2 This file is part of GNUnet.
3 Copyright (C) 2012-2018 GNUnet e.V.
5 GNUnet is free software: you can redistribute it and/or modify it
6 under the terms of the GNU Affero General Public License as published
7 by the Free Software Foundation, either version 3 of the License,
8 or (at your option) any later version.
10 GNUnet is distributed in the hope that it will be useful, but
11 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Affero General Public License for more details.
15 You should have received a copy of the GNU Affero General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 SPDX-License-Identifier: AGPL3.0-or-later
21 * @author Martin Schanzenbach
22 * @author Philippe Buschmann
23 * @file identity/plugin_rest_openid_connect.c
24 * @brief GNUnet Namestore REST plugin
31 #include "gnunet_gns_service.h"
32 #include "gnunet_gnsrecord_lib.h"
33 #include "gnunet_identity_service.h"
34 #include "gnunet_namestore_service.h"
35 #include "gnunet_reclaim_attribute_lib.h"
36 #include "gnunet_reclaim_service.h"
37 #include "gnunet_rest_lib.h"
38 #include "gnunet_rest_plugin.h"
39 #include "gnunet_signatures.h"
40 #include "microhttpd.h"
41 #include "oidc_helper.h"
45 #define GNUNET_REST_API_NS_OIDC "/openid"
50 #define GNUNET_REST_API_NS_AUTHORIZE "/openid/authorize"
55 #define GNUNET_REST_API_NS_TOKEN "/openid/token"
60 #define GNUNET_REST_API_NS_USERINFO "/openid/userinfo"
65 #define GNUNET_REST_API_NS_LOGIN "/openid/login"
68 * State while collecting all egos
70 #define ID_REST_STATE_INIT 0
73 * Done collecting egos
75 #define ID_REST_STATE_POST_INIT 1
80 #define OIDC_GRANT_TYPE_KEY "grant_type"
85 #define OIDC_GRANT_TYPE_VALUE "authorization_code"
90 #define OIDC_CODE_KEY "code"
93 * OIDC response_type key
95 #define OIDC_RESPONSE_TYPE_KEY "response_type"
100 #define OIDC_CLIENT_ID_KEY "client_id"
105 #define OIDC_SCOPE_KEY "scope"
108 * OIDC redirect_uri key
110 #define OIDC_REDIRECT_URI_KEY "redirect_uri"
115 #define OIDC_STATE_KEY "state"
120 #define OIDC_NONCE_KEY "nonce"
123 * OIDC PKCE code challenge
125 #define OIDC_CODE_CHALLENGE_KEY "code_challenge"
128 * OIDC PKCE code verifier
130 #define OIDC_CODE_VERIFIER_KEY "code_verifier"
133 * OIDC cookie expiration (in seconds)
135 #define OIDC_COOKIE_EXPIRATION 3
138 * OIDC cookie header key
140 #define OIDC_COOKIE_HEADER_KEY "cookie"
143 * OIDC cookie header information key
145 #define OIDC_AUTHORIZATION_HEADER_KEY "authorization"
148 * OIDC cookie header information key
150 #define OIDC_COOKIE_HEADER_INFORMATION_KEY "Identity="
153 * OIDC cookie header if user cancelled
155 #define OIDC_COOKIE_HEADER_ACCESS_DENIED "Identity=Denied"
158 * OIDC expected response_type while authorizing
160 #define OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE "code"
163 * OIDC expected scope part while authorizing
165 #define OIDC_EXPECTED_AUTHORIZATION_SCOPE "openid"
168 * OIDC error key for invalid client
170 #define OIDC_ERROR_KEY_INVALID_CLIENT "invalid_client"
173 * OIDC error key for invalid scopes
175 #define OIDC_ERROR_KEY_INVALID_SCOPE "invalid_scope"
178 * OIDC error key for invalid requests
180 #define OIDC_ERROR_KEY_INVALID_REQUEST "invalid_request"
183 * OIDC error key for invalid tokens
185 #define OIDC_ERROR_KEY_INVALID_TOKEN "invalid_token"
188 * OIDC error key for invalid cookies
190 #define OIDC_ERROR_KEY_INVALID_COOKIE "invalid_cookie"
193 * OIDC error key for generic server errors
195 #define OIDC_ERROR_KEY_SERVER_ERROR "server_error"
198 * OIDC error key for unsupported grants
200 #define OIDC_ERROR_KEY_UNSUPPORTED_GRANT_TYPE "unsupported_grant_type"
203 * OIDC error key for unsupported response types
205 #define OIDC_ERROR_KEY_UNSUPPORTED_RESPONSE_TYPE "unsupported_response_type"
208 * OIDC error key for unauthorized clients
210 #define OIDC_ERROR_KEY_UNAUTHORIZED_CLIENT "unauthorized_client"
213 * OIDC error key for denied access
215 #define OIDC_ERROR_KEY_ACCESS_DENIED "access_denied"
219 * OIDC ignored parameter array
221 static char *OIDC_ignored_parameter_array[] = {"display",
230 * OIDC Hash map that keeps track of issued cookies
232 struct GNUNET_CONTAINER_MultiHashMap *OIDC_cookie_jar_map;
235 * Hash map that links the issued access token to the corresponding ticket and
238 struct GNUNET_CONTAINER_MultiHashMap *OIDC_access_token_map;
241 * The configuration handle
243 const struct GNUNET_CONFIGURATION_Handle *cfg;
246 * HTTP methods allows for this plugin
248 static char *allow_methods;
251 * @brief struct returned by the initialization function of the plugin
255 const struct GNUNET_CONFIGURATION_Handle *cfg;
259 * OIDC needed variables
261 struct OIDC_Variables
264 * The RP client public key
266 struct GNUNET_CRYPTO_EcdsaPublicKey client_pkey;
269 * The OIDC client id of the RP
274 * The OIDC redirect uri
279 * The list of oidc scopes
294 * The OIDC response type
299 * The identity chosen by the user to login
301 char *login_identity;
304 * User cancelled authorization/login
309 * The PKCE code_challenge
311 char *code_challenge;
314 * The PKCE code_verifier
332 struct EgoEntry *next;
337 struct EgoEntry *prev;
352 struct GNUNET_IDENTITY_Ego *ego;
361 struct EgoEntry *ego_head;
366 struct EgoEntry *ego_tail;
371 struct EgoEntry *ego_entry;
374 * Pointer to ego private key
376 struct GNUNET_CRYPTO_EcdsaPrivateKey priv_key;
381 struct OIDC_Variables *oidc;
384 * The processing state
389 * Handle to Identity service.
391 struct GNUNET_IDENTITY_Handle *identity_handle;
396 struct GNUNET_REST_RequestHandle *rest_handle;
401 struct GNUNET_GNS_Handle *gns_handle;
406 struct GNUNET_GNS_LookupRequest *gns_op;
409 * Handle to NAMESTORE
411 struct GNUNET_NAMESTORE_Handle *namestore_handle;
414 * Iterator for NAMESTORE
416 struct GNUNET_NAMESTORE_ZoneIterator *namestore_handle_it;
419 * Attribute claim list
421 struct GNUNET_RECLAIM_ATTRIBUTE_ClaimList *attr_list;
426 struct GNUNET_IDENTITY_Operation *op;
431 struct GNUNET_RECLAIM_Handle *idp;
436 struct GNUNET_RECLAIM_Operation *idp_op;
441 struct GNUNET_RECLAIM_AttributeIterator *attr_it;
446 struct GNUNET_RECLAIM_TicketIterator *ticket_it;
451 struct GNUNET_RECLAIM_Ticket ticket;
454 * Desired timeout for the lookup (default is no timeout).
