Support for auth code based authentication flow for both app and web UI driven flow.

chrome/browser/chromeos/login/parallel_authenticator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/parallel_authenticator.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/files/file_path.h"
@@ skipping 54 matching lines @@
 }
 
 // Calls cryptohome's mount method.
 void Mount(AuthAttemptState* attempt,
            scoped_refptr<ParallelAuthenticator> resolver,
            int flags) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   chromeos::BootTimesLoader::Get()->AddLoginTimeMarker(
       "CryptohomeMount-Start", false);
   cryptohome::AsyncMethodCaller::GetInstance()->AsyncMount(
-      attempt->username,
+      attempt->credentials.username,
       attempt->ascii_hash,
       flags,
       base::Bind(&TriggerResolveWithLoginTimeMarker,
                  "CryptohomeMount-End",
                  attempt,
                  resolver));
 }
 
 // Calls cryptohome's mount method for guest.
 void MountGuest(AuthAttemptState* attempt,
@@ skipping 11 matching lines @@
              scoped_refptr<ParallelAuthenticator> resolver,
              bool passing_old_hash,
              const std::string& hash) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   chromeos::BootTimesLoader::Get()->AddLoginTimeMarker(
       "CryptohomeMigrate-Start", false);
   cryptohome::AsyncMethodCaller* caller =
       cryptohome::AsyncMethodCaller::GetInstance();
   if (passing_old_hash) {
     caller->AsyncMigrateKey(
-        attempt->username,
+        attempt->credentials.username,
         hash,
         attempt->ascii_hash,
         base::Bind(&TriggerResolveWithLoginTimeMarker,
                    "CryptohomeMount-End",
                    attempt,
                    resolver));
   } else {
     caller->AsyncMigrateKey(
-        attempt->username,
+        attempt->credentials.username,
         attempt->ascii_hash,
         hash,
         base::Bind(&TriggerResolveWithLoginTimeMarker,
                    "CryptohomeMount-End",
                    attempt,
                    resolver));
   }
 }
 
 // Calls cryptohome's remove method.
 void Remove(AuthAttemptState* attempt,
             scoped_refptr<ParallelAuthenticator> resolver) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   chromeos::BootTimesLoader::Get()->AddLoginTimeMarker(
       "CryptohomeRemove-Start", false);
   cryptohome::AsyncMethodCaller::GetInstance()->AsyncRemove(
-      attempt->username,
+      attempt->credentials.username,
       base::Bind(&TriggerResolveWithLoginTimeMarker,
                  "CryptohomeRemove-End",
                  attempt,
                  resolver));
 }
 
 // Calls cryptohome's key check method.
 void CheckKey(AuthAttemptState* attempt,
               scoped_refptr<ParallelAuthenticator> resolver) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   cryptohome::AsyncMethodCaller::GetInstance()->AsyncCheckKey(
-      attempt->username,
+      attempt->credentials.username,
       attempt->ascii_hash,
       base::Bind(&TriggerResolve, attempt, resolver));
 }
 
 // Returns whether the login failure was connection issue.
 bool WasConnectionIssue(const LoginFailure& online_outcome) {
   return ((online_outcome.reason() == LoginFailure::LOGIN_TIMED_OUT) ||
           (online_outcome.error().state() ==
            GoogleServiceAuthError::CONNECTION_FAILED) ||
           (online_outcome.error().state() ==
@@ skipping 29 matching lines @@
       ephemeral_mount_attempted_(false),
       check_key_attempted_(false),
       already_reported_success_(false),
       owner_is_verified_(false),
       user_can_login_(false),
       using_oauth_(true) {
 }
 
 void ParallelAuthenticator::AuthenticateToLogin(
     Profile* profile,
-    const std::string& username,
-    const std::string& password,
+    const UserCredentials& credentials,
     const std::string& login_token,
     const std::string& login_captcha) {
-  std::string canonicalized = gaia::CanonicalizeEmail(username);
+  std::string canonicalized = gaia::CanonicalizeEmail(credentials.username);
   authentication_profile_ = profile;
   current_state_.reset(
       new AuthAttemptState(
-          canonicalized,
-          password,
-          HashPassword(password),
+          UserCredentials(canonicalized,
+                          credentials.password,
+                          credentials.auth_code),
+          HashPassword(credentials.password),
           login_token,
           login_captcha,
           User::USER_TYPE_REGULAR,
           !UserManager::Get()->IsKnownUser(canonicalized)));
   // Reset the verified flag.
   owner_is_verified_ = false;
 
