2 This file is part of GNUnet.
3 Copyright (C) 2012-2015 GNUnet e.V.
5 GNUnet is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published
7 by the Free Software Foundation; either version 3, or (at your
8 option) any later version.
10 GNUnet is distributed in the hope that it will be useful, but
11 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with GNUnet; see the file COPYING. If not, write to the
17 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
18 Boston, MA 02110-1301, USA.
21 * @author Martin Schanzenbach
22 * @author Philippe Buschmann
23 * @file identity/plugin_rest_openid_connect.c
24 * @brief GNUnet Namestore REST plugin
29 #include "gnunet_rest_plugin.h"
30 #include "gnunet_identity_service.h"
31 #include "gnunet_gns_service.h"
32 #include "gnunet_gnsrecord_lib.h"
33 #include "gnunet_namestore_service.h"
34 #include "gnunet_rest_lib.h"
35 #include "gnunet_jsonapi_lib.h"
36 #include "gnunet_jsonapi_util.h"
37 #include "microhttpd.h"
40 #include "gnunet_signatures.h"
41 #include "gnunet_identity_attribute_lib.h"
42 #include "gnunet_identity_provider_service.h"
48 #define GNUNET_REST_API_NS_OIDC "/openid"
53 #define GNUNET_REST_API_NS_AUTHORIZE "/openid/authorize"
58 #define GNUNET_REST_API_NS_TOKEN "/openid/token"
63 #define GNUNET_REST_API_NS_USERINFO "/openid/userinfo"
68 #define GNUNET_REST_API_NS_LOGIN "/openid/login"
73 #define GNUNET_REST_JSONAPI_IDENTITY_ATTRIBUTE "attribute"
78 #define GNUNET_REST_JSONAPI_IDENTITY_TICKET "ticket"
84 #define GNUNET_REST_JSONAPI_IDENTITY_ATTRIBUTE_VALUE "value"
87 * State while collecting all egos
89 #define ID_REST_STATE_INIT 0
92 * Done collecting egos
94 #define ID_REST_STATE_POST_INIT 1
99 #define OIDC_GRANT_TYPE_KEY "grant_type"
102 * OIDC grant_type key
104 #define OIDC_GRANT_TYPE_VALUE "authorization_code"
109 #define OIDC_CODE_KEY "code"
112 * OIDC response_type key
114 #define OIDC_RESPONSE_TYPE_KEY "response_type"
119 #define OIDC_CLIENT_ID_KEY "client_id"
124 #define OIDC_SCOPE_KEY "scope"
127 * OIDC redirect_uri key
129 #define OIDC_REDIRECT_URI_KEY "redirect_uri"
134 #define OIDC_STATE_KEY "state"
139 #define OIDC_NONCE_KEY "nonce"
142 * OIDC cookie header key
144 #define OIDC_COOKIE_HEADER_KEY "cookie"
147 * OIDC cookie header information key
149 #define OIDC_AUTHORIZATION_HEADER_KEY "authorization"
152 * OIDC cookie header information key
154 #define OIDC_COOKIE_HEADER_INFORMATION_KEY "Identity="
157 * OIDC expected response_type while authorizing
159 #define OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE "code"
162 * OIDC expected scope part while authorizing
164 #define OIDC_EXPECTED_AUTHORIZATION_SCOPE "openid"
167 * OIDC ignored parameter array
169 static char* OIDC_ignored_parameter_array [] =
182 * OIDC authorized identities and times hashmap
184 struct GNUNET_CONTAINER_MultiHashMap *OIDC_identity_login_time;
187 * OIDC authorized identities and times hashmap
189 struct GNUNET_CONTAINER_MultiHashMap *OIDC_identity_grants;
192 * OIDC ticket/code use only once
194 struct GNUNET_CONTAINER_MultiHashMap *OIDC_ticket_once;
197 * OIDC access_token to ticket and ego
199 struct GNUNET_CONTAINER_MultiHashMap *OIDC_interpret_access_token;
202 * The configuration handle
204 const struct GNUNET_CONFIGURATION_Handle *cfg;
207 * HTTP methods allows for this plugin
209 static char* allow_methods;
212 * @brief struct returned by the initialization function of the plugin
216 const struct GNUNET_CONFIGURATION_Handle *cfg;
220 * OIDC needed variables
222 struct OIDC_Variables
225 * The RP client public key
227 struct GNUNET_CRYPTO_EcdsaPublicKey client_pkey;
230 * The OIDC client id of the RP
235 * GNUNET_YES if there is a delegation to
236 * this RP or if it is a local identity
238 int is_client_trusted;
241 * The OIDC redirect uri
246 * The list of oidc scopes
261 * The OIDC response type
266 * The identity chosen by the user to login
268 char *login_identity;
285 struct EgoEntry *next;
290 struct EgoEntry *prev;
305 struct GNUNET_IDENTITY_Ego *ego;
314 struct EgoEntry *ego_head;
319 struct EgoEntry *ego_tail;
324 struct EgoEntry *ego_entry;
327 * Pointer to ego private key
329 struct GNUNET_CRYPTO_EcdsaPrivateKey priv_key;
334 struct OIDC_Variables *oidc;
337 * The processing state
342 * Handle to Identity service.
344 struct GNUNET_IDENTITY_Handle *identity_handle;
349 struct GNUNET_REST_RequestHandle *rest_handle;
352 * Handle to NAMESTORE
354 struct GNUNET_NAMESTORE_Handle *namestore_handle;
357 * Iterator for NAMESTORE
359 struct GNUNET_NAMESTORE_ZoneIterator *namestore_handle_it;
362 * Attribute claim list
364 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimList *attr_list;
369 struct GNUNET_IDENTITY_Operation *op;
374 struct GNUNET_IDENTITY_PROVIDER_Handle *idp;
379 struct GNUNET_IDENTITY_PROVIDER_Operation *idp_op;
384 struct GNUNET_IDENTITY_PROVIDER_AttributeIterator *attr_it;
389 struct GNUNET_IDENTITY_PROVIDER_TicketIterator *ticket_it;
394 struct GNUNET_IDENTITY_PROVIDER_Ticket ticket;
397 * Desired timeout for the lookup (default is no timeout).
399 struct GNUNET_TIME_Relative timeout;
402 * ID of a task associated with the resolution process.
404 struct GNUNET_SCHEDULER_Task *timeout_task;
407 * The plugin result processor
409 GNUNET_REST_ResultProcessor proc;
412 * The closure of the result processor
422 * The tld for redirect
427 * Error response message
432 * Error response description
444 struct GNUNET_JSONAPI_Document *resp_object;
449 * Cleanup lookup handle
450 * @param handle Handle to clean up
453 cleanup_handle (struct RequestHandle *handle)
455 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimListEntry *claim_entry;
456 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimListEntry *claim_tmp;
457 struct EgoEntry *ego_entry;
458 struct EgoEntry *ego_tmp;
459 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
461 if (NULL != handle->resp_object)
462 GNUNET_JSONAPI_document_delete (handle->resp_object);
463 if (NULL != handle->timeout_task)
464 GNUNET_SCHEDULER_cancel (handle->timeout_task);
465 if (NULL != handle->identity_handle)
466 GNUNET_IDENTITY_disconnect (handle->identity_handle);
467 if (NULL != handle->attr_it)
468 GNUNET_IDENTITY_PROVIDER_get_attributes_stop (handle->attr_it);
469 if (NULL != handle->ticket_it)
470 GNUNET_IDENTITY_PROVIDER_ticket_iteration_stop (handle->ticket_it);
471 if (NULL != handle->idp)
472 GNUNET_IDENTITY_PROVIDER_disconnect (handle->idp);
473 if (NULL != handle->url)
474 GNUNET_free (handle->url);
475 if (NULL != handle->tld)
476 GNUNET_free (handle->tld);
477 if (NULL != handle->emsg)
478 GNUNET_free (handle->emsg);
479 if (NULL != handle->edesc)
480 GNUNET_free (handle->edesc);
481 if (NULL != handle->namestore_handle)
482 GNUNET_NAMESTORE_disconnect (handle->namestore_handle);
483 if (NULL != handle->oidc)
485 if (NULL != handle->oidc->client_id)
486 GNUNET_free(handle->oidc->client_id);
487 if (NULL != handle->oidc->login_identity)
488 GNUNET_free(handle->oidc->login_identity);
489 if (NULL != handle->oidc->nonce)
490 GNUNET_free(handle->oidc->nonce);
491 if (NULL != handle->oidc->redirect_uri)
492 GNUNET_free(handle->oidc->redirect_uri);
493 if (NULL != handle->oidc->response_type)
494 GNUNET_free(handle->oidc->response_type);
495 if (NULL != handle->oidc->scope)
496 GNUNET_free(handle->oidc->scope);
497 if (NULL != handle->oidc->state)
498 GNUNET_free(handle->oidc->state);
499 if (NULL != handle->oidc->response)
500 json_decref(handle->oidc->response);
501 GNUNET_free(handle->oidc);
503 if ( NULL != handle->attr_list )
505 for (claim_entry = handle->attr_list->list_head;
506 NULL != claim_entry;)
508 claim_tmp = claim_entry;
509 claim_entry = claim_entry->next;
510 GNUNET_free(claim_tmp->claim);
511 GNUNET_free(claim_tmp);
513 GNUNET_free (handle->attr_list);
515 for (ego_entry = handle->ego_head;
519 ego_entry = ego_entry->next;
520 GNUNET_free (ego_tmp->identifier);
521 GNUNET_free (ego_tmp->keystring);
522 GNUNET_free (ego_tmp);
524 if (NULL != handle->attr_it)
526 GNUNET_free(handle->attr_it);
528 GNUNET_free (handle);
532 cleanup_handle_delayed (void *cls)
534 cleanup_handle (cls);
539 * Task run on error, sends error message. Cleans up everything.