456 struct GNUNET_TIME_Relative timeout;
459 * ID of a task associated with the resolution process.
461 struct GNUNET_SCHEDULER_Task *timeout_task;
464 * The plugin result processor
466 GNUNET_REST_ResultProcessor proc;
469 * The closure of the result processor
479 * The tld for redirect
484 * The redirect prefix
486 char *redirect_prefix;
489 * The redirect suffix
491 char *redirect_suffix;
494 * Error response message
499 * Error response description
510 * Cleanup lookup handle
511 * @param handle Handle to clean up
514 cleanup_handle (struct RequestHandle *handle)
516 struct GNUNET_RECLAIM_ATTRIBUTE_ClaimListEntry *claim_entry;
517 struct GNUNET_RECLAIM_ATTRIBUTE_ClaimListEntry *claim_tmp;
518 struct EgoEntry *ego_entry;
519 struct EgoEntry *ego_tmp;
520 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Cleaning up\n");
521 if (NULL != handle->timeout_task)
522 GNUNET_SCHEDULER_cancel (handle->timeout_task);
523 if (NULL != handle->identity_handle)
524 GNUNET_IDENTITY_disconnect (handle->identity_handle);
525 if (NULL != handle->attr_it)
526 GNUNET_RECLAIM_get_attributes_stop (handle->attr_it);
527 if (NULL != handle->ticket_it)
528 GNUNET_RECLAIM_ticket_iteration_stop (handle->ticket_it);
529 if (NULL != handle->idp)
530 GNUNET_RECLAIM_disconnect (handle->idp);
531 GNUNET_free_non_null (handle->url);
532 GNUNET_free_non_null (handle->tld);
533 GNUNET_free_non_null (handle->redirect_prefix);
534 GNUNET_free_non_null (handle->redirect_suffix);
535 GNUNET_free_non_null (handle->emsg);
536 GNUNET_free_non_null (handle->edesc);
537 if (NULL != handle->gns_op)
538 GNUNET_GNS_lookup_cancel (handle->gns_op);
539 if (NULL != handle->gns_handle)
540 GNUNET_GNS_disconnect (handle->gns_handle);
542 if (NULL != handle->namestore_handle)
543 GNUNET_NAMESTORE_disconnect (handle->namestore_handle);
544 if (NULL != handle->oidc)
546 GNUNET_free_non_null (handle->oidc->client_id);
547 GNUNET_free_non_null (handle->oidc->login_identity);
548 GNUNET_free_non_null (handle->oidc->nonce);
549 GNUNET_free_non_null (handle->oidc->redirect_uri);
550 GNUNET_free_non_null (handle->oidc->response_type);
551 GNUNET_free_non_null (handle->oidc->scope);
552 GNUNET_free_non_null (handle->oidc->state);
553 json_decref (handle->oidc->response);
554 GNUNET_free (handle->oidc);
556 if (NULL != handle->attr_list)
558 for (claim_entry = handle->attr_list->list_head; NULL != claim_entry;)
560 claim_tmp = claim_entry;
561 claim_entry = claim_entry->next;
562 GNUNET_free (claim_tmp->claim);
563 GNUNET_free (claim_tmp);
565 GNUNET_free (handle->attr_list);
567 for (ego_entry = handle->ego_head; NULL != ego_entry;)
570 ego_entry = ego_entry->next;
571 GNUNET_free (ego_tmp->identifier);
572 GNUNET_free (ego_tmp->keystring);
573 GNUNET_free (ego_tmp);
575 GNUNET_free (handle);
579 cleanup_handle_delayed (void *cls)
581 cleanup_handle (cls);
586 * Task run on error, sends error message. Cleans up everything.
588 * @param cls the `struct RequestHandle`
593 struct RequestHandle *handle = cls;
594 struct MHD_Response *resp;
597 GNUNET_asprintf (&json_error,
598 "{ \"error\" : \"%s\", \"error_description\" : \"%s\"%s%s%s}",
600 (NULL != handle->edesc) ? handle->edesc : "",
601 (NULL != handle->oidc->state) ? ", \"state\":\"" : "",
602 (NULL != handle->oidc->state) ? handle->oidc->state : "",
603 (NULL != handle->oidc->state) ? "\"" : "");
604 if (0 == handle->response_code)
605 handle->response_code = MHD_HTTP_BAD_REQUEST;
606 resp = GNUNET_REST_create_response (json_error);
607 if (MHD_HTTP_UNAUTHORIZED == handle->response_code)
608 MHD_add_response_header (resp, MHD_HTTP_HEADER_WWW_AUTHENTICATE, "Basic");
609 MHD_add_response_header (resp,
610 MHD_HTTP_HEADER_CONTENT_TYPE,
612 handle->proc (handle->proc_cls, resp, handle->response_code);
613 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
614 GNUNET_free (json_error);
619 * Task run on error in userinfo endpoint, sends error header. Cleans up
622 * @param cls the `struct RequestHandle`
625 do_userinfo_error (void *cls)
627 struct RequestHandle *handle = cls;
628 struct MHD_Response *resp;
631 GNUNET_asprintf (&error,
632 "error=\"%s\", error_description=\"%s\"",
634 (NULL != handle->edesc) ? handle->edesc : "");
635 resp = GNUNET_REST_create_response ("");
636 MHD_add_response_header (resp, MHD_HTTP_HEADER_WWW_AUTHENTICATE, "Bearer");
637 handle->proc (handle->proc_cls, resp, handle->response_code);
638 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
644 * Task run on error, sends error message and redirects. Cleans up everything.
646 * @param cls the `struct RequestHandle`
649 do_redirect_error (void *cls)
651 struct RequestHandle *handle = cls;
652 struct MHD_Response *resp;
654 GNUNET_asprintf (&redirect,
655 "%s?error=%s&error_description=%s%s%s",
656 handle->oidc->redirect_uri,
659 (NULL != handle->oidc->state) ? "&state=" : "",
660 (NULL != handle->oidc->state) ? handle->oidc->state : "");
661 resp = GNUNET_REST_create_response ("");
662 MHD_add_response_header (resp, "Location", redirect);
663 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
664 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
665 GNUNET_free (redirect);
669 * Task run on timeout, sends error message. Cleans up everything.
