summaryrefslogtreecommitdiffstats
path: root/toolkit/identity/IdentityProvider.jsm
diff options
context:
space:
mode:
authorMatt A. Tobin <email@mattatobin.com>2020-04-19 17:46:17 -0400
committerwolfbeast <mcwerewolf@wolfbeast.com>2020-04-24 10:35:38 +0200
commit9258382b0dda205f7f1aa390f9cc58c5df33d092 (patch)
tree7f379cf84b36fc8123f18d6cba576a6355fae4e6 /toolkit/identity/IdentityProvider.jsm
parentb6a703907e7e349213fac466d5665e91966cbcaa (diff)
downloadUXP-9258382b0dda205f7f1aa390f9cc58c5df33d092.tar
UXP-9258382b0dda205f7f1aa390f9cc58c5df33d092.tar.gz
UXP-9258382b0dda205f7f1aa390f9cc58c5df33d092.tar.lz
UXP-9258382b0dda205f7f1aa390f9cc58c5df33d092.tar.xz
UXP-9258382b0dda205f7f1aa390f9cc58c5df33d092.zip
Issue #576 - Remove IdentityService and ContextualIdentityService
Diffstat (limited to 'toolkit/identity/IdentityProvider.jsm')
-rw-r--r--toolkit/identity/IdentityProvider.jsm496
1 files changed, 0 insertions, 496 deletions
diff --git a/toolkit/identity/IdentityProvider.jsm b/toolkit/identity/IdentityProvider.jsm
deleted file mode 100644
index 11529bfba..000000000
--- a/toolkit/identity/IdentityProvider.jsm
+++ /dev/null
@@ -1,496 +0,0 @@
-/* -*- js-indent-level: 2; indent-tabs-mode: nil -*- */
-/* vim: set ft=javascript ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-"use strict";
-
-const Cu = Components.utils;
-const Ci = Components.interfaces;
-const Cc = Components.classes;
-const Cr = Components.results;
-
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-Cu.import("resource://gre/modules/Services.jsm");
-Cu.import("resource://gre/modules/identity/LogUtils.jsm");
-Cu.import("resource://gre/modules/identity/Sandbox.jsm");
-
-this.EXPORTED_SYMBOLS = ["IdentityProvider"];
-const FALLBACK_PROVIDER = "browserid.org";
-
-XPCOMUtils.defineLazyModuleGetter(this,
- "jwcrypto",
- "resource://gre/modules/identity/jwcrypto.jsm");
-
-function log(...aMessageArgs) {
- Logger.log.apply(Logger, ["IDP"].concat(aMessageArgs));
-}
-function reportError(...aMessageArgs) {
- Logger.reportError.apply(Logger, ["IDP"].concat(aMessageArgs));
-}
-
-
-function IdentityProviderService() {
- XPCOMUtils.defineLazyModuleGetter(this,
- "_store",
- "resource://gre/modules/identity/IdentityStore.jsm",
- "IdentityStore");
-
- this.reset();
-}
-
-IdentityProviderService.prototype = {
- QueryInterface: XPCOMUtils.generateQI([Ci.nsISupports, Ci.nsIObserver]),
- _sandboxConfigured: false,
-
- observe: function observe(aSubject, aTopic, aData) {
- switch (aTopic) {
- case "quit-application-granted":
- Services.obs.removeObserver(this, "quit-application-granted");
- this.shutdown();
- break;
- }
- },
-
- reset: function IDP_reset() {
- // Clear the provisioning flows. Provision flows contain an
- // identity, idpParams (how to reach the IdP to provision and
- // authenticate), a callback (a completion callback for when things
- // are done), and a provisioningFrame (which is the provisioning
- // sandbox). Additionally, two callbacks will be attached:
- // beginProvisioningCallback and genKeyPairCallback.
- this._provisionFlows = {};
-
- // Clear the authentication flows. Authentication flows attach
- // to provision flows. In the process of provisioning an id, it
- // may be necessary to authenticate with an IdP. The authentication
- // flow maintains the state of that authentication process.
