aboutsummaryrefslogtreecommitdiff
path: root/src/identity-provider
diff options
context:
space:
mode:
authorSchanzenbach, Martin <martin.schanzenbach@aisec.fraunhofer.de>2018-03-06 12:36:31 +0100
committerSchanzenbach, Martin <martin.schanzenbach@aisec.fraunhofer.de>2018-03-06 12:36:31 +0100
commit958288ff94c8f9bbd1edb60c83d18983abc60d2f (patch)
tree83d998a1221eca23df6231f3b4fbfae89e8e5554 /src/identity-provider
parentf7b82a74cc5d39c55a4a232e0e14e7ab51b83ff6 (diff)
downloadgnunet-958288ff94c8f9bbd1edb60c83d18983abc60d2f.tar.gz
gnunet-958288ff94c8f9bbd1edb60c83d18983abc60d2f.zip
forgot file
Diffstat (limited to 'src/identity-provider')
-rw-r--r--src/identity-provider/plugin_rest_openid_connect.c2175
1 files changed, 2175 insertions, 0 deletions
diff --git a/src/identity-provider/plugin_rest_openid_connect.c b/src/identity-provider/plugin_rest_openid_connect.c
new file mode 100644
index 000000000..c637680da
--- /dev/null
+++ b/src/identity-provider/plugin_rest_openid_connect.c
@@ -0,0 +1,2175 @@
1/*
2 This file is part of GNUnet.
3 Copyright (C) 2012-2015 GNUnet e.V.
4
5 GNUnet is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published
7 by the Free Software Foundation; either version 3, or (at your
8 option) any later version.
9
10 GNUnet is distributed in the hope that it will be useful, but
11 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 General Public License for more details.
14
15 You should have received a copy of the GNU General Public License
16 along with GNUnet; see the file COPYING. If not, write to the
17 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
18 Boston, MA 02110-1301, USA.
19 */
20/**
21 * @author Martin Schanzenbach
22 * @author Philippe Buschmann
23 * @file identity/plugin_rest_openid_connect.c
24 * @brief GNUnet Namestore REST plugin
25 *
26 */
27
28#include "platform.h"
29#include "gnunet_rest_plugin.h"
30#include "gnunet_identity_service.h"
31#include "gnunet_gns_service.h"
32#include "gnunet_gnsrecord_lib.h"
33#include "gnunet_namestore_service.h"
34#include "gnunet_rest_lib.h"
35#include "gnunet_jsonapi_lib.h"
36#include "gnunet_jsonapi_util.h"
37#include "microhttpd.h"
38#include <jansson.h>
39#include <inttypes.h>
40#include "gnunet_signatures.h"
41#include "gnunet_identity_attribute_lib.h"
42#include "gnunet_identity_provider_service.h"
43#include "jwt.h"
44
45/**
46 * REST root namespace
47 */
48#define GNUNET_REST_API_NS_OIDC "/openid"
49
50/**
51 * Authorize endpoint
52 */
53#define GNUNET_REST_API_NS_AUTHORIZE "/openid/authorize"
54
55/**
56 * Token endpoint
57 */
58#define GNUNET_REST_API_NS_TOKEN "/openid/token"
59
60/**
61 * UserInfo endpoint
62 */
63#define GNUNET_REST_API_NS_USERINFO "/openid/userinfo"
64
65/**
66 * Login namespace
67 */
68#define GNUNET_REST_API_NS_LOGIN "/openid/login"
69
70/**
71 * Attribute key
72 */
73#define GNUNET_REST_JSONAPI_IDENTITY_ATTRIBUTE "attribute"
74
75/**
76 * Ticket key
77 */
78#define GNUNET_REST_JSONAPI_IDENTITY_TICKET "ticket"
79
80
81/**
82 * Value key
83 */
84#define GNUNET_REST_JSONAPI_IDENTITY_ATTRIBUTE_VALUE "value"
85
86/**
87 * State while collecting all egos
88 */
89#define ID_REST_STATE_INIT 0
90
91/**
92 * Done collecting egos
93 */
94#define ID_REST_STATE_POST_INIT 1
95
96/**
97 * OIDC grant_type key
98 */
99#define OIDC_GRANT_TYPE_KEY "grant_type"
100
101/**
102 * OIDC grant_type key
103 */
104#define OIDC_GRANT_TYPE_VALUE "authorization_code"
105
106/**
107 * OIDC code key
108 */
109#define OIDC_CODE_KEY "code"
110
111/**
112 * OIDC response_type key
113 */
114#define OIDC_RESPONSE_TYPE_KEY "response_type"
115
116/**
117 * OIDC client_id key
118 */
119#define OIDC_CLIENT_ID_KEY "client_id"
120
121/**
122 * OIDC scope key
123 */
124#define OIDC_SCOPE_KEY "scope"
125
126/**
127 * OIDC redirect_uri key
128 */
129#define OIDC_REDIRECT_URI_KEY "redirect_uri"
130
131/**
132 * OIDC state key
133 */
134#define OIDC_STATE_KEY "state"
135
136/**
137 * OIDC nonce key
138 */
139#define OIDC_NONCE_KEY "nonce"
140
141/**
142 * OIDC cookie header key
143 */
144#define OIDC_COOKIE_HEADER_KEY "Cookie"
145
146/**
147 * OIDC cookie header information key
148 */
149#define OIDC_AUTHORIZATION_HEADER_KEY "Authorization"
150
151/**
152 * OIDC cookie header information key
153 */
154#define OIDC_COOKIE_HEADER_INFORMATION_KEY "Identity="
155
156/**
157 * OIDC expected response_type while authorizing
158 */
159#define OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE "code"
160
161/**
162 * OIDC expected scope part while authorizing
163 */
164#define OIDC_EXPECTED_AUTHORIZATION_SCOPE "openid"
165
166/**
167 * OIDC ignored parameter array
168 */
169static char* OIDC_ignored_parameter_array [] =
170{
171 "display",
172 "prompt",
173 "max_age",
174 "ui_locales",
175 "response_mode",
176 "id_token_hint",
177 "login_hint",
178 "acr_values"
179};
180
181/**
182 * OIDC authorized identities and times hashmap
183 */
184struct GNUNET_CONTAINER_MultiHashMap *OIDC_identity_login_time;
185
186/**
187 * OIDC authorized identities and times hashmap
188 */
189struct GNUNET_CONTAINER_MultiHashMap *OIDC_identity_grants;
190
191/**
192 * OIDC ticket/code use only once
193 */
194struct GNUNET_CONTAINER_MultiHashMap *OIDC_ticket_once;
195
196/**
197 * OIDC access_token to ticket and ego
198 */
199struct GNUNET_CONTAINER_MultiHashMap *OIDC_interpret_access_token;
200
201/**
202 * The configuration handle
203 */
204const struct GNUNET_CONFIGURATION_Handle *cfg;
205
206/**
207 * HTTP methods allows for this plugin
208 */
209static char* allow_methods;
210
211/**
212 * @brief struct returned by the initialization function of the plugin
213 */
214struct Plugin
215{
216 const struct GNUNET_CONFIGURATION_Handle *cfg;
217};
218
219/**
220 * OIDC needed variables
221 */
222struct OIDC_Variables
223{
224 /**
225 * The RP client public key
226 */
227 struct GNUNET_CRYPTO_EcdsaPublicKey client_pkey;
228
229 /**
230 * The OIDC client id of the RP
231 */
232 char *client_id;
233
234 /**
235 * GNUNET_YES if there is a delegation to
236 * this RP or if it is a local identity
237 */
238 int is_client_trusted;
239
240 /**
241 * The OIDC redirect uri
242 */
243 char *redirect_uri;
244
245 /**
246 * The list of oidc scopes
247 */
248 char *scope;
249
250 /**
251 * The OIDC state
252 */
253 char *state;
254
255 /**
256 * The OIDC nonce
257 */
258 char *nonce;
259
260 /**
261 * The OIDC response type
262 */
263 char *response_type;
264
265 /**
266 * The identity chosen by the user to login
267 */
268 char *login_identity;
269
270 /**
271 * The response JSON
272 */
273 json_t *response;
274
275};
276
277/**
278 * The ego list
279 */
280struct EgoEntry
281{
282 /**
283 * DLL
284 */
285 struct EgoEntry *next;
286
287 /**
288 * DLL
289 */
290 struct EgoEntry *prev;
291
292 /**
293 * Ego Identifier
294 */
295 char *identifier;
296
297 /**
298 * Public key string
299 */
300 char *keystring;
301
302 /**
303 * The Ego
304 */
305 struct GNUNET_IDENTITY_Ego *ego;
306};
307
308
309struct RequestHandle
310{
311 /**
312 * Ego list
313 */
314 struct EgoEntry *ego_head;
315
316 /**
317 * Ego list
318 */
319 struct EgoEntry *ego_tail;
320
321 /**
322 * Selected ego
323 */
324 struct EgoEntry *ego_entry;
325
326 /**
327 * Pointer to ego private key
328 */
329 struct GNUNET_CRYPTO_EcdsaPrivateKey priv_key;
330
331 /**
332 * OIDC variables
333 */
334 struct OIDC_Variables *oidc;
335
336 /**
337 * The processing state
338 */
339 int state;
340
341 /**
342 * Handle to Identity service.
