oidc_helper.h File Reference

#include "gnunet_util_lib.h"
#include "gnunet_reclaim_service.h"

Include dependency graph for oidc_helper.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros
#define	JWT_ALG   "alg"
#define	JWT_TYP   "typ"
#define	JWT_TYP_VALUE   "jwt"
#define	JWT_ALG_VALUE_HMAC   "HS512"
#define	JWT_ALG_VALUE_RSA   "RS256"
#define	SERVER_ADDRESS   "http://localhost:7776"

Enumerations
enum	OIDC_VerificationOptions { OIDC_VERIFICATION_DEFAULT = 0 , OIDC_VERIFICATION_NO_CODE_VERIFIER = 1 }

Functions
char *	OIDC_generate_id_token_rsa (const char *rp_uri, const struct GNUNET_CRYPTO_BlindablePublicKey *sub_key, const struct GNUNET_RECLAIM_AttributeList *attrs, const struct GNUNET_RECLAIM_PresentationList *presentations, const struct GNUNET_TIME_Relative *expiration_time, const char *nonce, const json_t *secret_rsa_key)
	Create a JWT using RSA256 algorithm from attributes.
char *	OIDC_generate_id_token_hmac (const char *rp_uri, const struct GNUNET_CRYPTO_BlindablePublicKey *sub_key, const struct GNUNET_RECLAIM_AttributeList *attrs, const struct GNUNET_RECLAIM_PresentationList *presentations, const struct GNUNET_TIME_Relative *expiration_time, const char *nonce, const char *secret_key)
	Create a JWT using HMAC (HS256) from attributes.
char *	OIDC_build_authz_code (const struct GNUNET_CRYPTO_BlindablePrivateKey *issuer, const struct GNUNET_RECLAIM_Ticket *ticket, const struct GNUNET_RECLAIM_AttributeList *attrs, const struct GNUNET_RECLAIM_PresentationList *presentations, const char *nonce, const char *code_challenge)
	Builds an OIDC authorization code including a reclaim ticket and nonce.
int	OIDC_parse_authz_code (const char *rp_uri, const struct GNUNET_CRYPTO_BlindablePublicKey *cid, const char *code, const char *code_verifier, struct GNUNET_RECLAIM_Ticket *ticket, struct GNUNET_RECLAIM_AttributeList **attrs, struct GNUNET_RECLAIM_PresentationList **presentations, char **nonce, enum OIDC_VerificationOptions opts, char **emsg)
	Parse reclaim ticket and nonce from authorization code.
void	OIDC_build_token_response (const char *access_token, const char *id_token, const struct GNUNET_TIME_Relative *expiration_time, char **token_response)
	Build a token response for a token request TODO: Maybe we should add the scope here?
char *	OIDC_access_token_new (const struct GNUNET_RECLAIM_Ticket *ticket, const char *rp_uri)
	Generate a new access token.
int	OIDC_access_token_parse (const char *token, struct GNUNET_RECLAIM_Ticket **ticket, char **rp_uri)
	Parse an access token.
enum GNUNET_GenericReturnValue	OIDC_check_scopes_for_claim_request (const char *scopes, const char *attr)
	Checks if a claim is implicitly requested through standard scope(s)
char *	OIDC_generate_userinfo (const struct GNUNET_CRYPTO_BlindablePublicKey *sub_key, const struct GNUNET_RECLAIM_AttributeList *attrs, const struct GNUNET_RECLAIM_PresentationList *presentations)
	Generate userinfo JSON as string.

Macro Definition Documentation

JWT_ALG

#define JWT_ALG   "alg"

Definition at line 32 of file oidc_helper.h.

JWT_TYP

#define JWT_TYP   "typ"

Definition at line 33 of file oidc_helper.h.

JWT_TYP_VALUE

#define JWT_TYP_VALUE   "jwt"

Definition at line 34 of file oidc_helper.h.

JWT_ALG_VALUE_HMAC

#define JWT_ALG_VALUE_HMAC   "HS512"

Definition at line 36 of file oidc_helper.h.

JWT_ALG_VALUE_RSA

#define JWT_ALG_VALUE_RSA   "RS256"

Definition at line 37 of file oidc_helper.h.

SERVER_ADDRESS

#define SERVER_ADDRESS   "http://localhost:7776"

Definition at line 39 of file oidc_helper.h.

