Host-side third party token validation

remoting/protocol/negotiating_authenticator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/protocol/negotiating_authenticator.h"
 
 #include <algorithm>
 #include <sstream>
 
 #include "base/bind.h"
@@ skipping 31 matching lines @@
   DCHECK(!methods.empty());
   for (std::vector<AuthenticationMethod>::const_iterator it = methods.begin();
        it != methods.end(); ++it) {
     result->AddMethod(*it);
   }
 
   return scoped_ptr<Authenticator>(result.Pass());
 }
 
 // static
-scoped_ptr<Authenticator> NegotiatingAuthenticator::CreateForHost(
+scoped_ptr<Authenticator> NegotiatingAuthenticator::CreateForHostSharedSecret(
     const std::string& local_cert,
     scoped_refptr<RsaKeyPair> key_pair,
     const std::string& shared_secret_hash,
     AuthenticationMethod::HashFunction hash_function) {
   scoped_ptr<NegotiatingAuthenticator> result(
       new NegotiatingAuthenticator(WAITING_MESSAGE));
   result->local_cert_ = local_cert;
   result->local_key_pair_ = key_pair;
   result->shared_secret_hash_ = shared_secret_hash;
+  result->AddMethod(AuthenticationMethod::Spake2(hash_function));
 
-  result->AddMethod(AuthenticationMethod::Spake2(hash_function));
+  return scoped_ptr<Authenticator>(result.Pass());
+}
+
+// static
+scoped_ptr<Authenticator> NegotiatingAuthenticator::CreateForHostThirdParty(
+    const std::string& local_cert,
+    scoped_refptr<RsaKeyPair> key_pair,
+    const GURL& token_url,
+    const GURL& token_validation_url,
+    const std::string& local_jid,
+    const std::string& remote_jid,
+    ThirdPartyHostAuthenticator::TokenValidatorFactory*
+        token_validator_factory) {
+  scoped_ptr<NegotiatingAuthenticator> result(
+      new NegotiatingAuthenticator(WAITING_MESSAGE));
+  result->local_cert_ = local_cert;
+  result->local_key_pair_ = key_pair;
+  result->token_url_ = token_url;
+  result->token_validation_url_ = token_validation_url;
+  result->local_jid_ = local_jid;
+  result->remote_jid_ = remote_jid;
+  result->token_validator_factory_ = token_validator_factory;
+  result->AddMethod(AuthenticationMethod::ThirdParty());
 
   return scoped_ptr<Authenticator>(result.Pass());
 }
 
 NegotiatingAuthenticator::NegotiatingAuthenticator(
     Authenticator::State initial_state)
     : current_method_(AuthenticationMethod::Invalid()),
       state_(initial_state),
       rejection_reason_(INVALID_CREDENTIALS),
       weak_factory_(ALLOW_THIS_IN_INITIALIZER_LIST(this)) {
@@ skipping 140 matching lines @@
   return current_authenticator_->CreateChannelAuthenticator();
 }
 
 bool NegotiatingAuthenticator::is_host_side() const {
   return local_key_pair_.get() != NULL;
 }
 
 void NegotiatingAuthenticator::CreateAuthenticator(
     Authenticator::State preferred_initial_state,
     const base::Closure& resume_callback) {
+  DCHECK(current_method_.is_valid());
   if (is_host_side()) {
-    current_authenticator_ = V2Authenticator::CreateForHost(
-        local_cert_, local_key_pair_, shared_secret_hash_,
-        preferred_initial_state);
+    if (current_method_.type() == AuthenticationMethod::THIRD_PARTY) {
+      current_authenticator_.reset(new ThirdPartyHostAuthenticator(
+          local_cert_, local_key_pair_,
+          token_validator_factory_->CreateTokenValidator(
+              token_url_, token_validation_url_, local_key_pair_,
+              local_jid_, remote_jid_)));
+    } else {
+      DCHECK_EQ(current_method_.type(), AuthenticationMethod::SPAKE2);
+      current_authenticator_ = V2Authenticator::CreateForHost(
+          local_cert_, local_key_pair_, shared_secret_hash_,
+          preferred_initial_state);
+    }
     resume_callback.Run();
   } else {
     fetch_secret_callback_.Run(base::Bind(
         &NegotiatingAuthenticator::CreateV2AuthenticatorWithSecret,
         weak_factory_.GetWeakPtr(), preferred_initial_state, resume_callback));
   }
 }
 
 void NegotiatingAuthenticator::ProcessMessageInternal(
     const buzz::XmlElement* message,
@@ skipping 14 matching lines @@
     const std::string& shared_secret) {
   current_authenticator_ = V2Authenticator::CreateForClient(
       AuthenticationMethod::ApplyHashFunction(
           current_method_.hash_function(), authentication_tag_, shared_secret),
       initial_state);
   resume_callback.Run();
 }
 
 }  // namespace protocol
 }  // namespace remoting