671 * @param cls the `struct RequestHandle`
674 do_timeout (void *cls)
676 struct RequestHandle *handle = cls;
678 handle->timeout_task = NULL;
683 * Return attributes for claim
685 * @param cls the request handle
688 return_userinfo_response (void *cls)
691 struct RequestHandle *handle = cls;
692 struct MHD_Response *resp;
694 result_str = json_dumps (handle->oidc->response, 0);
696 resp = GNUNET_REST_create_response (result_str);
697 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
698 GNUNET_free (result_str);
699 cleanup_handle (handle);
704 * Respond to OPTIONS request
706 * @param con_handle the connection handle
708 * @param cls the RequestHandle
711 options_cont (struct GNUNET_REST_RequestHandle *con_handle,
715 struct MHD_Response *resp;
716 struct RequestHandle *handle = cls;
718 // For now, independent of path return all options
719 resp = GNUNET_REST_create_response (NULL);
720 MHD_add_response_header (resp, "Access-Control-Allow-Methods", allow_methods);
721 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
722 cleanup_handle (handle);
728 * Interprets cookie header and pass its identity keystring to handle
731 cookie_identity_interpretation (struct RequestHandle *handle)
733 struct GNUNET_HashCode cache_key;
735 struct GNUNET_TIME_Absolute current_time, *relog_time;
736 char delimiter[] = "; ";
741 // gets identity of login try with cookie
742 GNUNET_CRYPTO_hash (OIDC_COOKIE_HEADER_KEY,
743 strlen (OIDC_COOKIE_HEADER_KEY),
745 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
749 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "No cookie found\n");
752 // splits cookies and find 'Identity' cookie
754 GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->header_param_map,
756 cookies = GNUNET_strdup (tmp_cookies);
757 token = strtok (cookies, delimiter);
758 handle->oidc->user_cancelled = GNUNET_NO;
759 handle->oidc->login_identity = NULL;
762 GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
763 "Unable to parse cookie: %s\n",
765 GNUNET_free (cookies);
769 while (NULL != token)
771 if (0 == strcmp (token, OIDC_COOKIE_HEADER_ACCESS_DENIED))
773 handle->oidc->user_cancelled = GNUNET_YES;
774 GNUNET_free (cookies);
777 if (NULL != strstr (token, OIDC_COOKIE_HEADER_INFORMATION_KEY))
779 token = strtok (NULL, delimiter);
783 GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
784 "No cookie value to process: %s\n",
786 GNUNET_free (cookies);
789 GNUNET_CRYPTO_hash (token, strlen (token), &cache_key);
791 GNUNET_CONTAINER_multihashmap_contains (OIDC_cookie_jar_map, &cache_key))
794 GNUNET_ERROR_TYPE_WARNING,
795 "Found cookie `%s', but no corresponding expiration entry present...\n",
797 GNUNET_free (cookies);
801 GNUNET_CONTAINER_multihashmap_get (OIDC_cookie_jar_map, &cache_key);
802 current_time = GNUNET_TIME_absolute_get ();
803 // 30 min after old login -> redirect to login
804 if (current_time.abs_value_us > relog_time->abs_value_us)
806 GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
807 "Found cookie `%s', but it is expired.\n",
809 GNUNET_free (cookies);
812 value = strtok (token, OIDC_COOKIE_HEADER_INFORMATION_KEY);
813 GNUNET_assert (NULL != value);
814 handle->oidc->login_identity = GNUNET_strdup (value);
815 GNUNET_free (cookies);
819 * Redirects to login page stored in configuration file
822 login_redirect (void *cls)
824 char *login_base_url;
826 struct MHD_Response *resp;
827 struct RequestHandle *handle = cls;
829 if (GNUNET_OK == GNUNET_CONFIGURATION_get_value_string (cfg,
830 "reclaim-rest-plugin",
834 GNUNET_asprintf (&new_redirect,
835 "%s?%s=%s&%s=%s&%s=%s&%s=%s&%s=%s&%s=%s&%s=%s",
837 OIDC_RESPONSE_TYPE_KEY,
838 handle->oidc->response_type,
840 handle->oidc->client_id,
841 OIDC_REDIRECT_URI_KEY,
842 handle->oidc->redirect_uri,
846 (NULL != handle->oidc->state) ? handle->oidc->state : "",
847 OIDC_CODE_CHALLENGE_KEY,
848 (NULL != handle->oidc->code_challenge) ? handle->oidc->code_challenge : "",
850 (NULL != handle->oidc->nonce) ? handle->oidc->nonce : "");
851 resp = GNUNET_REST_create_response ("");
852 MHD_add_response_header (resp, "Location", new_redirect);
853 GNUNET_free (login_base_url);
857 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
858 handle->edesc = GNUNET_strdup ("gnunet configuration failed");
859 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
860 GNUNET_SCHEDULER_add_now (&do_error, handle);
863 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
864 GNUNET_free (new_redirect);
865 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
869 * Does internal server error when iteration failed.
872 oidc_iteration_error (void *cls)
874 struct RequestHandle *handle = cls;
875 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
876 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
877 GNUNET_SCHEDULER_add_now (&do_error, handle);
882 * Issues ticket and redirects to relying party with the authorization code as
883 * parameter. Otherwise redirects with error
886 oidc_ticket_issue_cb (void *cls, const struct GNUNET_RECLAIM_Ticket *ticket)
888 struct RequestHandle *handle = cls;
889 struct MHD_Response *resp;
894 handle->idp_op = NULL;
897 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
898 handle->edesc = GNUNET_strdup ("Server cannot generate ticket.");
899 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
902 handle->ticket = *ticket;
904 GNUNET_STRINGS_data_to_string_alloc (&handle->ticket,
905 sizeof (struct GNUNET_RECLAIM_Ticket));
906 // TODO change if more attributes are needed (see max_age)
907 code_string = OIDC_build_authz_code (&handle->priv_key,
911 handle->oidc->code_challenge);
912 if ((NULL != handle->redirect_prefix) && (NULL != handle->redirect_suffix) &&
913 (NULL != handle->tld))
916 GNUNET_asprintf (&redirect_uri,
917 "%s.%s/%s?%s=%s&state=%s",
918 handle->redirect_prefix,
920 handle->redirect_suffix,
921 handle->oidc->response_type,
923 handle->oidc->state);
927 GNUNET_asprintf (&redirect_uri,
929 handle->oidc->redirect_uri,
930 handle->oidc->response_type,
932 handle->oidc->state);
934 resp = GNUNET_REST_create_response ("");
935 MHD_add_response_header (resp, "Location", redirect_uri);
936 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
937 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
938 GNUNET_free (redirect_uri);
939 GNUNET_free (ticket_str);
940 GNUNET_free (code_string);
944 oidc_collect_finished_cb (void *cls)