343 */
344 struct GNUNET_IDENTITY_Handle *identity_handle;
345
346 /**
347 * Rest connection
348 */
349 struct GNUNET_REST_RequestHandle *rest_handle;
350
351 /**
352 * Handle to NAMESTORE
353 */
354 struct GNUNET_NAMESTORE_Handle *namestore_handle;
355
356 /**
357 * Iterator for NAMESTORE
358 */
359 struct GNUNET_NAMESTORE_ZoneIterator *namestore_handle_it;
360
361 /**
362 * Attribute claim list
363 */
364 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimList *attr_list;
365
366 /**
367 * IDENTITY Operation
368 */
369 struct GNUNET_IDENTITY_Operation *op;
370
371 /**
372 * Identity Provider
373 */
374 struct GNUNET_IDENTITY_PROVIDER_Handle *idp;
375
376 /**
377 * Idp Operation
378 */
379 struct GNUNET_IDENTITY_PROVIDER_Operation *idp_op;
380
381 /**
382 * Attribute iterator
383 */
384 struct GNUNET_IDENTITY_PROVIDER_AttributeIterator *attr_it;
385
386 /**
387 * Ticket iterator
388 */
389 struct GNUNET_IDENTITY_PROVIDER_TicketIterator *ticket_it;
390
391 /**
392 * A ticket
393 */
394 struct GNUNET_IDENTITY_PROVIDER_Ticket ticket;
395
396 /**
397 * Desired timeout for the lookup (default is no timeout).
398 */
399 struct GNUNET_TIME_Relative timeout;
400
401 /**
402 * ID of a task associated with the resolution process.
403 */
404 struct GNUNET_SCHEDULER_Task *timeout_task;
405
406 /**
407 * The plugin result processor
408 */
409 GNUNET_REST_ResultProcessor proc;
410
411 /**
412 * The closure of the result processor
413 */
414 void *proc_cls;
415
416 /**
417 * The url
418 */
419 char *url;
420
421 /**
422 * The tld for redirect
423 */
424 char *tld;
425
426 /**
427 * Error response message
428 */
429 char *emsg;
430
431 /**
432 * Error response description
433 */
434 char *edesc;
435
436 /**
437 * Reponse code
438 */
439 int response_code;
440
441 /**
442 * Response object
443 */
444 struct GNUNET_JSONAPI_Document *resp_object;
445
446};
447
448/**
449 * Cleanup lookup handle
450 * @param handle Handle to clean up
451 */
452static void
453cleanup_handle (struct RequestHandle *handle)
454{
455 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimListEntry *claim_entry;
456 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimListEntry *claim_tmp;
457 struct EgoEntry *ego_entry;
458 struct EgoEntry *ego_tmp;
459 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
460 "Cleaning up\n");
461 if (NULL != handle->resp_object)
462 GNUNET_JSONAPI_document_delete (handle->resp_object);
463 if (NULL != handle->timeout_task)
464 GNUNET_SCHEDULER_cancel (handle->timeout_task);
465 if (NULL != handle->identity_handle)
466 GNUNET_IDENTITY_disconnect (handle->identity_handle);
467 if (NULL != handle->attr_it)
468 GNUNET_IDENTITY_PROVIDER_get_attributes_stop (handle->attr_it);
469 if (NULL != handle->ticket_it)
470 GNUNET_IDENTITY_PROVIDER_ticket_iteration_stop (handle->ticket_it);
471 if (NULL != handle->idp)
472 GNUNET_IDENTITY_PROVIDER_disconnect (handle->idp);
473 if (NULL != handle->url)
474 GNUNET_free (handle->url);
475 if (NULL != handle->tld)
476 GNUNET_free (handle->tld);
477 if (NULL != handle->emsg)
478 GNUNET_free (handle->emsg);
479 if (NULL != handle->edesc)
480 GNUNET_free (handle->edesc);
481 if (NULL != handle->namestore_handle)
482 GNUNET_NAMESTORE_disconnect (handle->namestore_handle);
483 if (NULL != handle->oidc)
484 {
485 if (NULL != handle->oidc->client_id)
486 GNUNET_free(handle->oidc->client_id);
487 if (NULL != handle->oidc->login_identity)
488 GNUNET_free(handle->oidc->login_identity);
489 if (NULL != handle->oidc->nonce)
490 GNUNET_free(handle->oidc->nonce);
491 if (NULL != handle->oidc->redirect_uri)
492 GNUNET_free(handle->oidc->redirect_uri);
493 if (NULL != handle->oidc->response_type)
494 GNUNET_free(handle->oidc->response_type);
495 if (NULL != handle->oidc->scope)
496 GNUNET_free(handle->oidc->scope);
497 if (NULL != handle->oidc->state)
498 GNUNET_free(handle->oidc->state);
499 if (NULL != handle->oidc->response)
500 json_decref(handle->oidc->response);
501 GNUNET_free(handle->oidc);
502 }
503 if ( NULL != handle->attr_list )
504 {
505 for (claim_entry = handle->attr_list->list_head;
506 NULL != claim_entry;)
507 {
508 claim_tmp = claim_entry;
509 claim_entry = claim_entry->next;
510 GNUNET_free(claim_tmp->claim);
511 GNUNET_free(claim_tmp);
512 }
513 GNUNET_free (handle->attr_list);
514 }
515 for (ego_entry = handle->ego_head;
516 NULL != ego_entry;)
517 {
518 ego_tmp = ego_entry;
519 ego_entry = ego_entry->next;
520 GNUNET_free (ego_tmp->identifier);
521 GNUNET_free (ego_tmp->keystring);
522 GNUNET_free (ego_tmp);
523 }
524 if (NULL != handle->attr_it)
525 {
526 GNUNET_free(handle->attr_it);
527 }
528 GNUNET_free (handle);
529}
530
531static void
532cleanup_handle_delayed (void *cls)
533{
534 cleanup_handle (cls);
535}
536
537
538/**
539 * Task run on error, sends error message. Cleans up everything.
540 *
541 * @param cls the `struct RequestHandle`
542 */
543static void
544do_error (void *cls)
545{
546 struct RequestHandle *handle = cls;
547 struct MHD_Response *resp;
548 char *json_error;
549
550 GNUNET_asprintf (&json_error, "{ \"error\" : \"%s\", \"error_description\" : \"%s\"%s%s%s}",
551 handle->emsg,
552 (NULL != handle->edesc) ? handle->edesc : "",
553 (NULL != handle->oidc->state) ? ", \"state\":\"" : "",
554 (NULL != handle->oidc->state) ? handle->oidc->state : "",
555 (NULL != handle->oidc->state) ? "\"" : "");
556 if ( 0 == handle->response_code )
557 {
558 handle->response_code = MHD_HTTP_BAD_REQUEST;
559 }
560 resp = GNUNET_REST_create_response (json_error);
561 if (MHD_HTTP_UNAUTHORIZED == handle->response_code)
562 {
563 MHD_add_response_header(resp, "WWW-Authenticate", "Basic");
564 }
565 MHD_add_response_header (resp, "Content-Type", "application/json");
566 handle->proc (handle->proc_cls, resp, handle->response_code);
567 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
568 GNUNET_free (json_error);
569}
570
571
572/**
573 * Task run on error in userinfo endpoint, sends error header. Cleans up
574 * everything
575 *
576 * @param cls the `struct RequestHandle`
577 */
578static void
579do_userinfo_error (void *cls)
580{
581 struct RequestHandle *handle = cls;
582 struct MHD_Response *resp;
583 char *error;
584
585 GNUNET_asprintf (&error, "error=\"%s\", error_description=\"%s\"",
586 handle->emsg,
587 (NULL != handle->edesc) ? handle->edesc : "");
588 resp = GNUNET_REST_create_response ("");
589 MHD_add_response_header(resp, "WWW-Authenticate", error);
590 handle->proc (handle->proc_cls, resp, handle->response_code);
591 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
592 GNUNET_free (error);
593}
594
595
596/**
597 * Task run on error, sends error message and redirects. Cleans up everything.
598 *
599 * @param cls the `struct RequestHandle`
600 */
601static void
602do_redirect_error (void *cls)
603{
604 struct RequestHandle *handle = cls;
605 struct MHD_Response *resp;
606 char* redirect;
607 GNUNET_asprintf (&redirect,
608 "%s?error=%s&error_description=%s%s%s",
609 handle->oidc->redirect_uri, handle->emsg, handle->edesc,
610 (NULL != handle->oidc->state) ? "&state=" : "",
611 (NULL != handle->oidc->state) ? handle->oidc->state : "");
612 resp = GNUNET_REST_create_response ("");
613 MHD_add_response_header (resp, "Location", redirect);
614 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
615 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
616 GNUNET_free (redirect);
617}
618
619/**
620 * Task run on timeout, sends error message. Cleans up everything.