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&Mount,
                  current_state_.get(),
                  scoped_refptr<ParallelAuthenticator>(this),
                  cryptohome::MOUNT_FLAGS_NONE));
   // ClientLogin authentication check should happen immediately here.
   // We should not try OAuthLogin check until the profile loads.
   if (!using_oauth_) {
     // Initiate ClientLogin-based post authentication.
     current_online_.reset(new OnlineAttempt(current_state_.get(),
                                             this));
     current_online_->Initiate(profile);
   }
 }
 
 void ParallelAuthenticator::CompleteLogin(Profile* profile,
-                                          const std::string& username,
-                                          const std::string& password) {
-  std::string canonicalized = gaia::CanonicalizeEmail(username);
+                                          const UserCredentials& credentials) {
+  std::string canonicalized = gaia::CanonicalizeEmail(credentials.username);
   authentication_profile_ = profile;
   current_state_.reset(
       new AuthAttemptState(
-          canonicalized,
-          password,
-          HashPassword(password),
+          UserCredentials(canonicalized,
+                          credentials.password,
+                          credentials.auth_code),
+          HashPassword(credentials.password),
           !UserManager::Get()->IsKnownUser(canonicalized)));
 
   // Reset the verified flag.
   owner_is_verified_ = false;
 
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&Mount,
                  current_state_.get(),
                  scoped_refptr<ParallelAuthenticator>(this),
@@ skipping 10 matching lines @@
   } else {
     // For login completion from extension, we just need to resolve the current
     // auth attempt state, the rest of OAuth related tasks will be done in
     // parallel.
     BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
         base::Bind(&ParallelAuthenticator::ResolveLoginCompletionStatus, this));
   }
 }
 
-void ParallelAuthenticator::AuthenticateToUnlock(const std::string& username,
-                                                 const std::string& password) {
+void ParallelAuthenticator::AuthenticateToUnlock(
+    const UserCredentials& credentials) {
   current_state_.reset(
       new AuthAttemptState(
-          gaia::CanonicalizeEmail(username),
-          HashPassword(password)));
+          gaia::CanonicalizeEmail(credentials.username),
+          HashPassword(credentials.password)));
   check_key_attempted_ = true;
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&CheckKey,
                  current_state_.get(),
                  scoped_refptr<ParallelAuthenticator>(this)));
 }
 
 void ParallelAuthenticator::LoginAsLocallyManagedUser(
-    const std::string& username,
-    const std::string& password) {
+    const UserCredentials& credentials) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   // TODO(nkostylev): Pass proper value for |user_is_new| or remove (not used).
   current_state_.reset(
-      new AuthAttemptState(username, password,
-                           HashPassword(password),
-                           "", "",
+      new AuthAttemptState(credentials,
+                           HashPassword(credentials.password),
+                           "",   // login_token
+                           "",   // login_captcha
                            User::USER_TYPE_LOCALLY_MANAGED,
                            false));
   Mount(current_state_.get(),
         scoped_refptr<ParallelAuthenticator>(this),
         cryptohome::CREATE_IF_MISSING);
 }
 
 void ParallelAuthenticator::LoginRetailMode() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   // Note: |kRetailModeUserEMail| is used in other places to identify a retail
   // mode session.
-  current_state_.reset(new AuthAttemptState(kRetailModeUserEMail,
-                                            "", "", "", "",
-                                            User::USER_TYPE_RETAIL_MODE,
-                                            false));
+  current_state_.reset(new AuthAttemptState(
+        UserCredentials(kRetailModeUserEMail,
+                        "",   // password
+                        ""),  // auth_code
+        "",  // ascii_hash
+        "",  // login_token
+        "",  // login_captcha
+        User::USER_TYPE_RETAIL_MODE,
+        false));
   ephemeral_mount_attempted_ = true;
   MountGuest(current_state_.get(),
              scoped_refptr<ParallelAuthenticator>(this));
 }
 
 void ParallelAuthenticator::LoginOffTheRecord() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  current_state_.reset(new AuthAttemptState("", "", "", "", "",
-                                            User::USER_TYPE_GUEST,
-                                            false));
+  current_state_.reset(new AuthAttemptState(
+      UserCredentials("",  // username
+                      "",  // password
+                      ""),  // auth_code
+      "",  // ascii_hash
+      "",  // login_token
+      "",  // login_captcha
+      User::USER_TYPE_GUEST,
+      false));
   ephemeral_mount_attempted_ = true;
   MountGuest(current_state_.get(),
              scoped_refptr<ParallelAuthenticator>(this));
 }
 
 void ParallelAuthenticator::LoginAsPublicAccount(const std::string& username) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  current_state_.reset(new AuthAttemptState(username, "", "", "", "",
-                                            User::USER_TYPE_PUBLIC_ACCOUNT,
-                                            false));
+  current_state_.reset(new AuthAttemptState(
+      UserCredentials(username,
+                      "",  // password
+                      ""),  // auth_code
+      "",  // ascii_hash
+      "",  // login_token
+      "",  // login_captcha
+      User::USER_TYPE_PUBLIC_ACCOUNT,
+      false));
   ephemeral_mount_attempted_ = true;
   Mount(current_state_.get(),
         scoped_refptr<ParallelAuthenticator>(this),
         cryptohome::CREATE_IF_MISSING | cryptohome::ENSURE_EPHEMERAL);
 }
 