541 * @param cls the `struct RequestHandle`
546 struct RequestHandle *handle = cls;
547 struct MHD_Response *resp;
550 GNUNET_asprintf (&json_error, "{ \"error\" : \"%s\", \"error_description\" : \"%s\"%s%s%s}",
552 (NULL != handle->edesc) ? handle->edesc : "",
553 (NULL != handle->oidc->state) ? ", \"state\":\"" : "",
554 (NULL != handle->oidc->state) ? handle->oidc->state : "",
555 (NULL != handle->oidc->state) ? "\"" : "");
556 if ( 0 == handle->response_code )
558 handle->response_code = MHD_HTTP_BAD_REQUEST;
560 resp = GNUNET_REST_create_response (json_error);
561 if (MHD_HTTP_UNAUTHORIZED == handle->response_code)
563 MHD_add_response_header(resp, "WWW-Authenticate", "Basic");
565 MHD_add_response_header (resp, "Content-Type", "application/json");
566 handle->proc (handle->proc_cls, resp, handle->response_code);
567 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
568 GNUNET_free (json_error);
573 * Task run on error in userinfo endpoint, sends error header. Cleans up
576 * @param cls the `struct RequestHandle`
579 do_userinfo_error (void *cls)
581 struct RequestHandle *handle = cls;
582 struct MHD_Response *resp;
585 GNUNET_asprintf (&error, "error=\"%s\", error_description=\"%s\"",
587 (NULL != handle->edesc) ? handle->edesc : "");
588 resp = GNUNET_REST_create_response ("");
589 MHD_add_response_header(resp, "WWW-Authenticate", error);
590 handle->proc (handle->proc_cls, resp, handle->response_code);
591 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
597 * Task run on error, sends error message and redirects. Cleans up everything.
599 * @param cls the `struct RequestHandle`
602 do_redirect_error (void *cls)
604 struct RequestHandle *handle = cls;
605 struct MHD_Response *resp;
607 GNUNET_asprintf (&redirect,
608 "%s?error=%s&error_description=%s%s%s",
609 handle->oidc->redirect_uri, handle->emsg, handle->edesc,
610 (NULL != handle->oidc->state) ? "&state=" : "",
611 (NULL != handle->oidc->state) ? handle->oidc->state : "");
612 resp = GNUNET_REST_create_response ("");
613 MHD_add_response_header (resp, "Location", redirect);
614 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
615 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
616 GNUNET_free (redirect);
620 * Task run on timeout, sends error message. Cleans up everything.
622 * @param cls the `struct RequestHandle`
625 do_timeout (void *cls)
627 struct RequestHandle *handle = cls;
629 handle->timeout_task = NULL;
634 * Return attributes for claim
636 * @param cls the request handle
639 return_userinfo_response (void *cls)
642 struct RequestHandle *handle = cls;
643 struct MHD_Response *resp;
645 result_str = json_dumps (handle->oidc->response, 0);
647 resp = GNUNET_REST_create_response (result_str);
648 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
649 GNUNET_free (result_str);
650 cleanup_handle (handle);
654 * Returns base64 encoded string without padding
656 * @param string the string to encode
657 * @return base64 encoded string
660 base_64_encode(const char *s)
665 GNUNET_STRINGS_base64_encode(s, strlen(s), &enc);
666 tmp = strrchr (enc, '=');
672 * Respond to OPTIONS request
674 * @param con_handle the connection handle
676 * @param cls the RequestHandle
679 options_cont (struct GNUNET_REST_RequestHandle *con_handle,
683 struct MHD_Response *resp;
684 struct RequestHandle *handle = cls;
686 //For now, independent of path return all options
687 resp = GNUNET_REST_create_response (NULL);
688 MHD_add_response_header (resp,
689 "Access-Control-Allow-Methods",
691 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
692 cleanup_handle (handle);
697 * Interprets cookie header and pass its identity keystring to handle
700 cookie_identity_interpretation (struct RequestHandle *handle)
702 struct GNUNET_HashCode cache_key;
704 struct GNUNET_TIME_Absolute current_time, *relog_time;
705 char delimiter[] = "; ";
707 //gets identity of login try with cookie
708 GNUNET_CRYPTO_hash (OIDC_COOKIE_HEADER_KEY, strlen (OIDC_COOKIE_HEADER_KEY),
710 if ( GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->header_param_map,
713 //splits cookies and find 'Identity' cookie
714 cookies = GNUNET_CONTAINER_multihashmap_get ( handle->rest_handle->header_param_map, &cache_key);
715 handle->oidc->login_identity = strtok(cookies, delimiter);
717 while ( NULL != handle->oidc->login_identity )
719 if ( NULL != strstr (handle->oidc->login_identity, OIDC_COOKIE_HEADER_INFORMATION_KEY) )
723 handle->oidc->login_identity = strtok (NULL, delimiter);
725 GNUNET_CRYPTO_hash (handle->oidc->login_identity, strlen (handle->oidc->login_identity),
727 if ( GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (OIDC_identity_login_time, &cache_key) )
729 relog_time = GNUNET_CONTAINER_multihashmap_get (OIDC_identity_login_time,
731 current_time = GNUNET_TIME_absolute_get ();
732 // 30 min after old login -> redirect to login
733 if ( current_time.abs_value_us <= relog_time->abs_value_us )
735 handle->oidc->login_identity = strtok(handle->oidc->login_identity, OIDC_COOKIE_HEADER_INFORMATION_KEY);
736 handle->oidc->login_identity = GNUNET_strdup(handle->oidc->login_identity);
741 handle->oidc->login_identity = NULL;
747 * Redirects to login page stored in configuration file
750 login_redirection(void *cls)
752 char *login_base_url;
754 struct MHD_Response *resp;
755 struct RequestHandle *handle = cls;
758 == GNUNET_CONFIGURATION_get_value_string (cfg, "identity-rest-plugin",
759 "address", &login_base_url) )
761 GNUNET_asprintf (&new_redirect, "%s?%s=%s&%s=%s&%s=%s&%s=%s&%s=%s&%s=%s",
763 OIDC_RESPONSE_TYPE_KEY,
764 handle->oidc->response_type,
766 handle->oidc->client_id,
767 OIDC_REDIRECT_URI_KEY,
768 handle->oidc->redirect_uri,
772 (NULL != handle->oidc->state) ? handle->oidc->state : "",
774 (NULL != handle->oidc->nonce) ? handle->oidc->nonce : "");
775 resp = GNUNET_REST_create_response ("");
776 MHD_add_response_header (resp, "Location", new_redirect);
777 GNUNET_free(login_base_url);
781 handle->emsg = GNUNET_strdup("server_error");
782 handle->edesc = GNUNET_strdup ("gnunet configuration failed");
783 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
784 GNUNET_SCHEDULER_add_now (&do_error, handle);
787 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
788 GNUNET_free(new_redirect);
789 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
793 * Does internal server error when iteration failed.