Enumeration Type Documentation

OIDC_VerificationOptions

enum OIDC_VerificationOptions

Enumerator
OIDC_VERIFICATION_DEFAULT	Strict verification.
OIDC_VERIFICATION_NO_CODE_VERIFIER	Do not check code verifier even if expected.

Definition at line 41 of file oidc_helper.h.

{
  OIDC_VERIFICATION_DEFAULT = 0,
 
  OIDC_VERIFICATION_NO_CODE_VERIFIER = 1
};

Function Documentation

OIDC_generate_id_token_rsa()

char * OIDC_generate_id_token_rsa	(	const char *	rp_uri,
		const struct GNUNET_CRYPTO_BlindablePublicKey *	sub_key,
		const struct GNUNET_RECLAIM_AttributeList *	attrs,
		const struct GNUNET_RECLAIM_PresentationList *	presentations,
		const struct GNUNET_TIME_Relative *	expiration_time,
		const char *	nonce,
		const json_t *	secret_rsa_key
	)

Create a JWT using RSA256 algorithm from attributes.

Parameters

rp_uri	the RP URI
sub_key	the public key of the subject
attrs	the attribute list
presentations	credential presentation list (may be empty)
expiration_time	the validity of the token
secret_rsa_key	the key used to sign the JWT

Returns

a new base64-encoded JWT string.

Definition at line 417 of file oidc_helper.c.

{
  json_t *jws;
  char *body_str;
  char *result;
 
  // Generate the body of the JSON Web Signature
  body_str = generate_id_token_body (rp_uri,
                                     sub_key,
                                     attrs,
                                     presentations,
                                     expiration_time,
                                     nonce);
 
  if (NULL == body_str)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Body for the JWS could not be generated\n");
    return NULL;
  }
 
  // Creating the JSON Web Signature.
  jws = json_pack ("{s:o}", "payload",
                   jose_b64_enc (body_str, strlen (body_str)));
  GNUNET_free (body_str);
 
  if (! jose_jws_sig (NULL, jws, NULL, secret_rsa_key))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Signature generation failed\n");
    return NULL;
  }
 
  // Encoding JSON as compact JSON Web Signature
  GNUNET_asprintf (&result, "%s.%s.%s",
                   json_string_value (json_object_get (jws, "protected")),
                   json_string_value (json_object_get (jws, "payload")),
                   json_string_value (json_object_get (jws, "signature")) );
 
  json_decref (jws);
  return result;
}

References generate_id_token_body(), GNUNET_asprintf(), GNUNET_ERROR_TYPE_ERROR, GNUNET_free, GNUNET_log, and result.

Referenced by token_endpoint().

Here is the call graph for this function:

Here is the caller graph for this function:

OIDC_generate_id_token_hmac()

char * OIDC_generate_id_token_hmac	(	const char *	rp_uri,
		const struct GNUNET_CRYPTO_BlindablePublicKey *	sub_key,
		const struct GNUNET_RECLAIM_AttributeList *	attrs,
		const struct GNUNET_RECLAIM_PresentationList *	presentations,
		const struct GNUNET_TIME_Relative *	expiration_time,
		const char *	nonce,
		const char *	secret_key
	)

Create a JWT using HMAC (HS256) from attributes.

Parameters

rp_uri	the RP URI
sub_key	the public key of the subject
attrs	the attribute list
presentations	credential presentation list (may be empty)
expiration_time	the validity of the token
secret_key	the key used to sign the JWT

Returns

a new base64-encoded JWT string.

Creating the JWT signature. This might not be standards compliant, check.

Definition at line 470 of file oidc_helper.c.

{
  struct GNUNET_HashCode signature;
  char *header;
  char *header_base64;
  char *body_str;
  char *body_base64;
  char *signature_target;
  char *signature_base64;
  char *result;
 
  // Generate and encode Header
  header = create_jwt_hmac_header ();
  if (NULL == header)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Header for the JWS could not be generated\n");
    return NULL;
  }
  GNUNET_STRINGS_base64url_encode (header, strlen (header), &header_base64);
  GNUNET_free (header);
  fix_base64 (header_base64);
 
  // Generate and encode the body of the JSON Web Signature
  body_str = generate_id_token_body (rp_uri,
                                     sub_key,
                                     attrs,
                                     presentations,
                                     expiration_time,
                                     nonce);
 
  if (NULL == body_str)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Body for the JWS could not be generated\n");
    GNUNET_free (header_base64);
    return NULL;
  }
 
