<commit_before>﻿using System;
using System.IdentityModel.Metadata;
using System.IdentityModel.Tokens;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography.X509Certificates;

namespace Thinktecture.IdentityModel.Tokens
{
    public class MetadataBasedIssuerNameRegistry : IssuerNameRegistry
    {
        private Uri _metadataAddress;
        private string _issuerName;

        private static ConfigurationBasedIssuerNameRegistry _registry;
        private static object _registryLock = new object();

        public MetadataBasedIssuerNameRegistry(Uri metadataAddress, string issuerName, bool lazyLoad = false)
        {
            _metadataAddress = metadataAddress;
            _issuerName = issuerName;

            if (!lazyLoad)
            {
                LoadMetadata();
            }
        }

        public override string GetIssuerName(SecurityToken securityToken)
        {
            if (_registry == null)
            {
                lock (_registryLock)
                {
                    if (_registry == null)
                    {
                        LoadMetadata();
                    }
                }
            }

            return _registry.GetIssuerName(securityToken);
        }

        protected virtual void LoadMetadata()
        {
            var client = new HttpClient { BaseAddress = _metadataAddress };
            var stream = client.GetStreamAsync("").Result;

            var serializer = new MetadataSerializer();
            var md = serializer.ReadMetadata(stream);

            var id = md.SigningCredentials.SigningKeyIdentifier;
            var clause = id.First() as X509RawDataKeyIdentifierClause;
            var cert = new X509Certificate2(clause.GetX509RawData());

            _registry = new ConfigurationBasedIssuerNameRegistry();
            _registry.AddTrustedIssuer(cert.Thumbprint, _issuerName);
        }
    }
}
<commit_msg>update to load all signing certs<commit_after>﻿using System;
using System.Configuration;
using System.IdentityModel.Metadata;
using System.IdentityModel.Services;
using System.IdentityModel.Services.Configuration;
using System.IdentityModel.Tokens;
using System.IO;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography.X509Certificates;
using System.ServiceModel.Security;
using System.Xml;

namespace Thinktecture.IdentityModel.Tokens
{
    public class MetadataBasedIssuerNameRegistry : IssuerNameRegistry
    {
        private Uri metadataAddress;
        private string issuerName;
        X509CertificateValidationMode mode;

        private static volatile ConfigurationBasedIssuerNameRegistry _registry;
        private static object _registryLock = new object();

        public MetadataBasedIssuerNameRegistry()
        {
        }

        public MetadataBasedIssuerNameRegistry(
            FederationConfiguration federationConfiguration,
            Uri metadataAddress,
            string issuerName,
            X509CertificateValidationMode mode = X509CertificateValidationMode.None,
            bool lazyLoad = false)
        {
            this.metadataAddress = metadataAddress;
            this.issuerName = issuerName;
            this.mode = mode;

            if (!lazyLoad)
            {
                LoadMetadata();
            }
        }

        public override string GetIssuerName(SecurityToken securityToken)
        {
            if (_registry == null)
            {
                lock (_registryLock)
                {
                    if (_registry == null)
                    {
                        LoadMetadata();
                    }
                }
            }

            return _registry.GetIssuerName(securityToken);
        }

        protected virtual Stream GetMetadataStream()
        {
            var client = new HttpClient { BaseAddress = metadataAddress };
            var stream = client.GetStreamAsync("").Result;
            return stream;
        }

        protected virtual void LoadMetadata()
        {
            using (var stream = GetMetadataStream())
            {
                var serializer = new MetadataSerializer();
                serializer.CertificateValidationMode = mode;

                var md = serializer.ReadMetadata(stream);
                var ed = md as EntityDescriptor;
                var stsd = (SecurityTokenServiceDescriptor)ed.RoleDescriptors.FirstOrDefault(x => x is SecurityTokenServiceDescriptor);

                var registry = new ConfigurationBasedIssuerNameRegistry();
                foreach (var key in stsd.Keys)
                {
                    var clause = key.KeyInfo.FirstOrDefault() as X509RawDataKeyIdentifierClause;
                    if (clause != null)
                    {
                        var cert = new X509Certificate2(clause.GetX509RawData());
                        registry.AddTrustedIssuer(cert.Thumbprint, issuerName);
                    }
                }

                _registry = registry;
            }
        }

        public override void LoadCustomConfiguration(XmlNodeList nodeList)
        {
            if (nodeList == null || nodeList.Count == 0)
            {
                throw new ConfigurationErrorsException("No configuration provided.");
            }

            var node = nodeList.Cast<XmlNode>().FirstOrDefault(x => x.LocalName == "trustedIssuerMetadata");
            if (node == null)
            {
                throw new ConfigurationErrorsException("Expected 'trustedIssuerMetadata' element.");
            }

            var elem = node as XmlElement;

            var name = elem.Attributes["issuerName"];
            if (name == null || String.IsNullOrWhiteSpace(name.Value))
            {
                throw new ConfigurationErrorsException("Expected 'issuerName' attribute.");
            }

            var address = elem.Attributes["metadataAddress"];
            if (address == null || String.IsNullOrWhiteSpace(address.Value))
            {
                throw new ConfigurationErrorsException("Expected 'metadataAddress' attribute.");
            }

            this.metadataAddress = new Uri(address.Value);
            this.issuerName = name.Value;
        }
    }
}

{'fraction_non_alphanumeric': 0.0721285140562249, 'fraction_numerical': 0.005783132530120482, 'mean_word_length': 1.8364464692482916, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 6, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5714626', 'n_tokens_mistral': 1484, 'n_tokens_neox': 1404, 'n_words': 327}