796 oidc_iteration_error (void *cls)
798 struct RequestHandle *handle = cls;
799 handle->emsg = GNUNET_strdup("INTERNAL_SERVER_ERROR");
800 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
801 GNUNET_SCHEDULER_add_now (&do_error, handle);
804 static void get_client_name_result (void *cls,
805 const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
807 unsigned int rd_count,
808 const struct GNUNET_GNSRECORD_Data *rd)
810 struct RequestHandle *handle = cls;
811 struct MHD_Response *resp;
814 char *code_json_string;
815 char *code_base64_final_string;
820 ticket_str = GNUNET_STRINGS_data_to_string_alloc (&handle->ticket,
821 sizeof (struct GNUNET_IDENTITY_PROVIDER_Ticket));
822 //TODO change if more attributes are needed (see max_age)
823 GNUNET_asprintf (&code_json_string, "{\"ticket\":\"%s\"%s%s%s}",
825 (NULL != handle->oidc->nonce) ? ", \"nonce\":\"" : "",
826 (NULL != handle->oidc->nonce) ? handle->oidc->nonce : "",
827 (NULL != handle->oidc->nonce) ? "\"" : "");
828 code_base64_final_string = base_64_encode(code_json_string);
829 tmp = GNUNET_strdup (handle->oidc->redirect_uri);
830 redirect_path = strtok (tmp, "/");
831 redirect_path = strtok (NULL, "/");
832 redirect_path = strtok (NULL, "/");
833 tmp_prefix = GNUNET_strdup (handle->oidc->redirect_uri);
834 prefix = strrchr (tmp_prefix,
835 (unsigned char) '.');
837 GNUNET_asprintf (&redirect_uri, "%s.%s/%s?%s=%s&state=%s",
841 handle->oidc->response_type,
842 code_base64_final_string, handle->oidc->state);
843 resp = GNUNET_REST_create_response ("");
844 MHD_add_response_header (resp, "Location", redirect_uri);
845 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
846 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
848 GNUNET_free (tmp_prefix);
849 GNUNET_free (redirect_uri);
850 GNUNET_free (ticket_str);
851 GNUNET_free (code_json_string);
852 GNUNET_free (code_base64_final_string);
857 get_client_name_error (void *cls)
859 struct RequestHandle *handle = cls;
861 handle->emsg = GNUNET_strdup("server_error");
862 handle->edesc = GNUNET_strdup("Server cannot generate ticket, no name found for client.");
863 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
867 * Issues ticket and redirects to relying party with the authorization code as
868 * parameter. Otherwise redirects with error
871 oidc_ticket_issue_cb (void* cls,
872 const struct GNUNET_IDENTITY_PROVIDER_Ticket *ticket)
874 struct RequestHandle *handle = cls;
875 handle->idp_op = NULL;
876 handle->ticket = *ticket;
877 if (NULL != ticket) {
878 GNUNET_NAMESTORE_zone_to_name (handle->namestore_handle,
880 &handle->oidc->client_pkey,
881 &get_client_name_error,
883 &get_client_name_result,
887 handle->emsg = GNUNET_strdup("server_error");
888 handle->edesc = GNUNET_strdup("Server cannot generate ticket.");
889 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
893 oidc_collect_finished_cb (void *cls)
895 struct RequestHandle *handle = cls;
896 handle->attr_it = NULL;
897 handle->ticket_it = NULL;
898 if (NULL == handle->attr_list->list_head)
900 handle->emsg = GNUNET_strdup("invalid_scope");
901 handle->edesc = GNUNET_strdup("The requested scope is not available.");
902 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
905 handle->idp_op = GNUNET_IDENTITY_PROVIDER_ticket_issue (handle->idp,
907 &handle->oidc->client_pkey,
909 &oidc_ticket_issue_cb,
915 * Collects all attributes for an ego if in scope parameter
918 oidc_attr_collect (void *cls,
919 const struct GNUNET_CRYPTO_EcdsaPublicKey *identity,
920 const struct GNUNET_IDENTITY_ATTRIBUTE_Claim *attr)
922 struct RequestHandle *handle = cls;
923 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimListEntry *le;
924 char* scope_variables;
925 char* scope_variable;
926 char delimiter[]=" ";
928 if ( (NULL == attr->name) || (NULL == attr->data) )
930 GNUNET_IDENTITY_PROVIDER_get_attributes_next (handle->attr_it);
934 scope_variables = GNUNET_strdup(handle->oidc->scope);
935 scope_variable = strtok (scope_variables, delimiter);
936 while (NULL != scope_variable)
938 if ( 0 == strcmp (attr->name, scope_variable) )
942 scope_variable = strtok (NULL, delimiter);
944 if ( NULL == scope_variable )
946 GNUNET_IDENTITY_PROVIDER_get_attributes_next (handle->attr_it);
947 GNUNET_free(scope_variables);
950 GNUNET_free(scope_variables);
952 le = GNUNET_new(struct GNUNET_IDENTITY_ATTRIBUTE_ClaimListEntry);
953 le->claim = GNUNET_IDENTITY_ATTRIBUTE_claim_new (attr->name, attr->type,
954 attr->data, attr->data_size);
955 GNUNET_CONTAINER_DLL_insert(handle->attr_list->list_head,
956 handle->attr_list->list_tail, le);
957 GNUNET_IDENTITY_PROVIDER_get_attributes_next (handle->attr_it);
962 * Checks time and cookie and redirects accordingly
965 login_check (void *cls)
967 struct RequestHandle *handle = cls;
968 struct GNUNET_TIME_Absolute current_time, *relog_time;
969 struct GNUNET_CRYPTO_EcdsaPublicKey pubkey, ego_pkey;
970 struct GNUNET_HashCode cache_key;
971 char *identity_cookie;
973 GNUNET_asprintf (&identity_cookie, "Identity=%s", handle->oidc->login_identity);
974 GNUNET_CRYPTO_hash (identity_cookie, strlen (identity_cookie), &cache_key);
975 GNUNET_free(identity_cookie);
976 //No login time for identity -> redirect to login
978 == GNUNET_CONTAINER_multihashmap_contains (OIDC_identity_login_time,
981 relog_time = GNUNET_CONTAINER_multihashmap_get (OIDC_identity_login_time,
983 current_time = GNUNET_TIME_absolute_get ();
984 // 30 min after old login -> redirect to login
985 if ( current_time.abs_value_us <= relog_time->abs_value_us )
988 != GNUNET_CRYPTO_ecdsa_public_key_from_string (
989 handle->oidc->login_identity,
990 strlen (handle->oidc->login_identity), &pubkey) )
992 handle->emsg = GNUNET_strdup("invalid_cookie");
993 handle->edesc = GNUNET_strdup(
994 "The cookie of a login identity is not valid");
995 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
998 // iterate over egos and compare their public key
999 for (handle->ego_entry = handle->ego_head;
1000 NULL != handle->ego_entry; handle->ego_entry = handle->ego_entry->next)
1002 GNUNET_IDENTITY_ego_get_public_key (handle->ego_entry->ego, &ego_pkey);
1004 == memcmp (&ego_pkey, &pubkey,
1005 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1007 handle->priv_key = *GNUNET_IDENTITY_ego_get_private_key (
1008 handle->ego_entry->ego);
1009 handle->resp_object = GNUNET_JSONAPI_document_new ();
1010 handle->idp = GNUNET_IDENTITY_PROVIDER_connect (cfg);
1011 handle->attr_list = GNUNET_new(
1012 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimList);
1013 handle->attr_it = GNUNET_IDENTITY_PROVIDER_get_attributes_start (
1014 handle->idp, &handle->priv_key, &oidc_iteration_error, handle,
1015 &oidc_attr_collect, handle, &oidc_collect_finished_cb, handle);
1019 handle->emsg = GNUNET_strdup("invalid_cookie");
1020 handle->edesc = GNUNET_strdup(
1021 "The cookie of the login identity is not valid");
1022 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1029 * Searches for client_id in namestore. If found trust status stored in handle
1030 * Else continues to search
1032 * @param handle the RequestHandle
1035 namestore_iteration_callback (
1036 void *cls, const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
1037 const char *rname, unsigned int rd_len,
1038 const struct GNUNET_GNSRECORD_Data *rd)
