| package main |
| |
| import ( |
| "crypto/rand" |
| "encoding/base64" |
| "fmt" |
| "html/template" |
| "net" |
| "net/http" |
| "os" |
| "os/exec" |
| |
| "veyron/services/identity/googleoauth" |
| "veyron2/vlog" |
| ) |
| |
| func getOAuthAuthorizationCodeFromGoogle(clientID string, blessing <-chan string) (<-chan string, error) { |
| // Setup an HTTP server so that OAuth authorization codes can be intercepted. |
| // Steps: |
| // 1. Generate a state token to be included in the HTTP request |
| // (though, arguably, the random port assignment for the HTTP server is |
| // enough for XSRF protecetion) |
| // 2. Setup an HTTP server which will intercept redirect links from the OAuth |
| // flow. |
| // 3. Print out the link for the user to click |
| // 4. Return the authorization code obtained from the redirect to the "result" |
| // channel. |
| var stateBuf [32]byte |
| if _, err := rand.Read(stateBuf[:]); err != nil { |
| return nil, fmt.Errorf("failed to generate state token for OAuth: %v", err) |
| } |
| state := base64.URLEncoding.EncodeToString(stateBuf[:]) |
| |
| ln, err := net.Listen("tcp", "127.0.0.1:0") |
| if err != nil { |
| return nil, fmt.Errorf("failed to setup OAuth authorization code interception: %v", err) |
| } |
| redirectURL := fmt.Sprintf("http://%s", ln.Addr()) |
| result := make(chan string, 1) |
| result <- redirectURL |
| http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { |
| w.Header().Set("Content-Type", "text/html") |
| tmplArgs := struct { |
| Blessing, ErrShort, ErrLong string |
| }{} |
| defer func() { |
| if len(tmplArgs.ErrShort) > 0 { |
| w.WriteHeader(http.StatusBadRequest) |
| } |
| if err := tmpl.Execute(w, tmplArgs); err != nil { |
| vlog.Info("Failed to render template:", err) |
| } |
| }() |
| if urlstate := r.FormValue("state"); urlstate != state { |
| tmplArgs.ErrShort = "Unexpected request" |
| tmplArgs.ErrLong = "Mismatched state parameter. Possible cross-site-request-forging?" |
| return |
| } |
| code := r.FormValue("code") |
| if len(code) == 0 { |
| tmplArgs.ErrShort = "No authorization code received" |
| tmplArgs.ErrLong = "Expected Google to issue an authorization code using 'code' as a URL parameter in the redirect" |
| return |
| } |
| ln.Close() // No need for the HTTP server anymore |
| result <- code |
| blessed, ok := <-blessing |
| defer close(result) |
| if !ok { |
| tmplArgs.ErrShort = "No blessing received" |
| tmplArgs.ErrLong = "Unable to obtain blessing from the Veyron service" |
| return |
| } |
| tmplArgs.Blessing = blessed |
| return |
| }) |
| go http.Serve(ln, nil) |
| |
| // Print out the link to start the OAuth flow (to STDERR so that STDOUT output contains |
| // only the final blessing) and try to open it in the browser as well. |
| // |
| // TODO(ashankar): Detect devices with limited I/O and then decide to use the device flow |
| // instead? See: https://developers.google.com/accounts/docs/OAuth2#device |
| url := googleoauth.NewOAuthConfig(clientID, "", redirectURL).AuthCodeURL(state) |
| fmt.Fprintln(os.Stderr, "Please visit the following URL to authenticate with Google:") |
| fmt.Fprintln(os.Stderr, url) |
| // Make an attempt to start the browser as a convenience. |
| // If it fails, doesn't matter - the client can see the URL printed above. |
| // Use exec.Command().Start instead of exec.Command().Run since there is no |
| // need to wait for the command to return (and indeed on some window managers, |
| // the command will not exit until the browser is closed). |
| exec.Command(openCommand, url).Start() |
| return result, nil |
| } |
| |
| var tmpl = template.Must(template.New("name").Parse(`<!doctype html> |
| <html> |
| <head> |
| <meta charset="UTF-8"> |
| <title>Veyron Identity: Google</title> |
| <meta name="viewport" content="width=device-width, initial-scale=1.0"> |
| <link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.2.0/css/bootstrap.min.css"> |
| {{if .Blessing}} |
| <!--Attempt to close the window. Though this script does not work on many browser configurations--> |
| <script type="text/javascript">window.close();</script> |
| {{end}} |
| </head> |
| <body> |
| <div class="container"> |
| {{if .ErrShort}} |
| <h1><span class="label label-danger">error</span>{{.ErrShort}}</h1> |
| <div class="well">{{.ErrLong}}</div> |
| {{else}} |
| <h3>Received blessing: <tt>{{.Blessing}}</tt></h3> |
| <div class="well">If the name is prefixed with "unknown/", ignore that. You can close this window, the command line tool has retrieved the blessing</div> |
| {{end}} |
| </div> |
| </body> |
| </html>`)) |