- this._authenticationFlows = {};
- },
-
- getProvisionFlow: function getProvisionFlow(aProvId, aErrBack) {
- let provFlow = this._provisionFlows[aProvId];
- if (provFlow) {
- return provFlow;
- }
-
- let err = "No provisioning flow found with id " + aProvId;
- log("ERROR:", err);
- if (typeof aErrBack === 'function') {
- aErrBack(err);
- }
-
- return undefined;
- },
-
- shutdown: function RP_shutdown() {
- this.reset();
-
- if (this._sandboxConfigured) {
- // Tear down message manager listening on the hidden window
- Cu.import("resource://gre/modules/DOMIdentity.jsm");
- DOMIdentity._configureMessages(Services.appShell.hiddenDOMWindow, false);
- this._sandboxConfigured = false;
- }
-
- Services.obs.removeObserver(this, "quit-application-granted");
- },
-
- get securityLevel() {
- return 1;
- },
-
- get certDuration() {
- switch (this.securityLevel) {
- default:
- return 3600;
- }
- },
-
- /**
- * Provision an Identity
- *
- * @param aIdentity
- * (string) the email we're logging in with
- *
- * @param aIDPParams
- * (object) parameters of the IdP
- *
- * @param aCallback
- * (function) callback to invoke on completion
- * with first-positional parameter the error.
- */
- _provisionIdentity: function _provisionIdentity(aIdentity, aIDPParams, aProvId, aCallback) {
- let provPath = aIDPParams.idpParams.provisioning;
- let url = Services.io.newURI("https://" + aIDPParams.domain, null, null).resolve(provPath);
- log("_provisionIdentity: identity:", aIdentity, "url:", url);
-
- // If aProvId is not null, then we already have a flow
- // with a sandbox. Otherwise, get a sandbox and create a
- // new provision flow.
-
- if (aProvId) {
- // Re-use an existing sandbox
- log("_provisionIdentity: re-using sandbox in provisioning flow with id:", aProvId);
- this._provisionFlows[aProvId].provisioningSandbox.reload();
-
- } else {
- this._createProvisioningSandbox(url, function createdSandbox(aSandbox) {
- // create a provisioning flow, using the sandbox id, and
- // stash callback associated with this provisioning workflow.
-
- let provId = aSandbox.id;
- this._provisionFlows[provId] = {
- identity: aIdentity,
- idpParams: aIDPParams,
- securityLevel: this.securityLevel,
- provisioningSandbox: aSandbox,
- callback: function doCallback(aErr) {
- aCallback(aErr, provId);
- },
- };
-
- log("_provisionIdentity: Created sandbox and provisioning flow with id:", provId);
- // XXX bug 769862 - provisioning flow should timeout after N seconds
-
- }.bind(this));
- }
- },
-
- // DOM Methods
- /**
- * the provisioning iframe sandbox has called navigator.id.beginProvisioning()
- *
- * @param aCaller
- * (object) the iframe sandbox caller with all callbacks and
- * other information. Callbacks include:
- * - doBeginProvisioningCallback(id, duration_s)
- * - doGenKeyPairCallback(pk)
- */
- beginProvisioning: function beginProvisioning(aCaller) {
- log("beginProvisioning:", aCaller.id);
-
- // Expect a flow for this caller already to be underway.
- let provFlow = this.getProvisionFlow(aCaller.id, aCaller.doError);
-
- // keep the caller object around
- provFlow.caller = aCaller;
-
- let identity = provFlow.identity;
- let frame = provFlow.provisioningFrame;
-
- // Determine recommended length of cert.
- let duration = this.certDuration;
-
- // Make a record that we have begun provisioning. This is required
- // for genKeyPair.
- provFlow.didBeginProvisioning = true;
-
- // Let the sandbox know to invoke the callback to beginProvisioning with
- // the identity and cert length.
- return aCaller.doBeginProvisioningCallback(identity, duration);
- },
-
- /**
- * the provisioning iframe sandbox has called
- * navigator.id.raiseProvisioningFailure()
- *
- * @param aProvId
- * (int) the identifier of the provisioning flow tied to that sandbox
- * @param aReason
- */
- raiseProvisioningFailure: function raiseProvisioningFailure(aProvId, aReason) {
- reportError("Provisioning failure", aReason);
-
- // look up the provisioning caller and its callback
- let provFlow = this.getProvisionFlow(aProvId);
-
- // Sandbox is deleted in _cleanUpProvisionFlow in case we re-use it.
-
- // This may be either a "soft" or "hard" fail. If it's a
- // soft fail, we'll flow through setAuthenticationFlow, where
- // the provision flow data will be copied into a new auth
- // flow. If it's a hard fail, then the callback will be
- // responsible for cleaning up the now defunct provision flow.
-
- // invoke the callback with an error.
- provFlow.callback(aReason);
- },
-
- /**
- * When navigator.id.genKeyPair is called from provisioning iframe sandbox.
- * Generates a keypair for the current user being provisioned.
- *
- * @param aProvId
- * (int) the identifier of the provisioning caller tied to that sandbox
- *
- * It is an error to call genKeypair without receiving the callback for
- * the beginProvisioning() call first.
- */
- genKeyPair: function genKeyPair(aProvId) {
- // Look up the provisioning caller and make sure it's valid.
