Merge lp:~cjwatson/canonical-identity-provider/openid-macaroon-discharge-v1 into lp:canonical-identity-provider/release

[Colin Watson]

Switch the OpenID discharge macaroon protocol over to the new caveat-only mechanism and v1 caveat IDs.

Switch the OpenID discharge macaroon protocol over to the new caveat-only mechanism and v1 caveat IDs.

v0 caveat IDs should in fact still be accepted for the time being, but we won't support further features built on top of this branch such as human-readable descriptions with them, and we only test the new format.

I didn't bother keeping the older OpenID macaroon protocol around, because AFAIK it has no users yet other than my WIP changes to Launchpad.

The Launchpad side of this is in https://code.launchpad.net/~cjwatson/launchpad/login-discharge-macaroon/+merge/294355.

[Ricardo Kirkner (ricardokirkner)]

Much nicer. Thanks!

review: Approve

=== modified file 'src/api/v20/tests/test_handlers.py'
--- src/api/v20/tests/test_handlers.py	2016-05-05 20:58:23 +0000
+++ src/api/v20/tests/test_handlers.py	2016-05-11 17:42:55 +0000
@@ -2169,7 +2169,11 @@
         self.login_failed_calls = []
         login_failed.connect(self.track_failed_logins, dispatch_uid=self.id())
 
-        self.root_macaroon, self.macaroon_random_key, _ = self.build_macaroon()
+        # XXX cjwatson 2016-05-11:
+        # MacaroonRefreshHandlerTestCase.test_macaroon_refreshed needs to be
+        # fixed before changing the version here.
+        self.root_macaroon, self.macaroon_random_key, _ = self.build_macaroon(
+            version=0)
         self.data = dict(
             email='[e-mail]', password='foobar123',
             macaroon=self.root_macaroon.serialize())
@@ -2344,7 +2348,8 @@
                                  check_login_failed=False)
 
     def test_root_macaroon_not_for_sso(self):
-        macaroon, _, _ = self.build_macaroon(service_location="other service")
+        macaroon, _, _ = self.build_macaroon(
+            service_location="other service", version=1)
         data = dict(email='[e-mail]', password='foobar123',
                     macaroon=macaroon.serialize())
         self.assert_failed_login('INVALID_CREDENTIALS', data,
@@ -2360,7 +2365,8 @@
 
     def test_multiple_macaroons(self):
         # build *several* macaroons and send them all at once
-        roots, rkeys, _ = zip(*[self.build_macaroon() for _ in range(3)])
+        roots, rkeys, _ = zip(*[
+            self.build_macaroon(version=1) for _ in range(3)])
         ids = range(3)
         roots = dict(zip(ids, roots))
         rkeys = dict(zip(ids, rkeys))
@@ -2384,7 +2390,7 @@
 
     def test_multiple_mixed(self):
         bad_macaroon, _, _ = self.build_macaroon(
-            service_location="other service")
+            service_location="other service", version=1)
         data = dict(email='[e-mail]', password='foobar123', macaroons=[
             ('good', self.root_macaroon.serialize()),
             ('bad', bad_macaroon.serialize()),
@@ -2518,7 +2524,8 @@
                                  check_login_failed=False)
 
     def test_macaroon_bad_authinfo(self):
-        macaroon, _, _ = self.build_macaroon(service_location="other service")
+        macaroon, _, _ = self.build_macaroon(
+            service_location="other service", version=1)
         data = dict(root_macaroon=macaroon.serialize(),
                     discharge_macaroon=self.discharge_macaroon.serialize())
         self.assert_failed_login('INVALID_CREDENTIALS', data,
 
=== modified file 'src/identityprovider/forms.py'
--- src/identityprovider/forms.py	2016-05-03 12:21:13 +0000
+++ src/identityprovider/forms.py	2016-05-11 17:42:55 +0000
@@ -574,12 +574,13 @@
 class MacaroonRequestForm(Form):
     """A form object for user control over requesting discharge macaroons."""
 
