42 #include "microhttpd.h" 48 #define GNUNET_REST_API_NS_OIDC "/openid" 53 #define GNUNET_REST_API_NS_OIDC_CONFIG "/.well-known/openid-configuration" 58 #define GNUNET_REST_API_NS_AUTHORIZE "/openid/authorize" 63 #define GNUNET_REST_API_NS_TOKEN "/openid/token" 68 #define GNUNET_REST_API_NS_USERINFO "/openid/userinfo" 73 #define GNUNET_REST_API_NS_LOGIN "/openid/login" 78 #define ID_REST_STATE_INIT 0 83 #define ID_REST_STATE_POST_INIT 1 88 #define OIDC_GRANT_TYPE_KEY "grant_type" 93 #define OIDC_GRANT_TYPE_VALUE "authorization_code" 98 #define OIDC_CODE_KEY "code" 103 #define OIDC_RESPONSE_TYPE_KEY "response_type" 108 #define OIDC_CLIENT_ID_KEY "client_id" 113 #define OIDC_SCOPE_KEY "scope" 118 #define OIDC_REDIRECT_URI_KEY "redirect_uri" 123 #define OIDC_STATE_KEY "state" 128 #define OIDC_NONCE_KEY "nonce" 133 #define OIDC_CLAIMS_KEY "claims" 138 #define OIDC_CODE_CHALLENGE_KEY "code_challenge" 143 #define OIDC_CODE_VERIFIER_KEY "code_verifier" 148 #define OIDC_COOKIE_EXPIRATION 3 153 #define OIDC_COOKIE_HEADER_KEY "cookie" 158 #define OIDC_AUTHORIZATION_HEADER_KEY "authorization" 163 #define OIDC_COOKIE_HEADER_INFORMATION_KEY "Identity=" 168 #define OIDC_COOKIE_HEADER_ACCESS_DENIED "Identity=Denied" 173 #define OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE "code" 178 #define OIDC_EXPECTED_AUTHORIZATION_SCOPE "openid" 183 #define OIDC_ERROR_KEY_INVALID_CLIENT "invalid_client" 188 #define OIDC_ERROR_KEY_INVALID_SCOPE "invalid_scope" 193 #define OIDC_ERROR_KEY_INVALID_REQUEST "invalid_request" 198 #define OIDC_ERROR_KEY_INVALID_TOKEN "invalid_token" 203 #define OIDC_ERROR_KEY_INVALID_COOKIE "invalid_cookie" 208 #define OIDC_ERROR_KEY_SERVER_ERROR "server_error" 213 #define OIDC_ERROR_KEY_UNSUPPORTED_GRANT_TYPE "unsupported_grant_type" 218 #define OIDC_ERROR_KEY_UNSUPPORTED_RESPONSE_TYPE "unsupported_response_type" 223 #define OIDC_ERROR_KEY_UNAUTHORIZED_CLIENT "unauthorized_client" 228 #define OIDC_ERROR_KEY_ACCESS_DENIED "access_denied" 233 #define CONSUME_TIMEOUT GNUNET_TIME_relative_multiply ( \ 234 GNUNET_TIME_UNIT_SECONDS,2) 592 if (NULL != handle->
idp_op)
602 if (NULL != handle->
gns_op)
604 if (NULL != handle->
oidc)
645 struct MHD_Response *resp;
649 "{ \"error\" : \"%s\", \"error_description\" : \"%s\"%s%s%s}",
652 (NULL != handle->
oidc->
state) ?
", \"state\":\"" :
"",
654 (NULL != handle->
oidc->
state) ?
"\"" :
"");
659 MHD_add_response_header (resp, MHD_HTTP_HEADER_WWW_AUTHENTICATE,
"Basic");
660 MHD_add_response_header (resp,
661 MHD_HTTP_HEADER_CONTENT_TYPE,
679 struct MHD_Response *resp;
683 "Error: %s\n", handle->
edesc);
685 "error=\"%s\", error_description=\"%s\"",
687 (NULL != handle->
edesc) ? handle->
edesc :
"");
689 MHD_add_response_header (resp, MHD_HTTP_HEADER_WWW_AUTHENTICATE,
"Bearer");
705 struct MHD_Response *resp;
709 "%s?error=%s&error_description=%s%s%s",
713 (NULL != handle->
oidc->
state) ?