621 *
622 * @param cls the `struct RequestHandle`
623 */
624static void
625do_timeout (void *cls)
626{
627 struct RequestHandle *handle = cls;
628
629 handle->timeout_task = NULL;
630 do_error (handle);
631}
632
633/**
634 * Return attributes for claim
635 *
636 * @param cls the request handle
637 */
638static void
639return_userinfo_response (void *cls)
640{
641 char* result_str;
642 struct RequestHandle *handle = cls;
643 struct MHD_Response *resp;
644
645 result_str = json_dumps (handle->oidc->response, 0);
646
647 resp = GNUNET_REST_create_response (result_str);
648 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
649 GNUNET_free (result_str);
650 cleanup_handle (handle);
651}
652
653/**
654 * Returns base64 encoded string without padding
655 *
656 * @param string the string to encode
657 * @return base64 encoded string
658 */
659static char*
660base_64_encode(const char *s)
661{
662 char *enc;
663 char *tmp;
664
665 GNUNET_STRINGS_base64_encode(s, strlen(s), &enc);
666 tmp = strrchr (enc, '=');
667 *tmp = '\0';
668 return enc;
669}
670
671/**
672 * Respond to OPTIONS request
673 *
674 * @param con_handle the connection handle
675 * @param url the url
676 * @param cls the RequestHandle
677 */
678static void
679options_cont (struct GNUNET_REST_RequestHandle *con_handle,
680 const char* url,
681 void *cls)
682{
683 struct MHD_Response *resp;
684 struct RequestHandle *handle = cls;
685
686 //For now, independent of path return all options
687 resp = GNUNET_REST_create_response (NULL);
688 MHD_add_response_header (resp,
689 "Access-Control-Allow-Methods",
690 allow_methods);
691 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
692 cleanup_handle (handle);
693 return;
694}
695
696/**
697 * Interprets cookie header and pass its identity keystring to handle
698 */
699static void
700cookie_identity_interpretation (struct RequestHandle *handle)
701{
702 struct GNUNET_HashCode cache_key;
703 char *cookies;
704 struct GNUNET_TIME_Absolute current_time, *relog_time;
705 char delimiter[] = "; ";
706
707 //gets identity of login try with cookie
708 GNUNET_CRYPTO_hash (OIDC_COOKIE_HEADER_KEY, strlen (OIDC_COOKIE_HEADER_KEY),
709 &cache_key);
710 if ( GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->header_param_map,
711 &cache_key) )
712 {
713 //splits cookies and find 'Identity' cookie
714 cookies = GNUNET_CONTAINER_multihashmap_get ( handle->rest_handle->header_param_map, &cache_key);
715 handle->oidc->login_identity = strtok(cookies, delimiter);
716
717 while ( NULL != handle->oidc->login_identity )
718 {
719 if ( NULL != strstr (handle->oidc->login_identity, OIDC_COOKIE_HEADER_INFORMATION_KEY) )
720 {
721 break;
722 }
723 handle->oidc->login_identity = strtok (NULL, delimiter);
724 }
725 GNUNET_CRYPTO_hash (handle->oidc->login_identity, strlen (handle->oidc->login_identity),
726 &cache_key);
727 if ( GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (OIDC_identity_login_time, &cache_key) )
728 {
729 relog_time = GNUNET_CONTAINER_multihashmap_get (OIDC_identity_login_time,
730 &cache_key);
731 current_time = GNUNET_TIME_absolute_get ();
732 // 30 min after old login -> redirect to login
733 if ( current_time.abs_value_us <= relog_time->abs_value_us )
734 {
735 handle->oidc->login_identity = strtok(handle->oidc->login_identity, OIDC_COOKIE_HEADER_INFORMATION_KEY);
736 handle->oidc->login_identity = GNUNET_strdup(handle->oidc->login_identity);
737 }
738 }
739 else
740 {
741 handle->oidc->login_identity = NULL;
742 }
743 }
744}
745
746/**
747 * Redirects to login page stored in configuration file
748 */
749static void
750login_redirection(void *cls)
751{
752 char *login_base_url;
753 char *new_redirect;
754 struct MHD_Response *resp;
755 struct RequestHandle *handle = cls;
756
757 if ( GNUNET_OK
758 == GNUNET_CONFIGURATION_get_value_string (cfg, "identity-rest-plugin",
759 "address", &login_base_url) )
760 {
761 GNUNET_asprintf (&new_redirect, "%s?%s=%s&%s=%s&%s=%s&%s=%s&%s=%s&%s=%s",
762 login_base_url,
763 OIDC_RESPONSE_TYPE_KEY,
764 handle->oidc->response_type,
765 OIDC_CLIENT_ID_KEY,
766 handle->oidc->client_id,
767 OIDC_REDIRECT_URI_KEY,
768 handle->oidc->redirect_uri,
769 OIDC_SCOPE_KEY,
770 handle->oidc->scope,
771 OIDC_STATE_KEY,
772 (NULL != handle->oidc->state) ? handle->oidc->state : "",
773 OIDC_NONCE_KEY,
774 (NULL != handle->oidc->nonce) ? handle->oidc->nonce : "");
775 resp = GNUNET_REST_create_response ("");
776 MHD_add_response_header (resp, "Location", new_redirect);
777 GNUNET_free(login_base_url);
778 }
779 else
780 {
781 handle->emsg = GNUNET_strdup("server_error");
782 handle->edesc = GNUNET_strdup ("gnunet configuration failed");
783 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
784 GNUNET_SCHEDULER_add_now (&do_error, handle);
785 return;
786 }
787 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
788 GNUNET_free(new_redirect);
789 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
790}
791
792/**
793 * Does internal server error when iteration failed.
794 */
795static void
796oidc_iteration_error (void *cls)
797{
798 struct RequestHandle *handle = cls;
799 handle->emsg = GNUNET_strdup("INTERNAL_SERVER_ERROR");
800 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
801 GNUNET_SCHEDULER_add_now (&do_error, handle);
802}
803
804static void get_client_name_result (void *cls,
805 const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
806 const char *label,
807 unsigned int rd_count,
808 const struct GNUNET_GNSRECORD_Data *rd)
809{
810 struct RequestHandle *handle = cls;
811 struct MHD_Response *resp;
812 char *ticket_str;
813 char *redirect_uri;
814 char *code_json_string;
815 char *code_base64_final_string;
816 char *redirect_path;
817 char *tmp;
818 char *tmp_prefix;
819 char *prefix;
820 ticket_str = GNUNET_STRINGS_data_to_string_alloc (&handle->ticket,
821 sizeof (struct GNUNET_IDENTITY_PROVIDER_Ticket));
822 //TODO change if more attributes are needed (see max_age)
823 GNUNET_asprintf (&code_json_string, "{\"ticket\":\"%s\"%s%s%s}",
824 ticket_str,
825 (NULL != handle->oidc->nonce) ? ", \"nonce\":\"" : "",
826 (NULL != handle->oidc->nonce) ? handle->oidc->nonce : "",
827 (NULL != handle->oidc->nonce) ? "\"" : "");
828 code_base64_final_string = base_64_encode(code_json_string);
829 tmp = GNUNET_strdup (handle->oidc->redirect_uri);
830 redirect_path = strtok (tmp, "/");
831 redirect_path = strtok (NULL, "/");
832 redirect_path = strtok (NULL, "/");
833 tmp_prefix = GNUNET_strdup (handle->oidc->redirect_uri);
834 prefix = strrchr (tmp_prefix,
835 (unsigned char) '.');
836 *prefix = '\0';
837 GNUNET_asprintf (&redirect_uri, "%s.%s/%s?%s=%s&state=%s",
838 tmp_prefix,
839 handle->tld,
840 redirect_path,
841 handle->oidc->response_type,
842 code_base64_final_string, handle->oidc->state);
843 resp = GNUNET_REST_create_response ("");
844 MHD_add_response_header (resp, "Location", redirect_uri);
845 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
846 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
847 GNUNET_free (tmp);
848 GNUNET_free (tmp_prefix);
849 GNUNET_free (redirect_uri);
850 GNUNET_free (ticket_str);
851 GNUNET_free (code_json_string);
852 GNUNET_free (code_base64_final_string);
853 return;
854}
855
856static void
857get_client_name_error (void *cls)
858{
859 struct RequestHandle *handle = cls;
860
861 handle->emsg = GNUNET_strdup("server_error");
862 handle->edesc = GNUNET_strdup("Server cannot generate ticket, no name found for client.");
863 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
864}
865
866/**
867 * Issues ticket and redirects to relying party with the authorization code as
868 * parameter. Otherwise redirects with error
869 */
870static void
871oidc_ticket_issue_cb (void* cls,
872 const struct GNUNET_IDENTITY_PROVIDER_Ticket *ticket)
873{
874 struct RequestHandle *handle = cls;
875 handle->idp_op = NULL;
876 handle->ticket = *ticket;
877 if (NULL != ticket) {
878 GNUNET_NAMESTORE_zone_to_name (handle->namestore_handle,
879 &handle->priv_key,
880 &handle->oidc->client_pkey,
881 &get_client_name_error,
882 handle,
883 &get_client_name_result,
884 handle);
885 return;
886 }
887 handle->emsg = GNUNET_strdup("server_error");
888 handle->edesc = GNUNET_strdup("Server cannot generate ticket.");
889 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
890}
891
892static void
893oidc_collect_finished_cb (void *cls)
894{
895 struct RequestHandle *handle = cls;
896 handle->attr_it = NULL;
897 handle->ticket_it = NULL;
898 if (NULL == handle->attr_list->list_head)
899 {
900 handle->emsg = GNUNET_strdup("invalid_scope");
901 handle->edesc = GNUNET_strdup("The requested scope is not available.");
902 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
903 return;
904 }
905 handle->idp_op = GNUNET_IDENTITY_PROVIDER_ticket_issue (handle->idp,
906 &handle->priv_key,
907 &handle->oidc->client_pkey,
908 handle->attr_list,
909 &oidc_ticket_issue_cb,
910 handle);
911}
912
913
914/**
915 * Collects all attributes for an ego if in scope parameter
916 */
917static void
918oidc_attr_collect (void *cls,
919 const struct GNUNET_CRYPTO_EcdsaPublicKey *identity,
920 const struct GNUNET_IDENTITY_ATTRIBUTE_Claim *attr)
921{
922 struct RequestHandle *handle = cls;
923 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimListEntry *le;
924 char* scope_variables;