  GNUNET_STRINGS_base64url_encode (body_str, strlen (body_str), &body_base64);
  fix_base64 (body_base64);
 
  GNUNET_asprintf (&signature_target, "%s.%s", header_base64, body_base64);
  GNUNET_CRYPTO_hmac_raw (secret_key,
                          strlen (secret_key),
                          signature_target,
                          strlen (signature_target),
                          &signature);
  GNUNET_STRINGS_base64url_encode ((const char *) &signature,
                                   sizeof(struct GNUNET_HashCode),
                                   &signature_base64);
  fix_base64 (signature_base64);
 
  GNUNET_asprintf (&result,
                   "%s.%s.%s",
                   header_base64,
                   body_base64,
                   signature_base64);
 
  GNUNET_free (header_base64);
  GNUNET_free (body_str);
  GNUNET_free (body_base64);
  GNUNET_free (signature_target);
  GNUNET_free (signature_base64);
  return result;
}

References create_jwt_hmac_header(), fix_base64(), generate_id_token_body(), GNUNET_asprintf(), GNUNET_CRYPTO_hmac_raw(), GNUNET_ERROR_TYPE_ERROR, GNUNET_free, GNUNET_log, GNUNET_STRINGS_base64url_encode(), and result.

Referenced by token_endpoint().

Here is the call graph for this function:

Here is the caller graph for this function:

OIDC_build_authz_code()

char * OIDC_build_authz_code	(	const struct GNUNET_CRYPTO_BlindablePrivateKey *	issuer,
		const struct GNUNET_RECLAIM_Ticket *	ticket,
		const struct GNUNET_RECLAIM_AttributeList *	attrs,
		const struct GNUNET_RECLAIM_PresentationList *	presentations,
		const char *	nonce_str,
		const char *	code_challenge
	)

Builds an OIDC authorization code including a reclaim ticket and nonce.

Parameters

issuer	the issuer
ticket	the ticket to include in the code
attrs	list of attributes to share
presentations	credential presentation list
nonce	the nonce to include in the code
code_challenge	PKCE code challenge
opts	verification options

Returns

a new authorization code (caller must free)

Parameters

issuer	the issuer of the ticket, used to sign the ticket and nonce
ticket	the ticket to include in the code
attrs	list of attributes which are shared
presentations	credential presentation list (may be empty)
nonce	the nonce to include in the code
code_challenge	PKCE code challenge

Returns

a new authorization code (caller must free)

PLAINTEXT

END

Definition at line 563 of file oidc_helper.c.

{
  struct OIDC_Parameters params;
  char *code_payload;
  char *payload;
  char *tmp;
  char *code_str;
  char *buf_ptr = NULL;
  size_t payload_len;
  size_t code_payload_len;
  size_t attr_list_len = 0;
  size_t pres_list_len = 0;
  size_t code_challenge_len = 0;
  uint32_t nonce_len = 0;
  struct GNUNET_CRYPTO_SignaturePurpose *purpose;
 
  // Assign ticket
  memset (&params, 0, sizeof(params));
  memcpy (params.ticket.gns_name, ticket->gns_name, strlen (ticket->gns_name)
          + 1);
  // Assign nonce
  payload_len = sizeof(struct OIDC_Parameters);
  if ((NULL != nonce_str) && (strcmp ("", nonce_str) != 0))
  {
    nonce_len = strlen (nonce_str);
    payload_len += nonce_len;
  }
  params.nonce_len = htonl (nonce_len);
  // Assign code challenge
  if (NULL != code_challenge)
    code_challenge_len = strlen (code_challenge);
  payload_len += code_challenge_len;
  params.code_challenge_len = htonl (code_challenge_len);
  // Assign attributes
  if (NULL != attrs)
  {
    // Get length
    attr_list_len = GNUNET_RECLAIM_attribute_list_serialize_get_size (attrs);
    params.attr_list_len = htonl (attr_list_len);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Length of serialized attributes: %lu\n",
                attr_list_len);
    // Get serialized attributes
    payload_len += attr_list_len;
  }
  if (NULL != presentations)
  {
    // Get length
    // FIXME only add presentations relevant for attribute list!!!
    // This is important because of the distinction between id_token and
    // userinfo in OIDC
    pres_list_len =
      GNUNET_RECLAIM_presentation_list_serialize_get_size (presentations);
    params.pres_list_len = htonl (pres_list_len);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Length of serialized presentations: %lu\n",
                pres_list_len);
    // Get serialized attributes
    payload_len += pres_list_len;
  }
 