946 struct RequestHandle *handle = cls;
947 handle->attr_it = NULL;
948 handle->ticket_it = NULL;
949 if (NULL == handle->attr_list->list_head)
951 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_SCOPE);
952 handle->edesc = GNUNET_strdup ("The requested scope is not available.");
953 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
956 handle->idp_op = GNUNET_RECLAIM_ticket_issue (handle->idp,
958 &handle->oidc->client_pkey,
960 &oidc_ticket_issue_cb,
966 * Collects all attributes for an ego if in scope parameter
969 oidc_attr_collect (void *cls,
970 const struct GNUNET_CRYPTO_EcdsaPublicKey *identity,
971 const struct GNUNET_RECLAIM_ATTRIBUTE_Claim *attr)
973 struct RequestHandle *handle = cls;
974 struct GNUNET_RECLAIM_ATTRIBUTE_ClaimListEntry *le;
975 char *scope_variables;
976 char *scope_variable;
977 char delimiter[] = " ";
979 if ((NULL == attr->name) || (NULL == attr->data))
981 GNUNET_RECLAIM_get_attributes_next (handle->attr_it);
985 scope_variables = GNUNET_strdup (handle->oidc->scope);
986 scope_variable = strtok (scope_variables, delimiter);
987 while (NULL != scope_variable)
989 if (0 == strcmp (attr->name, scope_variable))
991 scope_variable = strtok (NULL, delimiter);
993 if (NULL == scope_variable)
995 GNUNET_RECLAIM_get_attributes_next (handle->attr_it);
996 GNUNET_free (scope_variables);
999 GNUNET_free (scope_variables);
1001 le = GNUNET_new (struct GNUNET_RECLAIM_ATTRIBUTE_ClaimListEntry);
1002 le->claim = GNUNET_RECLAIM_ATTRIBUTE_claim_new (attr->name,
1006 le->claim->id = attr->id;
1007 le->claim->version = attr->version;
1008 GNUNET_CONTAINER_DLL_insert (handle->attr_list->list_head,
1009 handle->attr_list->list_tail,
1011 GNUNET_RECLAIM_get_attributes_next (handle->attr_it);
1016 * Checks time and cookie and redirects accordingly
1019 code_redirect (void *cls)
1021 struct RequestHandle *handle = cls;
1022 struct GNUNET_TIME_Absolute current_time;
1023 struct GNUNET_TIME_Absolute *relog_time;
1024 struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
1025 struct GNUNET_CRYPTO_EcdsaPublicKey ego_pkey;
1026 struct GNUNET_HashCode cache_key;
1027 char *identity_cookie;
1029 GNUNET_asprintf (&identity_cookie,
1031 handle->oidc->login_identity);
1032 GNUNET_CRYPTO_hash (identity_cookie, strlen (identity_cookie), &cache_key);
1033 GNUNET_free (identity_cookie);
1034 // No login time for identity -> redirect to login
1036 GNUNET_CONTAINER_multihashmap_contains (OIDC_cookie_jar_map, &cache_key))
1039 GNUNET_CONTAINER_multihashmap_get (OIDC_cookie_jar_map, &cache_key);
1040 current_time = GNUNET_TIME_absolute_get ();
1041 // 30 min after old login -> redirect to login
1042 if (current_time.abs_value_us <= relog_time->abs_value_us)
1045 GNUNET_CRYPTO_ecdsa_public_key_from_string (handle->oidc
1052 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_COOKIE);
1054 GNUNET_strdup ("The cookie of a login identity is not valid");
1055 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1058 // iterate over egos and compare their public key
1059 for (handle->ego_entry = handle->ego_head; NULL != handle->ego_entry;
1060 handle->ego_entry = handle->ego_entry->next)
1062 GNUNET_IDENTITY_ego_get_public_key (handle->ego_entry->ego, &ego_pkey);
1063 if (0 == GNUNET_memcmp (&ego_pkey, &pubkey))
1066 *GNUNET_IDENTITY_ego_get_private_key (handle->ego_entry->ego);
1067 handle->idp = GNUNET_RECLAIM_connect (cfg);
1069 GNUNET_new (struct GNUNET_RECLAIM_ATTRIBUTE_ClaimList);
1071 GNUNET_RECLAIM_get_attributes_start (handle->idp,
1073 &oidc_iteration_error,
1077 &oidc_collect_finished_cb,
1082 GNUNET_SCHEDULER_add_now (&login_redirect, handle);
1090 build_redirect (void *cls)
1092 struct RequestHandle *handle = cls;
1093 struct MHD_Response *resp;
1096 if (GNUNET_YES == handle->oidc->user_cancelled)
1098 if ((NULL != handle->redirect_prefix) &&
1099 (NULL != handle->redirect_suffix) && (NULL != handle->tld))
1101 GNUNET_asprintf (&redirect_uri,
1102 "%s.%s/%s?error=%s&error_description=%s&state=%s",
1103 handle->redirect_prefix,
1105 handle->redirect_suffix,
1107 "User denied access",
1108 handle->oidc->state);
1112 GNUNET_asprintf (&redirect_uri,
1113 "%s?error=%s&error_description=%s&state=%s",
1114 handle->oidc->redirect_uri,
1116 "User denied access",
1117 handle->oidc->state);
1119 resp = GNUNET_REST_create_response ("");
1120 MHD_add_response_header (resp, "Location", redirect_uri);
1121 handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
1122 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
1123 GNUNET_free (redirect_uri);
1126 GNUNET_SCHEDULER_add_now (&code_redirect, handle);
1131 lookup_redirect_uri_result (void *cls,
1133 const struct GNUNET_GNSRECORD_Data *rd)
1135 struct RequestHandle *handle = cls;
1139 struct GNUNET_CRYPTO_EcdsaPublicKey redirect_zone;
1141 handle->gns_op = NULL;
1144 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
1146 GNUNET_strdup ("Server cannot generate ticket, redirect uri not found.");
1147 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1150 for (int i = 0; i < rd_count; i++)
1152 if (GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT != rd[i].record_type)
1154 if (0 != strncmp (rd[i].data, handle->oidc->redirect_uri, rd[i].data_size))
1156 tmp = GNUNET_strndup (rd[i].data, rd[i].data_size);
1157 if (NULL == strstr (tmp, handle->oidc->client_id))
1159 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
1160 "Redirect uri %s does not contain client_id %s\n",
1162 handle->oidc->client_id);
1166 pos = strrchr (tmp, (unsigned char) '.');
1169 GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
1170 "Redirect uri %s contains client_id but is malformed\n",
1176 handle->redirect_prefix = GNUNET_strdup (tmp);
1177 tmp_key_str = pos + 1;
1178 pos = strchr (tmp_key_str, (unsigned char) '/');
1181 GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
1182 "Redirect uri %s contains client_id but is malformed\n",
1188 handle->redirect_suffix = GNUNET_strdup (pos + 1);
1190 GNUNET_STRINGS_string_to_data (tmp_key_str,
1191 strlen (tmp_key_str),
1193 sizeof (redirect_zone));
1195 GNUNET_SCHEDULER_add_now (&build_redirect, handle);
1199 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
1201 GNUNET_strdup ("Server cannot generate ticket, redirect uri not found.");
1202 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1207 * Initiate redirect back to client.