"&state=" :
"",
716 MHD_add_response_header (resp,
"Location", redirect);
750 struct MHD_Response *resp;
755 MHD_add_response_header (resp,
"Access-Control-Allow-Methods",
allow_methods);
771 char delimiter[] =
"; ";
792 token = strtok (cookies, delimiter);
798 "Unable to parse cookie: %s\n",
804 while (NULL != token)
814 token = strtok (NULL, delimiter);
819 "No cookie value to process: %s\n",
830 "Found cookie `%s', but no corresponding expiration entry present...\n",
842 "Found cookie `%s', but it is expired.\n",
860 char *login_base_url;
863 struct MHD_Response *resp;
868 "reclaim-rest-plugin",
935 MHD_add_response_header (resp,
"Location", new_redirect);
976 struct MHD_Response *resp;
1000 (NULL != handle->
tld))
1003 "%s.%s/%s%s%s=%s&state=%s",
1016 "%s%s%s=%s&state=%s",
1025 MHD_add_response_header (resp,
"Location", redirect_uri);
1044 for (le_a = list_a->
list_head; NULL != le_a; le_a = le_a->
next)
1061 for (le_b = list_b->
list_head; NULL != le_b; le_b = le_b->
next)
1063 for (le_m = merged_list->
list_head; NULL != le_m; le_m = le_m->
next)
1099 for (le_m = merged_list->
list_head; NULL != le_m; le_m = le_m->
next)
1101 "List Attibute in ticket to issue: %s\n",
1185 const char *claims_parameter)
1202 root = json_loads (handle->
oidc->
claims, JSON_DECODE_ANY, &error);
1203 claims_j = json_object_get (root, claims_parameter);
1205 if (NULL != claims_j)
1207 json_object_foreach (claims_j, key, value) {
1208 if (0 != strcmp (attr_name, key))
1293 char *identity_cookie;
1317 GNUNET_strdup (
"The cookie of a login identity is not valid");
1357 struct MHD_Response *resp;
1366 "%s.%s/%s?error=%s&error_description=%s&state=%s",
1371 "User denied access",
1377 "%s?error=%s&error_description=%s&state=%s",
1380 "User denied access",
1384 MHD_add_response_header (resp,
"Location", redirect_uri);
1410 GNUNET_strdup (
"Server cannot generate ticket, redirect uri not found.");
1414 for (
int i = 0; i < rd_count; i++)
1424 "Redirect uri %s does not contain client_id %s\n",
1430 pos = strrchr (tmp, (
unsigned char)
'.');
1434 "Redirect uri %s contains client_id but is malformed\n",
1441 tmp_key_str = pos + 1;
1442 pos = strchr (tmp_key_str, (
unsigned char)
'/');
1446 "Redirect uri %s contains client_id but is malformed\n",
1455 strlen (tmp_key_str),
1457 sizeof(redirect_zone));
1465 GNUNET_strdup (
"Server cannot generate ticket, redirect uri not found.");
1523 char *expected_scope;
1524 char delimiter[] =
" ";
1525 int number_of_ignored_parameter,
iterator;
1567 number_of_ignored_parameter =
1569 for (iterator = 0; iterator < number_of_ignored_parameter; iterator++)
1581 "Server will not handle parameter: %s",
1594 "obtaining this authorization code.");
1602 test = strtok (expected_scope, delimiter);
1603 while (NULL != test)
1607 test = strtok (NULL, delimiter);
1613 GNUNET_strdup (
"The requested scope is invalid, unknown, or malformed.");
1687 "OAuth authorization request does not contain PKCE parameters!\n");
1696 "authorization code using this method.");
1704 for (tmp_ego = ego_head; NULL != tmp_ego; tmp_ego = tmp_ego->
next)
1714 if (NULL == handle->
tld)
1716 if (NULL == handle->
tld)
1750 root = json_loads (term_data, JSON_DECODE_ANY, &error);
1751 identity = json_object_get (root,
"identity");
1752 if (! json_is_string (identity))
1755 "Error parsing json string from %s\n",
1757 handle->
proc (handle->
proc_cls, resp, MHD_HTTP_BAD_REQUEST);
1762 GNUNET_asprintf (&cookie,
"Identity=%s", json_string_value (identity));
1767 MHD_add_response_header (resp,
"Set-Cookie", header_val);
1768 MHD_add_response_header (resp,
"Access-Control-Allow-Methods",
"POST");
1771 if (0 != strcmp (json_string_value (identity),
"Denied"))
1796 char **client_secret)
1799 char *authorization;
1801 char *basic_authorization;
1802 char *client_id_tmp;
1817 credentials = strtok (authorization,
" ");
1818 if ((NULL == credentials) || (0 != strcmp (
"Basic", credentials)))
1820 credentials = strtok (NULL,
" ");
1821 if (NULL == credentials)
1824 strlen (credentials),
1825 (
void **) &basic_authorization);
1827 if (NULL == basic_authorization)
1829 client_id_tmp = strtok (basic_authorization,
":");
1830 if (NULL == client_id_tmp)
1835 pass = strtok (NULL,
":");
1841 *client_id = strdup (client_id_tmp);
1842 *client_secret = strdup (pass);
1851 char **client_secret)
1854 char *client_id_tmp;
1858 strlen (
"client_id"),
1867 if (NULL == client_id_tmp)
1869 *client_id = strdup (client_id_tmp);
1871 strlen (
"client_secret"),
1888 *client_secret = strdup (pass);
1897 char *expected_pass;
1907 "Received client credentials in HTTP AuthZ header\n");
1914 "Received client credentials in POST body\n");
1920 if (NULL == pkce_cv)
1930 strlen (received_cid),
1940 "reclaim-rest-plugin",
1941 "OIDC_CLIENT_SECRET",
1944 if (0 != strcmp (expected_pass, received_cpw))
1980 strlen (received_cid),
1997 for (ego_entry = ego_head; NULL != ego_entry;
1998 ego_entry = ego_entry->
next)
2028 struct MHD_Response *resp;
2031 char *json_response;
2036 char *code_verifier;
2044 "OIDC authorization for token endpoint failed\n");
2059 if (NULL == grant_type)
2088 ego_entry =
find_ego (handle, &cid);
2089 if (NULL == ego_entry)
2101 if (NULL == code_verifier)
2104 "OAuth authorization request does not contain PKCE parameters!\n");
2117 if (NULL != code_verifier)
2122 if (NULL != code_verifier)
2127 "reclaim-rest-plugin",
2144 "reclaim-rest-plugin",
2162 (NULL != nonce) ? nonce : NULL,
2172 strlen (access_token),
2184 "OIDC access token already issued. Cleanup.\n");
2194 MHD_add_response_header (resp,