  // Get plaintext length
  payload = GNUNET_malloc (payload_len);
  memcpy (payload, &params, sizeof(params));
  tmp = payload + sizeof(params);
  if (0 < code_challenge_len)
  {
    memcpy (tmp, code_challenge, code_challenge_len);
    tmp += code_challenge_len;
  }
  if (0 < nonce_len)
  {
    memcpy (tmp, nonce_str, nonce_len);
    tmp += nonce_len;
  }
  if (0 < attr_list_len)
    GNUNET_RECLAIM_attribute_list_serialize (attrs, tmp);
  tmp += attr_list_len;
  if (0 < pres_list_len)
    GNUNET_RECLAIM_presentation_list_serialize (presentations, tmp);
  tmp += pres_list_len;
 
  // Get length
  code_payload_len = sizeof(struct GNUNET_CRYPTO_SignaturePurpose)
                     + payload_len + sizeof(struct
                                            GNUNET_CRYPTO_BlindableKeySignature)
  ;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Length of data to encode: %lu\n",
              code_payload_len);
 
  // Initialize code payload
  code_payload = GNUNET_malloc (code_payload_len);
  GNUNET_assert (NULL != code_payload);
  purpose = (struct GNUNET_CRYPTO_SignaturePurpose *) code_payload;
  purpose->size = htonl (sizeof(struct GNUNET_CRYPTO_SignaturePurpose)
                         + payload_len);
  purpose->purpose = htonl (GNUNET_SIGNATURE_PURPOSE_RECLAIM_CODE_SIGN);
  // Store pubkey
  buf_ptr = (char *) &purpose[1];
  memcpy (buf_ptr, payload, payload_len);
  GNUNET_free (payload);
  buf_ptr += payload_len;
  // Sign and store signature
  if (GNUNET_SYSERR ==
      GNUNET_CRYPTO_blinded_key_sign_ (issuer,
                                       purpose,
                                       (struct
                                        GNUNET_CRYPTO_BlindableKeySignature *)
                                       buf_ptr))
  {
    GNUNET_break (0);
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Unable to sign code\n");
    GNUNET_free (code_payload);
    return NULL;
  }
  GNUNET_STRINGS_base64url_encode (code_payload, code_payload_len, &code_str);
  GNUNET_free (code_payload);
  return code_str;
}

References OIDC_Parameters::attr_list_len, OIDC_Parameters::code_challenge_len, GNUNET_RECLAIM_Ticket::gns_name, GNUNET_assert, GNUNET_break, GNUNET_CRYPTO_blinded_key_sign_(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_ERROR, GNUNET_free, GNUNET_log, GNUNET_malloc, GNUNET_RECLAIM_attribute_list_serialize(), GNUNET_RECLAIM_attribute_list_serialize_get_size(), GNUNET_RECLAIM_presentation_list_serialize(), GNUNET_RECLAIM_presentation_list_serialize_get_size(), GNUNET_SIGNATURE_PURPOSE_RECLAIM_CODE_SIGN, GNUNET_STRINGS_base64url_encode(), GNUNET_SYSERR, OIDC_Parameters::nonce_len, payload, OIDC_Parameters::pres_list_len, GNUNET_CRYPTO_SignaturePurpose::purpose, ticket, and OIDC_Parameters::ticket.

Referenced by oidc_ticket_issue_cb().

Here is the call graph for this function:

Here is the caller graph for this function:

OIDC_parse_authz_code()

int OIDC_parse_authz_code	(	const char *	rp_uri,
		const struct GNUNET_CRYPTO_BlindablePublicKey *	cid,
		const char *	code,
		const char *	code_verifier,
		struct GNUNET_RECLAIM_Ticket *	ticket,
		struct GNUNET_RECLAIM_AttributeList **	attrs,
		struct GNUNET_RECLAIM_PresentationList **	presentations,
		char **	nonce_str,
		enum OIDC_VerificationOptions	opts,
		char **	emsg
	)

Parse reclaim ticket and nonce from authorization code.

This also verifies the signature in the code.

Parameters

rp_uri	the RP URI
code	the string representation of the code
code_verfier	PKCE code verifier
ticket	where to store the ticket
attrs	the attributes found in the code
presentations	credential presentation list
nonce	where to store the nonce

Returns

GNUNET_OK if successful, else GNUNET_SYSERR

This also verifies the signature in the code.