1210 client_redirect (void *cls)
1212 struct RequestHandle *handle = cls;
1214 /* Lookup client redirect uri to verify request */
1216 GNUNET_GNS_lookup (handle->gns_handle,
1217 GNUNET_GNS_EMPTY_LABEL_AT,
1218 &handle->oidc->client_pkey,
1219 GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT,
1220 GNUNET_GNS_LO_DEFAULT,
1221 &lookup_redirect_uri_result,
1226 get_url_parameter_copy (const struct RequestHandle *handle, const char *key)
1228 struct GNUNET_HashCode hc;
1230 GNUNET_CRYPTO_hash (key, strlen (key), &hc);
1231 if (GNUNET_YES != GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
1236 GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->url_param_map, &hc);
1239 return GNUNET_strdup (value);
1244 * Iteration over all results finished, build final
1247 * @param cls the `struct RequestHandle`
1250 build_authz_response (void *cls)
1252 struct RequestHandle *handle = cls;
1253 struct GNUNET_HashCode cache_key;
1255 char *expected_scope;
1256 char delimiter[] = " ";
1257 int number_of_ignored_parameter, iterator;
1260 // REQUIRED value: redirect_uri
1261 handle->oidc->redirect_uri =
1262 get_url_parameter_copy (handle, OIDC_REDIRECT_URI_KEY);
1263 if (NULL == handle->oidc->redirect_uri)
1265 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1266 handle->edesc = GNUNET_strdup ("missing parameter redirect_uri");
1267 GNUNET_SCHEDULER_add_now (&do_error, handle);
1271 // REQUIRED value: response_type
1272 handle->oidc->response_type =
1273 get_url_parameter_copy (handle, OIDC_RESPONSE_TYPE_KEY);
1274 if (NULL == handle->oidc->response_type)
1276 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1277 handle->edesc = GNUNET_strdup ("missing parameter response_type");
1278 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1282 // REQUIRED value: scope
1283 handle->oidc->scope = get_url_parameter_copy (handle, OIDC_SCOPE_KEY);
1284 if (NULL == handle->oidc->scope)
1286 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_SCOPE);
1287 handle->edesc = GNUNET_strdup ("missing parameter scope");
1288 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1292 // OPTIONAL value: nonce
1293 handle->oidc->nonce = get_url_parameter_copy (handle, OIDC_NONCE_KEY);
1295 // TODO check other values if needed
1296 number_of_ignored_parameter =
1297 sizeof (OIDC_ignored_parameter_array) / sizeof (char *);
1298 for (iterator = 0; iterator < number_of_ignored_parameter; iterator++)
1300 GNUNET_CRYPTO_hash (OIDC_ignored_parameter_array[iterator],
1301 strlen (OIDC_ignored_parameter_array[iterator]),
1304 GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
1308 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_ACCESS_DENIED);
1309 GNUNET_asprintf (&handle->edesc,
1310 "Server will not handle parameter: %s",
1311 OIDC_ignored_parameter_array[iterator]);
1312 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1317 // We only support authorization code flows.
1318 if (0 != strcmp (handle->oidc->response_type,
1319 OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE))
1321 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_UNSUPPORTED_RESPONSE_TYPE);
1322 handle->edesc = GNUNET_strdup ("The authorization server does not support "
1323 "obtaining this authorization code.");
1324 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1328 // Checks if scope contains 'openid'
1329 expected_scope = GNUNET_strdup (handle->oidc->scope);
1331 test = strtok (expected_scope, delimiter);
1332 while (NULL != test)
1334 if (0 == strcmp (OIDC_EXPECTED_AUTHORIZATION_SCOPE, expected_scope))
1336 test = strtok (NULL, delimiter);
1340 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_SCOPE);
1342 GNUNET_strdup ("The requested scope is invalid, unknown, or malformed.");
1343 GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
1344 GNUNET_free (expected_scope);
1348 GNUNET_free (expected_scope);
1349 if ((NULL == handle->oidc->login_identity) &&
1350 (GNUNET_NO == handle->oidc->user_cancelled))
1351 GNUNET_SCHEDULER_add_now (&login_redirect, handle);
1353 GNUNET_SCHEDULER_add_now (&client_redirect, handle);
1357 * Iterate over tlds in config
1360 tld_iter (void *cls, const char *section, const char *option, const char *value)
1362 struct RequestHandle *handle = cls;
1363 struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
1366 GNUNET_CRYPTO_ecdsa_public_key_from_string (value, strlen (value), &pkey))
1368 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Skipping non key %s\n", value);
1371 if (0 == GNUNET_memcmp (&pkey, &handle->oidc->client_pkey))
1372 handle->tld = GNUNET_strdup (option + 1);
1376 * Responds to authorization GET and url-encoded POST request
1378 * @param con_handle the connection handle
1379 * @param url the url
1380 * @param cls the RequestHandle
1383 authorize_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
1387 struct RequestHandle *handle = cls;
1388 struct EgoEntry *tmp_ego;
1389 const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key;
1390 struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
1392 cookie_identity_interpretation (handle);
1394 // RECOMMENDED value: state - REQUIRED for answers
1395 handle->oidc->state = get_url_parameter_copy (handle, OIDC_STATE_KEY);
1397 // REQUIRED value: client_id
1398 handle->oidc->client_id = get_url_parameter_copy (handle, OIDC_CLIENT_ID_KEY);
1399 if (NULL == handle->oidc->client_id)
1401 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1402 handle->edesc = GNUNET_strdup ("missing parameter client_id");
1403 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1404 GNUNET_SCHEDULER_add_now (&do_error, handle);
1408 // REQUIRED value: code_challenge
1409 handle->oidc->code_challenge = get_url_parameter_copy (handle, OIDC_CODE_CHALLENGE_KEY);
1410 if (NULL == handle->oidc->code_challenge)
1412 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1413 handle->edesc = GNUNET_strdup ("missing parameter code_challenge");
1414 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1415 GNUNET_SCHEDULER_add_now (&do_error, handle);
1420 GNUNET_CRYPTO_ecdsa_public_key_from_string (handle->oidc->client_id,
1422 handle->oidc->client_id),
1423 &handle->oidc->client_pkey))
1425 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_UNAUTHORIZED_CLIENT);
1426 handle->edesc = GNUNET_strdup ("The client is not authorized to request an "
1427 "authorization code using this method.");
1428 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1429 GNUNET_SCHEDULER_add_now (&do_error, handle);
1433 // If we know this identity, translated the corresponding TLD
1434 // TODO: We might want to have a reverse lookup functionality for TLDs?