1040 struct RequestHandle *handle = cls;
1041 struct GNUNET_CRYPTO_EcdsaPublicKey login_identity_pkey;
1042 struct GNUNET_CRYPTO_EcdsaPublicKey current_zone_pkey;
1045 for (i = 0; i < rd_len; i++)
1047 if ( GNUNET_GNSRECORD_TYPE_PKEY != rd[i].record_type )
1050 if ( NULL != handle->oidc->login_identity )
1052 GNUNET_CRYPTO_ecdsa_public_key_from_string (
1053 handle->oidc->login_identity,
1054 strlen (handle->oidc->login_identity),
1055 &login_identity_pkey);
1056 GNUNET_IDENTITY_ego_get_public_key (handle->ego_entry->ego,
1057 ¤t_zone_pkey);
1059 if ( 0 == memcmp (rd[i].data, &handle->oidc->client_pkey,
1060 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1062 if ( 0 == memcmp (&login_identity_pkey, ¤t_zone_pkey,
1063 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1065 handle->oidc->is_client_trusted = GNUNET_YES;
1071 if ( 0 == memcmp (rd[i].data, &handle->oidc->client_pkey,
1072 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1074 handle->oidc->is_client_trusted = GNUNET_YES;
1079 GNUNET_NAMESTORE_zone_iterator_next (handle->namestore_handle_it,
1085 * Iteration over all results finished, build final
1088 * @param cls the `struct RequestHandle`
1091 namestore_iteration_finished (void *cls)
1093 struct RequestHandle *handle = cls;
1094 struct GNUNET_HashCode cache_key;
1096 char *expected_scope;
1097 char delimiter[]=" ";
1098 int number_of_ignored_parameter, iterator;
1101 handle->ego_entry = handle->ego_entry->next;
1103 if(NULL != handle->ego_entry)
1105 handle->priv_key = *GNUNET_IDENTITY_ego_get_private_key (handle->ego_entry->ego);
1106 handle->namestore_handle_it = GNUNET_NAMESTORE_zone_iteration_start (handle->namestore_handle, &handle->priv_key,
1107 &oidc_iteration_error, handle, &namestore_iteration_callback, handle,
1108 &namestore_iteration_finished, handle);
1111 if (GNUNET_NO == handle->oidc->is_client_trusted)
1113 handle->emsg = GNUNET_strdup("unauthorized_client");
1114 handle->edesc = GNUNET_strdup("The client is not authorized to request an "
1115 "authorization code using this method.");
1116 GNUNET_SCHEDULER_add_now (&do_error, handle);
1120 // REQUIRED value: redirect_uri
1121 GNUNET_CRYPTO_hash (OIDC_REDIRECT_URI_KEY, strlen (OIDC_REDIRECT_URI_KEY),
1123 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1126 handle->emsg=GNUNET_strdup("invalid_request");
1127 handle->edesc=GNUNET_strdup("missing parameter redirect_uri");
1128 GNUNET_SCHEDULER_add_now (&do_error, handle);
1131 handle->oidc->redirect_uri = GNUNET_strdup (GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1134 // REQUIRED value: response_type
1135 GNUNET_CRYPTO_hash (OIDC_RESPONSE_TYPE_KEY, strlen (OIDC_RESPONSE_TYPE_KEY),
1137 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1140 handle->emsg=GNUNET_strdup("invalid_request");
1141 handle->edesc=GNUNET_strdup("missing parameter response_type");
1142 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1145 handle->oidc->response_type = GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1147 handle->oidc->response_type = GNUNET_strdup (handle->oidc->response_type);
1149 // REQUIRED value: scope
1150 GNUNET_CRYPTO_hash (OIDC_SCOPE_KEY, strlen (OIDC_SCOPE_KEY), &cache_key);
1151 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1154 handle->emsg=GNUNET_strdup("invalid_request");
1155 handle->edesc=GNUNET_strdup("missing parameter scope");
1156 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1159 handle->oidc->scope = GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1161 handle->oidc->scope = GNUNET_strdup(handle->oidc->scope);
1163 //OPTIONAL value: nonce
1164 GNUNET_CRYPTO_hash (OIDC_NONCE_KEY, strlen (OIDC_NONCE_KEY), &cache_key);
1165 if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1168 handle->oidc->nonce = GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1170 handle->oidc->nonce = GNUNET_strdup (handle->oidc->nonce);
1173 //TODO check other values if needed
1174 number_of_ignored_parameter = sizeof(OIDC_ignored_parameter_array) / sizeof(char *);
1175 for( iterator = 0; iterator < number_of_ignored_parameter; iterator++ )
1177 GNUNET_CRYPTO_hash (OIDC_ignored_parameter_array[iterator],
1178 strlen(OIDC_ignored_parameter_array[iterator]),
1180 if(GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains(handle->rest_handle->url_param_map,
1183 handle->emsg=GNUNET_strdup("access_denied");
1184 GNUNET_asprintf (&handle->edesc, "Server will not handle parameter: %s",
1185 OIDC_ignored_parameter_array[iterator]);
1186 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1191 // Checks if response_type is 'code'
1192 if( 0 != strcmp( handle->oidc->response_type, OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE ) )
1194 handle->emsg=GNUNET_strdup("unsupported_response_type");
1195 handle->edesc=GNUNET_strdup("The authorization server does not support "
1196 "obtaining this authorization code.");
1197 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1201 // Checks if scope contains 'openid'
1202 expected_scope = GNUNET_strdup(handle->oidc->scope);
1204 test = strtok (expected_scope, delimiter);
1205 while (NULL != test)
1207 if ( 0 == strcmp (OIDC_EXPECTED_AUTHORIZATION_SCOPE, expected_scope) )
1211 test = strtok (NULL, delimiter);
1215 handle->emsg = GNUNET_strdup("invalid_scope");
1216 handle->edesc=GNUNET_strdup("The requested scope is invalid, unknown, or "
1218 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1219 GNUNET_free(expected_scope);
1223 GNUNET_free(expected_scope);
1225 if( NULL != handle->oidc->login_identity )
1227 GNUNET_SCHEDULER_add_now(&login_check,handle);
1231 GNUNET_SCHEDULER_add_now(&login_redirection,handle);
1235 * Responds to authorization GET and url-encoded POST request
1237 * @param con_handle the connection handle
1238 * @param url the url
1239 * @param cls the RequestHandle
1242 authorize_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
1246 struct RequestHandle *handle = cls;
1247 struct GNUNET_HashCode cache_key;
1248 struct EgoEntry *tmp_ego;
1249 struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
1250 const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key;
1252 cookie_identity_interpretation(handle);
1254 //RECOMMENDED value: state - REQUIRED for answers
1255 GNUNET_CRYPTO_hash (OIDC_STATE_KEY, strlen (OIDC_STATE_KEY), &cache_key);
1256 if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1259 handle->oidc->state = GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1261 handle->oidc->state = GNUNET_strdup (handle->oidc->state);
1264 // REQUIRED value: client_id
1265 GNUNET_CRYPTO_hash (OIDC_CLIENT_ID_KEY, strlen (OIDC_CLIENT_ID_KEY),
1267 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->url_param_map,
1270 handle->emsg=GNUNET_strdup("invalid_request");
1271 handle->edesc=GNUNET_strdup("missing parameter client_id");
1272 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1273 GNUNET_SCHEDULER_add_now (&do_error, handle);
1276 handle->oidc->client_id = GNUNET_strdup (GNUNET_CONTAINER_multihashmap_get(handle->rest_handle->url_param_map,
1280 != GNUNET_CRYPTO_ecdsa_public_key_from_string (handle->oidc->client_id,
1281 strlen (handle->oidc->client_id),
1282 &handle->oidc->client_pkey) )
1284 handle->emsg = GNUNET_strdup("unauthorized_client");