Parameters

audience	the expected audience of the code
code	the string representation of the code
code_verfier	PKCE code verifier. Optional, must be provided if used in request.
ticket	where to store the ticket
attrs	the attributes in the code
presentations	credential presentation list
nonce_str	where to store the nonce (if contained)

Returns

GNUNET_OK if successful, else GNUNET_SYSERR

Definition at line 752 of file oidc_helper.c.

{
  char *code_payload;
  char *ptr;
  char *plaintext;
  char *attrs_ser;
  char *presentations_ser;
  char *code_challenge;
  struct GNUNET_CRYPTO_SignaturePurpose *purpose;
  struct GNUNET_CRYPTO_BlindableKeySignature *signature;
  struct GNUNET_CRYPTO_BlindablePublicKey iss;
  uint32_t code_challenge_len;
  uint32_t attrs_ser_len;
  uint32_t pres_ser_len;
  size_t plaintext_len;
  size_t code_payload_len;
  uint32_t nonce_len = 0;
  struct OIDC_Parameters *params;
 
 
  GNUNET_GNS_parse_ztld (ticket->gns_name, &iss);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Trying to decode `%s'\n", code);
  code_payload = NULL;
  code_payload_len =
    GNUNET_STRINGS_base64url_decode (code, strlen (code),
                                     (void **) &code_payload);
  if (code_payload_len < sizeof(struct GNUNET_CRYPTO_SignaturePurpose)
      + sizeof(struct OIDC_Parameters)
      + sizeof(struct GNUNET_CRYPTO_BlindableKeySignature))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Authorization code malformed\n");
    GNUNET_free (code_payload);
    return GNUNET_SYSERR;
  }
 
  purpose = (struct GNUNET_CRYPTO_SignaturePurpose *) code_payload;
  plaintext_len = code_payload_len;
  plaintext_len -= sizeof(struct GNUNET_CRYPTO_SignaturePurpose);
  ptr = (char *) &purpose[1];
  plaintext_len -= sizeof(struct GNUNET_CRYPTO_BlindableKeySignature);
  plaintext = ptr;
  ptr += plaintext_len;
  signature = (struct GNUNET_CRYPTO_BlindableKeySignature *) ptr;
  params = (struct OIDC_Parameters *) plaintext;
 
  // cmp code_challenge code_verifier
  code_challenge_len = ntohl (params->code_challenge_len);
  code_challenge = ((char *) &params[1]);
  if (! (opts & OIDC_VERIFICATION_NO_CODE_VERIFIER))
  {
    if (GNUNET_OK != check_code_challenge (code_challenge,
                                           code_challenge_len,
                                           code_verifier))
    {
      GNUNET_asprintf (emsg, "Code verifier `%s' invalid for challenge `%s'",
                       code_verifier, code_challenge);
      GNUNET_free (code_payload);
      return GNUNET_SYSERR;
    }
  }
  nonce_len = ntohl (params->nonce_len);
  if (0 != nonce_len)
  {
    *nonce_str = GNUNET_strndup (code_challenge + code_challenge_len,
                                 nonce_len);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Got nonce: %s\n", *nonce_str);
  }
 
  // Ticket
  memcpy (ticket, &params->ticket, sizeof(params->ticket));
  // Signature
  // GNUNET_CRYPTO_ecdsa_key_get_public (ecdsa_priv, &ecdsa_pub);
  if (GNUNET_OK !=
      GNUNET_CRYPTO_blinded_key_signature_verify_ (
        GNUNET_SIGNATURE_PURPOSE_RECLAIM_CODE_SIGN,
        purpose,
        signature,
        &iss))
  {
    GNUNET_free (code_payload);
    if (NULL != *nonce_str)
      GNUNET_free (*nonce_str);
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Signature of AuthZ code invalid!\n");
    *emsg = GNUNET_strdup ("Signature verification failed");
    return GNUNET_SYSERR;
  }
  // Attributes
  attrs_ser = ((char *) &params[1]) + code_challenge_len + nonce_len;
  attrs_ser_len = ntohl (params->attr_list_len);
  *attrs = GNUNET_RECLAIM_attribute_list_deserialize (attrs_ser, attrs_ser_len);
  presentations_ser = ((char*) attrs_ser) + attrs_ser_len;
  pres_ser_len = ntohl (params->pres_list_len);
  *presentations =
    GNUNET_RECLAIM_presentation_list_deserialize (presentations_ser,
                                                  pres_ser_len);
 