-    def __init__(self, request, macaroon_request, rpconfig,
+    def __init__(self, request, macaroon_request, rpconfig, trust_root,
                  approved_data=None):
         self.request = request
         self.macaroon_request = macaroon_request
-        self.root_macaroon = self.macaroon_request.root_macaroon
+        self.caveat_id = self.macaroon_request.caveat_id
         self.rpconfig = rpconfig
+        self.trust_root = trust_root
         self.approved_data = approved_data
         self.data = self._get_data_for_user()
         super(MacaroonRequestForm, self).__init__(self.data)
@@ -590,14 +591,18 @@
     def _get_data_for_user(self):
         """Data to ask about in the form."""
         data = {}
-        if self.root_macaroon:
-            data['macaroon'] = self.root_macaroon
+        if self.caveat_id:
+            data['macaroon'] = self.caveat_id
         return data
 
     def _init_fields(self, data):
         """Initialise fields from the discharge macaroon request."""
-        for location, root_macaroon in data.iteritems():
-            label = 'Service authorization for %s' % root_macaroon.location
+        for location, caveat_id in data.iteritems():
+            if self.rpconfig:
+                rp_displayname = self.rpconfig.displayname
+            else:
+                rp_displayname = self.trust_root
+            label = 'Service authorization for %s' % rp_displayname
             self.fields[location] = fields.BooleanField(
                 label=label, widget=forms.CheckboxInput(
                     check_test=self.check_test(location)))
 
=== modified file 'src/identityprovider/macaroon.py'
--- src/identityprovider/macaroon.py	2016-04-05 22:12:47 +0000
+++ src/identityprovider/macaroon.py	2016-05-11 17:42:55 +0000
@@ -19,8 +19,9 @@
 
     It must be set to: http://ns.login.ubuntu.com/2016/openid-macaroon
 
-  openid.macaroon.root
-    The serialised root macaroon that the RP wants to discharge.
+  openid.macaroon.caveat_id
+    The SSO third-party caveat ID from the root macaroon that the RP wants
+    to discharge.
 
 As part of the positive assertion OpenID response, the following fields
 will be provided:
@@ -38,7 +39,6 @@
     NamespaceAliasRegistrationError,
     registerNamespaceAlias,
 )
-from pymacaroons import Macaroon
 
 from identityprovider.const import MACAROON_NS
 
@@ -101,26 +101,22 @@
 class MacaroonRequest(Extension):
     """An object to hold the state of a discharge macaroon request.
 
-    @ivar root_macaroon_raw: The serialised root macaroon to discharge.
-    @type root_macaroon_raw: str
+    @ivar caveat_id: The SSO third-party caveat ID from the root macaroon
+        that the RP wants to discharge.
+    @type caveat_id: str
 
-    @group Consumer: requestField, requestMacaroon, getExtensionArgs,
-                     addToOpenIDRequest
+    @group Consumer: requestField, getExtensionArgs, addToOpenIDRequest
     @group Server: fromOpenIDRequest, parseExtensionArgs
     """
 
     ns_alias = 'macaroon'
 
-    def __init__(self, root_macaroon_raw=None, macaroon_ns_uri=MACAROON_NS):
+    def __init__(self, caveat_id=None, macaroon_ns_uri=MACAROON_NS):
         """Initialize an empty discharge macaroon request."""
         Extension.__init__(self)
-        self.root_macaroon_raw = root_macaroon_raw
-        self.root_macaroon = None
+        self.caveat_id = caveat_id
         self.ns_uri = macaroon_ns_uri
 
-        if root_macaroon_raw:
-            self.requestMacaroon(root_macaroon_raw)
-
     @classmethod
     def fromOpenIDRequest(cls, request):
         """Create a discharge macaroon request that contains the fields that
@@ -166,17 +162,7 @@
 
         @returns: None; updates this object
         """
-        self.root_macaroon_raw = args.get('root')
-        if self.root_macaroon_raw:
-            self.requestMacaroon(self.root_macaroon_raw)
-
-    def requestMacaroon(self, root_macaroon_raw):
-        """Request a discharge macaroon.
-
-        @param root_macaroon_raw: The serialised root macaroon to discharge.
-        @type root_macaroon_raw: str
-        """
-        self.root_macaroon = Macaroon.deserialize(root_macaroon_raw)
+        self.caveat_id = args.get('caveat_id')
 
     def getExtensionArgs(self):
         """Get a dictionary of unqualified macaroon request parameters
@@ -189,8 +175,8 @@
         """
         args = {}
 