1285 handle->edesc = GNUNET_strdup("The client is not authorized to request an "
1286 "authorization code using this method.");
1287 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1288 GNUNET_SCHEDULER_add_now (&do_error, handle);
1293 if ( NULL == handle->ego_head )
1295 handle->emsg = GNUNET_strdup("server_error");
1296 handle->edesc = GNUNET_strdup ("Egos are missing");
1297 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1298 GNUNET_SCHEDULER_add_now (&do_error, handle);
1302 handle->ego_entry = handle->ego_head;
1303 handle->priv_key = *GNUNET_IDENTITY_ego_get_private_key (handle->ego_head->ego);
1304 handle->oidc->is_client_trusted = GNUNET_NO;
1306 //First check if client_id is one of our egos; TODO: handle other TLD cases: Delegation, from config
1307 for (tmp_ego = handle->ego_head; NULL != tmp_ego; tmp_ego = tmp_ego->next)
1309 priv_key = GNUNET_IDENTITY_ego_get_private_key (tmp_ego->ego);
1310 GNUNET_CRYPTO_ecdsa_key_get_public (priv_key,
1312 if ( 0 == memcmp (&pkey, &handle->oidc->client_pkey,
1313 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) )
1315 handle->tld = GNUNET_strdup (tmp_ego->identifier);
1316 handle->oidc->is_client_trusted = GNUNET_YES;
1317 handle->ego_entry = handle->ego_tail;
1322 // Checks if client_id is valid:
1323 handle->namestore_handle_it = GNUNET_NAMESTORE_zone_iteration_start (
1324 handle->namestore_handle, &handle->priv_key, &oidc_iteration_error,
1325 handle, &namestore_iteration_callback, handle,
1326 &namestore_iteration_finished, handle);
1330 * Combines an identity with a login time and responds OK to login request
1332 * @param con_handle the connection handle
1333 * @param url the url
1334 * @param cls the RequestHandle
1337 login_cont (struct GNUNET_REST_RequestHandle *con_handle,
1341 struct MHD_Response *resp = GNUNET_REST_create_response ("");
1342 struct RequestHandle *handle = cls;
1343 struct GNUNET_HashCode cache_key;
1344 struct GNUNET_TIME_Absolute *current_time;
1345 struct GNUNET_TIME_Absolute *last_time;
1350 char term_data[handle->rest_handle->data_size+1];
1351 term_data[handle->rest_handle->data_size] = '\0';
1352 GNUNET_memcpy (term_data, handle->rest_handle->data, handle->rest_handle->data_size);
1353 root = json_loads (term_data, JSON_DECODE_ANY, &error);
1354 identity = json_object_get (root, "identity");
1355 if ( json_is_string(identity) )
1357 GNUNET_asprintf (&cookie, "Identity=%s", json_string_value (identity));
1358 MHD_add_response_header (resp, "Set-Cookie", cookie);
1359 MHD_add_response_header (resp, "Access-Control-Allow-Methods", "POST");
1360 GNUNET_CRYPTO_hash (cookie, strlen (cookie), &cache_key);
1362 current_time = GNUNET_new(struct GNUNET_TIME_Absolute);
1363 *current_time = GNUNET_TIME_relative_to_absolute (
1364 GNUNET_TIME_relative_multiply (GNUNET_TIME_relative_get_minute_ (),
1366 last_time = GNUNET_CONTAINER_multihashmap_get(OIDC_identity_login_time, &cache_key);
1367 if (NULL != last_time)
1369 GNUNET_free(last_time);
1371 GNUNET_CONTAINER_multihashmap_put (
1372 OIDC_identity_login_time, &cache_key, current_time,
1373 GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
1375 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
1376 GNUNET_free(cookie);
1380 handle->proc (handle->proc_cls, resp, MHD_HTTP_BAD_REQUEST);
1383 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
1388 * Responds to token url-encoded POST request
1390 * @param con_handle the connection handle
1391 * @param url the url
1392 * @param cls the RequestHandle
1395 token_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
1399 //TODO static strings
1400 struct RequestHandle *handle = cls;
1401 struct GNUNET_HashCode cache_key;
1402 char *authorization, *credentials;
1403 char delimiter[]=" ";
1404 char delimiter_user_psw[]=":";
1405 char *grant_type, *code;
1406 char *user_psw = NULL, *client_id, *psw;
1408 int client_exists = GNUNET_NO;
1409 struct MHD_Response *resp;
1411 json_t *root, *ticket_string, *nonce, *max_age;
1413 char *json_response;
1416 * Check Authorization
1418 GNUNET_CRYPTO_hash (OIDC_AUTHORIZATION_HEADER_KEY,
1419 strlen (OIDC_AUTHORIZATION_HEADER_KEY),
1421 if ( GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->header_param_map,
1424 handle->emsg=GNUNET_strdup("invalid_client");
1425 handle->edesc=GNUNET_strdup("missing authorization");
1426 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1427 GNUNET_SCHEDULER_add_now (&do_error, handle);
1430 authorization = GNUNET_CONTAINER_multihashmap_get ( handle->rest_handle->header_param_map, &cache_key);
1432 //split header in "Basic" and [content]
1433 credentials = strtok (authorization, delimiter);
1434 if (0 != strcmp ("Basic",credentials))
1436 handle->emsg=GNUNET_strdup("invalid_client");
1437 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1438 GNUNET_SCHEDULER_add_now (&do_error, handle);
1441 credentials = strtok(NULL, delimiter);
1442 if (NULL == credentials)
1444 handle->emsg=GNUNET_strdup("invalid_client");
1445 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1446 GNUNET_SCHEDULER_add_now (&do_error, handle);
1449 GNUNET_STRINGS_base64_decode (credentials, strlen (credentials), &user_psw);
1451 if ( NULL == user_psw )
1453 handle->emsg=GNUNET_strdup("invalid_client");
1454 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1455 GNUNET_SCHEDULER_add_now (&do_error, handle);
1458 client_id = strtok (user_psw, delimiter_user_psw);
1459 if ( NULL == client_id )
1461 GNUNET_free_non_null(user_psw);
1462 handle->emsg=GNUNET_strdup("invalid_client");
1463 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1464 GNUNET_SCHEDULER_add_now (&do_error, handle);
1467 psw = strtok (NULL, delimiter_user_psw);
1470 GNUNET_free_non_null(user_psw);
1471 handle->emsg=GNUNET_strdup("invalid_client");
1472 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1473 GNUNET_SCHEDULER_add_now (&do_error, handle);
1477 //check client password
1479 == GNUNET_CONFIGURATION_get_value_string (cfg, "identity-rest-plugin",
1480 "psw", &expected_psw) )
1482 if (0 != strcmp (expected_psw, psw))
1484 GNUNET_free_non_null(user_psw);
1485 GNUNET_free(expected_psw);
1486 handle->emsg=GNUNET_strdup("invalid_client");
1487 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1488 GNUNET_SCHEDULER_add_now (&do_error, handle);
1491 GNUNET_free(expected_psw);
1495 GNUNET_free_non_null(user_psw);
1496 handle->emsg = GNUNET_strdup("server_error");
1497 handle->edesc = GNUNET_strdup ("gnunet configuration failed");
1498 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1499 GNUNET_SCHEDULER_add_now (&do_error, handle);
1504 for (handle->ego_entry = handle->ego_head; NULL != handle->ego_entry->next; )
1506 if ( 0 == strcmp(handle->ego_entry->keystring, client_id))
1508 client_exists = GNUNET_YES;
1511 handle->ego_entry = handle->ego_entry->next;
1513 if (GNUNET_NO == client_exists)
1515 GNUNET_free_non_null(user_psw);
1516 handle->emsg=GNUNET_strdup("invalid_client");
1517 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1518 GNUNET_SCHEDULER_add_now (&do_error, handle);
1526 //TODO Do not allow multiple equal parameter names
1527 //REQUIRED grant_type
1528 GNUNET_CRYPTO_hash (OIDC_GRANT_TYPE_KEY, strlen (OIDC_GRANT_TYPE_KEY), &cache_key);
1530 == GNUNET_CONTAINER_multihashmap_contains (
1531 handle->rest_handle->url_param_map, &cache_key) )
