OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/chromeos/policy/policy_oauth2_token_fetcher.h" | 5 #include "chrome/browser/chromeos/policy/policy_oauth2_token_fetcher.h" |
6 | 6 |
7 #include <memory> | |
8 #include <vector> | 7 #include <vector> |
9 | 8 |
10 #include "base/bind.h" | 9 #include "base/bind.h" |
11 #include "base/logging.h" | 10 #include "base/logging.h" |
12 #include "base/memory/weak_ptr.h" | |
13 #include "base/strings/string_util.h" | 11 #include "base/strings/string_util.h" |
14 #include "content/public/browser/browser_thread.h" | 12 #include "content/public/browser/browser_thread.h" |
15 #include "google_apis/gaia/gaia_auth_fetcher.h" | 13 #include "google_apis/gaia/gaia_auth_fetcher.h" |
16 #include "google_apis/gaia/gaia_constants.h" | 14 #include "google_apis/gaia/gaia_constants.h" |
17 #include "google_apis/gaia/gaia_urls.h" | 15 #include "google_apis/gaia/gaia_urls.h" |
18 #include "google_apis/gaia/google_service_auth_error.h" | 16 #include "google_apis/gaia/google_service_auth_error.h" |
19 #include "google_apis/gaia/oauth2_access_token_fetcher_impl.h" | 17 #include "google_apis/gaia/oauth2_access_token_fetcher_impl.h" |
20 #include "net/url_request/url_request_context_getter.h" | 18 #include "net/url_request/url_request_context_getter.h" |
21 | 19 |
22 using content::BrowserThread; | 20 using content::BrowserThread; |
23 | 21 |
24 namespace policy { | 22 namespace policy { |
25 | 23 |
26 namespace { | 24 namespace { |
27 | 25 |
28 // If true, fake policy tokens will be sent instead of making network requests. | |
29 bool use_fake_tokens_for_testing_ = false; | |
30 | |
31 // Max retry count for token fetching requests. | 26 // Max retry count for token fetching requests. |
32 const int kMaxRequestAttemptCount = 5; | 27 const int kMaxRequestAttemptCount = 5; |
33 | 28 |
34 // OAuth token request retry delay in milliseconds. | 29 // OAuth token request retry delay in milliseconds. |
35 const int kRequestRestartDelay = 3000; | 30 const int kRequestRestartDelay = 3000; |
36 | 31 |
37 class PolicyOAuth2TokenFetcherImpl : public PolicyOAuth2TokenFetcher, | 32 } // namespace |
38 public GaiaAuthConsumer, | |
39 public OAuth2AccessTokenConsumer { | |
40 public: | |
41 PolicyOAuth2TokenFetcherImpl(); | |
42 ~PolicyOAuth2TokenFetcherImpl() override; | |
43 | 33 |
44 private: | 34 PolicyOAuth2TokenFetcher::PolicyOAuth2TokenFetcher() { |
45 // PolicyOAuth2TokenFetcher overrides. | 35 } |
46 void StartWithSigninContext( | |
47 net::URLRequestContextGetter* auth_context_getter, | |
48 net::URLRequestContextGetter* system_context_getter, | |
49 const TokenCallback& callback) override; | |
50 void StartWithAuthCode(const std::string& auth_code, | |
51 net::URLRequestContextGetter* system_context_getter, | |
52 const TokenCallback& callback) override; | |
53 void StartWithRefreshToken( | |
54 const std::string& oauth2_refresh_token, | |
55 net::URLRequestContextGetter* system_context_getter, | |
56 const TokenCallback& callback) override; | |
57 | 36 |
58 // Returns true if we have previously attempted to fetch tokens with this | 37 PolicyOAuth2TokenFetcher::~PolicyOAuth2TokenFetcher() { |
59 // class and failed. | 38 } |
60 bool Failed() const override { return failed_; } | |
61 | 39 |
62 const std::string& OAuth2RefreshToken() const override { | 40 void PolicyOAuth2TokenFetcher::StartWithSigninContext( |
63 return oauth2_refresh_token_; | |
64 } | |
65 const std::string& OAuth2AccessToken() const override { | |
66 return oauth2_access_token_; | |
67 } | |
68 | |
69 // GaiaAuthConsumer overrides. | |
70 void OnClientOAuthSuccess( | |
71 const GaiaAuthConsumer::ClientOAuthResult& oauth_tokens) override; | |