1435 for (tmp_ego = handle->ego_head; NULL != tmp_ego; tmp_ego = tmp_ego->next)
1437 priv_key = GNUNET_IDENTITY_ego_get_private_key (tmp_ego->ego);
1438 GNUNET_CRYPTO_ecdsa_key_get_public (priv_key, &pkey);
1439 if (0 == GNUNET_memcmp (&pkey, &handle->oidc->client_pkey))
1441 handle->tld = GNUNET_strdup (tmp_ego->identifier);
1442 handle->ego_entry = handle->ego_tail;
1445 if (NULL == handle->tld)
1446 GNUNET_CONFIGURATION_iterate_section_values (cfg, "gns", tld_iter, handle);
1447 if (NULL == handle->tld)
1448 handle->tld = GNUNET_strdup (handle->oidc->client_id);
1449 GNUNET_SCHEDULER_add_now (&build_authz_response, handle);
1453 * Combines an identity with a login time and responds OK to login request
1455 * @param con_handle the connection handle
1456 * @param url the url
1457 * @param cls the RequestHandle
1460 login_cont (struct GNUNET_REST_RequestHandle *con_handle,
1464 struct MHD_Response *resp = GNUNET_REST_create_response ("");
1465 struct RequestHandle *handle = cls;
1466 struct GNUNET_HashCode cache_key;
1467 struct GNUNET_TIME_Absolute *current_time;
1468 struct GNUNET_TIME_Absolute *last_time;
1474 char term_data[handle->rest_handle->data_size + 1];
1475 term_data[handle->rest_handle->data_size] = '\0';
1476 GNUNET_memcpy (term_data,
1477 handle->rest_handle->data,
1478 handle->rest_handle->data_size);
1479 root = json_loads (term_data, JSON_DECODE_ANY, &error);
1480 identity = json_object_get (root, "identity");
1481 if (! json_is_string (identity))
1483 GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
1484 "Error parsing json string from %s\n",
1486 handle->proc (handle->proc_cls, resp, MHD_HTTP_BAD_REQUEST);
1488 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
1491 GNUNET_asprintf (&cookie, "Identity=%s", json_string_value (identity));
1492 GNUNET_asprintf (&header_val,
1495 OIDC_COOKIE_EXPIRATION);
1496 MHD_add_response_header (resp, "Set-Cookie", header_val);
1497 MHD_add_response_header (resp, "Access-Control-Allow-Methods", "POST");
1498 GNUNET_CRYPTO_hash (cookie, strlen (cookie), &cache_key);
1500 if (0 != strcmp (json_string_value (identity), "Denied"))
1502 current_time = GNUNET_new (struct GNUNET_TIME_Absolute);
1503 *current_time = GNUNET_TIME_relative_to_absolute (
1504 GNUNET_TIME_relative_multiply (GNUNET_TIME_relative_get_second_ (),
1505 OIDC_COOKIE_EXPIRATION));
1507 GNUNET_CONTAINER_multihashmap_get (OIDC_cookie_jar_map, &cache_key);
1508 GNUNET_free_non_null (last_time);
1509 GNUNET_CONTAINER_multihashmap_put (OIDC_cookie_jar_map,
1512 GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
1514 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
1515 GNUNET_free (cookie);
1516 GNUNET_free (header_val);
1518 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
1522 check_authorization (struct RequestHandle *handle,
1523 struct GNUNET_CRYPTO_EcdsaPublicKey *cid)
1525 struct GNUNET_HashCode cache_key;
1526 char *authorization;
1528 char *basic_authorization;
1531 char *expected_pass;
1533 GNUNET_CRYPTO_hash (OIDC_AUTHORIZATION_HEADER_KEY,
1534 strlen (OIDC_AUTHORIZATION_HEADER_KEY),
1536 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
1540 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
1541 handle->edesc = GNUNET_strdup ("missing authorization");
1542 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1543 return GNUNET_SYSERR;
1546 GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->header_param_map,
1549 // split header in "Basic" and [content]
1550 credentials = strtok (authorization, " ");
1551 if ((NULL == credentials) || (0 != strcmp ("Basic", credentials)))
1553 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
1554 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1555 return GNUNET_SYSERR;
1557 credentials = strtok (NULL, " ");
1558 if (NULL == credentials)
1560 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
1561 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1562 return GNUNET_SYSERR;
1564 GNUNET_STRINGS_base64_decode (credentials,
1565 strlen (credentials),
1566 (void **) &basic_authorization);
1568 if (NULL == basic_authorization)
1570 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
1571 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1572 return GNUNET_SYSERR;
1574 client_id = strtok (basic_authorization, ":");
1575 if (NULL == client_id)
1577 GNUNET_free_non_null (basic_authorization);
1578 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
1579 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1580 return GNUNET_SYSERR;
1582 pass = strtok (NULL, ":");
1585 GNUNET_free_non_null (basic_authorization);
1586 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
1587 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1588 return GNUNET_SYSERR;
1591 // check client password
1592 if (GNUNET_OK == GNUNET_CONFIGURATION_get_value_string (cfg,
1593 "reclaim-rest-plugin",
1594 "OIDC_CLIENT_SECRET",
1597 if (0 != strcmp (expected_pass, pass))
1599 GNUNET_free_non_null (basic_authorization);
1600 GNUNET_free (expected_pass);
1601 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
1602 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1603 return GNUNET_SYSERR;
1605 GNUNET_free (expected_pass);
1609 GNUNET_free_non_null (basic_authorization);
1610 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
1611 handle->edesc = GNUNET_strdup ("gnunet configuration failed");
1612 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1613 return GNUNET_SYSERR;
1617 for (handle->ego_entry = handle->ego_head; NULL != handle->ego_entry;
1618 handle->ego_entry = handle->ego_entry->next)
1620 if (0 == strcmp (handle->ego_entry->keystring, client_id))
1623 if (NULL == handle->ego_entry)
1625 GNUNET_free_non_null (basic_authorization);
1626 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
1627 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1628 return GNUNET_SYSERR;
1630 GNUNET_STRINGS_string_to_data (client_id,
1633 sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey));
1635 GNUNET_free (basic_authorization);
1639 const struct EgoEntry *
1640 find_ego (struct RequestHandle *handle,
1641 struct GNUNET_CRYPTO_EcdsaPublicKey *test_key)
1643 struct EgoEntry *ego_entry;
1644 struct GNUNET_CRYPTO_EcdsaPublicKey pub_key;
1646 for (ego_entry = handle->ego_head; NULL != ego_entry;
1647 ego_entry = ego_entry->next)
1649 GNUNET_IDENTITY_ego_get_public_key (ego_entry->ego, &pub_key);
1650 if (0 == GNUNET_memcmp (&pub_key, test_key))
1657 persist_access_token (const struct RequestHandle *handle,
1658 const char *access_token,
1659 const struct GNUNET_RECLAIM_Ticket *ticket)
1661 struct GNUNET_HashCode hc;
1662 struct GNUNET_RECLAIM_Ticket *ticketbuf;
1664 GNUNET_CRYPTO_hash (access_token, strlen (access_token), &hc);
1665 ticketbuf = GNUNET_new (struct GNUNET_RECLAIM_Ticket);
1666 *ticketbuf = *ticket;
1667 GNUNET_assert (GNUNET_SYSERR !=
1668 GNUNET_CONTAINER_multihashmap_put (
1669 OIDC_access_token_map,
1672 GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
1676 * Responds to token url-encoded POST request
1678 * @param con_handle the connection handle
1679 * @param url the url
1680 * @param cls the RequestHandle
1683 token_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
1687 struct RequestHandle *handle = cls;
1688 const struct EgoEntry *ego_entry;
1689 struct GNUNET_TIME_Relative expiration_time;
1690 struct GNUNET_RECLAIM_ATTRIBUTE_ClaimList *cl;
1691 struct GNUNET_RECLAIM_Ticket ticket;
1692 struct GNUNET_CRYPTO_EcdsaPublicKey cid;
1693 const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
1694 struct GNUNET_HashCode cache_key;
1695 struct MHD_Response *resp;
1698 char *json_response;
1703 char *code_verifier;
1705 * Check Authorization
1707 if (GNUNET_SYSERR == check_authorization (handle, &cid))
1709 GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
1710 "OIDC authorization for token endpoint failed\n");
1711 GNUNET_SCHEDULER_add_now (&do_error, handle);
1719 // TODO Do not allow multiple equal parameter names
1720 // REQUIRED grant_type
1721 GNUNET_CRYPTO_hash (OIDC_GRANT_TYPE_KEY,
1722 strlen (OIDC_GRANT_TYPE_KEY),
1724 grant_type = get_url_parameter_copy (handle, OIDC_GRANT_TYPE_KEY);
1725 if (NULL == grant_type)
