internal void ValidateCreateContext(
            string package,
            NetworkCredential credential,
            string servicePrincipalName,
            ExtendedProtectionPolicy policy,
            ProtectionLevel protectionLevel,
            TokenImpersonationLevel impersonationLevel)
        {
            if (policy != null)
            {
                // One of these must be set if EP is turned on
                if (policy.CustomChannelBinding == null && policy.CustomServiceNames == null)
                {
                    throw new ArgumentException(SR.net_auth_must_specify_extended_protection_scheme, nameof(policy));
                }

                _extendedProtectionPolicy = policy;
            }
            else
            {
                _extendedProtectionPolicy = new ExtendedProtectionPolicy(PolicyEnforcement.Never);
            }

            ValidateCreateContext(package, true, credential, servicePrincipalName, _extendedProtectionPolicy.CustomChannelBinding, protectionLevel, impersonationLevel);
        }

        internal static int Compare(TokenImpersonationLevel x, TokenImpersonationLevel y)
        {
            int num = 0;
            if (x == y)
            {
                return num;
            }
            switch (x)
            {
                case TokenImpersonationLevel.Identification:
                    return -1;

                case TokenImpersonationLevel.Impersonation:
                    switch (y)
                    {
                        case TokenImpersonationLevel.Identification:
                            return 1;

                        case TokenImpersonationLevel.Delegation:
                            return -1;
                    }
                    break;

                case TokenImpersonationLevel.Delegation:
                    return 1;

                default:
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidEnumArgumentException("x", (int) x, typeof(TokenImpersonationLevel)));
            }
            throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidEnumArgumentException("y", (int) y, typeof(TokenImpersonationLevel)));
        }

 public static WindowsIdentity CreateWindowsIdentity(string userName, string password, TokenImpersonationLevel tokenImpersonationLevel)
 {
     IntPtr token = IntPtr.Zero;
     IntPtr duplicateToken = IntPtr.Zero;
     if (LogonUser(userName, string.Empty, password, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, ref token))
     {
         int impersonationLevel;
         switch (tokenImpersonationLevel)
         {
             case TokenImpersonationLevel.Anonymous:
                 { impersonationLevel = 0; break; }
             case TokenImpersonationLevel.Impersonation:
                 { impersonationLevel = 2; break; }
             case TokenImpersonationLevel.Delegation:
                 { impersonationLevel = 3; break; }
             default:
                 { impersonationLevel = 1; break; }
         }
         if (DuplicateToken(token, impersonationLevel, ref duplicateToken))
         {
             return new WindowsIdentity(duplicateToken);
         }
         else
         {
             throw new InvalidOperationException(string.Format("创建模拟令牌失败 (错误代码: {0}) ", Marshal.GetLastWin32Error()));
         }
     }
     else
     {
         throw new InvalidOperationException(string.Format("用户登录失败 (错误代码: {0}) ", Marshal.GetLastWin32Error()));
     }
 }

 //
 public virtual void AuthenticateAsClient( NetworkCredential       credential,
                                         string                  targetName,
                                         ProtectionLevel         requiredProtectionLevel,   //this will be the ultimate result or exception
                                         TokenImpersonationLevel allowedImpersonationLevel) //this OR LOWER will be ultimate result in auth context
 {
     AuthenticateAsClient(credential, null, targetName, requiredProtectionLevel, allowedImpersonationLevel);
 }

 public SspiSecurityToken(TokenImpersonationLevel impersonationLevel, bool allowNtlm, NetworkCredential networkCredential)
 {
     _impersonationLevel = impersonationLevel;
     _allowNtlm = allowNtlm;
     _networkCredential = SecurityUtils.GetNetworkCredentialsCopy(networkCredential);
     _effectiveTime = DateTime.UtcNow;
     _expirationTime = _effectiveTime.AddHours(10);
 }

 public SspiSecurityToken(TokenImpersonationLevel impersonationLevel, bool allowNtlm, System.Net.NetworkCredential networkCredential)
 {
     this.impersonationLevel = impersonationLevel;
     this.allowNtlm = allowNtlm;
     this.networkCredential = System.ServiceModel.Security.SecurityUtils.GetNetworkCredentialsCopy(networkCredential);
     this.effectiveTime = DateTime.UtcNow;
     this.expirationTime = this.effectiveTime.AddHours(10.0);
 }

 internal static void ValidateImpersonationLevel(TokenImpersonationLevel impersonationLevel)
 {
     if (impersonationLevel != TokenImpersonationLevel.Identification)
     {
         throw new ArgumentOutOfRangeException(nameof(impersonationLevel), impersonationLevel.ToString(),
             SR.net_auth_supported_impl_levels);
     }
 }