72 void OnClientOAuthFailure(const GoogleServiceAuthError& error) override; | |
73 | |
74 // OAuth2AccessTokenConsumer overrides. | |
75 void OnGetTokenSuccess(const std::string& access_token, | |
76 const base::Time& expiration_time) override; | |
77 void OnGetTokenFailure(const GoogleServiceAuthError& error) override; | |
78 | |
79 // Starts fetching OAuth2 refresh token. | |
80 void StartFetchingRefreshToken(); | |
81 | |
82 // Starts fetching OAuth2 access token for the device management service. | |
83 void StartFetchingAccessToken(); | |
84 | |
85 // Decides how to proceed on GAIA |error|. If the error looks temporary, | |
86 // retries |task| until max retry count is reached. | |
87 // If retry count runs out, or error condition is unrecoverable, it calls | |
88 // Delegate::OnOAuth2TokenFetchFailed(). | |
89 void RetryOnError(const GoogleServiceAuthError& error, | |
90 const base::Closure& task); | |
91 | |
92 // Passes |token| and |error| to the |callback_|. | |
93 void ForwardPolicyToken(const std::string& token, | |
94 const GoogleServiceAuthError& error); | |
95 | |
96 // Auth code which is used to retreive a refresh token. | |
97 std::string auth_code_; | |
98 | |
99 scoped_refptr<net::URLRequestContextGetter> auth_context_getter_; | |
100 scoped_refptr<net::URLRequestContextGetter> system_context_getter_; | |
101 std::unique_ptr<GaiaAuthFetcher> refresh_token_fetcher_; | |
102 std::unique_ptr<OAuth2AccessTokenFetcher> access_token_fetcher_; | |
103 | |
104 // OAuth2 refresh token. Could come either from the outside or through | |
105 // refresh token fetching flow within this class. | |
106 std::string oauth2_refresh_token_; | |
107 | |
108 // OAuth2 access token. | |
109 std::string oauth2_access_token_; | |
110 | |
111 // The retry counter. Increment this only when failure happened. | |
112 int retry_count_ = 0; | |
113 | |
114 // True if we have already failed to fetch the policy. | |
115 bool failed_ = false; | |
116 | |
117 // The callback to invoke when done. | |
118 TokenCallback callback_; | |
119 | |
120 base::WeakPtrFactory<PolicyOAuth2TokenFetcherImpl> weak_ptr_factory_; | |
121 | |
122 DISALLOW_COPY_AND_ASSIGN(PolicyOAuth2TokenFetcherImpl); | |
123 }; | |
124 | |
125 PolicyOAuth2TokenFetcherImpl::PolicyOAuth2TokenFetcherImpl() | |
126 : weak_ptr_factory_(this) {} | |
127 | |
128 PolicyOAuth2TokenFetcherImpl::~PolicyOAuth2TokenFetcherImpl() {} | |
129 | |
130 void PolicyOAuth2TokenFetcherImpl::StartWithSigninContext( | |
131 net::URLRequestContextGetter* auth_context_getter, | 41 net::URLRequestContextGetter* auth_context_getter, |
132 net::URLRequestContextGetter* system_context_getter, | 42 net::URLRequestContextGetter* system_context_getter, |
133 const TokenCallback& callback) { | 43 const TokenCallback& callback) { |
134 DCHECK(!refresh_token_fetcher_ && !access_token_fetcher_); | 44 DCHECK(!refresh_token_fetcher_ && !access_token_fetcher_); |
135 | 45 |
136 auth_context_getter_ = auth_context_getter; | 46 auth_context_getter_ = auth_context_getter; |
137 system_context_getter_ = system_context_getter; | 47 system_context_getter_ = system_context_getter; |
138 callback_ = callback; | 48 callback_ = callback; |
139 StartFetchingRefreshToken(); | 49 StartFetchingRefreshToken(); |
140 } | 50 } |
141 | 51 |
142 void PolicyOAuth2TokenFetcherImpl::StartWithAuthCode( | 52 void PolicyOAuth2TokenFetcher::StartWithAuthCode( |
143 const std::string& auth_code, | 53 const std::string& auth_code, |
144 net::URLRequestContextGetter* system_context_getter, | 54 net::URLRequestContextGetter* system_context_getter, |
145 const TokenCallback& callback) { | 55 const TokenCallback& callback) { |