1727 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1728 handle->edesc = GNUNET_strdup ("missing parameter grant_type");
1729 handle->response_code = MHD_HTTP_BAD_REQUEST;
1730 GNUNET_SCHEDULER_add_now (&do_error, handle);
1734 // Check parameter grant_type == "authorization_code"
1735 if (0 != strcmp (OIDC_GRANT_TYPE_VALUE, grant_type))
1737 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_UNSUPPORTED_GRANT_TYPE);
1738 handle->response_code = MHD_HTTP_BAD_REQUEST;
1739 GNUNET_free (grant_type);
1740 GNUNET_SCHEDULER_add_now (&do_error, handle);
1743 GNUNET_free (grant_type);
1745 code = get_url_parameter_copy (handle, OIDC_CODE_KEY);
1748 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1749 handle->edesc = GNUNET_strdup ("missing parameter code");
1750 handle->response_code = MHD_HTTP_BAD_REQUEST;
1751 GNUNET_SCHEDULER_add_now (&do_error, handle);
1754 ego_entry = find_ego (handle, &cid);
1755 if (NULL == ego_entry)
1757 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1758 handle->edesc = GNUNET_strdup ("Unknown client");
1759 handle->response_code = MHD_HTTP_BAD_REQUEST;
1761 GNUNET_SCHEDULER_add_now (&do_error, handle);
1764 privkey = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
1766 // REQUIRED code verifier
1767 code_verifier = get_url_parameter_copy (handle, OIDC_CODE_VERIFIER_KEY);
1768 if (NULL == code_verifier)
1770 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1771 handle->edesc = GNUNET_strdup ("missing parameter code_verifier");
1772 handle->response_code = MHD_HTTP_BAD_REQUEST;
1773 GNUNET_SCHEDULER_add_now (&do_error, handle);
1778 if (GNUNET_OK != OIDC_parse_authz_code (privkey, code, code_verifier, &ticket, &cl, &nonce))
1780 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1781 handle->edesc = GNUNET_strdup ("invalid code");
1782 handle->response_code = MHD_HTTP_BAD_REQUEST;
1784 GNUNET_SCHEDULER_add_now (&do_error, handle);
1790 if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_time (cfg,
1791 "reclaim-rest-plugin",
1795 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
1796 handle->edesc = GNUNET_strdup ("gnunet configuration failed");
1797 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1798 GNUNET_SCHEDULER_add_now (&do_error, handle);
1803 // TODO OPTIONAL acr,amr,azp
1804 if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
1805 "reclaim-rest-plugin",
1809 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
1810 handle->edesc = GNUNET_strdup ("No signing secret configured!");
1811 handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
1812 GNUNET_SCHEDULER_add_now (&do_error, handle);
1815 id_token = OIDC_id_token_new (&ticket.audience,
1819 (NULL != nonce) ? nonce : NULL,
1821 access_token = OIDC_access_token_new ();
1822 OIDC_build_token_response (access_token,
1827 persist_access_token (handle, access_token, &ticket);
1828 resp = GNUNET_REST_create_response (json_response);
1829 MHD_add_response_header (resp, "Cache-Control", "no-store");
1830 MHD_add_response_header (resp, "Pragma", "no-cache");
1831 MHD_add_response_header (resp, "Content-Type", "application/json");
1832 handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
1833 GNUNET_RECLAIM_ATTRIBUTE_list_destroy (cl);
1834 GNUNET_free (access_token);
1835 GNUNET_free (json_response);
1836 GNUNET_free (id_token);
1837 GNUNET_SCHEDULER_add_now (&cleanup_handle_delayed, handle);
1841 * Collects claims and stores them in handle
1844 consume_ticket (void *cls,
1845 const struct GNUNET_CRYPTO_EcdsaPublicKey *identity,
1846 const struct GNUNET_RECLAIM_ATTRIBUTE_Claim *attr)
1848 struct RequestHandle *handle = cls;
1852 if (NULL == identity)
1854 GNUNET_SCHEDULER_add_now (&return_userinfo_response, handle);
1857 tmp_value = GNUNET_RECLAIM_ATTRIBUTE_value_to_string (attr->type,
1860 value = json_string (tmp_value);
1861 json_object_set_new (handle->oidc->response, attr->name, value);
1862 GNUNET_free (tmp_value);
1866 * Responds to userinfo GET and url-encoded POST request
1868 * @param con_handle the connection handle
1869 * @param url the url
1870 * @param cls the RequestHandle
1873 userinfo_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
1877 // TODO expiration time
1878 struct RequestHandle *handle = cls;
1879 char delimiter[] = " ";
1880 struct GNUNET_HashCode cache_key;
1881 char *authorization;
1882 char *authorization_type;
1883 char *authorization_access_token;
1884 struct GNUNET_RECLAIM_Ticket *ticket;
1885 const struct EgoEntry *ego_entry;
1886 const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
1888 GNUNET_CRYPTO_hash (OIDC_AUTHORIZATION_HEADER_KEY,
1889 strlen (OIDC_AUTHORIZATION_HEADER_KEY),
1891 if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
1895 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
1896 handle->edesc = GNUNET_strdup ("No Access Token");
1897 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1898 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1902 GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->header_param_map,
1905 // split header in "Bearer" and access_token
1906 authorization = GNUNET_strdup (authorization);
1907 authorization_type = strtok (authorization, delimiter);
1908 if ((NULL == authorization_type) ||
1909 (0 != strcmp ("Bearer", authorization_type)))
1911 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
1912 handle->edesc = GNUNET_strdup ("No Access Token");
1913 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1914 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1915 GNUNET_free (authorization);
1918 authorization_access_token = strtok (NULL, delimiter);
1919 if (NULL == authorization_access_token)
1921 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
1922 handle->edesc = GNUNET_strdup ("Access token missing");
1923 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1924 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1925 GNUNET_free (authorization);
1929 GNUNET_CRYPTO_hash (authorization_access_token,
1930 strlen (authorization_access_token),
1933 GNUNET_CONTAINER_multihashmap_contains (OIDC_access_token_map,
1936 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
1937 handle->edesc = GNUNET_strdup ("The access token expired");
1938 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1939 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1940 GNUNET_free (authorization);
1944 GNUNET_CONTAINER_multihashmap_get (OIDC_access_token_map, &cache_key);
1945 GNUNET_assert (NULL != ticket);
1946 ego_entry = find_ego (handle, &ticket->audience);
1947 if (NULL == ego_entry)
1949 handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
1950 handle->edesc = GNUNET_strdup ("The access token expired");
1951 handle->response_code = MHD_HTTP_UNAUTHORIZED;
1952 GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
1953 GNUNET_free (authorization);
1957 handle->idp = GNUNET_RECLAIM_connect (cfg);
1958 handle->oidc->response = json_object ();
1959 json_object_set_new (handle->oidc->response,
1961 json_string (ego_entry->keystring));
1962 privkey = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
1963 handle->idp_op = GNUNET_RECLAIM_ticket_consume (handle->idp,
1968 GNUNET_free (authorization);
1973 * Handle rest request
1975 * @param handle the request handle
1978 init_cont (struct RequestHandle *handle)
1980 struct GNUNET_REST_RequestHandlerError err;
1981 static const struct GNUNET_REST_RequestHandler handlers[] =
1982 {{MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_AUTHORIZE, &authorize_endpoint},
1983 {MHD_HTTP_METHOD_POST,
1984 GNUNET_REST_API_NS_AUTHORIZE,
1985 &authorize_endpoint}, // url-encoded
1986 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_LOGIN, &login_cont},
1987 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_TOKEN, &token_endpoint},
1988 {MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_USERINFO, &userinfo_endpoint},
1989 {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_USERINFO, &userinfo_endpoint},
1990 {MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_OIDC, &options_cont},
1991 GNUNET_REST_HANDLER_END};
1994 GNUNET_REST_handle_request (handle->rest_handle, handlers, &err, handle))
1996 handle->response_code = err.error_code;
1997 GNUNET_SCHEDULER_add_now (&do_error, handle);
2002 * If listing is enabled, prints information about the egos.