"Cache-Control",
"no-store");
2195 MHD_add_response_header (resp,
"Pragma",
"no-cache");
2196 MHD_add_response_header (resp,
"Content-Type",
"application/json");
2219 struct MHD_Response *resp;
2227 if (NULL == identity)
2254 NULL != atle; atle = atle->
next)
2289 if (NULL != handle->
idp_op)
2294 "Ticket consumptioned timed out. Using cache...\n");
2300 if (NULL == cached_code)
2311 cached_code, NULL, &ticket,
2325 struct MHD_Response *resp;
2357 char delimiter[] =
" ";
2359 char *authorization;
2360 char *authorization_type;
2361 char *authorization_access_token;
2385 authorization_type = strtok (authorization, delimiter);
2386 if ((NULL == authorization_type) ||
2387 (0 != strcmp (
"Bearer", authorization_type)))
2396 authorization_access_token = strtok (NULL, delimiter);
2397 if (NULL == authorization_access_token)
2422 if (NULL == aud_ego)
2489 const char *identifier)
2505 ego_entry->
ego = ego;
2513 if (identifier != NULL)
2515 for (ego_entry = ego_head; NULL != ego_entry;
2516 ego_entry = ego_entry->
next)
2518 if (ego_entry->
ego == ego)
2526 if (NULL == ego_entry)
2532 ego_entry->
ego = ego;
2542 for (ego_entry = ego_head; NULL != ego_entry;
2543 ego_entry = ego_entry->
next)
2545 if (ego_entry->
ego == ego)
2548 if (NULL == ego_entry)
2567 json_t *oidc_config;
2568 json_t *auth_methods;
2571 json_t *response_types;
2573 json_t *claim_types;
2574 char *oidc_config_str;
2575 struct MHD_Response *resp;
2578 oidc_config = json_object ();
2580 json_object_set_new (oidc_config,
2581 "issuer", json_string (
"http://localhost:7776"));
2582 json_object_set_new (oidc_config,
2583 "authorization_endpoint",
2584 json_string (
"https://api.reclaim/openid/authorize"));
2585 json_object_set_new (oidc_config,
2587 json_string (
"http://localhost:7776/openid/token"));
2588 auth_methods = json_array ();
2589 json_array_append_new (auth_methods,
2590 json_string (
"client_secret_basic"));
2591 json_array_append_new (auth_methods,
2592 json_string (
"client_secret_post"));
2593 json_object_set_new (oidc_config,
2594 "token_endpoint_auth_methods_supported",
2596 sig_algs = json_array ();
2597 json_array_append_new (sig_algs,
2598 json_string (
"HS512"));
2599 json_object_set_new (oidc_config,
2600 "id_token_signing_alg_values_supported",
2602 json_object_set_new (oidc_config,
2603 "userinfo_endpoint",
2604 json_string (
"http://localhost:7776/openid/userinfo"));
2605 scopes = json_array ();
2606 json_array_append_new (scopes,
2607 json_string (
"openid"));
2608 json_array_append_new (scopes,
2609 json_string (
"profile"));
2610 json_array_append_new (scopes,
2611 json_string (
"email"));
2612 json_array_append_new (scopes,
2613 json_string (
"address"));
2614 json_array_append_new (scopes,
2615 json_string (
"phone"));
2616 json_object_set_new (oidc_config,
2619 response_types = json_array ();
2620 json_array_append_new (response_types,
2621 json_string (
"code"));
2622 json_object_set_new (oidc_config,
2623 "response_types_supported",
2625 sub_types = json_array ();
2626 json_array_append_new (sub_types,
2627 json_string (
"public"));
2628 json_object_set_new (oidc_config,
2629 "subject_types_supported",
2631 claim_types = json_array ();
2632 json_array_append_new (claim_types,
2633 json_string (
"normal"));
2634 json_array_append_new (claim_types,
2635 json_string (
"aggregated"));
2636 json_object_set_new (oidc_config,
2637 "claim_types_supported",
2639 json_object_set_new (oidc_config,
2640 "claims_parameter_supported",
2642 oidc_config_str = json_dumps (oidc_config, JSON_INDENT (1));
2645 json_decref (oidc_config);
2663 struct MHD_Response *resp;
2668 MHD_add_response_header (resp,
"Access-Control-Allow-Methods",
allow_methods);
2669 MHD_add_response_header (resp,
"Access-Control-Allow-Origin",
"*");
2685 { MHD_HTTP_METHOD_POST,
2699 if (NULL == OIDC_cookie_jar_map)
2702 if (NULL == oidc_code_cache)
2717 if (handle->
url[strlen (handle->
url) - 1] ==
'/')
2718 handle->
url[strlen (handle->
url) - 1] =
'\0';
2736 static struct Plugin plugin;
2740 if (NULL != plugin.
cfg)
2742 memset (&plugin, 0,
sizeof(
struct Plugin));
2754 "%s, %s, %s, %s, %s",
2755 MHD_HTTP_METHOD_GET,
2756 MHD_HTTP_METHOD_POST,
2757 MHD_HTTP_METHOD_PUT,
2758 MHD_HTTP_METHOD_DELETE,
2759 MHD_HTTP_METHOD_OPTIONS);
2762 _ (
"OpenID Connect REST API initialized\n"));
2789 while (NULL != requests_head)
2791 if (NULL != OIDC_cookie_jar_map)
2798 if (NULL != oidc_code_cache)
2807 if (NULL != gns_handle)
2809 if (NULL != identity_handle)
2813 while (NULL != (ego_entry = ego_head))
2824 "OpenID Connect REST plugin is finished\n");
struct GNUNET_IDENTITY_Handle * GNUNET_IDENTITY_connect(const struct GNUNET_CONFIGURATION_Handle *cfg, GNUNET_IDENTITY_Callback cb, void *cb_cls)
Connect to the identity service.
static void build_redirect(void *cls)
#define GNUNET_CONTAINER_DLL_remove(head, tail, element)
Remove an element from a DLL.
static int iterator(void *cls, const struct GNUNET_PeerIdentity *key, void *value)
Iterator over hash map entries.
struct GNUNET_RECLAIM_AttributeList * attr_userinfo_list
Attribute claim list for userinfo.
Connection to the GNS service.
struct GNUNET_CONTAINER_MultiHashMap * oidc_code_cache
OIDC hashmap for cached access tokens and codes.
char * redirect_uri
The OIDC redirect uri.
char * scope
The list of oidc scopes.
void GNUNET_RECLAIM_get_credentials_next(struct GNUNET_RECLAIM_CredentialIterator *ait)
Calls the record processor specified in GNUNET_RECLAIM_get_credentials_start for the next record...
Do not check code verifier even if expected.
The authorization ticket.