925 char* scope_variable;
926 char delimiter[]=" ";
927
928 if ( (NULL == attr->name) || (NULL == attr->data) )
929 {
930 GNUNET_IDENTITY_PROVIDER_get_attributes_next (handle->attr_it);
931 return;
932 }
933
934 scope_variables = GNUNET_strdup(handle->oidc->scope);
935 scope_variable = strtok (scope_variables, delimiter);
936 while (NULL != scope_variable)
937 {
938 if ( 0 == strcmp (attr->name, scope_variable) )
939 {
940 break;
941 }
942 scope_variable = strtok (NULL, delimiter);
943 }
944 if ( NULL == scope_variable )
945 {
946 GNUNET_IDENTITY_PROVIDER_get_attributes_next (handle->attr_it);
947 GNUNET_free(scope_variables);
948 return;
949 }
950 GNUNET_free(scope_variables);
951
952 le = GNUNET_new(struct GNUNET_IDENTITY_ATTRIBUTE_ClaimListEntry);
953 le->claim = GNUNET_IDENTITY_ATTRIBUTE_claim_new (attr->name, attr->type,
954 attr->data, attr->data_size);
955 GNUNET_CONTAINER_DLL_insert(handle->attr_list->list_head,
956 handle->attr_list->list_tail, le);
957 GNUNET_IDENTITY_PROVIDER_get_attributes_next (handle->attr_it);
958}
959
960
961/**
962 * Checks time and cookie and redirects accordingly
963 */
964static void
965login_check (void *cls)
966{
967 struct RequestHandle *handle = cls;
968 struct GNUNET_TIME_Absolute current_time, *relog_time;
969 struct GNUNET_CRYPTO_EcdsaPublicKey pubkey, ego_pkey;
970 struct GNUNET_HashCode cache_key;
971 char *identity_cookie;
972
973 GNUNET_asprintf (&identity_cookie, "Identity=%s", handle->oidc->login_identity);
974 GNUNET_CRYPTO_hash (identity_cookie, strlen (identity_cookie), &cache_key);
975 GNUNET_free(identity_cookie);
976 //No login time for identity -> redirect to login
977 if ( GNUNET_YES
978 == GNUNET_CONTAINER_multihashmap_contains (OIDC_identity_login_time,
979 &cache_key) )
980 {
981 relog_time = GNUNET_CONTAINER_multihashmap_get (OIDC_identity_login_time,
982 &cache_key);
983 current_time = GNUNET_TIME_absolute_get ();
984 // 30 min after old login -> redirect to login
985 if ( current_time.abs_value_us <= relog_time->abs_value_us )
986 {
987 if ( GNUNET_OK
988 != GNUNET_CRYPTO_ecdsa_public_key_from_string (
989 handle->oidc->login_identity,
990 strlen (handle->oidc->login_identity), &pubkey) )
991 {
992 handle->emsg = GNUNET_strdup("invalid_cookie");
993 handle->edesc = GNUNET_strdup(
994 "The cookie of a login identity is not valid");
995 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
996 return;
997 }
998 // iterate over egos and compare their public key
999 for (handle->ego_entry = handle->ego_head;
1000 NULL != handle->ego_entry; handle->ego_entry = handle->ego_entry->next)
1001 {
1002 GNUNET_IDENTITY_ego_get_public_key (handle->ego_entry->ego, &ego_pkey);
1003 if ( 0
1004 == memcmp (&ego_pkey, &pubkey,
1005 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1006 {
1007 handle->priv_key = *GNUNET_IDENTITY_ego_get_private_key (
1008 handle->ego_entry->ego);
1009 handle->resp_object = GNUNET_JSONAPI_document_new ();
1010 handle->idp = GNUNET_IDENTITY_PROVIDER_connect (cfg);
1011 handle->attr_list = GNUNET_new(
1012 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimList);
1013 handle->attr_it = GNUNET_IDENTITY_PROVIDER_get_attributes_start (
1014 handle->idp, &handle->priv_key, &oidc_iteration_error, handle,
1015 &oidc_attr_collect, handle, &oidc_collect_finished_cb, handle);
1016 return;
1017 }
1018 }
1019 handle->emsg = GNUNET_strdup("invalid_cookie");
1020 handle->edesc = GNUNET_strdup(
1021 "The cookie of the login identity is not valid");
1022 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1023 return;
1024 }
1025 }
1026}
1027
1028/**
1029 * Searches for client_id in namestore. If found trust status stored in handle
1030 * Else continues to search
1031 *
1032 * @param handle the RequestHandle
1033 */
1034static void
1035namestore_iteration_callback (
1036 void *cls, const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
1037 const char *rname, unsigned int rd_len,
1038 const struct GNUNET_GNSRECORD_Data *rd)
1039{
1040 struct RequestHandle *handle = cls;
1041 struct GNUNET_CRYPTO_EcdsaPublicKey login_identity_pkey;
1042 struct GNUNET_CRYPTO_EcdsaPublicKey current_zone_pkey;
1043 int i;
1044
1045 for (i = 0; i < rd_len; i++)
1046 {
1047 if ( GNUNET_GNSRECORD_TYPE_PKEY != rd[i].record_type )
1048 continue;
1049
1050 if ( NULL != handle->oidc->login_identity )
1051 {
1052 GNUNET_CRYPTO_ecdsa_public_key_from_string (
1053 handle->oidc->login_identity,
1054 strlen (handle->oidc->login_identity),
1055 &login_identity_pkey);
1056 GNUNET_IDENTITY_ego_get_public_key (handle->ego_entry->ego,
1057 &current_zone_pkey);
1058
1059 if ( 0 == memcmp (rd[i].data, &handle->oidc->client_pkey,
1060 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1061 {
1062 if ( 0 == memcmp (&login_identity_pkey, &current_zone_pkey,
1063 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1064 {
1065 handle->oidc->is_client_trusted = GNUNET_YES;
1066 }
1067 }
1068 }
1069 else
1070 {
1071 if ( 0 == memcmp (rd[i].data, &handle->oidc->client_pkey,
1072 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1073 {
1074 handle->oidc->is_client_trusted = GNUNET_YES;
1075 }
1076 }
1077 }
1078
1079 GNUNET_NAMESTORE_zone_iterator_next (handle->namestore_handle_it);
1080}
1081
1082/**
1083 * Iteration over all results finished, build final
1084 * response.
1085 *
1086 * @param cls the `struct RequestHandle`
1087 */
1088static void namestore_iteration_finished (void *cls)
1089{
1090 struct RequestHandle *handle = cls;
1091 struct GNUNET_HashCode cache_key;
1092
1093 char *expected_scope;
1094 char delimiter[]=" ";
1095 int number_of_ignored_parameter, iterator;
1096
1097
1098 handle->ego_entry = handle->ego_entry->next;
1099
1100 if(NULL != handle->ego_entry)
1101 {
1102 handle->priv_key = *GNUNET_IDENTITY_ego_get_private_key (handle->ego_entry->ego);
1103 handle->namestore_handle_it = GNUNET_NAMESTORE_zone_iteration_start (handle->namestore_handle, &handle->priv_key,
1104 &oidc_iteration_error, handle, &namestore_iteration_callback, handle,
1105 &namestore_iteration_finished, handle);
1106 return;
1107 }
1108 if (GNUNET_NO == handle->oidc->is_client_trusted)
1109 {
1110 handle->emsg = GNUNET_strdup("unauthorized_client");
1111 handle->edesc = GNUNET_strdup("The client is not authorized to request an "
1112 "authorization code using this method.");
1113 GNUNET_SCHEDULER_add_now (&do_error, handle);
1114 return;
1115 }
1116
1117 // REQUIRED value: redirect_uri
1118 GNUNET_CRYPTO_hash (OIDC_REDIRECT_URI_KEY, strlen (OIDC_REDIRECT_URI_KEY),
1119 &cache_key);
1120 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1121 &cache_key))
1122 {
1123 handle->emsg=GNUNET_strdup("invalid_request");
1124 handle->edesc=GNUNET_strdup("missing parameter redirect_uri");
1125 GNUNET_SCHEDULER_add_now (&do_error, handle);
1126 return;
1127 }
1128 handle->oidc->redirect_uri = GNUNET_strdup (GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1129 &cache_key));
1130
1131 // REQUIRED value: response_type
1132 GNUNET_CRYPTO_hash (OIDC_RESPONSE_TYPE_KEY, strlen (OIDC_RESPONSE_TYPE_KEY),
1133 &cache_key);
1134 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1135 &cache_key))
1136 {
1137 handle->emsg=GNUNET_strdup("invalid_request");
1138 handle->edesc=GNUNET_strdup("missing parameter response_type");
1139 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1140 return;
1141 }
1142 handle->oidc->response_type = GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1143 &cache_key);
1144 handle->oidc->response_type = GNUNET_strdup (handle->oidc->response_type);
1145
1146 // REQUIRED value: scope
1147 GNUNET_CRYPTO_hash (OIDC_SCOPE_KEY, strlen (OIDC_SCOPE_KEY), &cache_key);
1148 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1149 &cache_key))
1150 {
1151 handle->emsg=GNUNET_strdup("invalid_request");
1152 handle->edesc=GNUNET_strdup("missing parameter scope");
1153 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1154 return;
1155 }
1156 handle->oidc->scope = GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1157 &cache_key);
1158 handle->oidc->scope = GNUNET_strdup(handle->oidc->scope);
1159
1160 //OPTIONAL value: nonce
1161 GNUNET_CRYPTO_hash (OIDC_NONCE_KEY, strlen (OIDC_NONCE_KEY), &cache_key);
1162 if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1163 &cache_key))
1164 {
1165 handle->oidc->nonce = GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1166 &cache_key);
1167 handle->oidc->nonce = GNUNET_strdup (handle->oidc->nonce);
1168 }
1169
1170 //TODO check other values if needed
1171 number_of_ignored_parameter = sizeof(OIDC_ignored_parameter_array) / sizeof(char *);
1172 for( iterator = 0; iterator < number_of_ignored_parameter; iterator++ )
1173 {
1174 GNUNET_CRYPTO_hash (OIDC_ignored_parameter_array[iterator],
1175 strlen(OIDC_ignored_parameter_array[iterator]),
1176 &cache_key);
1177 if(GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains(handle->rest_handle->url_param_map,
1178 &cache_key))
1179 {
1180 handle->emsg=GNUNET_strdup("access_denied");
1181 GNUNET_asprintf (&handle->edesc, "Server will not handle parameter: %s",
1182 OIDC_ignored_parameter_array[iterator]);
1183 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1184 return;
1185 }
1186 }
1187
1188 // Checks if response_type is 'code'
1189 if( 0 != strcmp( handle->oidc->response_type, OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE ) )