1533 GNUNET_free_non_null(user_psw);
1534 handle->emsg = GNUNET_strdup("invalid_request");
1535 handle->edesc = GNUNET_strdup("missing parameter grant_type");
1536 handle->response_code = MHD_HTTP_BAD_REQUEST;
1537 GNUNET_SCHEDULER_add_now (&do_error, handle);
1540 grant_type = GNUNET_CONTAINER_multihashmap_get (
1541 handle->rest_handle->url_param_map, &cache_key);
1544 GNUNET_CRYPTO_hash (OIDC_CODE_KEY, strlen (OIDC_CODE_KEY), &cache_key);
1546 == GNUNET_CONTAINER_multihashmap_contains (
1547 handle->rest_handle->url_param_map, &cache_key) )
1549 GNUNET_free_non_null(user_psw);
1550 handle->emsg = GNUNET_strdup("invalid_request");
1551 handle->edesc = GNUNET_strdup("missing parameter code");
1552 handle->response_code = MHD_HTTP_BAD_REQUEST;
1553 GNUNET_SCHEDULER_add_now (&do_error, handle);
1556 code = GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->url_param_map,
1559 //REQUIRED redirect_uri
1560 GNUNET_CRYPTO_hash (OIDC_REDIRECT_URI_KEY, strlen (OIDC_REDIRECT_URI_KEY),
1563 == GNUNET_CONTAINER_multihashmap_contains (
1564 handle->rest_handle->url_param_map, &cache_key) )
1566 GNUNET_free_non_null(user_psw);
1567 handle->emsg = GNUNET_strdup("invalid_request");
1568 handle->edesc = GNUNET_strdup("missing parameter redirect_uri");
1569 handle->response_code = MHD_HTTP_BAD_REQUEST;
1570 GNUNET_SCHEDULER_add_now (&do_error, handle);
1574 //Check parameter grant_type == "authorization_code"
1575 if (0 != strcmp(OIDC_GRANT_TYPE_VALUE, grant_type))
1577 GNUNET_free_non_null(user_psw);
1578 handle->emsg=GNUNET_strdup("unsupported_grant_type");
1579 handle->response_code = MHD_HTTP_BAD_REQUEST;
1580 GNUNET_SCHEDULER_add_now (&do_error, handle);
1583 GNUNET_CRYPTO_hash (code, strlen (code), &cache_key);
1586 == GNUNET_CONTAINER_multihashmap_put (OIDC_ticket_once,
1589 GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY) )
1591 GNUNET_free_non_null(user_psw);
1592 handle->emsg = GNUNET_strdup("invalid_request");
1593 handle->edesc = GNUNET_strdup("Cannot use the same code more than once");
1594 handle->response_code = MHD_HTTP_BAD_REQUEST;
1595 GNUNET_SCHEDULER_add_now (&do_error, handle);
1600 GNUNET_STRINGS_base64_decode(code,strlen(code),&code_output);
1601 root = json_loads (code_output, 0, &error);
1602 GNUNET_free(code_output);
1603 ticket_string = json_object_get (root, "ticket");
1604 nonce = json_object_get (root, "nonce");
1605 max_age = json_object_get (root, "max_age");
1607 if(ticket_string == NULL && !json_is_string(ticket_string))
1609 GNUNET_free_non_null(user_psw);
1610 handle->emsg = GNUNET_strdup("invalid_request");
1611 handle->edesc = GNUNET_strdup("invalid code");
1612 handle->response_code = MHD_HTTP_BAD_REQUEST;
1613 GNUNET_SCHEDULER_add_now (&do_error, handle);
1617 struct GNUNET_IDENTITY_PROVIDER_Ticket *ticket = GNUNET_new(struct GNUNET_IDENTITY_PROVIDER_Ticket);
1619 != GNUNET_STRINGS_string_to_data (json_string_value(ticket_string),
1620 strlen (json_string_value(ticket_string)),
1622 sizeof(struct GNUNET_IDENTITY_PROVIDER_Ticket)))
1624 GNUNET_free_non_null(user_psw);
1625 handle->emsg = GNUNET_strdup("invalid_request");
1626 handle->edesc = GNUNET_strdup("invalid code");
1627 handle->response_code = MHD_HTTP_BAD_REQUEST;
1628 GNUNET_SCHEDULER_add_now (&do_error, handle);
1629 GNUNET_free(ticket);
1632 // this is the current client (relying party)
1633 struct GNUNET_CRYPTO_EcdsaPublicKey pub_key;
1634 GNUNET_IDENTITY_ego_get_public_key(handle->ego_entry->ego,&pub_key);
1635 if (0 != memcmp(&pub_key,&ticket->audience,sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)))
1637 GNUNET_free_non_null(user_psw);
1638 handle->emsg = GNUNET_strdup("invalid_request");
1639 handle->edesc = GNUNET_strdup("invalid code");
1640 handle->response_code = MHD_HTTP_BAD_REQUEST;
1641 GNUNET_SCHEDULER_add_now (&do_error, handle);
1642 GNUNET_free(ticket);
1647 unsigned long long int expiration_time;
1649 != GNUNET_CONFIGURATION_get_value_number(cfg, "identity-rest-plugin",
1650 "expiration_time", &expiration_time) )
1652 GNUNET_free_non_null(user_psw);
1653 handle->emsg = GNUNET_strdup("server_error");
1654 handle->edesc = GNUNET_strdup ("gnunet configuration failed");
1655 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1656 GNUNET_SCHEDULER_add_now (&do_error, handle);
1657 GNUNET_free(ticket);
1661 struct GNUNET_IDENTITY_ATTRIBUTE_ClaimList *cl = GNUNET_new (struct GNUNET_IDENTITY_ATTRIBUTE_ClaimList);
1662 //aud REQUIRED public key client_id must be there
1663 GNUNET_IDENTITY_ATTRIBUTE_list_add(cl,
1665 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1668 //exp REQUIRED time expired from config
1669 struct GNUNET_TIME_Absolute exp_time = GNUNET_TIME_relative_to_absolute (
1670 GNUNET_TIME_relative_multiply (GNUNET_TIME_relative_get_second_ (),
1672 const char* exp_time_string = GNUNET_STRINGS_absolute_time_to_string(exp_time);
1673 GNUNET_IDENTITY_ATTRIBUTE_list_add (cl,
1675 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1677 strlen(exp_time_string));
1678 //iat REQUIRED time now
1679 struct GNUNET_TIME_Absolute time_now = GNUNET_TIME_absolute_get();
1680 const char* time_now_string = GNUNET_STRINGS_absolute_time_to_string(time_now);
1681 GNUNET_IDENTITY_ATTRIBUTE_list_add (cl,
1683 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1685 strlen(time_now_string));
1686 //nonce only if nonce is provided
1687 if ( NULL != nonce && json_is_string(nonce) )
1689 GNUNET_IDENTITY_ATTRIBUTE_list_add (cl,
1691 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1692 json_string_value(nonce),
1693 strlen(json_string_value(nonce)));
1695 //auth_time only if max_age is provided
1696 if ( NULL != max_age && json_is_string(max_age) )
1698 GNUNET_IDENTITY_ATTRIBUTE_list_add (cl,
1700 GNUNET_IDENTITY_ATTRIBUTE_TYPE_STRING,
1701 json_string_value(max_age),
1702 strlen(json_string_value(max_age)));
1704 //TODO OPTIONAL acr,amr,azp
1706 struct EgoEntry *ego_entry;
1707 for (ego_entry = handle->ego_head; NULL != ego_entry; ego_entry = ego_entry->next)
1709 GNUNET_IDENTITY_ego_get_public_key (ego_entry->ego, &pub_key);
1710 if (0 == memcmp (&pub_key, &ticket->audience, sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)))
1715 if ( NULL == ego_entry )
1717 GNUNET_free_non_null(user_psw);
1718 handle->emsg = GNUNET_strdup("invalid_request");
1719 handle->edesc = GNUNET_strdup("invalid code....");
1720 handle->response_code = MHD_HTTP_BAD_REQUEST;
1721 GNUNET_SCHEDULER_add_now (&do_error, handle);
1722 GNUNET_free(ticket);
1725 char *id_token = jwt_create_from_list(&ticket->audience,
1727 GNUNET_IDENTITY_ego_get_private_key(ego_entry->ego));
1729 //Create random access_token
1730 char* access_token_number;
1732 uint64_t random_number;
1733 random_number = GNUNET_CRYPTO_random_u64(GNUNET_CRYPTO_QUALITY_NONCE, UINT64_MAX);
1734 GNUNET_asprintf(&access_token_number, "%" PRIu64, random_number);
1735 GNUNET_STRINGS_base64_encode(access_token_number,strlen(access_token_number),&access_token);
1739 //TODO OPTIONAL add refresh_token and scope
1740 GNUNET_asprintf (&json_response,
1741 "{ \"access_token\" : \"%s\", "
1742 "\"token_type\" : \"Bearer\", "
1743 "\"expires_in\" : %d, "
1744 "\"id_token\" : \"%s\"}",
1748 GNUNET_CRYPTO_hash(access_token, strlen(access_token), &cache_key);
