#define GNUNET_REST_API_NS_IDENTITY_CONSUME "/idp/consume"
/**
- * Authorize namespace
+ * Authorize endpoint
*/
#define GNUNET_REST_API_NS_AUTHORIZE "/idp/authorize"
+/**
+ * Token endpoint
+ */
+#define GNUNET_REST_API_NS_TOKEN "/idp/token"
+
/**
* Login namespace
*/
*/
#define OIDC_COOKIE_HEADER_KEY "Cookie"
+/**
+ * OIDC cookie header information key
+ */
+#define OIDC_AUTHORIZATION_HEADER_KEY "Authorization"
+
+
/**
* OIDC cookie header information key
*/
/**
* OIDC authorized identities and times hashmap
*/
-struct GNUNET_CONTAINER_MultiHashMap *OIDC_authorized_identities;
+struct GNUNET_CONTAINER_MultiHashMap *OIDC_identity_login_time;
+
+/**
+ * OIDC authorized identities and times hashmap
+ */
+struct GNUNET_CONTAINER_MultiHashMap *OIDC_identity_grants;
/**
* The configuration handle
(NULL != handle->oidc->state) ? "\"" : "");
if ( 0 == handle->response_code )
{
- handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+ handle->response_code = MHD_HTTP_BAD_REQUEST;
}
resp = GNUNET_REST_create_response (json_error);
handle->proc (handle->proc_cls, resp, handle->response_code);
struct GNUNET_JSONAPI_Resource *json_resource;
struct RequestHandle *handle = cls;
json_t *value;
+ char* tmp_value;
if ((NULL == attr->name) || (NULL == attr->data))
{
attr->name);
GNUNET_JSONAPI_document_resource_add (handle->resp_object, json_resource);
- value = json_string (attr->data);
+ tmp_value = GNUNET_IDENTITY_ATTRIBUTE_value_to_string (attr->type,
+ attr->data,
+ attr->data_size);
+
+ value = json_string (tmp_value);
+
GNUNET_JSONAPI_resource_add_attr (json_resource,
"value",
value);
json_decref (value);
+ GNUNET_free(tmp_value);
GNUNET_IDENTITY_PROVIDER_get_attributes_next (handle->attr_it);
}
{
struct GNUNET_HashCode cache_key;
char* cookies;
+ struct GNUNET_TIME_Absolute current_time, *relog_time;
char delimiter[] = "; ";
//gets identity of login try with cookie
}
GNUNET_CRYPTO_hash (handle->oidc->login_identity, strlen (handle->oidc->login_identity),
&cache_key);
- if ( GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (OIDC_authorized_identities, &cache_key) )
+ if ( GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (OIDC_identity_login_time, &cache_key) )
{
- relog_time = GNUNET_CONTAINER_multihashmap_get (OIDC_authorized_identities,
+ relog_time = GNUNET_CONTAINER_multihashmap_get (OIDC_identity_login_time,
&cache_key);
current_time = GNUNET_TIME_absolute_get ();
// 30 min after old login -> redirect to login
{
struct RequestHandle *handle = cls;
struct MHD_Response *resp;
+ struct GNUNET_HashCode cache_key;
char* ticket_str;
char* redirect_uri;
+ char* jwt;
+ handle->idp_op = NULL;
resp = GNUNET_REST_create_response ("");
if (NULL != ticket) {
ticket_str = GNUNET_STRINGS_data_to_string_alloc (ticket,
sizeof (struct GNUNET_IDENTITY_PROVIDER_Ticket));
+
+
+ //TODO Check if this is right:
+// GNUNET_CRYPTO_hash (ticket_str, strlen (ticket_str), &cache_key);
+// jwt = jwt_create_from_list (handle->oidc->client_pkey,
+// handle->attr_list,
+// handle->priv_key);
+// //TODO Check success of function
+// GNUNET_CONTAINER_multihashmap_put (
+// OIDC_identity_grants, &cache_key, jwt,
+// GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+
+
GNUNET_asprintf (&redirect_uri, "%s?%s=%s&state=%s",
handle->oidc->redirect_uri,
handle->oidc->response_type,
GNUNET_free(identity_cookie);
//No login time for identity -> redirect to login
if ( GNUNET_YES
- == GNUNET_CONTAINER_multihashmap_contains (OIDC_authorized_identities,
+ == GNUNET_CONTAINER_multihashmap_contains (OIDC_identity_login_time,
&cache_key) )
{
- relog_time = GNUNET_CONTAINER_multihashmap_get (OIDC_authorized_identities,
+ relog_time = GNUNET_CONTAINER_multihashmap_get (OIDC_identity_login_time,
&cache_key);
current_time = GNUNET_TIME_absolute_get ();
// 30 min after old login -> redirect to login
handle->ego_entry = handle->ego_entry->next;
- if(NULL != handle->ego_entry){
+ if(NULL != handle->ego_entry)
+ {
handle->priv_key = *GNUNET_IDENTITY_ego_get_private_key (handle->ego_entry->ego);
handle->namestore_handle_it = GNUNET_NAMESTORE_zone_iteration_start (handle->namestore_handle, &handle->priv_key,
&oidc_iteration_error, handle, &namestore_iteration_callback, handle,
&cache_key))
{
handle->emsg=GNUNET_strdup("invalid_request");