  GNUNET_free (code_payload);
  return GNUNET_OK;
}

References OIDC_Parameters::attr_list_len, check_code_challenge(), OIDC_Parameters::code_challenge_len, GNUNET_RECLAIM_Ticket::gns_name, GNUNET_asprintf(), GNUNET_CRYPTO_blinded_key_signature_verify_(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_ERROR, GNUNET_free, GNUNET_GNS_parse_ztld(), GNUNET_log, GNUNET_OK, GNUNET_RECLAIM_attribute_list_deserialize(), GNUNET_RECLAIM_presentation_list_deserialize(), GNUNET_SIGNATURE_PURPOSE_RECLAIM_CODE_SIGN, GNUNET_strdup, GNUNET_STRINGS_base64url_decode(), GNUNET_strndup, GNUNET_SYSERR, OIDC_Parameters::nonce_len, OIDC_VERIFICATION_NO_CODE_VERIFIER, OIDC_Parameters::pres_list_len, GNUNET_CRYPTO_SignaturePurpose::purpose, ticket, and OIDC_Parameters::ticket.

Referenced by consume_fail(), and token_endpoint().

Here is the call graph for this function:

Here is the caller graph for this function:

OIDC_build_token_response()

void OIDC_build_token_response	(	const char *	access_token,
		const char *	id_token,
		const struct GNUNET_TIME_Relative *	expiration_time,
		char **	token_response
	)

Build a token response for a token request TODO: Maybe we should add the scope here?

Parameters

access_token	the access token to include
id_token	the id_token to include
expiration_time	the expiration time of the token(s)
token_response	where to store the response

Definition at line 871 of file oidc_helper.c.

{
  json_t *root_json;
 
  root_json = json_object ();
 
  GNUNET_assert (NULL != access_token);
  GNUNET_assert (NULL != id_token);
  GNUNET_assert (NULL != expiration_time);
  json_object_set_new (root_json, "access_token", json_string (access_token));
  json_object_set_new (root_json, "token_type", json_string ("Bearer"));
  json_object_set_new (root_json,
                       "expires_in",
                       json_integer (expiration_time->rel_value_us
                                     / (1000 * 1000)));
  json_object_set_new (root_json, "id_token", json_string (id_token));
  *token_response = json_dumps (root_json, JSON_INDENT (0) | JSON_COMPACT);
  json_decref (root_json);
}

References GNUNET_assert, and GNUNET_TIME_Relative::rel_value_us.

Referenced by token_endpoint().

Here is the caller graph for this function:

OIDC_access_token_new()

char * OIDC_access_token_new	(	const struct GNUNET_RECLAIM_Ticket *	ticket,
		const char *	rp_uri
	)

Generate a new access token.

Definition at line 899 of file oidc_helper.c.

{
  char *access_token;
  char *tkt_b64;
 
  GNUNET_STRINGS_base64_encode (ticket,
                                sizeof(*ticket),
                                &tkt_b64);
  GNUNET_asprintf (&access_token, "%s-%s", tkt_b64, rp_uri);
  GNUNET_free (tkt_b64);
  return access_token;
}

References GNUNET_asprintf(), GNUNET_free, GNUNET_STRINGS_base64_encode(), and ticket.

Referenced by token_endpoint().

Here is the call graph for this function:

Here is the caller graph for this function:

OIDC_access_token_parse()

int OIDC_access_token_parse	(	const char *	token,
		struct GNUNET_RECLAIM_Ticket **	ticket,
		char **	rp_uri
	)

Parse an access token.

Definition at line 918 of file oidc_helper.c.

{
  size_t sret;
  char *decoded;
  char *tmp;
  char *tkt_str;
  char *rp_uri_str;
  tmp = GNUNET_strdup (token);
  tkt_str = strtok (tmp, "-");
  GNUNET_assert (NULL != tkt_str); // FIXME handle
  rp_uri_str = strtok (NULL, "-");
  GNUNET_assert (NULL != rp_uri_str); // FIXME handle
  sret = GNUNET_STRINGS_base64_decode (tkt_str,
                                       strlen (tkt_str),
                                       (void**) &decoded);
  if (sizeof (struct GNUNET_RECLAIM_Ticket) != sret)
  {
    GNUNET_free (decoded);
    GNUNET_free (tmp);
    return GNUNET_SYSERR;
  }
  *ticket = (struct GNUNET_RECLAIM_Ticket *) decoded;
  *rp_uri = GNUNET_strdup (rp_uri_str);
  GNUNET_free (tmp);
  return GNUNET_OK;
}

References GNUNET_assert, GNUNET_free, GNUNET_OK, GNUNET_strdup, GNUNET_STRINGS_base64_decode(), GNUNET_SYSERR, and ticket.