1190 {
1191 handle->emsg=GNUNET_strdup("unsupported_response_type");
1192 handle->edesc=GNUNET_strdup("The authorization server does not support "
1193 "obtaining this authorization code.");
1194 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1195 return;
1196 }
1197
1198 // Checks if scope contains 'openid'
1199 expected_scope = GNUNET_strdup(handle->oidc->scope);
1200 char* test;
1201 test = strtok (expected_scope, delimiter);
1202 while (NULL != test)
1203 {
1204 if ( 0 == strcmp (OIDC_EXPECTED_AUTHORIZATION_SCOPE, expected_scope) )
1205 {
1206 break;
1207 }
1208 test = strtok (NULL, delimiter);
1209 }
1210 if (NULL == test)
1211 {
1212 handle->emsg = GNUNET_strdup("invalid_scope");
1213 handle->edesc=GNUNET_strdup("The requested scope is invalid, unknown, or "
1214 "malformed.");
1215 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1216 GNUNET_free(expected_scope);
1217 return;
1218 }
1219
1220 GNUNET_free(expected_scope);
1221
1222 if( NULL != handle->oidc->login_identity )
1223 {
1224 GNUNET_SCHEDULER_add_now(&login_check,handle);
1225 return;
1226 }
1227
1228 GNUNET_SCHEDULER_add_now(&login_redirection,handle);
1229}
1230
1231/**
1232 * Responds to authorization GET and url-encoded POST request
1233 *
1234 * @param con_handle the connection handle
1235 * @param url the url
1236 * @param cls the RequestHandle
1237 */
1238static void
1239authorize_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
1240 const char* url,
1241 void *cls)
1242{
1243 struct RequestHandle *handle = cls;
1244 struct GNUNET_HashCode cache_key;
1245 struct EgoEntry *tmp_ego;
1246 struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
1247 const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key;
1248
1249 cookie_identity_interpretation(handle);
1250
1251 //RECOMMENDED value: state - REQUIRED for answers
1252 GNUNET_CRYPTO_hash (OIDC_STATE_KEY, strlen (OIDC_STATE_KEY), &cache_key);
1253 if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1254 &cache_key))
1255 {
1256 handle->oidc->state = GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1257 &cache_key);
1258 handle->oidc->state = GNUNET_strdup (handle->oidc->state);
1259 }
1260
1261 // REQUIRED value: client_id
1262 GNUNET_CRYPTO_hash (OIDC_CLIENT_ID_KEY, strlen (OIDC_CLIENT_ID_KEY),
1263 &cache_key);
1264 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1265 &cache_key))
1266 {
1267 handle->emsg=GNUNET_strdup("invalid_request");
1268 handle->edesc=GNUNET_strdup("missing parameter client_id");
1269 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1270 GNUNET_SCHEDULER_add_now (&do_error, handle);
1271 return;
1272 }
1273 handle->oidc->client_id = GNUNET_strdup (GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1274 &cache_key));
1275
1276 if ( GNUNET_OK
1277 != GNUNET_CRYPTO_ecdsa_public_key_from_string (handle->oidc->client_id,
1278 strlen (handle->oidc->client_id),
1279 &handle->oidc->client_pkey) )
1280 {
1281 handle->emsg = GNUNET_strdup("unauthorized_client");
1282 handle->edesc = GNUNET_strdup("The client is not authorized to request an "
1283 "authorization code using this method.");
1284 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1285 GNUNET_SCHEDULER_add_now (&do_error, handle);
1286 return;
1287 }
1288
1289
1290 if ( NULL == handle->ego_head )
1291 {
1292 handle->emsg = GNUNET_strdup("server_error");
1293 handle->edesc = GNUNET_strdup ("Egos are missing");
1294 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1295 GNUNET_SCHEDULER_add_now (&do_error, handle);
1296 return;
1297 }
1298
1299 handle->ego_entry = handle->ego_head;
1300 handle->priv_key = *GNUNET_IDENTITY_ego_get_private_key (handle->ego_head->ego);
1301 handle->oidc->is_client_trusted = GNUNET_NO;
1302
1303 //First check if client_id is one of our egos; TODO: handle other TLD cases: Delegation, from config
1304 for (tmp_ego = handle->ego_head; NULL != tmp_ego; tmp_ego = tmp_ego->next)
1305 {
1306 priv_key = GNUNET_IDENTITY_ego_get_private_key (tmp_ego->ego);
1307 GNUNET_CRYPTO_ecdsa_key_get_public (priv_key,
1308 &pkey);
1309 if ( 0 == memcmp (&pkey, &handle->oidc->client_pkey,
1310 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1311 {
1312 handle->tld = GNUNET_strdup (tmp_ego->identifier);
1313 handle->oidc->is_client_trusted = GNUNET_YES;
1314 handle->ego_entry = handle->ego_tail;
1315 }
1316 }
1317
1318
1319 // Checks if client_id is valid:
1320 handle->namestore_handle_it = GNUNET_NAMESTORE_zone_iteration_start (
1321 handle->namestore_handle, &handle->priv_key, &oidc_iteration_error,
1322 handle, &namestore_iteration_callback, handle,
1323 &namestore_iteration_finished, handle);
1324}
1325
1326/**
1327 * Combines an identity with a login time and responds OK to login request
1328 *
1329 * @param con_handle the connection handle
1330 * @param url the url
1331 * @param cls the RequestHandle
1332 */
1333static void
1334login_cont (struct GNUNET_REST_RequestHandle *con_handle,
1335 const char* url,
1336 void *cls)
1337{
1338 struct MHD_Response *resp = GNUNET_REST_create_response ("");
1339 struct RequestHandle *handle = cls;
1340 struct GNUNET_HashCode cache_key;
1341 struct GNUNET_TIME_Absolute *current_time;
1342 struct GNUNET_TIME_Absolute *last_time;
1343 char* cookie;
1344 json_t *root;
1345 json_error_t error;
1346 json_t *identity;
1347 char term_data[handle->rest_handle->data_size+1];
1348 term_data[handle->rest_handle->data_size] = '\0';
1349 GNUNET_memcpy (term_data, handle->rest_handle->data, handle->rest_handle->data_size);
1350 root = json_loads (term_data, JSON_DECODE_ANY, &error);
1351 identity = json_object_get (root, "identity");
1352 if ( json_is_string(identity) )
1353 {
1354 GNUNET_asprintf (&cookie, "Identity=%s", json_string_value (identity));
1355 MHD_add_response_header (resp, "Set-Cookie", cookie);
1356 MHD_add_response_header (resp, "Access-Control-Allow-Methods", "POST");
1357 GNUNET_CRYPTO_hash (cookie, strlen (cookie), &cache_key);
1358
1359 current_time = GNUNET_new(struct GNUNET_TIME_Absolute);
1360 *current_time = GNUNET_TIME_relative_to_absolute (
1361 GNUNET_TIME_relative_multiply (GNUNET_TIME_relative_get_minute_ (),
1362 30));
1363 last_time = GNUNET_CONTAINER_multihashmap_get(OIDC_identity_login_time, &cache_key);
1364 if (NULL != last_time)
1365 {
1366 GNUNET_free(last_time);
1367 }
1368 GNUNET_CONTAINER_multihashmap_put (
1369 OIDC_identity_login_time, &cache_key, current_time,
1370 GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
1371
1372 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
1373 GNUNET_free(cookie);
1374 }
1375 else
1376 {
1377 handle->proc (handle->proc_cls, resp, MHD_HTTP_BAD_REQUEST);
1378 }
1379 json_decref (root);
1380 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
1381 return;
1382}
1383
1384/**
1385 * Responds to token url-encoded POST request
1386 *
1387 * @param con_handle the connection handle
1388 * @param url the url
1389 * @param cls the RequestHandle
1390 */
1391static void
1392token_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
1393 const char* url,
1394 void *cls)
1395{
1396 //TODO static strings
1397 struct RequestHandle *handle = cls;
1398 struct GNUNET_HashCode cache_key;
1399 char *authorization, *credentials;
1400 char delimiter[]=" ";
1401 char delimiter_user_psw[]=":";
1402 char *grant_type, *code;
1403 char *user_psw = NULL, *client_id, *psw;
1404 char *expected_psw;
1405 int client_exists = GNUNET_NO;
1406 struct MHD_Response *resp;
1407 char* code_output;
1408 json_t *root, *ticket_string, *nonce, *max_age;
1409 json_error_t error;
1410 char *json_response;
1411
1412 /*
1413 * Check Authorization
1414 */
1415 GNUNET_CRYPTO_hash (OIDC_AUTHORIZATION_HEADER_KEY,
1416 strlen (OIDC_AUTHORIZATION_HEADER_KEY),
1417 &cache_key);
1418 if ( GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->header_param_map,
1419 &cache_key) )
1420 {
1421 handle->emsg=GNUNET_strdup("invalid_client");
1422 handle->edesc=GNUNET_strdup("missing authorization");
1423 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1424 GNUNET_SCHEDULER_add_now (&do_error, handle);
1425 return;
1426 }
1427 authorization = GNUNET_CONTAINER_multihashmap_get ( handle->rest_handle->header_param_map, &cache_key);
1428
1429 //split header in "Basic" and [content]
1430 credentials = strtok (authorization, delimiter);
1431 if (0 != strcmp ("Basic",credentials))
1432 {
1433 handle->emsg=GNUNET_strdup("invalid_client");
1434 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1435 GNUNET_SCHEDULER_add_now (&do_error, handle);
1436 return;
1437 }
1438 credentials = strtok(NULL, delimiter);
1439 if (NULL == credentials)
1440 {
1441 handle->emsg=GNUNET_strdup("invalid_client");
1442 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1443 GNUNET_SCHEDULER_add_now (&do_error, handle);
1444 return;
1445 }
1446 GNUNET_STRINGS_base64_decode (credentials, strlen (credentials), &user_psw);
1447
1448 if ( NULL == user_psw )
1449 {
1450 handle->emsg=GNUNET_strdup("invalid_client");
1451 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1452 GNUNET_SCHEDULER_add_now (&do_error, handle);
1453 return;
1454 }
1455 client_id = strtok (user_psw, delimiter_user_psw);
1456 if ( NULL == client_id )
1457 {
1458 GNUNET_free_non_null(user_psw);
1459 handle->emsg=GNUNET_strdup("invalid_client");