#define OIDC_NONCE_KEY
OIDC nonce key.
void(* GNUNET_REST_ResultProcessor)(void *cls, struct MHD_Response *resp, int status)
Iterator called on obtained result for a REST result.
size_t GNUNET_STRINGS_urldecode(const char *data, size_t len, char **out)
url/percent encode (RFC3986).
struct GNUNET_RECLAIM_Attribute * GNUNET_RECLAIM_attribute_new(const char *attr_name, const struct GNUNET_RECLAIM_Identifier *credential, uint32_t type, const void *data, size_t data_size)
Create a new attribute claim.
static struct GNUNET_GNS_Handle * gns_handle
GNS handle.
static void consume_timeout(void *cls)
static int parse_credentials_basic_auth(struct RequestHandle *handle, char **client_id, char **client_secret)
#define OIDC_CODE_CHALLENGE_KEY
OIDC PKCE code challenge.
struct GNUNET_GNS_LookupRequest * GNUNET_GNS_lookup(struct GNUNET_GNS_Handle *handle, const char *name, const struct GNUNET_IDENTITY_PublicKey *zone, uint32_t type, enum GNUNET_GNS_LocalOptions options, GNUNET_GNS_LookupResultProcessor proc, void *proc_cls)
Perform an asynchronous lookup operation on the GNS.
struct GNUNET_RECLAIM_Identifier id
ID.
uint32_t type
Type/Format of Claim.
void GNUNET_CONFIGURATION_iterate_section_values(const struct GNUNET_CONFIGURATION_Handle *cfg, const char *section, GNUNET_CONFIGURATION_Iterator iter, void *iter_cls)
Iterate over values of a section in the configuration.
#define GNUNET_CONTAINER_DLL_insert(head, tail, element)
Insert an element at the head of a DLL.
uint32_t type
Type/Format of Claim.
If a value with the given key exists, replace it.
static struct GNUNET_RECLAIM_AttributeList * attribute_list_merge(struct GNUNET_RECLAIM_AttributeList *list_a, struct GNUNET_RECLAIM_AttributeList *list_b)
void GNUNET_RECLAIM_get_credentials_stop(struct GNUNET_RECLAIM_CredentialIterator *ait)
Stops iteration and releases the handle for further calls.
char * nonce
The OIDC nonce.
void GNUNET_RECLAIM_attribute_list_destroy(struct GNUNET_RECLAIM_AttributeList *attrs)
Destroy claim list.
#define GNUNET_GNS_EMPTY_LABEL_AT
String we use to indicate an empty label (top-level entry in the zone).
#define OIDC_GRANT_TYPE_KEY
OIDC grant_type key.
#define OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE
OIDC expected response_type while authorizing.
void * cls
The closure of the plugin.
static void oidc_cred_collect_finished_cb(void *cls)
size_t data_size
The POST data size.
#define GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT
Used reclaimID OIDC client redirect URIs.
static int parse_credentials_post_body(struct RequestHandle *handle, char **client_id, char **client_secret)
struct GNUNET_RECLAIM_AttributeIterator * attr_it
Attribute iterator.
const char * name
The name of the attribute.
static int cleanup_hashmap(void *cls, const struct GNUNET_HashCode *key, void *value)
static void cookie_identity_interpretation(struct RequestHandle *handle)
Interprets cookie header and pass its identity keystring to handle.
struct GNUNET_RECLAIM_Credential * credential
The credential.
static struct RequestHandle * requests_tail
DLL.
#define OIDC_CODE_KEY
OIDC code key.
GNUNET_REST_ResultProcessor proc
The plugin result processor.
#define OIDC_ERROR_KEY_SERVER_ERROR
OIDC error key for generic server errors.
char * GNUNET_IDENTITY_public_key_to_string(const struct GNUNET_IDENTITY_PublicKey *key)
Creates a (Base32) string representation of the public key.
struct GNUNET_RECLAIM_CredentialIterator * GNUNET_RECLAIM_get_credentials_start(struct GNUNET_RECLAIM_Handle *h, const struct GNUNET_IDENTITY_PrivateKey *identity, GNUNET_SCHEDULER_TaskCallback error_cb, void *error_cb_cls, GNUNET_RECLAIM_CredentialResult proc, void *proc_cls, GNUNET_SCHEDULER_TaskCallback finish_cb, void *finish_cb_cls)
List all credentials for a local identity.
struct GNUNET_TIME_Absolute GNUNET_TIME_relative_to_absolute(struct GNUNET_TIME_Relative rel)
Convert relative time to an absolute time in the future.
static size_t data_size
Number of bytes in data.
#define GNUNET_assert(cond)
Use this for fatal errors that cannot be handled.
#define OIDC_REDIRECT_URI_KEY
OIDC redirect_uri key.
char * GNUNET_buffer_reap_str(struct GNUNET_Buffer *buf)
Clear the buffer and return the string it contained.
#define OIDC_ERROR_KEY_UNAUTHORIZED_CLIENT
OIDC error key for unauthorized clients.
const struct EgoEntry * find_ego(struct RequestHandle *handle, struct GNUNET_IDENTITY_PublicKey *test_key)
size_t data_size
Number of bytes in data.
struct GNUNET_GNS_LookupRequest * gns_op
GNS lookup op.
struct GNUNET_RECLAIM_PresentationListEntry * next
DLL.
#define OIDC_CLAIMS_KEY
OIDC claims key.
struct GNUNET_RECLAIM_CredentialListEntry * list_tail
List tail.
void GNUNET_buffer_write_fstr(struct GNUNET_Buffer *buf, const char *fmt,...) __attribute__((format(printf
Write a 0-terminated formatted string to a buffer, excluding the 0-terminator.
const struct GNUNET_CONFIGURATION_Handle * cfg
Our configuration.
Handle to a lookup request.
void GNUNET_RECLAIM_disconnect(struct GNUNET_RECLAIM_Handle *h)
Disconnect from identity provider service.
struct GNUNET_RECLAIM_CredentialListEntry * next
DLL.
#define OIDC_COOKIE_EXPIRATION
OIDC cookie expiration (in seconds)
void GNUNET_RECLAIM_cancel(struct GNUNET_RECLAIM_Operation *op)
Cancel an identity provider operation.
A private key for an identity as per LSD0001.
#define GNUNET_memcpy(dst, src, n)
Call memcpy() but check for n being 0 first.
struct returned by the initialization function of the plugin
struct GNUNET_RECLAIM_PresentationListEntry * list_head
List head.
static int ret
Return value of the commandline.
int OIDC_parse_authz_code(const struct GNUNET_IDENTITY_PublicKey *audience, const char *code, const char *code_verifier, struct GNUNET_RECLAIM_Ticket *ticket, struct GNUNET_RECLAIM_AttributeList **attrs, struct GNUNET_RECLAIM_PresentationList **presentations, char **nonce_str, enum OIDC_VerificationOptions opts)
Parse reclaim ticket and nonce from authorization code.