2004 * This function is initially called for all egos and then again
2005 * whenever a ego's identifier changes or if it is deleted. At the
2006 * end of the initial pass over all egos, the function is once called
2007 * with 'NULL' for 'ego'. That does NOT mean that the callback won't
2008 * be invoked in the future or that there was an error.
2010 * When used with 'GNUNET_IDENTITY_create' or 'GNUNET_IDENTITY_get',
2011 * this function is only called ONCE, and 'NULL' being passed in
2012 * 'ego' does indicate an error (i.e. name is taken or no default
2013 * value is known). If 'ego' is non-NULL and if '*ctx'
2014 * is set in those callbacks, the value WILL be passed to a subsequent
2015 * call to the identity callback of 'GNUNET_IDENTITY_connect' (if
2016 * that one was not NULL).
2018 * When an identity is renamed, this function is called with the
2019 * (known) ego but the NEW identifier.
2021 * When an identity is deleted, this function is called with the
2022 * (known) ego and "NULL" for the 'identifier'. In this case,
2023 * the 'ego' is henceforth invalid (and the 'ctx' should also be
2026 * @param cls closure
2027 * @param ego ego handle
2028 * @param ctx context for application to store data for this ego
2029 * (during the lifetime of this process, initially NULL)
2030 * @param identifier identifier assigned by the user for this ego,
2031 * NULL if the user just deleted the ego and it
2032 * must thus no longer be used
2035 list_ego (void *cls,
2036 struct GNUNET_IDENTITY_Ego *ego,
2038 const char *identifier)
2040 struct RequestHandle *handle = cls;
2041 struct EgoEntry *ego_entry;
2042 struct GNUNET_CRYPTO_EcdsaPublicKey pk;
2044 if ((NULL == ego) && (ID_REST_STATE_INIT == handle->state))
2046 handle->state = ID_REST_STATE_POST_INIT;
2050 GNUNET_assert (NULL != ego);
2051 if (ID_REST_STATE_INIT == handle->state)
2054 ego_entry = GNUNET_new (struct EgoEntry);
2055 GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
2056 ego_entry->keystring = GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
2057 ego_entry->ego = ego;
2058 ego_entry->identifier = GNUNET_strdup (identifier);
2059 GNUNET_CONTAINER_DLL_insert_tail (handle->ego_head,
2064 /* Ego renamed or added */
2065 if (identifier != NULL)
2067 for (ego_entry = handle->ego_head; NULL != ego_entry;
2068 ego_entry = ego_entry->next)
2070 if (ego_entry->ego == ego)
2073 GNUNET_free (ego_entry->identifier);
2074 ego_entry->identifier = GNUNET_strdup (identifier);
2078 if (NULL == ego_entry)
2081 ego_entry = GNUNET_new (struct EgoEntry);
2082 GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
2083 ego_entry->keystring = GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
2084 ego_entry->ego = ego;
2085 ego_entry->identifier = GNUNET_strdup (identifier);
2086 GNUNET_CONTAINER_DLL_insert_tail (handle->ego_head,
2094 for (ego_entry = handle->ego_head; NULL != ego_entry;
2095 ego_entry = ego_entry->next)
2097 if (ego_entry->ego == ego)
2100 if (NULL != ego_entry)
2101 GNUNET_CONTAINER_DLL_remove (handle->ego_head,
2108 rest_identity_process_request (struct GNUNET_REST_RequestHandle *rest_handle,
2109 GNUNET_REST_ResultProcessor proc,
2112 struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
2113 handle->oidc = GNUNET_new (struct OIDC_Variables);
2114 if (NULL == OIDC_cookie_jar_map)
2115 OIDC_cookie_jar_map = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2116 if (NULL == OIDC_access_token_map)
2117 OIDC_access_token_map =
2118 GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
2119 handle->response_code = 0;
2120 handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
2121 handle->proc_cls = proc_cls;
2122 handle->proc = proc;
2123 handle->state = ID_REST_STATE_INIT;
2124 handle->rest_handle = rest_handle;
2126 handle->url = GNUNET_strdup (rest_handle->url);
2127 if (handle->url[strlen (handle->url) - 1] == '/')
2128 handle->url[strlen (handle->url) - 1] = '\0';
2129 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Connecting...\n");
2130 handle->identity_handle = GNUNET_IDENTITY_connect (cfg, &list_ego, handle);
2131 handle->gns_handle = GNUNET_GNS_connect (cfg);
2132 handle->namestore_handle = GNUNET_NAMESTORE_connect (cfg);
2133 handle->timeout_task =
2134 GNUNET_SCHEDULER_add_delayed (handle->timeout, &do_timeout, handle);
2135 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Connected\n");
2139 * Entry point for the plugin.
2141 * @param cls Config info
2142 * @return NULL on error, otherwise the plugin context
2145 libgnunet_plugin_rest_openid_connect_init (void *cls)
2147 static struct Plugin plugin;
2148 struct GNUNET_REST_Plugin *api;
2151 if (NULL != plugin.cfg)
2152 return NULL; /* can only initialize once! */
2153 memset (&plugin, 0, sizeof (struct Plugin));
2155 api = GNUNET_new (struct GNUNET_REST_Plugin);
2157 api->name = GNUNET_REST_API_NS_OIDC;
2158 api->process_request = &rest_identity_process_request;
2159 GNUNET_asprintf (&allow_methods,
2160 "%s, %s, %s, %s, %s",
2161 MHD_HTTP_METHOD_GET,
2162 MHD_HTTP_METHOD_POST,
2163 MHD_HTTP_METHOD_PUT,
2164 MHD_HTTP_METHOD_DELETE,
2165 MHD_HTTP_METHOD_OPTIONS);
2167 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2168 _ ("OpenID Connect REST API initialized\n"));
2174 * Exit point from the plugin.
2176 * @param cls the plugin context (as returned by "init")
2177 * @return always NULL
2180 libgnunet_plugin_rest_openid_connect_done (void *cls)
2182 struct GNUNET_REST_Plugin *api = cls;
2183 struct Plugin *plugin = api->cls;
2186 struct GNUNET_CONTAINER_MultiHashMapIterator *hashmap_it;
2189 GNUNET_CONTAINER_multihashmap_iterator_create (OIDC_cookie_jar_map);
2190 while (GNUNET_YES ==
2191 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2192 GNUNET_free_non_null (value);
2193 GNUNET_CONTAINER_multihashmap_iterator_destroy (hashmap_it);
2194 GNUNET_CONTAINER_multihashmap_destroy (OIDC_cookie_jar_map);
2197 GNUNET_CONTAINER_multihashmap_iterator_create (OIDC_access_token_map);
2198 while (GNUNET_YES ==
2199 GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
2200 GNUNET_free_non_null (value);
2201 GNUNET_CONTAINER_multihashmap_destroy (OIDC_access_token_map);
2202 GNUNET_CONTAINER_multihashmap_iterator_destroy (hashmap_it);
2203 GNUNET_free_non_null (allow_methods);
2205 GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
2206 "OpenID Connect REST plugin is finished\n");
2210 /* end of plugin_rest_openid_connect.c */