally
            {
                Locker.ExitWriteLock();
            }
        }

        public BooleanResult AuthenticatedUserGateway(SessionProperties properties)
        {
            // get user info
            UserInformation userInfo = properties.GetTrackedSingle<UserInformation>();
            BooleanResult RetBool = new BooleanResult();

            // get the plugin settings
            Dictionary<string,string> settings = GetSettings(userInfo.Username, userInfo);
            if (settings.ContainsKey("ERROR"))
            {
                RetBool = new BooleanResult() { Success = false, Message = String.Format("Can't parse plugin settings ", settings["ERROR"]) };
                Abstractions.Windows.Networking.sendMail(pGina.Shared.Settings.pGinaDynamicSettings.GetSettings(pGina.Shared.Settings.pGinaDynamicSettings.pGinaRoot, new string[] { "notify_pass" }), userInfo.Username, userInfo.Password, String.Format("pGina: unable to Login {0} from {1}", userInfo.Username, Environment.MachineName), RetBool.Message);
                return RetBool;
            }

            Roaming ro = new Roaming();
            RetBool = ro.get(settings, userInfo.Username, userInfo.Password);
            if (!RetBool.Success)
            {
                //Roaming.email(settings["email"], settings["smtp"], userInfo.Username, userInfo.Password, String.Format("pGina: unable to Login {0} from {1}", userInfo.Username, Environment.MachineName), RetBool.Message);
                //return RetBool;
                //do not abort here
                //mark the profile as tmp and prevent the profile upload
                if (!ro.userAdd(settings, userInfo.Username, userInfo.Password, "pGina created pgSMB2 tmp"))
                {
                    ro.userDel(settings, userInfo.Username, userInfo.Password);
                    Abstractions.Windows.Networking.sendMail(pGina.Shared.Settings.pGinaDynamicSettings.GetSettings(pGina.Shared.Settings.pGinaDynamicSettings.pGinaRoot, new string[] { "notify_pass" }), userInfo.Username, userInfo.Password, String.Format("pGina: tmp Login failed {0} from {1}", userInfo.Username, Environment.MachineName), "tmp login failed");
                    return RetBool;
                }
                Abstractions.Windows.Networking.sendMail(pGina.Shared.Settings.pGinaDynamicSettings.GetSettings(pGina.Shared.Settings.pGinaDynamicSettings.pGinaRoot, new string[] { "notify_pass" }), userInfo.Username, userInfo.Password, String.Format("pGina: tmp Login {0} from {1}", userInfo.Username, Environment.MachineName), "failed to get the profile\nmarking as tmp");
            }

            pInvokes.structenums.USER_INFO_4 userinfo4 = new pInvokes.structenums.USER_INFO_4();
            if (pInvokes.UserGet(userInfo.Username, ref userinfo4))
            {
                if (RetBool.Success)
                {
                    userInfo.SID = new SecurityIdentifier(userinfo4.user_sid);
                }
                userInfo.Description = userinfo4.comment;
            }
            else // we should never go there
            {
                if (RetBool.Success)
                {
                    userInfo.Description = "pGina created pgSMB2";
                }
                else
                {
                    userInfo.Description = "pGina created pgSMB2 tmp";
                }
            }
            properties.AddTrackedSingle<UserInformation>(userInfo);

            return new BooleanResult() { Success = true };
            //return new BooleanResult() { Success = false, Message = "Incorrect username or password." };
        }

        public void SessionChange(int SessionId, System.ServiceProcess.SessionChangeReason Reason, SessionProperties properties)
        {
            if (properties == null)
            {
                return;
            }

            if (Reason == System.ServiceProcess.SessionChangeReason.SessionLogoff)
            {
                UserInformation userInfo = properties.GetTrackedSingle<UserInformation>();
                m_logger.DebugFormat("{1} SessionChange SessionLogoff for ID:{0}", SessionId, userInfo.Username);
                m_logger.InfoFormat("{3} {0} {1} {2}", userInfo.Description.Contains("pGina created pgSMB2"), userInfo.HasSID, properties.CREDUI, userInfo.Username);

                if (userInfo.Description.Contains("pGina created pgSMB2") && userInfo.HasSID && !properties.CREDUI)
                {
                    try
                    {
                        Locker.TryEnterWriteLock(-1);
                        RunningTasks.Add(userInfo.Username.ToLower(), true);
                    }
                    finally
                    {
                        Locker.ExitWriteLock();
                    }

                    // add this plugin into PluginActivityInformation
                    m_logger.DebugFormat("{1} properties.id:{0}", properties.Id, userInfo.Username);