1749 char *id_ticket_combination;
1750 GNUNET_asprintf(&id_ticket_combination,
1753 json_string_value(ticket_string));
1754 GNUNET_CONTAINER_multihashmap_put(OIDC_interpret_access_token,
1756 id_ticket_combination,
1757 GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
1759 resp = GNUNET_REST_create_response (json_response);
1760 MHD_add_response_header (resp, "Cache-Control", "no-store");
1761 MHD_add_response_header (resp, "Pragma", "no-cache");
1762 MHD_add_response_header (resp, "Content-Type", "application/json");
1763 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
1765 GNUNET_IDENTITY_ATTRIBUTE_list_destroy(cl);
1766 GNUNET_free(access_token_number);
1767 GNUNET_free(access_token);
1768 GNUNET_free(user_psw);
1769 GNUNET_free(json_response);
1770 GNUNET_free(ticket);
1771 GNUNET_free(id_token);
1773 GNUNET_SCHEDULER_add_now(&cleanup_handle_delayed, handle);
1777 * Collects claims and stores them in handle
1780 consume_ticket (void *cls,
1781 const struct GNUNET_CRYPTO_EcdsaPublicKey *identity,
1782 const struct GNUNET_IDENTITY_ATTRIBUTE_Claim *attr)
1784 struct RequestHandle *handle = cls;
1788 if (NULL == identity)
1790 GNUNET_SCHEDULER_add_now (&return_userinfo_response, handle);
1794 tmp_value = GNUNET_IDENTITY_ATTRIBUTE_value_to_string (attr->type,
1798 value = json_string (tmp_value);
1801 json_object_set_new (handle->oidc->response,
1804 GNUNET_free (tmp_value);
1808 * Responds to userinfo GET and url-encoded POST request
1810 * @param con_handle the connection handle
1811 * @param url the url
1812 * @param cls the RequestHandle
1815 userinfo_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
1816 const char* url, void *cls)
1818 //TODO expiration time
1819 struct RequestHandle *handle = cls;
1820 char delimiter[] = " ";
1821 char delimiter_db[] = ";";
1822 struct GNUNET_HashCode cache_key;
1823 char *authorization, *authorization_type, *authorization_access_token;
1824 char *client_ticket, *client, *ticket_str;
1825 struct GNUNET_IDENTITY_PROVIDER_Ticket *ticket;
1827 GNUNET_CRYPTO_hash (OIDC_AUTHORIZATION_HEADER_KEY,
1828 strlen (OIDC_AUTHORIZATION_HEADER_KEY),
1831 == GNUNET_CONTAINER_multihashmap_contains (
1832 handle->rest_handle->header_param_map, &cache_key) )
1834 handle->emsg = GNUNET_strdup("invalid_token");
1835 handle->edesc = GNUNET_strdup("No Access Token");
1836 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1837 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1840 authorization = GNUNET_CONTAINER_multihashmap_get (
1841 handle->rest_handle->header_param_map, &cache_key);
1843 //split header in "Bearer" and access_token
1844 authorization = GNUNET_strdup(authorization);
1845 authorization_type = strtok (authorization, delimiter);
1846 if ( 0 != strcmp ("Bearer", authorization_type) )
1848 handle->emsg = GNUNET_strdup("invalid_token");
1849 handle->edesc = GNUNET_strdup("No Access Token");
1850 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1851 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1852 GNUNET_free(authorization);
1855 authorization_access_token = strtok (NULL, delimiter);
1856 if ( NULL == authorization_access_token )
1858 handle->emsg = GNUNET_strdup("invalid_token");
1859 handle->edesc = GNUNET_strdup("No Access Token");
1860 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1861 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1862 GNUNET_free(authorization);
1866 GNUNET_CRYPTO_hash (authorization_access_token,
1867 strlen (authorization_access_token),
1869 if ( GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (OIDC_interpret_access_token,
1872 handle->emsg = GNUNET_strdup("invalid_token");
1873 handle->edesc = GNUNET_strdup("The Access Token expired");
1874 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1875 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1876 GNUNET_free(authorization);
1880 client_ticket = GNUNET_CONTAINER_multihashmap_get(OIDC_interpret_access_token,
1882 client_ticket = GNUNET_strdup(client_ticket);
1883 client = strtok(client_ticket,delimiter_db);
1886 handle->emsg = GNUNET_strdup("invalid_token");
1887 handle->edesc = GNUNET_strdup("The Access Token expired");
1888 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1889 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1890 GNUNET_free(authorization);
1891 GNUNET_free(client_ticket);
1894 handle->ego_entry = handle->ego_head;
1895 for(; NULL != handle->ego_entry; handle->ego_entry = handle->ego_entry->next)
1897 if (0 == strcmp(handle->ego_entry->keystring,client))
1902 if (NULL == handle->ego_entry)
1904 handle->emsg = GNUNET_strdup("invalid_token");
1905 handle->edesc = GNUNET_strdup("The Access Token expired");
1906 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1907 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1908 GNUNET_free(authorization);
1909 GNUNET_free(client_ticket);
1912 ticket_str = strtok(NULL, delimiter_db);
1913 if (NULL == ticket_str)
1915 handle->emsg = GNUNET_strdup("invalid_token");
1916 handle->edesc = GNUNET_strdup("The Access Token expired");
1917 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1918 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1919 GNUNET_free(authorization);
1920 GNUNET_free(client_ticket);
1923 ticket = GNUNET_new(struct GNUNET_IDENTITY_PROVIDER_Ticket);
1925 != GNUNET_STRINGS_string_to_data (ticket_str,
1926 strlen (ticket_str),
1928 sizeof(struct GNUNET_IDENTITY_PROVIDER_Ticket)))
1930 handle->emsg = GNUNET_strdup("invalid_token");
1931 handle->edesc = GNUNET_strdup("The Access Token expired");
1932 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1933 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1934 GNUNET_free(ticket);
1935 GNUNET_free(authorization);
1936 GNUNET_free(client_ticket);
1940 handle->idp = GNUNET_IDENTITY_PROVIDER_connect (cfg);
1941 handle->oidc->response = json_object();
1942 json_object_set_new( handle->oidc->response, "sub", json_string( handle->ego_entry->keystring));
1943 handle->idp_op = GNUNET_IDENTITY_PROVIDER_ticket_consume (
1945 GNUNET_IDENTITY_ego_get_private_key (handle->ego_entry->ego),
1949 GNUNET_free(ticket);
1950 GNUNET_free(authorization);
1951 GNUNET_free(client_ticket);
1957 * Handle rest request
1959 * @param handle the request handle
1962 init_cont (struct RequestHandle *handle)
1964 struct GNUNET_REST_RequestHandlerError err;
1965 static const struct GNUNET_REST_RequestHandler handlers[] = {
1966 {MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_AUTHORIZE, &authorize_endpoint},
1967 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_AUTHORIZE, &authorize_endpoint}, //url-encoded
1968 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_LOGIN, &login_cont},
1969 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_TOKEN, &token_endpoint },
1970 {MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_USERINFO, &userinfo_endpoint },
1971 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_USERINFO, &userinfo_endpoint },
1972 {MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_OIDC,
1974 GNUNET_REST_HANDLER_END
1977 if (GNUNET_NO == GNUNET_REST_handle_request (handle->rest_handle,
1982 handle->response_code = err.error_code;
1983 GNUNET_SCHEDULER_add_now (&do_error, handle);
1988 * If listing is enabled, prints information about the egos.