GNUNET_GenericReturnValue
Named constants for return values.
helper library for OIDC related functions
#define OIDC_COOKIE_HEADER_INFORMATION_KEY
OIDC cookie header information key.
A list of GNUNET_RECLAIM_Attribute structures.
#define CONSUME_TIMEOUT
How long to wait for a consume in userinfo endpoint.
void GNUNET_RECLAIM_ticket_iteration_stop(struct GNUNET_RECLAIM_TicketIterator *it)
Stops iteration and releases the handle for further calls.
size_t data_size
Number of bytes in data.
const void * data
Binary value stored as credential value.
struct GNUNET_RECLAIM_Operation * GNUNET_RECLAIM_ticket_consume(struct GNUNET_RECLAIM_Handle *h, const struct GNUNET_IDENTITY_PrivateKey *identity, const struct GNUNET_RECLAIM_Ticket *ticket, GNUNET_RECLAIM_AttributeTicketResult cb, void *cb_cls)
Consumes an issued ticket.
static void tld_iter(void *cls, const char *section, const char *option, const char *value)
Iterate over tlds in config.
#define OIDC_COOKIE_HEADER_ACCESS_DENIED
OIDC cookie header if user cancelled.
int user_cancelled
User cancelled authorization/login.
#define GNUNET_new(type)
Allocate a struct or union of the given type.
void GNUNET_RECLAIM_get_attributes_next(struct GNUNET_RECLAIM_AttributeIterator *it)
Calls the record processor specified in GNUNET_RECLAIM_get_attributes_start for the next record...
#define OIDC_ERROR_KEY_INVALID_TOKEN
OIDC error key for invalid tokens.
void(* proc)(struct GNUNET_REST_RequestHandle *handle, const char *url, void *cls)
Namespace to handle.
void * libgnunet_plugin_rest_openid_connect_init(void *cls)
Entry point for the plugin.
static struct RequestHandle * requests_head
DLL.
static int state
The processing state.
Handle for an operation with the service.
int GNUNET_CONTAINER_multihashmap_contains(const struct GNUNET_CONTAINER_MultiHashMap *map, const struct GNUNET_HashCode *key)
Check if the map contains any value under the given key (including values that are NULL)...
struct GNUNET_RECLAIM_Identifier credential
Referenced ID of credential (may be GNUNET_RECLAIM_ID_ZERO if self-creded)
void OIDC_build_token_response(const char *access_token, const char *id_token, const struct GNUNET_TIME_Relative *expiration_time, char **token_response)
Build a token response for a token request TODO: Maybe we should add the scope here?
void GNUNET_IDENTITY_ego_get_public_key(struct GNUNET_IDENTITY_Ego *ego, struct GNUNET_IDENTITY_PublicKey *pk)
Get the identifier (public key) of an ego.
enum GNUNET_GenericReturnValue GNUNET_CONFIGURATION_get_value_string(const struct GNUNET_CONFIGURATION_Handle *cfg, const char *section, const char *option, char **value)
Get a configuration value that should be a string.
#define GNUNET_strdup(a)
Wrapper around GNUNET_xstrdup_.
static void login_redirect(void *cls)
Redirects to login page stored in configuration file.
void * proc_cls
The closure of the result processor.
uint64_t abs_value_us
The actual value.
char * edesc
Error response description.
struct OIDC_Variables * oidc
OIDC variables.
Internal representation of the hash map.
Handle for an operation with the identity service.
#define GNUNET_REST_HANDLER_END
static struct GNUNET_DNSSTUB_Context * ctx
Context for DNS resolution.
struct GNUNET_BLOCK_PluginFunctions * api
Plugin API.
enum GNUNET_GenericReturnValue OIDC_check_scopes_for_claim_request(const char *scopes, const char *attr)
Checks if a claim is implicitly requested through standard scope(s) or explicitly through non-standar...
#define OIDC_STATE_KEY
OIDC state key.
struct GNUNET_RECLAIM_Attribute * attribute
The attribute claim.
static struct EgoEntry * ego_tail
Ego list.
#define GNUNET_REST_API_NS_OIDC_CONFIG
OIDC config.
void * GNUNET_CONTAINER_multihashmap_get(const struct GNUNET_CONTAINER_MultiHashMap *map, const struct GNUNET_HashCode *key)
Given a key find a value in the map matching the key.
static char * section
Name of the section.
#define OIDC_ERROR_KEY_UNSUPPORTED_GRANT_TYPE
OIDC error key for unsupported grants.
char * response_type
The OIDC response type.
#define OIDC_RESPONSE_TYPE_KEY
OIDC response_type key.
static int check_authorization(struct RequestHandle *handle, struct GNUNET_IDENTITY_PublicKey *cid)
static struct GNUNET_RECLAIM_Ticket ticket
Ticket to consume.
struct GNUNET_IDENTITY_Ego * ego
The Ego.
struct GNUNET_RECLAIM_PresentationList * presentations
Presentations.
struct GNUNET_SCHEDULER_Task * GNUNET_SCHEDULER_add_delayed(struct GNUNET_TIME_Relative delay, GNUNET_SCHEDULER_TaskCallback task, void *task_cls)
Schedule a new task to be run with a specified delay.
static void oidc_ticket_issue_cb(void *cls, const struct GNUNET_RECLAIM_Ticket *ticket, const struct GNUNET_RECLAIM_PresentationList *pres)
Issues ticket and redirects to relying party with the authorization code as parameter.