146 DCHECK(!refresh_token_fetcher_ && !access_token_fetcher_); | 56 DCHECK(!refresh_token_fetcher_ && !access_token_fetcher_); |
147 | 57 |
148 auth_code_ = auth_code; | 58 auth_code_ = auth_code; |
149 system_context_getter_ = system_context_getter; | 59 system_context_getter_ = system_context_getter; |
150 callback_ = callback; | 60 callback_ = callback; |
151 StartFetchingRefreshToken(); | 61 StartFetchingRefreshToken(); |
152 } | 62 } |
153 | 63 |
154 void PolicyOAuth2TokenFetcherImpl::StartWithRefreshToken( | 64 void PolicyOAuth2TokenFetcher::StartWithRefreshToken( |
155 const std::string& oauth2_refresh_token, | 65 const std::string& oauth2_refresh_token, |
156 net::URLRequestContextGetter* system_context_getter, | 66 net::URLRequestContextGetter* system_context_getter, |
157 const TokenCallback& callback) { | 67 const TokenCallback& callback) { |
158 DCHECK(!refresh_token_fetcher_ && !access_token_fetcher_); | 68 DCHECK(!refresh_token_fetcher_ && !access_token_fetcher_); |
159 | 69 |
160 oauth2_refresh_token_ = oauth2_refresh_token; | 70 oauth2_refresh_token_ = oauth2_refresh_token; |
161 system_context_getter_ = system_context_getter; | 71 system_context_getter_ = system_context_getter; |
162 callback_ = callback; | 72 callback_ = callback; |
163 StartFetchingAccessToken(); | 73 StartFetchingAccessToken(); |
164 } | 74 } |
165 | 75 |
166 void PolicyOAuth2TokenFetcherImpl::StartFetchingRefreshToken() { | 76 void PolicyOAuth2TokenFetcher::StartFetchingRefreshToken() { |
167 if (auth_code_.empty()) { | 77 if (auth_code_.empty()) { |
168 refresh_token_fetcher_.reset(new GaiaAuthFetcher( | 78 refresh_token_fetcher_.reset(new GaiaAuthFetcher( |
169 this, GaiaConstants::kChromeSource, auth_context_getter_.get())); | 79 this, GaiaConstants::kChromeSource, auth_context_getter_.get())); |
170 refresh_token_fetcher_->StartCookieForOAuthLoginTokenExchange( | 80 refresh_token_fetcher_->StartCookieForOAuthLoginTokenExchange( |
171 std::string()); | 81 std::string()); |
172 } else { | 82 } else { |
173 refresh_token_fetcher_.reset(new GaiaAuthFetcher( | 83 refresh_token_fetcher_.reset(new GaiaAuthFetcher( |
174 this, GaiaConstants::kChromeSource, system_context_getter_.get())); | 84 this, GaiaConstants::kChromeSource, system_context_getter_.get())); |
175 refresh_token_fetcher_->StartAuthCodeForOAuth2TokenExchange(auth_code_); | 85 refresh_token_fetcher_->StartAuthCodeForOAuth2TokenExchange(auth_code_); |
176 } | 86 } |
177 } | 87 } |
178 | 88 |
179 void PolicyOAuth2TokenFetcherImpl::StartFetchingAccessToken() { | 89 void PolicyOAuth2TokenFetcher::StartFetchingAccessToken() { |
180 std::vector<std::string> scopes; | 90 std::vector<std::string> scopes; |
181 scopes.push_back(GaiaConstants::kDeviceManagementServiceOAuth); | 91 scopes.push_back(GaiaConstants::kDeviceManagementServiceOAuth); |
182 scopes.push_back(GaiaConstants::kOAuthWrapBridgeUserInfoScope); | 92 scopes.push_back(GaiaConstants::kOAuthWrapBridgeUserInfoScope); |
183 access_token_fetcher_.reset( | 93 access_token_fetcher_.reset( |
184 new OAuth2AccessTokenFetcherImpl(this, | 94 new OAuth2AccessTokenFetcherImpl(this, |
185 system_context_getter_.get(), | 95 system_context_getter_.get(), |
186 oauth2_refresh_token_)); | 96 oauth2_refresh_token_)); |
187 access_token_fetcher_->Start( | 97 access_token_fetcher_->Start( |
188 GaiaUrls::GetInstance()->oauth2_chrome_client_id(), | 98 GaiaUrls::GetInstance()->oauth2_chrome_client_id(), |
189 GaiaUrls::GetInstance()->oauth2_chrome_client_secret(), | 99 GaiaUrls::GetInstance()->oauth2_chrome_client_secret(), |
190 scopes); | 100 scopes); |
191 } | 101 } |
192 | 102 |
193 void PolicyOAuth2TokenFetcherImpl::OnClientOAuthSuccess( | 103 void PolicyOAuth2TokenFetcher::OnClientOAuthSuccess( |
194 const GaiaAuthConsumer::ClientOAuthResult& oauth2_tokens) { | 104 const GaiaAuthConsumer::ClientOAuthResult& oauth2_tokens) { |
195 VLOG(1) << "OAuth2 tokens for policy fetching succeeded."; | 105 VLOG(1) << "OAuth2 tokens for policy fetching succeeded."; |
196 oauth2_refresh_token_ = oauth2_tokens.refresh_token; | 106 oauth2_refresh_token_ = oauth2_tokens.refresh_token; |
197 retry_count_ = 0; | 107 retry_count_ = 0; |
198 StartFetchingAccessToken(); | 108 StartFetchingAccessToken(); |
199 } | 109 } |
200 | 110 |
201 void PolicyOAuth2TokenFetcherImpl::OnClientOAuthFailure( | 111 void PolicyOAuth2TokenFetcher::OnClientOAuthFailure( |
202 const GoogleServiceAuthError& error) { | 112 const GoogleServiceAuthError& error) { |
203 VLOG(1) << "OAuth2 tokens fetch for policy fetch failed! (error = " | 113 VLOG(1) << "OAuth2 tokens fetch for policy fetch failed! (error = " |
204 << error.state() << ")"; | 114 << error.state() << ")"; |
205 RetryOnError( | 115 RetryOnError(error, |
206 error, | 116 base::Bind(&PolicyOAuth2TokenFetcher::StartFetchingRefreshToken, |
207 base::Bind(&PolicyOAuth2TokenFetcherImpl::StartFetchingRefreshToken, | 117 AsWeakPtr())); |
208 weak_ptr_factory_.GetWeakPtr())); | |
209 } | 118 } |
210 | 119 |
211 void PolicyOAuth2TokenFetcherImpl::OnGetTokenSuccess( | 120 void PolicyOAuth2TokenFetcher::OnGetTokenSuccess( |
212 const std::string& access_token, | 121 const std::string& access_token, |
213 const base::Time& expiration_time) { | 122 const base::Time& expiration_time) { |
214 VLOG(1) << "OAuth2 access token (device management) fetching succeeded."; | 123 VLOG(1) << "OAuth2 access token (device management) fetching succeeded."; |
215 oauth2_access_token_ = access_token; | 124 oauth2_access_token_ = access_token; |
216 ForwardPolicyToken(access_token, | 125 ForwardPolicyToken(access_token, |
217 GoogleServiceAuthError(GoogleServiceAuthError::NONE)); | 126 GoogleServiceAuthError(GoogleServiceAuthError::NONE)); |
218 } | 127 } |
219 | 128 |
220 void PolicyOAuth2TokenFetcherImpl::OnGetTokenFailure( | 129 void PolicyOAuth2TokenFetcher::OnGetTokenFailure( |
221 const GoogleServiceAuthError& error) { | 130 const GoogleServiceAuthError& error) { |
222 LOG(ERROR) << "OAuth2 access token (device management) fetching failed!"; | 131 LOG(ERROR) << "OAuth2 access token (device management) fetching failed!"; |
223 RetryOnError( | 132 RetryOnError(error, |
224 error, base::Bind(&PolicyOAuth2TokenFetcherImpl::StartFetchingAccessToken, | 133 base::Bind(&PolicyOAuth2TokenFetcher::StartFetchingAccessToken, |
225 weak_ptr_factory_.GetWeakPtr())); | 134 AsWeakPtr())); |
226 } | 135 } |
227 | 136 |
228 void PolicyOAuth2TokenFetcherImpl::RetryOnError( | 137 void PolicyOAuth2TokenFetcher::RetryOnError(const GoogleServiceAuthError& error, |
229 const GoogleServiceAuthError& error, | 138 const base::Closure& task) { |
230 const base::Closure& task) { | |
231 DCHECK_CURRENTLY_ON(BrowserThread::UI); | 139 DCHECK_CURRENTLY_ON(BrowserThread::UI); |
232 if (error.IsTransientError() && retry_count_ < kMaxRequestAttemptCount) { | 140 if (error.IsTransientError() && retry_count_ < kMaxRequestAttemptCount) { |
233 retry_count_++; | 141 retry_count_++; |
234 BrowserThread::PostDelayedTask( | 142 BrowserThread::PostDelayedTask( |
235 BrowserThread::UI, FROM_HERE, task, | 143 BrowserThread::UI, FROM_HERE, task, |
236 base::TimeDelta::FromMilliseconds(kRequestRestartDelay)); | 144 base::TimeDelta::FromMilliseconds(kRequestRestartDelay)); |
237 return; | 145 return; |
238 } | 146 } |
239 LOG(ERROR) << "Unrecoverable error or retry count max reached."; | 147 LOG(ERROR) << "Unrecoverable error or retry count max reached."; |
240 failed_ = true; | 148 failed_ = true; |
241 // Invoking the |callback_| signals to the owner of this object that it has | 149 // Invoking the |callback_| signals to the owner of this object that it has |
242 // completed, and the owner may delete this object on the callback method. | 150 // completed, and the owner may delete this object on the callback method. |
243 // So don't rely on |this| still being valid after ForwardPolicyToken() | 151 // So don't rely on |this| still being valid after ForwardPolicyToken() |
244 // returns i.e. don't write to |failed_| or other fields. | 152 // returns i.e. don't write to |failed_| or other fields. |
245 ForwardPolicyToken(std::string(), error); | 153 ForwardPolicyToken(std::string(), error); |
246 } | 154 } |
247 | 155 |
248 void PolicyOAuth2TokenFetcherImpl::ForwardPolicyToken( | 156 void PolicyOAuth2TokenFetcher::ForwardPolicyToken( |
249 const std::string& token, | 157 const std::string& token, |
250 const GoogleServiceAuthError& error) { | 158 const GoogleServiceAuthError& error) { |
251 if (!callback_.is_null()) | 159 if (!callback_.is_null()) |
252 callback_.Run(token, error); | 160 callback_.Run(token, error); |
253 } | 161 } |
254 | 162 |
255 // Fake token fetcher that immediately returns tokens without making network | |
256 // requests. | |
257 class PolicyOAuth2TokenFetcherFake : public PolicyOAuth2TokenFetcher { | |
258 public: | |
259 PolicyOAuth2TokenFetcherFake() {} | |
260 ~PolicyOAuth2TokenFetcherFake() override {} | |
261 | |
262 private: | |
263 // PolicyOAuth2TokenFetcher overrides. | |
264 void StartWithSigninContext( | |
265 net::URLRequestContextGetter* auth_context_getter, | |
266 net::URLRequestContextGetter* system_context_getter, | |
267 const TokenCallback& callback) override { | |
268 ForwardPolicyToken(callback); | |
269 } | |
270 | |
271 void StartWithAuthCode(const std::string& auth_code, | |
272 net::URLRequestContextGetter* system_context_getter, | |
273 const TokenCallback& callback) override { | |
274 ForwardPolicyToken(callback); | |
275 } | |
276 | |
277 void StartWithRefreshToken( | |
278 const std::string& oauth2_refresh_token, | |
279 net::URLRequestContextGetter* system_context_getter, | |
280 const TokenCallback& callback) override { | |
281 ForwardPolicyToken(callback); | |
282 } | |
283 | |
284 bool Failed() const override { return false; } | |
285 const std::string& OAuth2RefreshToken() const override { | |
286 return refresh_token_; | |
287 } | |
288 const std::string& OAuth2AccessToken() const override { | |
289 return access_token_; | |
290 } | |
291 | |
292 private: | |
293 void ForwardPolicyToken(const TokenCallback& callback) { | |
294 if (!callback.is_null()) | |
295 callback.Run(access_token_, GoogleServiceAuthError::AuthErrorNone()); | |
296 } | |
297 | |
298 const std::string refresh_token_ = "fake_refresh_token"; | |
299 const std::string access_token_ = "fake_access_token"; | |
300 | |
301 DISALLOW_COPY_AND_ASSIGN(PolicyOAuth2TokenFetcherFake); | |
302 }; | |
303 | |
304 } // namespace | |
305 | |
306 // static | |
307 void PolicyOAuth2TokenFetcher::UseFakeTokensForTesting() { | |
308 use_fake_tokens_for_testing_ = true; | |
309 } | |
310 | |
311 // static | |
312 PolicyOAuth2TokenFetcher* PolicyOAuth2TokenFetcher::CreateInstance() { | |
313 if (use_fake_tokens_for_testing_) | |
314 return new PolicyOAuth2TokenFetcherFake(); | |
315 return new PolicyOAuth2TokenFetcherImpl(); | |
316 } | |
317 | |
318 PolicyOAuth2TokenFetcher::PolicyOAuth2TokenFetcher() {} | |
319 | |
320 PolicyOAuth2TokenFetcher::~PolicyOAuth2TokenFetcher() {} | |
321 | |
322 } // namespace policy | 163 } // namespace policy |
OLD | NEW |