 void ParallelAuthenticator::OnRetailModeLoginSuccess() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   VLOG(1) << "Retail mode login success";
   // Send notification of success
@@ skipping 13 matching lines @@
   AuthenticationNotificationDetails details(true);
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_LOGIN_AUTHENTICATION,
       content::NotificationService::AllSources(),
       content::Details<AuthenticationNotificationDetails>(&details));
   {
     base::AutoLock for_this_block(success_lock_);
     already_reported_success_ = true;
   }
   if (consumer_)
-    consumer_->OnLoginSuccess(current_state_->username,
-                              current_state_->password,
+    consumer_->OnLoginSuccess(current_state_->credentials,
                               request_pending,
                               using_oauth_);
 }
 
 void ParallelAuthenticator::OnOffTheRecordLoginSuccess() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   // Send notification of success
   AuthenticationNotificationDetails details(true);
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_LOGIN_AUTHENTICATION,
@@ skipping 64 matching lines @@
   CrosSettings::Get()->GetBoolean(kPolicyMissingMitigationMode, &is_safe_mode);
   if (!is_safe_mode) {
     // Now we can continue with the login and report mount success.
     user_can_login_ = true;
     owner_is_verified_ = true;
     return true;
   }
   // First we have to make sure the current user's cert store is available.
   CrosLibrary::Get()->GetCertLibrary()->LoadKeyStore();
   // Now we can continue reading the private key.
-  DeviceSettingsService::Get()->SetUsername(current_state_->username);
+  DeviceSettingsService::Get()->SetUsername(
+      current_state_->credentials.username);
   DeviceSettingsService::Get()->GetOwnershipStatusAsync(
       base::Bind(&ParallelAuthenticator::OnOwnershipChecked, this));
   return false;
 }
 
 void ParallelAuthenticator::OnOwnershipChecked(
     DeviceSettingsService::OwnershipStatus status,
     bool is_owner) {
   // Now we can check if this user is the owner.
   user_can_login_ = is_owner;
   owner_is_verified_ = true;
   Resolve();
 }
 
 void ParallelAuthenticator::RetryAuth(Profile* profile,
-                                      const std::string& username,
-                                      const std::string& password,
+                                      const UserCredentials& credentials,
                                       const std::string& login_token,
                                       const std::string& login_captcha) {
   reauth_state_.reset(
       new AuthAttemptState(
-          gaia::CanonicalizeEmail(username),
-          password,
-          HashPassword(password),
+          UserCredentials(gaia::CanonicalizeEmail(credentials.username),
+                          credentials.password,
+                          credentials.auth_code),
+          HashPassword(credentials.password),
           login_token,
           login_captcha,
           User::USER_TYPE_REGULAR,
           false /* not a new user */));
   // Always use ClientLogin regardless of using_oauth flag. This is because
   // we are unable to renew oauth token on lock screen currently and will
   // stuck with lock screen if we use OAuthLogin here.
   // TODO(xiyuan): Revisit this after we support Gaia in lock screen.
   current_online_.reset(new OnlineAttempt(reauth_state_.get(),
                                           this));
@@ skipping 91 matching lines @@
         BrowserThread::PostTask(
             BrowserThread::UI, FROM_HERE,
             base::Bind(&ParallelAuthenticator::OnLoginFailure, this,
                        login_failure));
         // Check if we couldn't verify OAuth token here.
         if (using_oauth_ &&
             login_failure.reason() == LoginFailure::NETWORK_AUTH_FAILED) {
           BrowserThread::PostTask(
               BrowserThread::UI, FROM_HERE,
               base::Bind(&ParallelAuthenticator::RecordOAuthCheckFailure, this,
-                         (reauth_state_.get() ? reauth_state_->username :
-                             current_state_->username)));
+                         (reauth_state_.get() ?
+                             reauth_state_->credentials.username :
+                             current_state_->credentials.username)));
         }
         break;
     }
     case HAVE_NEW_PW:
       migrate_attempted_ = true;
       BrowserThread::PostTask(
           BrowserThread::UI, FROM_HERE,
           base::Bind(&Migrate,
                      reauth_state_.get(),
                      scoped_refptr<ParallelAuthenticator>(this),
@@ skipping 250 matching lines @@
   Resolve();
 }
 
 void ParallelAuthenticator::SetOwnerState(bool owner_check_finished,
                                           bool check_result) {
   owner_is_verified_ = owner_check_finished;
   user_can_login_ = check_result;
 }
 
 }  // namespace chromeos