Handle for a attribute iterator operation.
static void do_timeout(void *cls)
Task run on timeout, sends error message.
static struct GNUNET_TIME_Relative timeout
Desired timeout for the lookup (default is no timeout).
struct GNUNET_RECLAIM_CredentialList * credentials
Credentials.
static char * value
Value of the record to add/remove.
struct GNUNET_IDENTITY_PublicKey identity
The ticket issuer (= the user)
char * emsg
Error response message.
struct GNUNET_CONTAINER_MultiHashMap * url_param_map
Map of url parameters.
static char * attr_name
The attribute.
void GNUNET_CRYPTO_hash(const void *block, size_t size, struct GNUNET_HashCode *ret)
Compute hash of a given block.
const char * url
The url as string.
char * client_id
The OIDC client id of the RP.
void GNUNET_CONTAINER_multihashmap_destroy(struct GNUNET_CONTAINER_MultiHashMap *map)
Destroy a hash map.
static void oidc_config_cors(struct GNUNET_REST_RequestHandle *con_handle, const char *url, void *cls)
Respond to OPTIONS request.
struct GNUNET_RECLAIM_AttributeListEntry * list_tail
List tail.
struct GNUNET_SCHEDULER_Task * GNUNET_SCHEDULER_add_now(GNUNET_SCHEDULER_TaskCallback task, void *task_cls)
Schedule a new task to be run as soon as possible.
void GNUNET_GNS_disconnect(struct GNUNET_GNS_Handle *handle)
Shutdown connection with the GNS service.
struct GNUNET_RECLAIM_AttributeIterator * GNUNET_RECLAIM_get_attributes_start(struct GNUNET_RECLAIM_Handle *h, const struct GNUNET_IDENTITY_PrivateKey *identity, GNUNET_SCHEDULER_TaskCallback error_cb, void *error_cb_cls, GNUNET_RECLAIM_AttributeResult proc, void *proc_cls, GNUNET_SCHEDULER_TaskCallback finish_cb, void *finish_cb_cls)
List all attributes for a local identity.
#define OIDC_ERROR_KEY_INVALID_COOKIE
OIDC error key for invalid cookies.
#define OIDC_ERROR_KEY_INVALID_REQUEST
OIDC error key for invalid requests.
struct GNUNET_TIME_Relative timeout
Desired timeout for the lookup (default is no timeout).
static void lookup_redirect_uri_result(void *cls, uint32_t rd_count, const struct GNUNET_GNSRECORD_Data *rd)
struct GNUNET_RECLAIM_TicketIterator * ticket_it
Ticket iterator.
char * tld
The tld for redirect.
static int attr_in_userinfo_request(struct RequestHandle *handle, const char *attr_name)
static void oidc_config_endpoint(struct GNUNET_REST_RequestHandle *con_handle, const char *url, void *cls)
char * OIDC_access_token_new(const struct GNUNET_RECLAIM_Ticket *ticket)
Generate a new access token.
void GNUNET_RECLAIM_credential_list_destroy(struct GNUNET_RECLAIM_CredentialList *credentials)
Destroy claim list.
static char * get_url_parameter_copy(const struct RequestHandle *handle, const char *key)
static char * option
Name of the option.
#define GNUNET_REST_API_NS_AUTHORIZE
Authorize endpoint.
static struct GNUNET_DNS_Handle * handle
Handle to transport service.
struct GNUNET_TIME_Relative GNUNET_TIME_relative_multiply(struct GNUNET_TIME_Relative rel, unsigned long long factor)
Multiply relative time by a given factor.
#define GNUNET_TIME_UNIT_FOREVER_REL
Constant used to specify "forever".
void GNUNET_IDENTITY_disconnect(struct GNUNET_IDENTITY_Handle *h)
Disconnect from identity service.
struct GNUNET_RECLAIM_Identifier credential_id
The credential id of which this is a presentation.
const void * data
Binary value stored as presentation value.
enum GNUNET_GenericReturnValue GNUNET_IDENTITY_key_get_public(const struct GNUNET_IDENTITY_PrivateKey *privkey, struct GNUNET_IDENTITY_PublicKey *key)
Retrieves the public key representation of a private key.
struct GNUNET_RECLAIM_Identifier id
ID.
struct GNUNET_GNS_Handle * GNUNET_GNS_connect(const struct GNUNET_CONFIGURATION_Handle *cfg)
Initialize the connection with the GNS service.
size_t data_size
Number of bytes in data.
#define OIDC_ERROR_KEY_UNSUPPORTED_RESPONSE_TYPE
OIDC error key for unsupported response types.
char * access_token
The passed access token.
#define OIDC_CODE_VERIFIER_KEY
OIDC PKCE code verifier.
int GNUNET_REST_handle_request(struct GNUNET_REST_RequestHandle *conn, const struct GNUNET_REST_RequestHandler *handlers, struct GNUNET_REST_RequestHandlerError *err, void *cls)
static void cleanup_handle(struct RequestHandle *handle)
Cleanup lookup handle.
struct GNUNET_REST_RequestHandle * rest_handle
Rest connection.
int response_code
Response code.
static void login_cont(struct GNUNET_REST_RequestHandle *con_handle, const char *url, void *cls)
Combines an identity with a login time and responds OK to login request.
static void code_redirect(void *cls)
Checks time and cookie and redirects accordingly.
static char * plugin
Solver plugin name as string.
struct GNUNET_TIME_Absolute GNUNET_TIME_absolute_get(void)
Get the current time.
size_t GNUNET_STRINGS_base64_decode(const char *data, size_t len, void **output)
Decode from Base64.
char * OIDC_generate_id_token(const struct GNUNET_IDENTITY_PublicKey *aud_key, const struct GNUNET_IDENTITY_PublicKey *sub_key, const struct GNUNET_RECLAIM_AttributeList *attrs, const struct GNUNET_RECLAIM_PresentationList *presentations, const struct GNUNET_TIME_Relative *expiration_time, const char *nonce, const char *secret_key)
Create a JWT from attributes.
char * OIDC_build_authz_code(const struct GNUNET_IDENTITY_PrivateKey *issuer, const struct GNUNET_RECLAIM_Ticket *ticket, const struct GNUNET_RECLAIM_AttributeList *attrs, const struct GNUNET_RECLAIM_PresentationList *presentations, const char *nonce_str, const char *code_challenge)
Builds an OIDC authorization code including a reclaim ticket and nonce.
int int GNUNET_asprintf(char **buf, const char *format,...) __attribute__((format(printf
Like asprintf, just portable.
enum GNUNET_GenericReturnValue GNUNET_IDENTITY_public_key_from_string(const char *str, struct GNUNET_IDENTITY_PublicKey *key)
Parses a (Base32) string representation of the public key.
const char * data
The POST data.
struct RequestHandle * next
DLL.
char * claims
The OIDC claims.
char * keystring
Public key string.