1460 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1461 GNUNET_SCHEDULER_add_now (&do_error, handle);
1462 return;
1463 }
1464 psw = strtok (NULL, delimiter_user_psw);
1465 if (NULL == psw)
1466 {
1467 GNUNET_free_non_null(user_psw);
1468 handle->emsg=GNUNET_strdup("invalid_client");
1469 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1470 GNUNET_SCHEDULER_add_now (&do_error, handle);
1471 return;
1472 }
1473
1474 //check client password
1475 if ( GNUNET_OK
1476 == GNUNET_CONFIGURATION_get_value_string (cfg, "identity-rest-plugin",
1477 "psw", &expected_psw) )
1478 {
1479 if (0 != strcmp (expected_psw, psw))
1480 {
1481 GNUNET_free_non_null(user_psw);
1482 GNUNET_free(expected_psw);
1483 handle->emsg=GNUNET_strdup("invalid_client");
1484 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1485 GNUNET_SCHEDULER_add_now (&do_error, handle);
1486 return;
1487 }
1488 GNUNET_free(expected_psw);
1489 }
1490 else
1491 {
1492 GNUNET_free_non_null(user_psw);
1493 handle->emsg = GNUNET_strdup("server_error");
1494 handle->edesc = GNUNET_strdup ("gnunet configuration failed");
1495 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1496 GNUNET_SCHEDULER_add_now (&do_error, handle);
1497 return;
1498 }
1499
1500 //check client_id
1501 for (handle->ego_entry = handle->ego_head; NULL != handle->ego_entry->next; )
1502 {
1503 if ( 0 == strcmp(handle->ego_entry->keystring, client_id))
1504 {
1505 client_exists = GNUNET_YES;
1506 break;
1507 }
1508 handle->ego_entry = handle->ego_entry->next;
1509 }
1510 if (GNUNET_NO == client_exists)
1511 {
1512 GNUNET_free_non_null(user_psw);
1513 handle->emsg=GNUNET_strdup("invalid_client");
1514 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1515 GNUNET_SCHEDULER_add_now (&do_error, handle);
1516 return;
1517 }
1518
1519 /*
1520 * Check parameter
1521 */
1522
1523 //TODO Do not allow multiple equal parameter names
1524 //REQUIRED grant_type
1525 GNUNET_CRYPTO_hash (OIDC_GRANT_TYPE_KEY, strlen (OIDC_GRANT_TYPE_KEY), &cache_key);
1526 if ( GNUNET_NO
1527 == GNUNET_CONTAINER_multihashmap_contains (
1528 handle->rest_handle->url_param_map, &cache_key) )
1529 {
1530 GNUNET_free_non_null(user_psw);
1531 handle->emsg = GNUNET_strdup("invalid_request");
1532 handle->edesc = GNUNET_strdup("missing parameter grant_type");
1533 handle->response_code = MHD_HTTP_BAD_REQUEST;
1534 GNUNET_SCHEDULER_add_now (&do_error, handle);
1535 return;
1536 }
1537 grant_type = GNUNET_CONTAINER_multihashmap_get (
1538 handle->rest_handle->url_param_map, &cache_key);
1539
1540 //REQUIRED code
1541 GNUNET_CRYPTO_hash (OIDC_CODE_KEY, strlen (OIDC_CODE_KEY), &cache_key);
1542 if ( GNUNET_NO
1543 == GNUNET_CONTAINER_multihashmap_contains (
1544 handle->rest_handle->url_param_map, &cache_key) )
1545 {
1546 GNUNET_free_non_null(user_psw);
1547 handle->emsg = GNUNET_strdup("invalid_request");
1548 handle->edesc = GNUNET_strdup("missing parameter code");
1549 handle->response_code = MHD_HTTP_BAD_REQUEST;
1550 GNUNET_SCHEDULER_add_now (&do_error, handle);
1551 return;
1552 }
1553 code = GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->url_param_map,
1554 &cache_key);
1555
1556 //REQUIRED redirect_uri
1557 GNUNET_CRYPTO_hash (OIDC_REDIRECT_URI_KEY, strlen (OIDC_REDIRECT_URI_KEY),
1558 &cache_key);
1559 if ( GNUNET_NO
1560 == GNUNET_CONTAINER_multihashmap_contains (
1561 handle->rest_handle->url_param_map, &cache_key) )
1562 {
1563 GNUNET_free_non_null(user_psw);
1564 handle->emsg = GNUNET_strdup("invalid_request");
1565 handle->edesc = GNUNET_strdup("missing parameter redirect_uri");
1566 handle->response_code = MHD_HTTP_BAD_REQUEST;
1567 GNUNET_SCHEDULER_add_now (&do_error, handle);
1568 return;
1569 }
1570
1571 //Check parameter grant_type == "authorization_code"
1572 if (0 != strcmp(OIDC_GRANT_TYPE_VALUE, grant_type))
1573 {
1574 GNUNET_free_non_null(user_psw);
1575 handle->emsg=GNUNET_strdup("unsupported_grant_type");
1576 handle->response_code = MHD_HTTP_BAD_REQUEST;
1577 GNUNET_SCHEDULER_add_now (&do_error, handle);
1578 return;
1579 }
1580 GNUNET_CRYPTO_hash (code, strlen (code), &cache_key);
1581 int i = 1;
1582 if ( GNUNET_SYSERR
1583 == GNUNET_CONTAINER_multihashmap_put (OIDC_ticket_once,
1584 &cache_key,
1585 &i,
1586 GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY) )
1587 {
1588 GNUNET_free_non_null(user_psw);
1589 handle->emsg = GNUNET_strdup("invalid_request");
1590 handle->edesc = GNUNET_strdup("Cannot use the same code more than once");
1591 handle->response_code = MHD_HTTP_BAD_REQUEST;
1592 GNUNET_SCHEDULER_add_now (&do_error, handle);
1593 return;
1594 }
1595
1596 //decode code
1597 GNUNET_STRINGS_base64_decode(code,strlen(code),&code_output);
1598 root = json_loads (code_output, 0, &error);
1599 GNUNET_free(code_output);
1600 ticket_string = json_object_get (root, "ticket");
1601 nonce = json_object_get (root, "nonce");
1602 max_age = json_object_get (root, "max_age");
1603
1604 if(ticket_string == NULL && !json_is_string(ticket_string))
1605 {
1606 GNUNET_free_non_null(user_psw);
1607 handle->emsg = GNUNET_strdup("invalid_request");
1608 handle->edesc = GNUNET_strdup("invalid code");
1609 handle->response_code = MHD_HTTP_BAD_REQUEST;
1610 GNUNET_SCHEDULER_add_now (&do_error, handle);
1611 return;
1612 }
1613
1614 struct GNUNET_IDENTITY_PROVIDER_Ticket *ticket = GNUNET_new(struct GNUNET_IDENTITY_PROVIDER_Ticket);
1615 if ( GNUNET_OK
1616 != GNUNET_STRINGS_string_to_data (json_string_value(ticket_string),
1617 strlen (json_string_value(ticket_string)),
1618 ticket,
1619 sizeof(struct GNUNET_IDENTITY_PROVIDER_Ticket)))
1620 {
1621 GNUNET_free_non_null(user_psw);
1622 handle->emsg = GNUNET_strdup("invalid_request");
1623 handle->edesc = GNUNET_strdup("invalid code");
1624 handle->response_code = MHD_HTTP_BAD_REQUEST;
1625 GNUNET_SCHEDULER_add_now (&do_error, handle);
1626 GNUNET_free(ticket);
1627 return;
1628 }
1629 // this is the current client (relying party)
1630 struct GNUNET_CRYPTO_EcdsaPublicKey pub_key;
1631 GNUNET_IDENTITY_ego_get_public_key(handle->ego_entry->ego,&pub_key);
1632 if (0 != memcmp(&pub_key,&ticket->audience,sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)))
1633 {
1634 GNUNET_free_non_null(user_psw);
1635 handle->emsg = GNUNET_strdup("invalid_request");
1636 handle->edesc = GNUNET_strdup("invalid code");
1637 handle->response_code = MHD_HTTP_BAD_REQUEST;
1638 GNUNET_SCHEDULER_add_now (&do_error, handle);
1639 GNUNET_free(ticket);
1640 return;
1641 }
1642
1643 //create jwt
1644 unsigned long long int expiration_time;
1645 if ( GNUNET_OK
1646 != GNUNET_CONFIGURATION_get_value_number(cfg, "identity-rest-plugin",
1647 "expiration_time", &expiration_time) )
1648 {
1649 GNUNET_free_non_null(user_psw);
1650 handle->emsg = GNUNET_strdup("server_error");
1651 handle->edesc = GNUNET_strdup ("gnunet configuration failed");
1652 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1653 GNUNET_SCHEDULER_add_now (&do_error, handle);
1654 GNUNET_free(ticket);
1655 return;
1656 }
1657
1658 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimList *cl = GNUNET_new (struct GNUNET_IDENTITY_ATTRIBUTE_ClaimList);
1659 //aud REQUIRED public key client_id must be there
1660 GNUNET_IDENTITY_ATTRIBUTE_list_add(cl,
1661 "aud",
1662 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1663 client_id,
1664 strlen(client_id));
1665 //exp REQUIRED time expired from config
1666 struct GNUNET_TIME_Absolute exp_time = GNUNET_TIME_relative_to_absolute (
1667 GNUNET_TIME_relative_multiply (GNUNET_TIME_relative_get_second_ (),
1668 expiration_time));
1669 const char* exp_time_string = GNUNET_STRINGS_absolute_time_to_string(exp_time);
1670 GNUNET_IDENTITY_ATTRIBUTE_list_add (cl,
1671 "exp",
1672 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1673 exp_time_string,
1674 strlen(exp_time_string));
1675 //iat REQUIRED time now
1676 struct GNUNET_TIME_Absolute time_now = GNUNET_TIME_absolute_get();
1677 const char* time_now_string = GNUNET_STRINGS_absolute_time_to_string(time_now);
1678 GNUNET_IDENTITY_ATTRIBUTE_list_add (cl,
1679 "iat",
1680 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1681 time_now_string,
1682 strlen(time_now_string));
1683 //nonce only if nonce is provided
1684 if ( NULL != nonce && json_is_string(nonce) )
1685 {
1686 GNUNET_IDENTITY_ATTRIBUTE_list_add (cl,
1687 "nonce",
1688 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1689 json_string_value(nonce),
1690 strlen(json_string_value(nonce)));
1691 }
1692 //auth_time only if max_age is provided
1693 if ( NULL != max_age && json_is_string(max_age) )
1694 {
1695 GNUNET_IDENTITY_ATTRIBUTE_list_add (cl,
1696 "auth_time",
1697 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1698 json_string_value(max_age),
1699 strlen(json_string_value(max_age)));
1700 }
1701 //TODO OPTIONAL acr,amr,azp
1702
1703 struct EgoEntry *ego_entry;
1704 for (ego_entry = handle->ego_head; NULL != ego_entry; ego_entry = ego_entry->next)
1705 {
1706 GNUNET_IDENTITY_ego_get_public_key (ego_entry->ego, &pub_key);
1707 if (0 == memcmp (&pub_key, &ticket->audience, sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)))
1708 {
1709 break;
1710 }
1711 }
1712 if ( NULL == ego_entry )
1713 {
1714 GNUNET_free_non_null(user_psw);
1715 handle->emsg = GNUNET_strdup("invalid_request");
1716 handle->edesc = GNUNET_strdup("invalid code....");