- let provFlow = this.getProvisionFlow(aProvId);
-
- if (!provFlow.didBeginProvisioning) {
- let errStr = "ERROR: genKeyPair called before beginProvisioning";
- log(errStr);
- provFlow.callback(errStr);
- return;
- }
-
- // Ok generate a keypair
- jwcrypto.generateKeyPair(jwcrypto.ALGORITHMS.DS160, function gkpCb(err, kp) {
- log("in gkp callback");
- if (err) {
- log("ERROR: genKeyPair:", err);
- provFlow.callback(err);
- return;
- }
-
- provFlow.kp = kp;
-
- // Serialize the publicKey of the keypair and send it back to the
- // sandbox.
- log("genKeyPair: generated keypair for provisioning flow with id:", aProvId);
- provFlow.caller.doGenKeyPairCallback(provFlow.kp.serializedPublicKey);
- }.bind(this));
- },
-
- /**
- * When navigator.id.registerCertificate is called from provisioning iframe
- * sandbox.
- *
- * Sets the certificate for the user for which a certificate was requested
- * via a preceding call to beginProvisioning (and genKeypair).
- *
- * @param aProvId
- * (integer) the identifier of the provisioning caller tied to that
- * sandbox
- *
- * @param aCert
- * (String) A JWT representing the signed certificate for the user
- * being provisioned, provided by the IdP.
- */
- registerCertificate: function registerCertificate(aProvId, aCert) {
- log("registerCertificate:", aProvId, aCert);
-
- // look up provisioning caller, make sure it's valid.
- let provFlow = this.getProvisionFlow(aProvId);
-
- if (!provFlow.caller) {
- reportError("registerCertificate", "No provision flow or caller");
- return;
- }
- if (!provFlow.kp) {
- let errStr = "Cannot register a certificate without a keypair";
- reportError("registerCertificate", errStr);
- provFlow.callback(errStr);
- return;
- }
-
- // store the keypair and certificate just provided in IDStore.
- this._store.addIdentity(provFlow.identity, provFlow.kp, aCert);
-
- // Great success!
- provFlow.callback(null);
-
- // Clean up the flow.
- this._cleanUpProvisionFlow(aProvId);
- },
-
- /**
- * Begin the authentication process with an IdP
- *
- * @param aProvId
- * (int) the identifier of the provisioning flow which failed
- *
- * @param aCallback
- * (function) to invoke upon completion, with
- * first-positional-param error.
- */
- _doAuthentication: function _doAuthentication(aProvId, aIDPParams) {
- log("_doAuthentication: provId:", aProvId, "idpParams:", aIDPParams);
- // create an authentication caller and its identifier AuthId
- // stash aIdentity, idpparams, and callback in it.
-
- // extract authentication URL from idpParams
- let authPath = aIDPParams.idpParams.authentication;
- let authURI = Services.io.newURI("https://" + aIDPParams.domain, null, null).resolve(authPath);
-
- // beginAuthenticationFlow causes the "identity-auth" topic to be
- // observed. Since it's sending a notification to the DOM, there's
- // no callback. We wait for the DOM to trigger the next phase of
- // provisioning.
- this._beginAuthenticationFlow(aProvId, authURI);
-
- // either we bind the AuthID to the sandbox ourselves, or UX does that,
- // in which case we need to tell UX the AuthId.
- // Currently, the UX creates the UI and gets the AuthId from the window
- // and sets is with setAuthenticationFlow
- },
-
- /**
- * The authentication frame has called navigator.id.beginAuthentication
- *
- * IMPORTANT: the aCaller is *always* non-null, even if this is called from
- * a regular content page. We have to make sure, on every DOM call, that
- * aCaller is an expected authentication-flow identifier. If not, we throw
- * an error or something.
- *
- * @param aCaller
- * (object) the authentication caller
- *
- */
- beginAuthentication: function beginAuthentication(aCaller) {
- log("beginAuthentication: caller id:", aCaller.id);
-
- // Begin the authentication flow after having concluded a provisioning
- // flow. The aCaller that the DOM gives us will have the same ID as
- // the provisioning flow we just concluded. (see setAuthenticationFlow)
- let authFlow = this._authenticationFlows[aCaller.id];
- if (!authFlow) {
- return aCaller.doError("beginAuthentication: no flow for caller id", aCaller.id);
- }
-
- authFlow.caller = aCaller;
-
- let identity = this._provisionFlows[authFlow.provId].identity;
-
- // tell the UI to start the authentication process
- log("beginAuthentication: authFlow:", aCaller.id, "identity:", identity);
- return authFlow.caller.doBeginAuthenticationCallback(identity);
- },
-
- /**
- * The auth frame has called navigator.id.completeAuthentication
- *
- * @param aAuthId
- * (int) the identifier of the authentication caller tied to that sandbox
- *
- */
- completeAuthentication: function completeAuthentication(aAuthId) {
- log("completeAuthentication:", aAuthId);
-
- // look up the AuthId caller, and get its callback.
