diff options
Diffstat (limited to 'toolkit/identity/IdentityProvider.jsm')
| -rw-r--r-- | toolkit/identity/IdentityProvider.jsm | 496 |
1 files changed, 496 insertions, 0 deletions
diff --git a/toolkit/identity/IdentityProvider.jsm b/toolkit/identity/IdentityProvider.jsm new file mode 100644 index 000000000..11529bfba --- /dev/null +++ b/toolkit/identity/IdentityProvider.jsm @@ -0,0 +1,496 @@ +/* -*- js-indent-level: 2; indent-tabs-mode: nil -*- */ +/* vim: set ft=javascript ts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this file, + * You can obtain one at http://mozilla.org/MPL/2.0/. */ + +"use strict"; + +const Cu = Components.utils; +const Ci = Components.interfaces; +const Cc = Components.classes; +const Cr = Components.results; + +Cu.import("resource://gre/modules/XPCOMUtils.jsm"); +Cu.import("resource://gre/modules/Services.jsm"); +Cu.import("resource://gre/modules/identity/LogUtils.jsm"); +Cu.import("resource://gre/modules/identity/Sandbox.jsm"); + +this.EXPORTED_SYMBOLS = ["IdentityProvider"]; +const FALLBACK_PROVIDER = "browserid.org"; + +XPCOMUtils.defineLazyModuleGetter(this, + "jwcrypto", + "resource://gre/modules/identity/jwcrypto.jsm"); + +function log(...aMessageArgs) { + Logger.log.apply(Logger, ["IDP"].concat(aMessageArgs)); +} +function reportError(...aMessageArgs) { + Logger.reportError.apply(Logger, ["IDP"].concat(aMessageArgs)); +} + + +function IdentityProviderService() { + XPCOMUtils.defineLazyModuleGetter(this, + "_store", + "resource://gre/modules/identity/IdentityStore.jsm", + "IdentityStore"); + + this.reset(); +} + +IdentityProviderService.prototype = { + QueryInterface: XPCOMUtils.generateQI([Ci.nsISupports, Ci.nsIObserver]), + _sandboxConfigured: false, + + observe: function observe(aSubject, aTopic, aData) { + switch (aTopic) { + case "quit-application-granted": + Services.obs.removeObserver(this, "quit-application-granted"); + this.shutdown(); + break; + } + }, + + reset: function IDP_reset() { + // Clear the provisioning flows. Provision flows contain an + // identity, idpParams (how to reach the IdP to provision and + // authenticate), a callback (a completion callback for when things + // are done), and a provisioningFrame (which is the provisioning + // sandbox). Additionally, two callbacks will be attached: + // beginProvisioningCallback and genKeyPairCallback. + this._provisionFlows = {}; + + // Clear the authentication flows. Authentication flows attach + // to provision flows. In the process of provisioning an id, it + // may be necessary to authenticate with an IdP. The authentication + // flow maintains the state of that authentication process. + this._authenticationFlows = {}; + }, + + getProvisionFlow: function getProvisionFlow(aProvId, aErrBack) { + let provFlow = this._provisionFlows[aProvId]; + if (provFlow) { + return provFlow; + } + + let err = "No provisioning flow found with id " + aProvId; + log("ERROR:", err); + if (typeof aErrBack === 'function') { + aErrBack(err); + } + + return undefined; + }, + + shutdown: function RP_shutdown() { + this.reset(); + + if (this._sandboxConfigured) { + // Tear down message manager listening on the hidden window + Cu.import("resource://gre/modules/DOMIdentity.jsm"); + DOMIdentity._configureMessages(Services.appShell.hiddenDOMWindow, false); + this._sandboxConfigured = false; + } + + Services.obs.removeObserver(this, "quit-application-granted"); + }, + + get securityLevel() { + return 1; + }, + + get certDuration() { + switch (this.securityLevel) { + default: + return 3600; + } + }, + + /** + * Provision an Identity + * + * @param aIdentity + * (string) the email we're logging in with + * + * @param aIDPParams + * (object) parameters of the IdP + * + * @param aCallback + * (function) callback to invoke on completion + * with first-positional parameter the error. + */ + _provisionIdentity: function _provisionIdentity(aIdentity, aIDPParams, aProvId, aCallback) { + let provPath = aIDPParams.idpParams.provisioning; + let url = Services.io.newURI("https://" + aIDPParams.domain, null, null).resolve(provPath); + log("_provisionIdentity: identity:", aIdentity, "url:", url); + + // If aProvId is not null, then we already have a flow + // with a sandbox. Otherwise, get a sandbox and create a + // new provision flow. + + if (aProvId) { + // Re-use an existing sandbox + log("_provisionIdentity: re-using sandbox in provisioning flow with id:", aProvId); + this._provisionFlows[aProvId].provisioningSandbox.reload(); + + } else { + this._createProvisioningSandbox(url, function createdSandbox(aSandbox) { + // create a provisioning flow, using the sandbox id, and + // stash callback associated with this provisioning workflow. + + let provId = aSandbox.id; + this._provisionFlows[provId] = { + identity: aIdentity, + idpParams: aIDPParams, + securityLevel: this.securityLevel, + provisioningSandbox: aSandbox, + callback: function doCallback(aErr) { + aCallback(aErr, provId); + }, + }; + + log("_provisionIdentity: Created sandbox and provisioning flow with id:", provId); + // XXX bug 769862 - provisioning flow should timeout after N seconds + + }.bind(this)); + } + }, + + // DOM Methods + /** + * the provisioning iframe sandbox has called navigator.id.beginProvisioning() + * + * @param aCaller + * (object) the iframe sandbox caller with all callbacks and + * other information. Callbacks include: + * - doBeginProvisioningCallback(id, duration_s) + * - doGenKeyPairCallback(pk) + */ + beginProvisioning: function beginProvisioning(aCaller) { + log("beginProvisioning:", aCaller.id); + + // Expect a flow for this caller already to be underway. + let provFlow = this.getProvisionFlow(aCaller.id, aCaller.doError); + + // keep the caller object around + provFlow.caller = aCaller; + + let identity = provFlow.identity; + let frame = provFlow.provisioningFrame; + + // Determine recommended length of cert. + let duration = this.certDuration; + + // Make a record that we have begun provisioning. This is required + // for genKeyPair. + provFlow.didBeginProvisioning = true; + + // Let the sandbox know to invoke the callback to beginProvisioning with + // the identity and cert length. + return aCaller.doBeginProvisioningCallback(identity, duration); + }, + + /** + * the provisioning iframe sandbox has called + * navigator.id.raiseProvisioningFailure() + * + * @param aProvId + * (int) the identifier of the provisioning flow tied to that sandbox + * @param aReason + */ + raiseProvisioningFailure: function raiseProvisioningFailure(aProvId, aReason) { + reportError("Provisioning failure", aReason); + + // look up the provisioning caller and its callback + let provFlow = this.getProvisionFlow(aProvId); + + // Sandbox is deleted in _cleanUpProvisionFlow in case we re-use it. + + // This may be either a "soft" or "hard" fail. If it's a + // soft fail, we'll flow through setAuthenticationFlow, where + // the provision flow data will be copied into a new auth + // flow. If it's a hard fail, then the callback will be + // responsible for cleaning up the now defunct provision flow. + + // invoke the callback with an error. + provFlow.callback(aReason); + }, + + /** + * When navigator.id.genKeyPair is called from provisioning iframe sandbox. + * Generates a keypair for the current user being provisioned. + * + * @param aProvId + * (int) the identifier of the provisioning caller tied to that sandbox + * + * It is an error to call genKeypair without receiving the callback for + * the beginProvisioning() call first. + */ + genKeyPair: function genKeyPair(aProvId) { + // Look up the provisioning caller and make sure it's valid. + let provFlow = this.getProvisionFlow(aProvId); + + if (!provFlow.didBeginProvisioning) { + let errStr = "ERROR: genKeyPair called before beginProvisioning"; + log(errStr); + provFlow.callback(errStr); + return; + } + + // Ok generate a keypair + jwcrypto.generateKeyPair(jwcrypto.ALGORITHMS.DS160, function gkpCb(err, kp) { + log("in gkp callback"); + if (err) { + log("ERROR: genKeyPair:", err); + provFlow.callback(err); + return; + } + + provFlow.kp = kp; + + // Serialize the publicKey of the keypair and send it back to the + // sandbox. + log("genKeyPair: generated keypair for provisioning flow with id:", aProvId); + provFlow.caller.doGenKeyPairCallback(provFlow.kp.serializedPublicKey); + }.bind(this)); + }, + + /** + * When navigator.id.registerCertificate is called from provisioning iframe + * sandbox. + * + * Sets the certificate for the user for which a certificate was requested + * via a preceding call to beginProvisioning (and genKeypair). + * + * @param aProvId + * (integer) the identifier of the provisioning caller tied to that + * sandbox + * + * @param aCert + * (String) A JWT representing the signed certificate for the user + * being provisioned, provided by the IdP. + */ + registerCertificate: function registerCertificate(aProvId, aCert) { + log("registerCertificate:", aProvId, aCert); + + // look up provisioning caller, make sure it's valid. + let provFlow = this.getProvisionFlow(aProvId); + + if (!provFlow.caller) { + reportError("registerCertificate", "No provision flow or caller"); + return; + } + if (!provFlow.kp) { + let errStr = "Cannot register a certificate without a keypair"; + reportError("registerCertificate", errStr); + provFlow.callback(errStr); + return; + } + + // store the keypair and certificate just provided in IDStore. + this._store.addIdentity(provFlow.identity, provFlow.kp, aCert); + + // Great success! + provFlow.callback(null); + + // Clean up the flow. + this._cleanUpProvisionFlow(aProvId); + }, + + /** + * Begin the authentication process with an IdP + * + * @param aProvId + * (int) the identifier of the provisioning flow which failed + * + * @param aCallback + * (function) to invoke upon completion, with + * first-positional-param error. + */ + _doAuthentication: function _doAuthentication(aProvId, aIDPParams) { + log("_doAuthentication: provId:", aProvId, "idpParams:", aIDPParams); + // create an authentication caller and its identifier AuthId + // stash aIdentity, idpparams, and callback in it. + + // extract authentication URL from idpParams + let authPath = aIDPParams.idpParams.authentication; + let authURI = Services.io.newURI("https://" + aIDPParams.domain, null, null).resolve(authPath); + + // beginAuthenticationFlow causes the "identity-auth" topic to be + // observed. Since it's sending a notification to the DOM, there's + // no callback. We wait for the DOM to trigger the next phase of + // provisioning. + this._beginAuthenticationFlow(aProvId, authURI); + + // either we bind the AuthID to the sandbox ourselves, or UX does that, + // in which case we need to tell UX the AuthId. + // Currently, the UX creates the UI and gets the AuthId from the window + // and sets is with setAuthenticationFlow + }, + + /** + * The authentication frame has called navigator.id.beginAuthentication + * + * IMPORTANT: the aCaller is *always* non-null, even if this is called from + * a regular content page. We have to make sure, on every DOM call, that + * aCaller is an expected authentication-flow identifier. If not, we throw + * an error or something. + * + * @param aCaller + * (object) the authentication caller + * + */ + beginAuthentication: function beginAuthentication(aCaller) { + log("beginAuthentication: caller id:", aCaller.id); + + // Begin the authentication flow after having concluded a provisioning + // flow. The aCaller that the DOM gives us will have the same ID as + // the provisioning flow we just concluded. (see setAuthenticationFlow) + let authFlow = this._authenticationFlows[aCaller.id]; + if (!authFlow) { + return aCaller.doError("beginAuthentication: no flow for caller id", aCaller.id); + } + + authFlow.caller = aCaller; + + let identity = this._provisionFlows[authFlow.provId].identity; + + // tell the UI to start the authentication process + log("beginAuthentication: authFlow:", aCaller.id, "identity:", identity); + return authFlow.caller.doBeginAuthenticationCallback(identity); + }, + + /** + * The auth frame has called navigator.id.completeAuthentication + * + * @param aAuthId + * (int) the identifier of the authentication caller tied to that sandbox + * + */ + completeAuthentication: function completeAuthentication(aAuthId) { + log("completeAuthentication:", aAuthId); + + // look up the AuthId caller, and get its callback. + let authFlow = this._authenticationFlows[aAuthId]; + if (!authFlow) { + reportError("completeAuthentication", "No auth flow with id", aAuthId); + return; + } + let provId = authFlow.provId; + + // delete caller + delete authFlow['caller']; + delete this._authenticationFlows[aAuthId]; + + let provFlow = this.getProvisionFlow(provId); + provFlow.didAuthentication = true; + let subject = { + rpId: provFlow.rpId, + identity: provFlow.identity, + }; + Services.obs.notifyObservers({ wrappedJSObject: subject }, "identity-auth-complete", aAuthId); + }, + + /** + * The auth frame has called navigator.id.cancelAuthentication + * + * @param aAuthId + * (int) the identifier of the authentication caller + * + */ + cancelAuthentication: function cancelAuthentication(aAuthId) { + log("cancelAuthentication:", aAuthId); + + // look up the AuthId caller, and get its callback. + let authFlow = this._authenticationFlows[aAuthId]; + if (!authFlow) { + reportError("cancelAuthentication", "No auth flow with id:", aAuthId); + return; + } + let provId = authFlow.provId; + + // delete caller + delete authFlow['caller']; + delete this._authenticationFlows[aAuthId]; + + let provFlow = this.getProvisionFlow(provId); + provFlow.didAuthentication = true; + Services.obs.notifyObservers(null, "identity-auth-complete", aAuthId); + + // invoke callback with ERROR. + let errStr = "Authentication canceled by IDP"; + log("ERROR: cancelAuthentication:", errStr); + provFlow.callback(errStr); + }, + + /** + * Called by the UI to set the ID and caller for the authentication flow after it gets its ID + */ + setAuthenticationFlow: function(aAuthId, aProvId) { + // this is the transition point between the two flows, + // provision and authenticate. We tell the auth flow which + // provisioning flow it is started from. + log("setAuthenticationFlow: authId:", aAuthId, "provId:", aProvId); + this._authenticationFlows[aAuthId] = { provId: aProvId }; + this._provisionFlows[aProvId].authId = aAuthId; + }, + + /** + * Load the provisioning URL in a hidden frame to start the provisioning + * process. + */ + _createProvisioningSandbox: function _createProvisioningSandbox(aURL, aCallback) { + log("_createProvisioningSandbox:", aURL); + + if (!this._sandboxConfigured) { + // Configure message manager listening on the hidden window + Cu.import("resource://gre/modules/DOMIdentity.jsm"); + DOMIdentity._configureMessages(Services.appShell.hiddenDOMWindow, true); + this._sandboxConfigured = true; + } + + new Sandbox(aURL, aCallback); + }, + + /** + * Load the authentication UI to start the authentication process. + */ + _beginAuthenticationFlow: function _beginAuthenticationFlow(aProvId, aURL) { + log("_beginAuthenticationFlow:", aProvId, aURL); + let propBag = {provId: aProvId}; + + Services.obs.notifyObservers({wrappedJSObject:propBag}, "identity-auth", aURL); + }, + + /** + * Clean up a provision flow and the authentication flow and sandbox + * that may be attached to it. + */ + _cleanUpProvisionFlow: function _cleanUpProvisionFlow(aProvId) { + log('_cleanUpProvisionFlow:', aProvId); + let prov = this._provisionFlows[aProvId]; + + // Clean up the sandbox, if there is one. + if (prov.provisioningSandbox) { + let sandbox = this._provisionFlows[aProvId]['provisioningSandbox']; + if (sandbox.free) { + log('_cleanUpProvisionFlow: freeing sandbox'); + sandbox.free(); + } + delete this._provisionFlows[aProvId]['provisioningSandbox']; + } + + // Clean up a related authentication flow, if there is one. + if (this._authenticationFlows[prov.authId]) { + delete this._authenticationFlows[prov.authId]; + } + + // Finally delete the provision flow + delete this._provisionFlows[aProvId]; + } + +}; + +this.IdentityProvider = new IdentityProviderService(); |