1717 handle->response_code = MHD_HTTP_BAD_REQUEST;
1718 GNUNET_SCHEDULER_add_now (&do_error, handle);
1719 GNUNET_free(ticket);
1720 return;
1721 }
1722 char *id_token = jwt_create_from_list(&ticket->audience,
1723 cl,
1724 GNUNET_IDENTITY_ego_get_private_key(ego_entry->ego));
1725
1726 //Create random access_token
1727 char* access_token_number;
1728 char* access_token;
1729 uint64_t random_number;
1730 random_number = GNUNET_CRYPTO_random_u64(GNUNET_CRYPTO_QUALITY_NONCE, UINT64_MAX);
1731 GNUNET_asprintf(&access_token_number, "%" PRIu64, random_number);
1732 GNUNET_STRINGS_base64_encode(access_token_number,strlen(access_token_number),&access_token);
1733
1734
1735
1736 //TODO OPTIONAL add refresh_token and scope
1737 GNUNET_asprintf (&json_response,
1738 "{ \"access_token\" : \"%s\", "
1739 "\"token_type\" : \"Bearer\", "
1740 "\"expires_in\" : %d, "
1741 "\"id_token\" : \"%s\"}",
1742 access_token,
1743 expiration_time,
1744 id_token);
1745 GNUNET_CRYPTO_hash(access_token, strlen(access_token), &cache_key);
1746 char *id_ticket_combination;
1747 GNUNET_asprintf(&id_ticket_combination,
1748 "%s;%s",
1749 client_id,
1750 json_string_value(ticket_string));
1751 GNUNET_CONTAINER_multihashmap_put(OIDC_interpret_access_token,
1752 &cache_key,
1753 id_ticket_combination,
1754 GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
1755
1756 resp = GNUNET_REST_create_response (json_response);
1757 MHD_add_response_header (resp, "Cache-Control", "no-store");
1758 MHD_add_response_header (resp, "Pragma", "no-cache");
1759 MHD_add_response_header (resp, "Content-Type", "application/json");
1760 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
1761
1762 GNUNET_IDENTITY_ATTRIBUTE_list_destroy(cl);
1763 GNUNET_free(access_token_number);
1764 GNUNET_free(access_token);
1765 GNUNET_free(user_psw);
1766 GNUNET_free(json_response);
1767 GNUNET_free(ticket);
1768 GNUNET_free(id_token);
1769 json_decref (root);
1770 GNUNET_SCHEDULER_add_now(&cleanup_handle_delayed, handle);
1771}
1772
1773/**
1774 * Collects claims and stores them in handle
1775 */
1776static void
1777consume_ticket (void *cls,
1778 const struct GNUNET_CRYPTO_EcdsaPublicKey *identity,
1779 const struct GNUNET_IDENTITY_ATTRIBUTE_Claim *attr)
1780{
1781 struct RequestHandle *handle = cls;
1782 char *tmp_value;
1783 json_t *value;
1784
1785 if (NULL == identity)
1786 {
1787 GNUNET_SCHEDULER_add_now (&return_userinfo_response, handle);
1788 return;
1789 }
1790
1791 tmp_value = GNUNET_IDENTITY_ATTRIBUTE_value_to_string (attr->type,
1792 attr->data,
1793 attr->data_size);
1794
1795 value = json_string (tmp_value);
1796
1797
1798 json_object_set_new (handle->oidc->response,
1799 attr->name,
1800 value);
1801 GNUNET_free (tmp_value);
1802}
1803
1804/**
1805 * Responds to userinfo GET and url-encoded POST request
1806 *
1807 * @param con_handle the connection handle
1808 * @param url the url
1809 * @param cls the RequestHandle
1810 */
1811static void
1812userinfo_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
1813 const char* url, void *cls)
1814{
1815 //TODO expiration time
1816 struct RequestHandle *handle = cls;
1817 char delimiter[] = " ";
1818 char delimiter_db[] = ";";
1819 struct GNUNET_HashCode cache_key;
1820 char *authorization, *authorization_type, *authorization_access_token;
1821 char *client_ticket, *client, *ticket_str;
1822 struct GNUNET_IDENTITY_PROVIDER_Ticket *ticket;
1823
1824 GNUNET_CRYPTO_hash (OIDC_AUTHORIZATION_HEADER_KEY,
1825 strlen (OIDC_AUTHORIZATION_HEADER_KEY),
1826 &cache_key);
1827 if ( GNUNET_NO
1828 == GNUNET_CONTAINER_multihashmap_contains (
1829 handle->rest_handle->header_param_map, &cache_key) )
1830 {
1831 handle->emsg = GNUNET_strdup("invalid_token");
1832 handle->edesc = GNUNET_strdup("No Access Token");
1833 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1834 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1835 return;
1836 }
1837 authorization = GNUNET_CONTAINER_multihashmap_get (
1838 handle->rest_handle->header_param_map, &cache_key);
1839
1840 //split header in "Bearer" and access_token
1841 authorization = GNUNET_strdup(authorization);
1842 authorization_type = strtok (authorization, delimiter);
1843 if ( 0 != strcmp ("Bearer", authorization_type) )
1844 {
1845 handle->emsg = GNUNET_strdup("invalid_token");
1846 handle->edesc = GNUNET_strdup("No Access Token");
1847 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1848 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1849 GNUNET_free(authorization);
1850 return;
1851 }
1852 authorization_access_token = strtok (NULL, delimiter);
1853 if ( NULL == authorization_access_token )
1854 {
1855 handle->emsg = GNUNET_strdup("invalid_token");
1856 handle->edesc = GNUNET_strdup("No Access Token");
1857 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1858 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1859 GNUNET_free(authorization);
1860 return;
1861 }
1862
1863 GNUNET_CRYPTO_hash (authorization_access_token,
1864 strlen (authorization_access_token),
1865 &cache_key);
1866 if ( GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (OIDC_interpret_access_token,
1867 &cache_key) )
1868 {
1869 handle->emsg = GNUNET_strdup("invalid_token");
1870 handle->edesc = GNUNET_strdup("The Access Token expired");
1871 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1872 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1873 GNUNET_free(authorization);
1874 return;
1875 }
1876
1877 client_ticket = GNUNET_CONTAINER_multihashmap_get(OIDC_interpret_access_token,
1878 &cache_key);
1879 client_ticket = GNUNET_strdup(client_ticket);
1880 client = strtok(client_ticket,delimiter_db);
1881 if (NULL == client)
1882 {
1883 handle->emsg = GNUNET_strdup("invalid_token");
1884 handle->edesc = GNUNET_strdup("The Access Token expired");
1885 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1886 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1887 GNUNET_free(authorization);
1888 GNUNET_free(client_ticket);
1889 return;
1890 }
1891 handle->ego_entry = handle->ego_head;
1892 for(; NULL != handle->ego_entry; handle->ego_entry = handle->ego_entry->next)
1893 {
1894 if (0 == strcmp(handle->ego_entry->keystring,client))
1895 {
1896 break;
1897 }
1898 }
1899 if (NULL == handle->ego_entry)
1900 {
1901 handle->emsg = GNUNET_strdup("invalid_token");
1902 handle->edesc = GNUNET_strdup("The Access Token expired");
1903 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1904 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1905 GNUNET_free(authorization);
1906 GNUNET_free(client_ticket);
1907 return;
1908 }
1909 ticket_str = strtok(NULL, delimiter_db);
1910 if (NULL == ticket_str)
1911 {
1912 handle->emsg = GNUNET_strdup("invalid_token");
1913 handle->edesc = GNUNET_strdup("The Access Token expired");
1914 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1915 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1916 GNUNET_free(authorization);
1917 GNUNET_free(client_ticket);
1918 return;
1919 }
1920 ticket = GNUNET_new(struct GNUNET_IDENTITY_PROVIDER_Ticket);
1921 if ( GNUNET_OK
1922 != GNUNET_STRINGS_string_to_data (ticket_str,
1923 strlen (ticket_str),
1924 ticket,
1925 sizeof(struct GNUNET_IDENTITY_PROVIDER_Ticket)))
1926 {
1927 handle->emsg = GNUNET_strdup("invalid_token");
1928 handle->edesc = GNUNET_strdup("The Access Token expired");
1929 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1930 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1931 GNUNET_free(ticket);
1932 GNUNET_free(authorization);
1933 GNUNET_free(client_ticket);
1934 return;
1935 }
1936
1937 handle->idp = GNUNET_IDENTITY_PROVIDER_connect (cfg);
1938 handle->oidc->response = json_object();
1939 json_object_set_new( handle->oidc->response, "sub", json_string( handle->ego_entry->keystring));
1940 handle->idp_op = GNUNET_IDENTITY_PROVIDER_ticket_consume (
1941 handle->idp,
1942 GNUNET_IDENTITY_ego_get_private_key (handle->ego_entry->ego),
1943 ticket,
1944 consume_ticket,
1945 handle);
1946 GNUNET_free(ticket);
1947 GNUNET_free(authorization);
1948 GNUNET_free(client_ticket);
1949
1950}
1951
1952
1953/**
1954 * Handle rest request
1955 *
1956 * @param handle the request handle
1957 */
1958static void
1959init_cont (struct RequestHandle *handle)
1960{
1961 struct GNUNET_REST_RequestHandlerError err;
1962 static const struct GNUNET_REST_RequestHandler handlers[] = {
1963 {MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_AUTHORIZE, &authorize_endpoint},
1964 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_AUTHORIZE, &authorize_endpoint}, //url-encoded
1965 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_LOGIN, &login_cont},
1966 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_TOKEN, &token_endpoint },
1967 {MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_USERINFO, &userinfo_endpoint },
1968 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_USERINFO, &userinfo_endpoint },
1969 {MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_OIDC,
1970 &options_cont},
1971 GNUNET_REST_HANDLER_END
1972 };
1973
1974 if (GNUNET_NO == GNUNET_REST_handle_request (handle->rest_handle,
1975 handlers,
1976 &err,
1977 handle))
1978 {
1979 handle->response_code = err.error_code;
1980 GNUNET_SCHEDULER_add_now (&do_error, handle);
1981 }
1982}
1983
1984/**
1985 * If listing is enabled, prints information about the egos.
