Host-side third party token validation

remoting/protocol/negotiating_authenticator.cc

Index: remoting/protocol/negotiating_authenticator.cc
diff --git a/remoting/protocol/negotiating_authenticator.cc b/remoting/protocol/negotiating_authenticator.cc
index c6ecacb6a327dceae945ace9116139f3a77b0e60..07b85fb37e97e944cec377d5bb6903366e6b9bd8 100644
--- a/remoting/protocol/negotiating_authenticator.cc
+++ b/remoting/protocol/negotiating_authenticator.cc
@@ -49,7 +49,7 @@ scoped_ptr<Authenticator> NegotiatingAuthenticator::CreateForClient(
 }
 
 // static
-scoped_ptr<Authenticator> NegotiatingAuthenticator::CreateForHost(
+scoped_ptr<Authenticator> NegotiatingAuthenticator::CreateForHostSharedSecret(
     const std::string& local_cert,
     scoped_refptr<RsaKeyPair> key_pair,
     const std::string& shared_secret_hash,
@@ -59,12 +59,35 @@ scoped_ptr<Authenticator> NegotiatingAuthenticator::CreateForHost(
   result->local_cert_ = local_cert;
   result->local_key_pair_ = key_pair;
   result->shared_secret_hash_ = shared_secret_hash;
-
   result->AddMethod(AuthenticationMethod::Spake2(hash_function));
 
   return scoped_ptr<Authenticator>(result.Pass());
 }
 
+// static
+scoped_ptr<Authenticator> NegotiatingAuthenticator::CreateForHostThirdParty(
+    const std::string& local_cert,
+    scoped_refptr<RsaKeyPair> key_pair,
+    const GURL& token_url,
+    const GURL& token_validation_url,
+    const std::string& local_jid,
+    const std::string& remote_jid,
+    ThirdPartyHostAuthenticator::TokenValidatorFactory*
+        token_validator_factory) {
+  scoped_ptr<NegotiatingAuthenticator> result(
+      new NegotiatingAuthenticator(WAITING_MESSAGE));
+  result->local_cert_ = local_cert;
+  result->local_key_pair_ = key_pair;
+  result->token_url_ = token_url;
+  result->token_validation_url_ = token_validation_url;
+  result->local_jid_ = local_jid;
+  result->remote_jid_ = remote_jid;
+  result->token_validator_factory_ = token_validator_factory;
+  result->AddMethod(AuthenticationMethod::ThirdParty());
+
+  return scoped_ptr<Authenticator>(result.Pass());
+}
+
 NegotiatingAuthenticator::NegotiatingAuthenticator(
     Authenticator::State initial_state)
     : current_method_(AuthenticationMethod::Invalid()),
@@ -221,10 +244,20 @@ bool NegotiatingAuthenticator::is_host_side() const {
 void NegotiatingAuthenticator::CreateAuthenticator(
     Authenticator::State preferred_initial_state,
     const base::Closure& resume_callback) {
+  DCHECK(current_method_.is_valid());
   if (is_host_side()) {
-    current_authenticator_ = V2Authenticator::CreateForHost(
-        local_cert_, local_key_pair_, shared_secret_hash_,
-        preferred_initial_state);
+    if (current_method_.type() == AuthenticationMethod::THIRD_PARTY) {
+      current_authenticator_.reset(new ThirdPartyHostAuthenticator(
+          local_cert_, local_key_pair_,
+          token_validator_factory_->CreateTokenValidator(
+              token_url_, token_validation_url_, local_key_pair_,
+              local_jid_, remote_jid_)));
+    } else {
+      DCHECK_EQ(current_method_.type(), AuthenticationMethod::SPAKE2);
+      current_authenticator_ = V2Authenticator::CreateForHost(
+          local_cert_, local_key_pair_, shared_secret_hash_,
+          preferred_initial_state);
+    }
     resume_callback.Run();
   } else {
     fetch_secret_callback_.Run(base::Bind(