 internal static bool IsDefined(TokenImpersonationLevel value)
 {
     if (((value != TokenImpersonationLevel.None) && (value != TokenImpersonationLevel.Anonymous)) && ((value != TokenImpersonationLevel.Identification) && (value != TokenImpersonationLevel.Impersonation)))
     {
         return (value == TokenImpersonationLevel.Delegation);
     }
     return true;
 }

		public SspiSecurityTokenProvider (NetworkCredential credential, 
			bool allowNtlm, TokenImpersonationLevel impersonationLevel)
		{
			if (credential == null)
				throw new ArgumentNullException ("credential");
			this.credential = credential;
			allow_ntlm = allowNtlm;
			impersonation_level = impersonationLevel;
		}

 internal void ValidateCreateContext(string package,
                                     NetworkCredential credential,
                                     string servicePrincipalName,
                                     ExtendedProtectionPolicy policy,
                                     ProtectionLevel protectionLevel,
                                     TokenImpersonationLevel impersonationLevel)
 {
     throw new PlatformNotSupportedException();
 }

 static TokenImpersonationLevelHelper()
 {
     TokenImpersonationLevel[] levelArray = new TokenImpersonationLevel[5];
     levelArray[1] = TokenImpersonationLevel.Anonymous;
     levelArray[2] = TokenImpersonationLevel.Identification;
     levelArray[3] = TokenImpersonationLevel.Impersonation;
     levelArray[4] = TokenImpersonationLevel.Delegation;
     TokenImpersonationLevelOrder = levelArray;
 }

 public SpnegoTokenProvider(System.IdentityModel.SafeFreeCredentials credentialsHandle, SecurityBindingElement securityBindingElement) : base(securityBindingElement)
 {
     this.allowedImpersonationLevel = TokenImpersonationLevel.Identification;
     this.identityVerifier = System.ServiceModel.Security.IdentityVerifier.CreateDefault();
     this.allowNtlm = true;
     this.authenticateServer = true;
     this.interactiveNegoExLogonEnabled = true;
     this.credentialsHandle = credentialsHandle;
 }

 internal IpcClientTransportSink(string channelURI, IpcClientChannel channel)
 {
     string str;
     this.portCache = new ConnectionCache();
     this._tokenImpersonationLevel = TokenImpersonationLevel.Identification;
     this._timeout = 0x3e8;
     this._channel = channel;
     string str2 = IpcChannelHelper.ParseURL(channelURI, out str);
     int startIndex = str2.IndexOf("://") + 3;
     this._portName = str2.Substring(startIndex);
 }

 public WebRequestChannel()
 {
     // Set HWR default values
     this.allowPipelining = true;
     this.authenticationLevel = AuthenticationLevel.MutualAuthRequested;
     this.cachePolicy = WebRequest.DefaultCachePolicy;
     this.impersonationLevel = TokenImpersonationLevel.Delegation;
     this.maxResponseHeadersLength = HttpWebRequest.DefaultMaximumResponseHeadersLength;
     this.readWriteTimeout = 5 * 60 * 1000; // 5 minutes
     this.unsafeAuthenticatedConnectionSharing = false;
 }

 internal WindowsClientCredential(WindowsClientCredential other)
 {
     this.allowedImpersonationLevel = TokenImpersonationLevel.Identification;
     this.allowNtlm = true;
     if (other.windowsCredentials != null)
     {
         this.windowsCredentials = System.ServiceModel.Security.SecurityUtils.GetNetworkCredentialsCopy(other.windowsCredentials);
     }
     this.allowedImpersonationLevel = other.allowedImpersonationLevel;
     this.allowNtlm = other.allowNtlm;
     this.isReadOnly = other.isReadOnly;
 }

		public WebRequestHandler ()
		{
			allowPipelining = true;
			authenticationLevel = AuthenticationLevel.MutualAuthRequested;
			cachePolicy = System.Net.WebRequest.DefaultCachePolicy;
			continueTimeout = TimeSpan.FromMilliseconds (350);
			impersonationLevel = TokenImpersonationLevel.Delegation;
			maxResponseHeadersLength = HttpWebRequest.DefaultMaximumResponseHeadersLength;
			readWriteTimeout = 300000;
			serverCertificateValidationCallback = null;
			unsafeAuthenticatedConnectionSharing = false;
		}