- handle->edesc=GNUNET_strdup("Missing parameter: redirect_uri");
+ handle->edesc=GNUNET_strdup("missing parameter redirect_uri");
GNUNET_SCHEDULER_add_now (&do_error, handle);
return;
}
&cache_key))
{
handle->emsg=GNUNET_strdup("invalid_request");
- handle->edesc=GNUNET_strdup("Missing parameter: response_type");
+ handle->edesc=GNUNET_strdup("missing parameter response_type");
GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
return;
}
&cache_key))
{
handle->emsg=GNUNET_strdup("invalid_request");
- handle->edesc=GNUNET_strdup("Missing parameter: scope");
+ handle->edesc=GNUNET_strdup("missing parameter scope");
GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
return;
}
&cache_key))
{
handle->emsg=GNUNET_strdup("invalid_request");
- handle->edesc=GNUNET_strdup("Missing parameter: client_id");
+ handle->edesc=GNUNET_strdup("missing parameter client_id");
handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
GNUNET_SCHEDULER_add_now (&do_error, handle);
return;
if ( NULL == cache_object || !json_is_string(cache_object) )
{
handle->emsg=GNUNET_strdup("invalid_request");
- handle->edesc=GNUNET_strdup("Missing parameter: redirect_uri");
+ handle->edesc=GNUNET_strdup("missing parameter redirect_uri");
GNUNET_SCHEDULER_add_now (&do_error, handle);
return;
}
if ( NULL == cache_object || !json_is_string(cache_object) )
{
handle->emsg=GNUNET_strdup("invalid_request");
- handle->edesc=GNUNET_strdup("Missing parameter: response_type");
+ handle->edesc=GNUNET_strdup("missing parameter response_type");
GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
return;
}
if ( NULL == cache_object || !json_is_string(cache_object) )
{
handle->emsg=GNUNET_strdup("invalid_request");
- handle->edesc=GNUNET_strdup("Missing parameter: scope");
+ handle->edesc=GNUNET_strdup("missing parameter scope");
GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
return;
}
if ( NULL == cache_object || !json_is_string(cache_object) )
{
handle->emsg = GNUNET_strdup("invalid_request");
- handle->edesc = GNUNET_strdup("Missing parameter: client_id");
+ handle->edesc = GNUNET_strdup("missing parameter client_id");
handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
GNUNET_SCHEDULER_add_now (&do_error, handle);
return;
*current_time = GNUNET_TIME_relative_to_absolute (
GNUNET_TIME_relative_multiply (GNUNET_TIME_relative_get_minute_ (),
30));
- last_time = GNUNET_CONTAINER_multihashmap_get(OIDC_authorized_identities, &cache_key);
+ last_time = GNUNET_CONTAINER_multihashmap_get(OIDC_identity_login_time, &cache_key);
if (NULL != last_time)
{
GNUNET_free(last_time);
}
GNUNET_CONTAINER_multihashmap_put (
- OIDC_authorized_identities, &cache_key, current_time,
+ OIDC_identity_login_time, &cache_key, current_time,
GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
return;
}
+static void
+token_cont(struct GNUNET_REST_RequestHandle *con_handle,
+ const char* url,
+ void *cls)
+{
+ //TODO static strings
+ struct RequestHandle *handle = cls;
+ struct GNUNET_HashCode cache_key;
+ char *authorization, *cache_authorization, *jwt;
+ char delimiter[]=" ";
+ json_t *cache_object;
+ json_error_t error;
+ char *grant_type, *code, *expected_jwt, *redirect_uri, *expected_redirect_uri;
+
+ handle->oidc->post_object = json_loads (handle->rest_handle->data, 0, &error);
+ //Check Authorization Header
+ GNUNET_CRYPTO_hash (OIDC_COOKIE_HEADER_KEY, strlen (OIDC_COOKIE_HEADER_KEY),
+ &cache_key);
+ if ( GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle->header_param_map,
+ &cache_key) )
+ {
+ //error
+ }
+ authorization = GNUNET_CONTAINER_multihashmap_get ( handle->rest_handle->header_param_map, &cache_key);
+ //split JWT in "Base" and [content]
+ cache_authorization = GNUNET_strdup (authorization);
+ jwt = strtok(cache_authorization,delimiter);
+ if( NULL != jwt)
+ {
+ jwt = strtok(jwt, delimiter);
+ GNUNET_log(GNUNET_ERROR_TYPE_ERROR, "Test:%s\n", jwt);
+ }
+
+ cache_object = json_object_get (handle->oidc->post_object, "grant_type");
+ if ( NULL == cache_object || !json_is_string(cache_object) )
+ {
+ handle->emsg=GNUNET_strdup("invalid_request");
+ handle->edesc=GNUNET_strdup("missing parameter grant_type");
+ GNUNET_SCHEDULER_add_now (&do_error, handle);
+ return;
+ }
+ grant_type = json_string_value (cache_object);
+
+ //Check parameter grant_type == "authorization_code"