- let authFlow = this._authenticationFlows[aAuthId];
- if (!authFlow) {
- reportError("completeAuthentication", "No auth flow with id", aAuthId);
- return;
- }
- let provId = authFlow.provId;
-
- // delete caller
- delete authFlow['caller'];
- delete this._authenticationFlows[aAuthId];
-
- let provFlow = this.getProvisionFlow(provId);
- provFlow.didAuthentication = true;
- let subject = {
- rpId: provFlow.rpId,
- identity: provFlow.identity,
- };
- Services.obs.notifyObservers({ wrappedJSObject: subject }, "identity-auth-complete", aAuthId);
- },
-
- /**
- * The auth frame has called navigator.id.cancelAuthentication
- *
- * @param aAuthId
- * (int) the identifier of the authentication caller
- *
- */
- cancelAuthentication: function cancelAuthentication(aAuthId) {
- log("cancelAuthentication:", aAuthId);
-
- // look up the AuthId caller, and get its callback.
- let authFlow = this._authenticationFlows[aAuthId];
- if (!authFlow) {
- reportError("cancelAuthentication", "No auth flow with id:", aAuthId);
- return;
- }
- let provId = authFlow.provId;
-
- // delete caller
- delete authFlow['caller'];
- delete this._authenticationFlows[aAuthId];
-
- let provFlow = this.getProvisionFlow(provId);
- provFlow.didAuthentication = true;
- Services.obs.notifyObservers(null, "identity-auth-complete", aAuthId);
-
- // invoke callback with ERROR.
- let errStr = "Authentication canceled by IDP";
- log("ERROR: cancelAuthentication:", errStr);
- provFlow.callback(errStr);
- },
-
- /**
- * Called by the UI to set the ID and caller for the authentication flow after it gets its ID
- */
- setAuthenticationFlow: function(aAuthId, aProvId) {
- // this is the transition point between the two flows,
- // provision and authenticate. We tell the auth flow which
- // provisioning flow it is started from.
- log("setAuthenticationFlow: authId:", aAuthId, "provId:", aProvId);
- this._authenticationFlows[aAuthId] = { provId: aProvId };
- this._provisionFlows[aProvId].authId = aAuthId;
- },
-
- /**
- * Load the provisioning URL in a hidden frame to start the provisioning
- * process.
- */
- _createProvisioningSandbox: function _createProvisioningSandbox(aURL, aCallback) {
- log("_createProvisioningSandbox:", aURL);
-
- if (!this._sandboxConfigured) {
- // Configure message manager listening on the hidden window
- Cu.import("resource://gre/modules/DOMIdentity.jsm");
- DOMIdentity._configureMessages(Services.appShell.hiddenDOMWindow, true);
- this._sandboxConfigured = true;
- }
-
- new Sandbox(aURL, aCallback);
- },
-
- /**
- * Load the authentication UI to start the authentication process.
- */
- _beginAuthenticationFlow: function _beginAuthenticationFlow(aProvId, aURL) {
- log("_beginAuthenticationFlow:", aProvId, aURL);
- let propBag = {provId: aProvId};
-
- Services.obs.notifyObservers({wrappedJSObject:propBag}, "identity-auth", aURL);
- },
-
- /**
- * Clean up a provision flow and the authentication flow and sandbox
- * that may be attached to it.
- */
- _cleanUpProvisionFlow: function _cleanUpProvisionFlow(aProvId) {
- log('_cleanUpProvisionFlow:', aProvId);
- let prov = this._provisionFlows[aProvId];
-
- // Clean up the sandbox, if there is one.
- if (prov.provisioningSandbox) {
- let sandbox = this._provisionFlows[aProvId]['provisioningSandbox'];
- if (sandbox.free) {
- log('_cleanUpProvisionFlow: freeing sandbox');
- sandbox.free();
- }
- delete this._provisionFlows[aProvId]['provisioningSandbox'];
- }
-
- // Clean up a related authentication flow, if there is one.
- if (this._authenticationFlows[prov.authId]) {
- delete this._authenticationFlows[prov.authId];
- }
-
- // Finally delete the provision flow
- delete this._provisionFlows[aProvId];
- }
-
-};
-
-this.IdentityProvider = new IdentityProviderService();