A credential presentation.
void GNUNET_RECLAIM_presentation_list_destroy(struct GNUNET_RECLAIM_PresentationList *presentations)
Destroy presentations list.
static struct GNUNET_IDENTITY_Handle * identity
Which namespace do we publish to? NULL if we do not publish to a namespace.
static void oidc_attr_collect(void *cls, const struct GNUNET_IDENTITY_PublicKey *identity, const struct GNUNET_RECLAIM_Attribute *attr)
Collects all attributes for an ego if in scope parameter.
size_t data_size
Number of bytes in data.
#define OIDC_ERROR_KEY_ACCESS_DENIED
OIDC error key for denied access.
size_t GNUNET_STRINGS_urlencode(const char *data, size_t len, char **out)
url/percent encode (RFC3986).
struct GNUNET_RECLAIM_CredentialListEntry * list_head
List head.
const char * name
The name of the credential.
static void userinfo_endpoint(struct GNUNET_REST_RequestHandle *con_handle, const char *url, void *cls)
Responds to userinfo GET and url-encoded POST request.
static struct GNUNET_RECLAIM_Handle * idp
Identity Provider.
#define OIDC_AUTHORIZATION_HEADER_KEY
OIDC cookie header information key.
struct GNUNET_RECLAIM_AttributeListEntry * next
DLL.
static struct GNUNET_RECLAIM_Identifier credential
Credential ID.
struct RequestHandle * prev
DLL.
struct GNUNET_RECLAIM_CredentialIterator * cred_it
Credential iterator.
#define OIDC_EXPECTED_AUTHORIZATION_SCOPE
OIDC expected scope part while authorizing.
#define GNUNET_CONTAINER_DLL_insert_tail(head, tail, element)
Insert an element at the tail of a DLL.
#define GNUNET_REST_API_NS_LOGIN
Login namespace.
static struct GNUNET_SCHEDULER_Task * timeout_task
Task to be run on timeout.
static char * OIDC_ignored_parameter_array[]
OIDC ignored parameter array.
struct GNUNET_SCHEDULER_Task * consume_timeout_op
Timeout task for consume.
static void build_authz_response(void *cls)
Iteration over all results finished, build final response.
char * state
The OIDC state.
int GNUNET_CONTAINER_multihashmap_put(struct GNUNET_CONTAINER_MultiHashMap *map, const struct GNUNET_HashCode *key, void *value, enum GNUNET_CONTAINER_MultiHashMapOption opt)
Store a key-value pair in the map.
#define GNUNET_memcmp(a, b)
Compare memory in a and b, where both must be of the same pointer type.
#define GNUNET_REST_API_NS_OIDC
REST root namespace.
static void oidc_cred_collect(void *cls, const struct GNUNET_IDENTITY_PublicKey *identity, const struct GNUNET_RECLAIM_Credential *cred)
Collects all attributes for an ego if in scope parameter.
static void client_redirect(void *cls)
Initiate redirect back to client.
static void authorize_endpoint(struct GNUNET_REST_RequestHandle *con_handle, const char *url, void *cls)
Responds to authorization GET and url-encoded POST request.
char * identifier
Ego Identifier.
static void do_error(void *cls)
Task run on error, sends error message.
static struct GNUNET_IDENTITY_Handle * identity_handle
Handle to Identity service.
#define GNUNET_strndup(a, length)
Wrapper around GNUNET_xstrndup_.
struct GNUNET_RECLAIM_Presentation * presentation
The credential.
char * redirect_prefix
The redirect prefix.
struct GNUNET_TIME_Relative GNUNET_TIME_relative_get_second_(void)
Return relative time of 1s.
static char * allow_methods
HTTP methods allows for this plugin.
struct GNUNET_RECLAIM_Ticket ticket
A ticket.
An identity key as per LSD0001.
A list of GNUNET_RECLAIM_Presentation structures.
struct GNUNET_IDENTITY_PublicKey client_pkey
The RP client public key.
static void consume_ticket(void *cls, const struct GNUNET_IDENTITY_PublicKey *identity, const struct GNUNET_RECLAIM_Attribute *attr, const struct GNUNET_RECLAIM_Presentation *pres)
Collects claims and stores them in handle.
static int attr_in_claims_request(struct RequestHandle *handle, const char *attr_name, const char *claims_parameter)
enum GNUNET_GenericReturnValue GNUNET_CONFIGURATION_get_value_time(const struct GNUNET_CONFIGURATION_Handle *cfg, const char *section, const char *option, struct GNUNET_TIME_Relative *time)
Get a configuration value that should be a relative time.
static void options_cont(struct GNUNET_REST_RequestHandle *con_handle, const char *url, void *cls)
Respond to OPTIONS request.
void GNUNET_RECLAIM_get_attributes_stop(struct GNUNET_RECLAIM_AttributeIterator *it)
Stops iteration and releases the handle for further calls.
const struct GNUNET_IDENTITY_PrivateKey * GNUNET_IDENTITY_ego_get_private_key(const struct GNUNET_IDENTITY_Ego *ego)
Obtain the ECC key associated with a ego.
struct GNUNET_SCHEDULER_Task * timeout_task
ID of a task associated with the resolution process.
static void list_ego(void *cls, struct GNUNET_IDENTITY_Ego *ego, void **ctx, const char *identifier)
If listing is enabled, prints information about the egos.
static enum GNUNET_GenericReturnValue rest_identity_process_request(struct GNUNET_REST_RequestHandle *rest_handle, GNUNET_REST_ResultProcessor proc, void *proc_cls)
static void token_endpoint(struct GNUNET_REST_RequestHandle *con_handle, const char *url, void *cls)
Responds to token url-encoded POST request.