+ if (0 != strcmp("authorization_code", grant_type))
+ {
+ //error
+ }
+
+ cache_object = json_object_get (handle->oidc->post_object, "code");
+ if ( NULL == cache_object || !json_is_string(cache_object) )
+ {
+ handle->emsg=GNUNET_strdup("invalid_request");
+ handle->edesc=GNUNET_strdup("missing parameter code");
+ GNUNET_SCHEDULER_add_now (&do_error, handle);
+ return;
+ }
+ code = json_string_value (cache_object);
+
+ // lookup code in grants_hashmap and check if [content] is same
+ GNUNET_CRYPTO_hash(code, strlen(code), &cache_key);
+ if ( GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (OIDC_identity_grants, &cache_key) )
+ {
+ //error
+ }
+ expected_jwt = GNUNET_CONTAINER_multihashmap_get (OIDC_identity_grants, &cache_key);
+
+ if (0 != strcmp(expected_jwt,jwt))
+ {
+ //error
+ }
+
+ cache_object = json_object_get (handle->oidc->post_object, "redirect_uri");
+ if ( NULL == cache_object || !json_is_string(cache_object) )
+ {
+ handle->emsg=GNUNET_strdup("invalid_request");
+ handle->edesc=GNUNET_strdup("missing parameter code");
+ GNUNET_SCHEDULER_add_now (&do_error, handle);
+ return;
+ }
+ redirect_uri = json_string_value (cache_object);
+
+ // check redirect_uri
+ // jwt breakdown to iss or sub
+
+// GNUNET_asprintf (&expected_redirect_uri, "https://%s.zkey", iss);
+// // verify the redirect uri matches https://<client_id>.zkey[/xyz]
+// if( 0 != strncmp( expected_redirect_uri, redirect_uri, strlen(expected_redirect_uri)) )
+// {
+// handle->emsg=GNUNET_strdup("invalid_request");
+// handle->edesc=GNUNET_strdup("Invalid redirect_uri");
+// GNUNET_SCHEDULER_add_now (&do_error, handle);
+// GNUNET_free(expected_redirect_uri);
+// return;
+// }
+// handle->oidc->redirect_uri = GNUNET_strdup(handle->oidc->redirect_uri);
+// GNUNET_free(expected_redirect_uri);
+
+
+ //do we need the client_id?
+
+ GNUNET_free(cache_authorization);
+ decref(handle->oidc->post_object);
+}
+
/**
* Handle rest request
*
{MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_IDENTITY_ATTRIBUTES, &add_attribute_cont},
{MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_IDENTITY_TICKETS, &list_tickets_cont},
{MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_AUTHORIZE, &authorize_GET_cont},
- {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_LOGIN, &login_cont},
{MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_AUTHORIZE, &authorize_POST_cont},
+ {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_LOGIN, &login_cont},
+ {MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_TOKEN, &token_cont},
{MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_IDENTITY_REVOKE, &revoke_ticket_cont},
{MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_IDENTITY_CONSUME, &consume_ticket_cont},
{MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_IDENTITY_PROVIDER,
{
struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
handle->oidc = GNUNET_new (struct OIDC_Variables);
- if ( NULL == OIDC_authorized_identities )
- OIDC_authorized_identities = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
+ if ( NULL == OIDC_identity_login_time )
+ OIDC_identity_login_time = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
+ if ( NULL == OIDC_identity_grants )
+ OIDC_identity_grants = GNUNET_CONTAINER_multihashmap_create (10, GNUNET_NO);
handle->response_code = 0;
handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
handle->proc_cls = proc_cls;
{
struct GNUNET_REST_Plugin *api = cls;
struct Plugin *plugin = api->cls;
-
plugin->cfg = NULL;
+
+ struct GNUNET_CONTAINER_MultiHashMapIterator *hashmap_it;
+ void *value = NULL;
+ hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (
+ OIDC_identity_login_time);
+ while (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
+ {
+ if (NULL != value)
+ GNUNET_free(value);
+ }
+ GNUNET_CONTAINER_multihashmap_destroy(OIDC_identity_login_time);
+ hashmap_it = GNUNET_CONTAINER_multihashmap_iterator_create (OIDC_identity_grants);
+ while (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_iterator_next (hashmap_it, NULL, value))
+ {
+ if (NULL != value)
+ GNUNET_free(value);
+ }
+ GNUNET_CONTAINER_multihashmap_destroy(OIDC_identity_grants);
GNUNET_free_non_null (allow_methods);
GNUNET_free (api);
GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
projects / oweals / gnunet.git / commitdiff