 private IAsyncResult BeginAuthenticateAsClient(
     NetworkCredential credential,
     string targetName,
     ProtectionLevel requiredProtectionLevel,
     TokenImpersonationLevel allowedImpersonationLevel,
     AsyncCallback asyncCallback,
     object asyncState)
 {
     return BeginAuthenticateAsClient(credential, null, targetName,
                                      requiredProtectionLevel, allowedImpersonationLevel,
                                      asyncCallback, asyncState);
 }

        public KerberosSecurityTokenProvider(string servicePrincipalName, TokenImpersonationLevel tokenImpersonationLevel, NetworkCredential networkCredential)
        {
            if (servicePrincipalName == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("servicePrincipalName");
            if (tokenImpersonationLevel != TokenImpersonationLevel.Identification && tokenImpersonationLevel != TokenImpersonationLevel.Impersonation)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException("tokenImpersonationLevel",
                    SR.GetString(SR.ImpersonationLevelNotSupported, tokenImpersonationLevel)));
            }

            this.servicePrincipalName = servicePrincipalName;
            this.tokenImpersonationLevel = tokenImpersonationLevel;
            this.networkCredential = networkCredential;
        }

 /// <summary>
 /// Initializes a new instance of the <see cref="OverlappingPipeClientStream"/> class.
 /// </summary>
 /// <param name="serverName">Name of the server.</param>
 /// <param name="pipeName">Name of the pipe.</param>
 /// <param name="transmissionMode"></param>
 /// <param name="impersonationLevel">The impersonation level.</param>
 /// <param name="inheritability">The inheritability.</param>
 public OverlappingPipeClientStream(
     [NotNull] string serverName,
     [NotNull] string pipeName,
     PipeTransmissionMode transmissionMode,
     TokenImpersonationLevel impersonationLevel = TokenImpersonationLevel.None,
     HandleInheritability inheritability = HandleInheritability.None)
     : base(new NamedPipeClientStream(
                serverName,
                pipeName,
                PipeDirection.InOut,
                PipeOptions.Asynchronous,
                impersonationLevel,
                inheritability))
 {
     Debug.Assert(Stream != null);
     ReadMode = transmissionMode;
 }

 public NamedPipeClientStream(string serverName, string pipeName, PipeAccessRights desiredAccessRights, PipeOptions options, TokenImpersonationLevel impersonationLevel, HandleInheritability inheritability) : base(DirectionFromRights(desiredAccessRights), 0)
 {
     if (pipeName == null)
     {
         throw new ArgumentNullException("pipeName");
     }
     if (serverName == null)
     {
         throw new ArgumentNullException("serverName", System.SR.GetString("ArgumentNull_ServerName"));
     }
     if (pipeName.Length == 0)
     {
         throw new ArgumentException(System.SR.GetString("Argument_NeedNonemptyPipeName"));
     }
     if (serverName.Length == 0)
     {
         throw new ArgumentException(System.SR.GetString("Argument_EmptyServerName"));
     }
     if ((options & ~(PipeOptions.Asynchronous | PipeOptions.WriteThrough)) != PipeOptions.None)
     {
         throw new ArgumentOutOfRangeException("options", System.SR.GetString("ArgumentOutOfRange_OptionsInvalid"));
     }
     if ((impersonationLevel < TokenImpersonationLevel.None) || (impersonationLevel > TokenImpersonationLevel.Delegation))
     {
         throw new ArgumentOutOfRangeException("impersonationLevel", System.SR.GetString("ArgumentOutOfRange_ImpersonationInvalid"));
     }
     if ((inheritability < HandleInheritability.None) || (inheritability > HandleInheritability.Inheritable))
     {
         throw new ArgumentOutOfRangeException("inheritability", System.SR.GetString("ArgumentOutOfRange_HandleInheritabilityNoneOrInheritable"));
     }
     if ((desiredAccessRights & ~(PipeAccessRights.AccessSystemSecurity | PipeAccessRights.FullControl)) != 0)
     {
         throw new ArgumentOutOfRangeException("desiredAccessRights", System.SR.GetString("ArgumentOutOfRange_InvalidPipeAccessRights"));
     }
     this.m_normalizedPipePath = Path.GetFullPath(@"\\" + serverName + @"\pipe\" + pipeName);
     if (string.Compare(this.m_normalizedPipePath, @"\\.\pipe\anonymous", StringComparison.OrdinalIgnoreCase) == 0)
     {
         throw new ArgumentOutOfRangeException("pipeName", System.SR.GetString("ArgumentOutOfRange_AnonymousReserved"));
     }
     this.m_inheritability = inheritability;
     this.m_impersonationLevel = impersonationLevel;
     this.m_pipeOptions = options;
     this.m_access = (int) desiredAccessRights;
 }