1990 * This function is initially called for all egos and then again
1991 * whenever a ego's identifier changes or if it is deleted. At the
1992 * end of the initial pass over all egos, the function is once called
1993 * with 'NULL' for 'ego'. That does NOT mean that the callback won't
1994 * be invoked in the future or that there was an error.
1996 * When used with 'GNUNET_IDENTITY_create' or 'GNUNET_IDENTITY_get',
1997 * this function is only called ONCE, and 'NULL' being passed in
1998 * 'ego' does indicate an error (i.e. name is taken or no default
1999 * value is known). If 'ego' is non-NULL and if '*ctx'
2000 * is set in those callbacks, the value WILL be passed to a subsequent
2001 * call to the identity callback of 'GNUNET_IDENTITY_connect' (if
2002 * that one was not NULL).
2004 * When an identity is renamed, this function is called with the
2005 * (known) ego but the NEW identifier.
2007 * When an identity is deleted, this function is called with the
2008 * (known) ego and "NULL" for the 'identifier'. In this case,
2009 * the 'ego' is henceforth invalid (and the 'ctx' should also be
2012 * @param cls closure
2013 * @param ego ego handle
2014 * @param ctx context for application to store data for this ego
2015 * (during the lifetime of this process, initially NULL)
2016 * @param identifier identifier assigned by the user for this ego,
2017 * NULL if the user just deleted the ego and it
2018 * must thus no longer be used
2021 list_ego (void *cls,
2022 struct GNUNET_IDENTITY_Ego *ego,
2024 const char *identifier)
2026 struct RequestHandle *handle = cls;
2027 struct EgoEntry *ego_entry;
2028 struct GNUNET_CRYPTO_EcdsaPublicKey pk;
2030 if ((NULL == ego) && (ID_REST_STATE_INIT == handle->state))
2032 handle->state = ID_REST_STATE_POST_INIT;
2036 if (ID_REST_STATE_INIT == handle->state) {
2037 ego_entry = GNUNET_new (struct EgoEntry);
2038 GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
2039 ego_entry->keystring =
2040 GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
2041 ego_entry->ego = ego;
2042 ego_entry->identifier = GNUNET_strdup (identifier);
2043 GNUNET_CONTAINER_DLL_insert_tail(handle->ego_head,handle->ego_tail, ego_entry);
2046 /* Ego renamed or added */
2047 if (identifier != NULL) {
2048 for (ego_entry = handle->ego_head; NULL != ego_entry; ego_entry = ego_entry->next) {
2049 if (ego_entry->ego == ego) {
2051 GNUNET_free (ego_entry->identifier);
2052 ego_entry->identifier = GNUNET_strdup (identifier);
2056 if (NULL == ego_entry) {
2058 ego_entry = GNUNET_new (struct EgoEntry);
2059 GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
2060 ego_entry->keystring =
2061 GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
2062 ego_entry->ego = ego;
2063 ego_entry->identifier = GNUNET_strdup (identifier);
2064 GNUNET_CONTAINER_DLL_insert_tail(handle->ego_head,handle->ego_tail, ego_entry);
2068 for (ego_entry = handle->ego_head; NULL != ego_entry; ego_entry = ego_entry->next) {
2069 if (ego_entry->ego == ego)
2072 if (NULL != ego_entry)
2073 GNUNET_CONTAINER_DLL_remove(handle->ego_head,handle->ego_tail, ego_entry);
2079 rest_identity_process_request(struct GNUNET_REST_RequestHandle *rest_handle,
2080 GNUNET_REST_ResultProcessor proc,
2083 struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
2084 handle->oidc = GNUNET_new (struct OIDC_Variables);
2085 if ( NULL == OIDC_identity_login_time )
2086 OIDC_identity_login_time = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2087 if ( NULL == OIDC_identity_grants )
2088 OIDC_identity_grants = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2089 if ( NULL == OIDC_ticket_once )
2090 OIDC_ticket_once = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2091 if ( NULL == OIDC_interpret_access_token )
2092 OIDC_interpret_access_token = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2093 handle->response_code = 0;
2094 handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
2095 handle->proc_cls = proc_cls;
2096 handle->proc = proc;
2097 handle->state = ID_REST_STATE_INIT;
2098 handle->rest_handle = rest_handle;
2100 handle->url = GNUNET_strdup (rest_handle->url);
2101 if (handle->url[strlen (handle->url)-1] == '/')
2102 handle->url[strlen (handle->url)-1] = '\0';
2103 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2105 handle->identity_handle = GNUNET_IDENTITY_connect (cfg,
2108 handle->namestore_handle = GNUNET_NAMESTORE_connect (cfg);
2109 handle->timeout_task =
2110 GNUNET_SCHEDULER_add_delayed (handle->timeout,
2113 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2118 * Entry point for the plugin.
2120 * @param cls Config info
2121 * @return NULL on error, otherwise the plugin context
2124 libgnunet_plugin_rest_openid_connect_init (void *cls)
2126 static struct Plugin plugin;
2127 struct GNUNET_REST_Plugin *api;
2130 if (NULL != plugin.cfg)
2131 return NULL; /* can only initialize once! */
2132 memset (&plugin, 0, sizeof (struct Plugin));
2134 api = GNUNET_new (struct GNUNET_REST_Plugin);
2136 api->name = GNUNET_REST_API_NS_OIDC;
2137 api->process_request = &rest_identity_process_request;
2138 GNUNET_asprintf (&allow_methods,
2139 "%s, %s, %s, %s, %s",
2140 MHD_HTTP_METHOD_GET,
2141 MHD_HTTP_METHOD_POST,
2142 MHD_HTTP_METHOD_PUT,
2143 MHD_HTTP_METHOD_DELETE,
2144 MHD_HTTP_METHOD_OPTIONS);
2146 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2147 _("Identity Provider REST API initialized\n"));
2153 * Exit point from the plugin.
2155 * @param cls the plugin context (as returned by "init")
2156 * @return always NULL
2159 libgnunet_plugin_rest_openid_connect_done (void *cls)
2161 struct GNUNET_REST_Plugin *api = cls;
2162 struct Plugin *plugin = api->cls;
2165 struct GNUNET_CONTAINER_MultiHashMapIterator *hashmap_it;
2167 hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (
2168 OIDC_identity_login_time);
2169 while (GNUNET_YES ==
2170 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2175 GNUNET_CONTAINER_multihashmap_destroy(OIDC_identity_login_time);
2176 hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (OIDC_identity_grants);
2177 while (GNUNET_YES ==
2178 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2183 GNUNET_CONTAINER_multihashmap_destroy(OIDC_identity_grants);
2184 hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (OIDC_ticket_once);
2185 while (GNUNET_YES ==
2186 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2191 GNUNET_CONTAINER_multihashmap_destroy(OIDC_ticket_once);
2192 hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (OIDC_interpret_access_token);
2193 while (GNUNET_YES ==
2194 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2199 GNUNET_CONTAINER_multihashmap_destroy(OIDC_interpret_access_token);
2200 GNUNET_CONTAINER_multihashmap_iterator_destroy(hashmap_it);
2201 GNUNET_free_non_null (allow_methods);
2203 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2204 "Identity Provider REST plugin is finished\n");
2208 /* end of plugin_rest_identity_provider.c */