A list of GNUNET_RECLAIM_Credential structures.
char * redirect_suffix
The redirect suffix.
#define OIDC_ERROR_KEY_INVALID_CLIENT
OIDC error key for invalid client.
struct MHD_Response * GNUNET_REST_create_response(const char *data)
Create REST MHD response.
struct GNUNET_RECLAIM_Presentation * GNUNET_RECLAIM_presentation_new(uint32_t type, const void *data, size_t data_size)
#define GNUNET_RECLAIM_id_is_equal(a, b)
Handle for a ticket iterator operation.
struct GNUNET_IDENTITY_PublicKey audience
The ticket audience (= relying party)
#define GNUNET_log(kind,...)
const struct GNUNET_CONFIGURATION_Handle * cfg
The configuration handle.
Entry in list of pending tasks.
struct GNUNET_RECLAIM_AttributeList * attr_idtoken_list
Attribute claim list for id_token.
struct GNUNET_IDENTITY_PrivateKey priv_key
Pointer to ego private key.
const void * data
Binary value stored as attribute value.
#define OIDC_SCOPE_KEY
OIDC scope key.
static int attr_in_idtoken_request(struct RequestHandle *handle, const char *attr_name)
struct GNUNET_RECLAIM_Operation * idp_op
Idp Operation.
void * GNUNET_GNS_lookup_cancel(struct GNUNET_GNS_LookupRequest *lr)
Cancel pending lookup request.
#define OIDC_GRANT_TYPE_VALUE
OIDC grant_type key.
#define ID_REST_STATE_INIT
State while collecting all egos.
struct GNUNET_CONTAINER_MultiHashMap * GNUNET_CONTAINER_multihashmap_create(unsigned int len, int do_not_copy_keys)
Create a multi hash map.
uint32_t type
Type of Claim.
#define OIDC_CLIENT_ID_KEY
OIDC client_id key.
struct GNUNET_RECLAIM_PresentationListEntry * list_tail
List tail.
char * code_verifier
The PKCE code_verifier.
int OIDC_access_token_parse(const char *token, struct GNUNET_RECLAIM_Ticket **ticket)
Parse an access token.
Time for absolute times used by GNUnet, in microseconds.
struct GNUNET_CONTAINER_MultiHashMap * header_param_map
Map of headers.
struct GNUNET_RECLAIM_Credential * GNUNET_RECLAIM_credential_new(const char *name, uint32_t type, const void *data, size_t data_size)
Create a new credential.
Defaults, look in cache, then in DHT.
Common buffer management functions.
struct EgoEntry * prev
DLL.
struct GNUNET_CONTAINER_MultiHashMap * OIDC_cookie_jar_map
OIDC hashmap that keeps track of issued cookies.
char * GNUNET_STRINGS_data_to_string_alloc(const void *buf, size_t size)
Return the base32crockford encoding of the given buffer.
void * libgnunet_plugin_rest_openid_connect_done(void *cls)
Exit point from the plugin.
void GNUNET_buffer_write_str(struct GNUNET_Buffer *buf, const char *str)
Write a 0-terminated string to a buffer, excluding the 0-terminator.
static struct GNUNET_ARM_Operation * op
Current operation.
char * code_challenge
The PKCE code_challenge.
struct EgoEntry * ego_entry
IDENTITY Operation.
static void oidc_iteration_error(void *cls)
Does internal server error when iteration failed.
enum GNUNET_GenericReturnValue(* process_request)(struct GNUNET_REST_RequestHandle *handle, GNUNET_REST_ResultProcessor proc, void *proc_cls)
Function to process a REST call.
int GNUNET_CONTAINER_multihashmap_iterate(struct GNUNET_CONTAINER_MultiHashMap *map, GNUNET_CONTAINER_MulitHashMapIteratorCallback it, void *it_cls)
Iterate over all entries in the map.
struct GNUNET_RECLAIM_Handle * GNUNET_RECLAIM_connect(const struct GNUNET_CONFIGURATION_Handle *cfg)
Connect to the re:claimID service.
struct GNUNET_RECLAIM_Operation * GNUNET_RECLAIM_ticket_issue(struct GNUNET_RECLAIM_Handle *h, const struct GNUNET_IDENTITY_PrivateKey *iss, const struct GNUNET_IDENTITY_PublicKey *rp, const struct GNUNET_RECLAIM_AttributeList *attrs, GNUNET_RECLAIM_IssueTicketCallback cb, void *cb_cls)
Issues a ticket to a relying party.
uint32_t data
The data value.
int public_client
Public client.
#define OIDC_COOKIE_HEADER_KEY
OIDC cookie header key.
struct EgoEntry * next
DLL.
char * OIDC_generate_userinfo(const struct GNUNET_IDENTITY_PublicKey *sub_key, const struct GNUNET_RECLAIM_AttributeList *attrs, const struct GNUNET_RECLAIM_PresentationList *presentations)
Generate userinfo JSON as string.
static struct EgoEntry * ego_head
Ego list.
#define GNUNET_REST_API_NS_USERINFO
UserInfo endpoint.
Handle for a credential iterator operation.
struct GNUNET_RECLAIM_AttributeListEntry * list_head
List head.
int GNUNET_STRINGS_string_to_data(const char *enc, size_t enclen, void *out, size_t out_size)
Convert CrockfordBase32 encoding back to data.
#define ID_REST_STATE_POST_INIT
Done collecting egos.
#define GNUNET_free(ptr)
Wrapper around free.
Time for relative time used by GNUnet, in microseconds.
static void oidc_attr_collect_finished_cb(void *cls)
#define OIDC_ERROR_KEY_INVALID_SCOPE
OIDC error key for invalid scopes.
#define GNUNET_REST_API_NS_TOKEN
Token endpoint.
char * login_identity
The identity chosen by the user to login.
static void do_userinfo_error(void *cls)
Task run on error in userinfo endpoint, sends error header.
static void do_redirect_error(void *cls)
Task run on error, sends error message and redirects.
void * GNUNET_SCHEDULER_cancel(struct GNUNET_SCHEDULER_Task *task)
Cancel the task with the specified identifier.