third_party_auth_config.cc 4.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145
  1. // Copyright 2015 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "remoting/host/third_party_auth_config.h"
  5. #include "base/logging.h"
  6. #include "base/values.h"
  7. #include "build/build_config.h"
  8. #include "components/policy/policy_constants.h"
  9. namespace remoting {
  10. namespace {
  11. bool ParseUrlPolicy(const std::string& str, GURL* out) {
  12. if (str.empty()) {
  13. *out = GURL();
  14. return true;
  15. }
  16. GURL gurl(str);
  17. if (!gurl.is_valid()) {
  18. LOG(ERROR) << "Not a valid URL: " << str;
  19. return false;
  20. }
  21. // We validate https-vs-http only on Release builds to help with manual testing.
  22. #if defined(NDEBUG)
  23. if (!gurl.SchemeIsCryptographic()) {
  24. LOG(ERROR) << "Not a secure URL: " << str;
  25. return false;
  26. }
  27. #endif
  28. *out = gurl;
  29. return true;
  30. }
  31. } // namespace
  32. bool ThirdPartyAuthConfig::ParseStrings(
  33. const std::string& token_url,
  34. const std::string& token_validation_url,
  35. const std::string& token_validation_cert_issuer,
  36. ThirdPartyAuthConfig* result) {
  37. ThirdPartyAuthConfig tmp;
  38. // Extract raw values for the 3 individual fields.
  39. bool urls_valid = true;
  40. urls_valid &= ParseUrlPolicy(token_url, &tmp.token_url);
  41. urls_valid &= ParseUrlPolicy(token_validation_url, &tmp.token_validation_url);
  42. if (!urls_valid) {
  43. return false;
  44. }
  45. tmp.token_validation_cert_issuer = token_validation_cert_issuer;
  46. // Validate inter-dependencies between the 3 fields.
  47. if (tmp.token_url.is_empty() ^ tmp.token_validation_url.is_empty()) {
  48. LOG(ERROR) << "TokenUrl and TokenValidationUrl "
  49. << "have to be specified together.";
  50. return false;
  51. }
  52. if (!tmp.token_validation_cert_issuer.empty() && tmp.token_url.is_empty()) {
  53. LOG(ERROR) << "TokenValidationCertificateIssuer cannot be used "
  54. << "without TokenUrl and TokenValidationUrl.";
  55. return false;
  56. }
  57. *result = tmp;
  58. return true;
  59. }
  60. namespace {
  61. #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS) && !BUILDFLAG(IS_IOS)
  62. void ExtractHelper(const base::DictionaryValue& policy_dict,
  63. const std::string& policy_name,
  64. bool* policy_present,
  65. std::string* policy_value) {
  66. DCHECK(policy_value);
  67. if (const std::string* value = policy_dict.FindStringKey(policy_name)) {
  68. *policy_value = *value;
  69. *policy_present = true;
  70. } else {
  71. policy_value->clear();
  72. }
  73. }
  74. #endif
  75. } // namespace
  76. bool ThirdPartyAuthConfig::ExtractStrings(
  77. const base::DictionaryValue& policy_dict,
  78. std::string* token_url,
  79. std::string* token_validation_url,
  80. std::string* token_validation_cert_issuer) {
  81. bool policies_present = false;
  82. #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS) && !BUILDFLAG(IS_IOS)
  83. ExtractHelper(policy_dict, policy::key::kRemoteAccessHostTokenUrl,
  84. &policies_present, token_url);
  85. ExtractHelper(policy_dict, policy::key::kRemoteAccessHostTokenValidationUrl,
  86. &policies_present, token_validation_url);
  87. ExtractHelper(policy_dict,
  88. policy::key::kRemoteAccessHostTokenValidationCertificateIssuer,
  89. &policies_present, token_validation_cert_issuer);
  90. #endif
  91. return policies_present;
  92. }
  93. ThirdPartyAuthConfig::ParseStatus ThirdPartyAuthConfig::Parse(
  94. const base::DictionaryValue& policy_dict,
  95. ThirdPartyAuthConfig* result) {
  96. // Extract 3 individial policy values.
  97. std::string token_url;
  98. std::string token_validation_url;
  99. std::string token_validation_cert_issuer;
  100. if (!ThirdPartyAuthConfig::ExtractStrings(policy_dict, &token_url,
  101. &token_validation_url,
  102. &token_validation_cert_issuer)) {
  103. return NoPolicy;
  104. }
  105. // Parse the policy value.
  106. if (!ThirdPartyAuthConfig::ParseStrings(token_url, token_validation_url,
  107. token_validation_cert_issuer,
  108. result)) {
  109. return InvalidPolicy;
  110. }
  111. return ParsingSuccess;
  112. }
  113. std::ostream& operator<<(std::ostream& os, const ThirdPartyAuthConfig& cfg) {
  114. if (cfg.is_null()) {
  115. os << "<no 3rd party auth config specified>";
  116. } else {
  117. os << "TokenUrl = <" << cfg.token_url << ">, ";
  118. os << "TokenValidationUrl = <" << cfg.token_validation_url << ">, ";
  119. os << "TokenValidationCertificateIssuer = <"
  120. << cfg.token_validation_cert_issuer << ">";
  121. }
  122. return os;
  123. }
  124. } // namespace remoting