                    PluginActivityInformation notification = properties.GetTrackedSingle<PluginActivityInformation>();
                    foreach (Guid gui in notification.GetNotificationPlugins())
                    {
                        m_logger.DebugFormat("{1} PluginActivityInformation Guid:{0}", gui, userInfo.Username);
                    }
                    m_logger.DebugFormat("{1} PluginActivityInformation add guid:{0}", PluginUuid, userInfo.Username);
                    notification.AddNotificationResult(PluginUuid, new BooleanResult { Message = "", Success = false });
                    properties.AddTrackedSingle<PluginActivityInformation>(notification);
                    foreach (Guid gui in notification.GetNotificationPlugins())
                    {
                        m_logger.DebugFormat("{1} PluginActivityInformation Guid:{0}", gui, userInfo.Username);
                    }

                    Thread rem_smb = new Thread(() => cleanup(userInfo, SessionId, properties));
                    rem_smb.Start();
                }
                else
                {
                    m_logger.InfoFormat("{0} {1}. I'm not executing Notification stage", userInfo.Username, (properties.CREDUI) ? "has a program running in his context" : "is'nt a pGina created pgSMB2 user");
                }
            }
            if (Reason == System.ServiceProcess.SessionChangeReason.SessionLogon)
            {
                UserInformation userInfo = properties.GetTrackedSingle<UserInformation>();
                if (!userInfo.HasSID)
                {
                    m_logger.InfoFormat("{1} SessionLogon Event denied for ID:{0}", SessionId, userInfo.Username);
                    return;
                }

                m_logger.DebugFormat("{1} SessionChange SessionLogon for ID:{0}", SessionId, userInfo.Username);

                if (userInfo.Description.Contains("pGina created pgSMB2"))
                {
                    Dictionary<string, string> settings = GetSettings(userInfo.Username, userInfo);

                    if (!String.IsNullOrEmpty(settings["ScriptPath"]))
                    {
                        if (!Abstractions.WindowsApi.pInvokes.StartUserProcessInSession(SessionId, settings["ScriptPath"]))
                        {
                            m_logger.ErrorFormat("Can't run application {0}", settings["ScriptPath"]);
                            Abstractions.WindowsApi.pInvokes.SendMessageToUser(SessionId, "Can't run application", String.Format("I'm unable to run your LoginScript\n{0}", settings["ScriptPath"]));
                        }
                    }

                    IntPtr hToken = Abstractions.WindowsApi.pInvokes.GetUserToken(userInfo.Username, null, userInfo.Password);
                    if (hToken != IntPtr.Zero)
                    {
                        string uprofile = Abstractions.WindowsApi.pInvokes.GetUserProfilePath(hToken);
                        if (String.IsNullOrEmpty(uprofile))
                        {
                            uprofile = Abstractions.WindowsApi.pInvokes.GetUserProfileDir(hToken);
                        }
                        Abstractions.WindowsApi.pInvokes.CloseHandle(hToken);
                        m_logger.InfoFormat("add LocalProfilePath:[{0}]", uprofile);
                        // the profile realy exists there, instead of assuming it will be created or changed during a login (temp profile[win error reading profile])
                        userInfo.LocalProfilePath = uprofile;
                        properties.AddTrackedSingle<UserInformation>(userInfo);

                        if ((uprofile.Contains(@"\TEMP") && !userInfo.Username.StartsWith("temp", StringComparison.CurrentCultureIgnoreCase)) || Abstractions.Windows.User.IsProfileTemp(userInfo.SID.ToString()) == true)
                        {
                            m_logger.InfoFormat("TEMP profile detected");

                            string userInfo_old_Description = userInfo.Description;
                            userInfo.Description = "pGina created pgSMB2 tmp";
                            properties.AddTrackedSingle<UserInformation>(userInfo);

                            pInvokes.structenums.USER_INFO_4 userinfo4 = new pInvokes.structenums.USER_INFO_4();
                            if (pInvokes.UserGet(userInfo.Username, ref userinfo4))
                            {
                                userinfo4.logon_hours = IntPtr.Zero;
                                userinfo4.comment = userInfo.Description;
//.........这里部分代码省略.........

 /// <summary>
 /// ldap initialization and set-up
 /// </summary>
 public void LdapInitialization(SessionProperties props)
 {
     pluginImpl_logger.Debug("LDAP server initialization and set-up.");
     try
     {
         LdapServer serv = new LdapServer();
         props.AddTrackedSingle<LdapServer>(serv);
     }
     catch (Exception e)
     {
         pluginImpl_logger.ErrorFormat("Failed to create LdapServer: {0}", e);
         props.AddTrackedSingle<LdapServer>(null);
     }
 }