1986 *
1987 * This function is initially called for all egos and then again
1988 * whenever a ego's identifier changes or if it is deleted. At the
1989 * end of the initial pass over all egos, the function is once called
1990 * with 'NULL' for 'ego'. That does NOT mean that the callback won't
1991 * be invoked in the future or that there was an error.
1992 *
1993 * When used with 'GNUNET_IDENTITY_create' or 'GNUNET_IDENTITY_get',
1994 * this function is only called ONCE, and 'NULL' being passed in
1995 * 'ego' does indicate an error (i.e. name is taken or no default
1996 * value is known). If 'ego' is non-NULL and if '*ctx'
1997 * is set in those callbacks, the value WILL be passed to a subsequent
1998 * call to the identity callback of 'GNUNET_IDENTITY_connect' (if
1999 * that one was not NULL).
2000 *
2001 * When an identity is renamed, this function is called with the
2002 * (known) ego but the NEW identifier.
2003 *
2004 * When an identity is deleted, this function is called with the
2005 * (known) ego and "NULL" for the 'identifier'. In this case,
2006 * the 'ego' is henceforth invalid (and the 'ctx' should also be
2007 * cleaned up).
2008 *
2009 * @param cls closure
2010 * @param ego ego handle
2011 * @param ctx context for application to store data for this ego
2012 * (during the lifetime of this process, initially NULL)
2013 * @param identifier identifier assigned by the user for this ego,
2014 * NULL if the user just deleted the ego and it
2015 * must thus no longer be used
2016 */
2017static void
2018list_ego (void *cls,
2019 struct GNUNET_IDENTITY_Ego *ego,
2020 void **ctx,
2021 const char *identifier)
2022{
2023 struct RequestHandle *handle = cls;
2024 struct EgoEntry *ego_entry;
2025 struct GNUNET_CRYPTO_EcdsaPublicKey pk;
2026
2027 if ((NULL == ego) && (ID_REST_STATE_INIT == handle->state))
2028 {
2029 handle->state = ID_REST_STATE_POST_INIT;
2030 init_cont (handle);
2031 return;
2032 }
2033 if (ID_REST_STATE_INIT == handle->state) {
2034 ego_entry = GNUNET_new (struct EgoEntry);
2035 GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
2036 ego_entry->keystring =
2037 GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
2038 ego_entry->ego = ego;
2039 ego_entry->identifier = GNUNET_strdup (identifier);
2040 GNUNET_CONTAINER_DLL_insert_tail(handle->ego_head,handle->ego_tail, ego_entry);
2041 }
2042
2043}
2044
2045static void
2046rest_identity_process_request(struct GNUNET_REST_RequestHandle *rest_handle,
2047 GNUNET_REST_ResultProcessor proc,
2048 void *proc_cls)
2049{
2050 struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
2051 handle->oidc = GNUNET_new (struct OIDC_Variables);
2052 if ( NULL == OIDC_identity_login_time )
2053 OIDC_identity_login_time = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2054 if ( NULL == OIDC_identity_grants )
2055 OIDC_identity_grants = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2056 if ( NULL == OIDC_ticket_once )
2057 OIDC_ticket_once = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2058 if ( NULL == OIDC_interpret_access_token )
2059 OIDC_interpret_access_token = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2060 handle->response_code = 0;
2061 handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
2062 handle->proc_cls = proc_cls;
2063 handle->proc = proc;
2064 handle->state = ID_REST_STATE_INIT;
2065 handle->rest_handle = rest_handle;
2066
2067 handle->url = GNUNET_strdup (rest_handle->url);
2068 if (handle->url[strlen (handle->url)-1] == '/')
2069 handle->url[strlen (handle->url)-1] = '\0';
2070 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2071 "Connecting...\n");
2072 handle->identity_handle = GNUNET_IDENTITY_connect (cfg,
2073 &list_ego,
2074 handle);
2075 handle->namestore_handle = GNUNET_NAMESTORE_connect (cfg);
2076 handle->timeout_task =
2077 GNUNET_SCHEDULER_add_delayed (handle->timeout,
2078 &do_timeout,
2079 handle);
2080 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2081 "Connected\n");
2082}
2083
2084/**
2085 * Entry point for the plugin.
2086 *
2087 * @param cls Config info
2088 * @return NULL on error, otherwise the plugin context
2089 */
2090void *
2091libgnunet_plugin_rest_openid_connect_init (void *cls)
2092{
2093 static struct Plugin plugin;
2094 struct GNUNET_REST_Plugin *api;
2095
2096 cfg = cls;
2097 if (NULL != plugin.cfg)
2098 return NULL; /* can only initialize once! */
2099 memset (&plugin, 0, sizeof (struct Plugin));
2100 plugin.cfg = cfg;
2101 api = GNUNET_new (struct GNUNET_REST_Plugin);
2102 api->cls = &plugin;
2103 api->name = GNUNET_REST_API_NS_OIDC;
2104 api->process_request = &rest_identity_process_request;
2105 GNUNET_asprintf (&allow_methods,
2106 "%s, %s, %s, %s, %s",
2107 MHD_HTTP_METHOD_GET,
2108 MHD_HTTP_METHOD_POST,
2109 MHD_HTTP_METHOD_PUT,
2110 MHD_HTTP_METHOD_DELETE,
2111 MHD_HTTP_METHOD_OPTIONS);
2112
2113 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2114 _("Identity Provider REST API initialized\n"));
2115 return api;
2116}
2117
2118
2119/**
2120 * Exit point from the plugin.
2121 *
2122 * @param cls the plugin context (as returned by "init")
2123 * @return always NULL
2124 */
2125void *
2126libgnunet_plugin_rest_openid_connect_done (void *cls)
2127{
2128 struct GNUNET_REST_Plugin *api = cls;
2129 struct Plugin *plugin = api->cls;
2130 plugin->cfg = NULL;
2131
2132 struct GNUNET_CONTAINER_MultiHashMapIterator *hashmap_it;
2133 void *value = NULL;
2134 hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (
2135 OIDC_identity_login_time);
2136 while (GNUNET_YES ==
2137 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2138 {
2139 if (NULL != value)
2140 GNUNET_free(value);
2141 }
2142 GNUNET_CONTAINER_multihashmap_destroy(OIDC_identity_login_time);
2143 hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (OIDC_identity_grants);
2144 while (GNUNET_YES ==
2145 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2146 {
2147 if (NULL != value)
2148 GNUNET_free(value);
2149 }
2150 GNUNET_CONTAINER_multihashmap_destroy(OIDC_identity_grants);
2151 hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (OIDC_ticket_once);
2152 while (GNUNET_YES ==
2153 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2154 {
2155 if (NULL != value)
2156 GNUNET_free(value);
2157 }
2158 GNUNET_CONTAINER_multihashmap_destroy(OIDC_ticket_once);
2159 hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (OIDC_interpret_access_token);
2160 while (GNUNET_YES ==
2161 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2162 {
2163 if (NULL != value)
2164 GNUNET_free(value);
2165 }
2166 GNUNET_CONTAINER_multihashmap_destroy(OIDC_interpret_access_token);
2167 GNUNET_CONTAINER_multihashmap_iterator_destroy(hashmap_it);
2168 GNUNET_free_non_null (allow_methods);
2169 GNUNET_free (api);
2170 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2171 "Identity Provider REST plugin is finished\n");
2172 return NULL;
2173}
2174
2175/* end of plugin_rest_identity_provider.c */
generated by cgit v1.2.3 (git 2.39.1) at 2024-04-30 23:19:03 +0000