Referenced by userinfo_endpoint().

Here is the call graph for this function:

Here is the caller graph for this function:

OIDC_check_scopes_for_claim_request()

enum GNUNET_GenericReturnValue OIDC_check_scopes_for_claim_request	(	const char *	scopes,
		const char *	attr
	)

Checks if a claim is implicitly requested through standard scope(s)

Parameters

scopes	the scopes which have been requested
attr	the attribute name to check

Returns

GNUNET_YES if attribute is implicitly requested

Checks if a claim is implicitly requested through standard scope(s)

Parameters

scopes	the scopes which have been requested
attr	the attribute name to check

Returns

GNUNET_YES if attribute is implicitly requested

attribute matches requested scope

Definition at line 957 of file oidc_helper.c.

{
  char *scope_variables;
  char *scope_variable;
  char delimiter[] = " ";
  int i;
 
  scope_variables = GNUNET_strdup (scopes);
  scope_variable = strtok (scope_variables, delimiter);
  while (NULL != scope_variable)
  {
    if (0 == strcmp ("profile", scope_variable))
    {
      for (i = 0; i < 14; i++)
      {
        if (0 == strcmp (attr, OIDC_profile_claims[i]))
        {
          GNUNET_free (scope_variables);
          return GNUNET_YES;
        }
      }
    }
    else if (0 == strcmp ("address", scope_variable))
    {
      for (i = 0; i < 5; i++)
      {
        if (0 == strcmp (attr, OIDC_address_claims[i]))
        {
          GNUNET_free (scope_variables);
          return GNUNET_YES;
        }
      }
    }
    else if (0 == strcmp ("email", scope_variable))
    {
      for (i = 0; i < 2; i++)
      {
        if (0 == strcmp (attr, OIDC_email_claims[i]))
        {
          GNUNET_free (scope_variables);
          return GNUNET_YES;
        }
      }
    }
    else if (0 == strcmp ("phone", scope_variable))
    {
      for (i = 0; i < 2; i++)
      {
        if (0 == strcmp (attr, OIDC_phone_claims[i]))
        {
          GNUNET_free (scope_variables);
          return GNUNET_YES;
        }
      }
 
    }
    else if (0 == strcmp (attr, scope_variable))
    {
      GNUNET_free (scope_variables);
      return GNUNET_YES;
    }
    scope_variable = strtok (NULL, delimiter);
  }
  GNUNET_free (scope_variables);
  return GNUNET_NO;
 
}

References GNUNET_free, GNUNET_NO, GNUNET_strdup, GNUNET_YES, OIDC_address_claims, OIDC_email_claims, OIDC_phone_claims, and OIDC_profile_claims.

Referenced by attr_in_claims_request().

Here is the caller graph for this function:

OIDC_generate_userinfo()

char * OIDC_generate_userinfo	(	const struct GNUNET_CRYPTO_BlindablePublicKey *	sub_key,
		const struct GNUNET_RECLAIM_AttributeList *	attrs,
		const struct GNUNET_RECLAIM_PresentationList *	presentations
	)

Generate userinfo JSON as string.

Parameters

sub_key	the subject (user)
attrs	user attribute list
presentations	credential presentation list

Returns

Userinfo JSON

Parameters

sub_key	the subject (user)
attrs	user attribute list
presentations	credential presentation list (may be empty)

Returns

Userinfo JSON

Definition at line 342 of file oidc_helper.c.

{
  char *body_str;
  json_t*body = generate_userinfo_json (sub_key,
                                        attrs,
                                        presentations);
  body_str = json_dumps (body, JSON_INDENT (0) | JSON_COMPACT);
  json_decref (body);
  return body_str;
}

References generate_userinfo_json().

Referenced by consume_fail(), and consume_ticket().

Here is the call graph for this function:

Here is the caller graph for this function: