auth: Make luci-go services trust signatures produced by the token server.

server/auth/auth.go

 // Copyright 2015 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package auth
 
 import (
         "fmt"
         "net/http"
 
         "golang.org/x/net/context"
 
         "github.com/luci/luci-go/common/errors"
         "github.com/luci/luci-go/common/logging"
 
-        "github.com/luci/luci-go/server/auth/authdb"
         "github.com/luci/luci-go/server/auth/delegation"
         "github.com/luci/luci-go/server/auth/identity"
         "github.com/luci/luci-go/server/auth/signing"
 )
 
 var (
         // ErrNotConfigured is returned by Authenticate if auth library wasn't
         // properly initialized (see SetConfig).
         ErrNotConfigured = errors.New("auth: the library is not properly configured")
 
@@ skipping 153 matching lines @@
         if delegationTok != "" {
                 // Need to grab our own identity to verify that the delegation token is
                 // minted for consumption by us and not some other service.
                 ownServiceIdentity, err := getOwnServiceIdentity(c, cfg.Signer)
                 if err != nil {
                         return nil, err
                 }
                 delegatedIdentity, err := delegation.CheckToken(c, delegation.CheckTokenParams{
                         Token:                delegationTok,
                         PeerID:               s.peerIdent,
-                        CertificatesProvider: certsProvider{s.db},
+                        CertificatesProvider: s.db,
                         GroupsChecker:        s.db,
                         OwnServiceIdentity:   ownServiceIdentity,
                 })
                 if err != nil {
                         return nil, err
                 }
                 // User profile information is not available when using delegation, so just
                 // wipe it.
                 s.user = &User{Identity: delegatedIdentity}
         }
@@ skipping 26 matching lines @@
 // then redirects the user to the URL specified by dest.
 func (a Authenticator) LogoutURL(c context.Context, dest string) (string, error) {
         if api := a.usersAPI(); api != nil {
                 return api.LogoutURL(c, dest)
         }
         return "", ErrNoUsersAPI
 }
 
 ////
 
-// certsProvider implements delegation.CertificatesProvider.
-type certsProvider struct {
-        db authdb.DB
-}
-
-func (p certsProvider) GetAuthServiceCertificates(c context.Context) (*signing.PublicCertificates, error) {
-        serviceURL, err := p.db.GetAuthServiceURL(c)
-        if err != nil {
-                return nil, err
-        }
-        return signing.FetchCertificatesFromLUCIService(c, serviceURL)
-}
-
 // getOwnServiceIdentity returns 'service:<appID>' identity of the current
 // service.
 func getOwnServiceIdentity(c context.Context, signer signing.Signer) (identity.Identity, error) {
         if signer == nil {
                 return "", ErrNotConfigured
         }
         serviceInfo, err := signer.ServiceInfo(c)
         if err != nil {
                 return "", err
         }
         return identity.MakeIdentity("service:" + serviceInfo.AppID)
 }