-        if self.root_macaroon_raw:
-            args['root'] = self.root_macaroon_raw
+        if self.caveat_id:
+            args['caveat_id'] = self.caveat_id
 
         return args
 
 
=== modified file 'src/identityprovider/tests/test_auth.py'
--- src/identityprovider/tests/test_auth.py	2016-05-05 20:58:23 +0000
+++ src/identityprovider/tests/test_auth.py	2016-05-11 17:42:55 +0000
@@ -968,14 +968,16 @@
 
     def setUp(self):
         super(BuildMacaroonFromRootDischargeTestCase, self).setUp()
-        self.root_macaroon, self.macaroon_random_key, _ = self.build_macaroon()
+        self.root_macaroon, self.macaroon_random_key, _ = self.build_macaroon(
+            version=0)
 
     def test_root_macaroon_corrupt(self):
         self.assertRaises(ValidationError, build_discharge_macaroon_from_root,
                           "fake account", "I'm a seriously corrupted macaroon")
 
     def test_root_macaroon_not_for_sso(self):
-        macaroon, _, _ = self.build_macaroon(service_location="other service")
+        macaroon, _, _ = self.build_macaroon(
+            service_location="other service", version=0)
         self.assertRaises(AuthenticationError,
                           build_discharge_macaroon_from_root,
                           "fake account", macaroon.serialize())
@@ -1043,18 +1045,18 @@
                           "fake account", "I'm a seriously corrupted caveatid")
 
     def test_caveat_id_not_for_sso(self):
-        macaroon, _, _ = self.build_macaroon(service_location="other service")
-        (sso_caveat,) = [c for c in macaroon.third_party_caveats()
-                         if c.location == "other service"]
+        macaroon, _, _ = self.build_macaroon(
+            service_location="other service", version=1)
+        sso_caveat = self.get_sso_caveat(
+            macaroon, service_location="other service")
 
         self.assertRaises(ValidationError, build_discharge_macaroon,
                           "fake account", sso_caveat)
 
     def test_proper_discharging(self):
         # build the input and call
-        root_macaroon, _, random_key = self.build_macaroon()
-        (sso_caveat,) = [c for c in root_macaroon.third_party_caveats()
-                         if c.location == settings.MACAROON_SERVICE_LOCATION]
+        root_macaroon, _, random_key = self.build_macaroon(version=1)
+        sso_caveat = self.get_sso_caveat(root_macaroon)
 
         real_account = self.factory.make_account()
         before = now()
@@ -1177,7 +1179,8 @@
 
     def setUp(self):
         super(MacaroonRefreshFromRootTestCase, self).setUp()
-        self.root_macaroon, self.macaroon_random_key, _ = self.build_macaroon()
+        self.root_macaroon, self.macaroon_random_key, _ = self.build_macaroon(
+            version=0)
 
         # discharge the test macaroon
         self.account = self.factory.make_account()
@@ -1196,7 +1199,7 @@
 
     def test_macaroons_dont_verify_ok(self):
         # just get *another* discharge so it's not for the same root macaroon
-        other_root, _, _ = self.build_macaroon()
+        other_root, _, _ = self.build_macaroon(version=0)
         other_discharge = build_discharge_macaroon_from_root(
             self.account, other_root.serialize())
         self.assertRaises(AuthenticationError, refresh_macaroons,
@@ -1297,7 +1300,7 @@
 
     def setUp(self):
         super(MacaroonRefreshTestCase, self).setUp()
-        root_macaroon, _, self.random_key = self.build_macaroon()
+        root_macaroon, _, self.random_key = self.build_macaroon(version=1)
         (caveat,) = [c for c in root_macaroon.third_party_caveats()
                      if c.location == settings.MACAROON_SERVICE_LOCATION]
 
 
=== modified file 'src/identityprovider/tests/test_forms.py'
--- src/identityprovider/tests/test_forms.py	2016-05-05 11:39:43 +0000
+++ src/identityprovider/tests/test_forms.py	2016-05-11 17:42:55 +0000
@@ -45,7 +45,6 @@
     UserAttribsRequestForm,
     tos_error,
 )
-from identityprovider.macaroon import MacaroonRequest
 from identityprovider.models import Account, AccountPassword, OpenIDRPConfig
 from identityprovider.models.const import AccountStatus, EmailStatus
 from identityprovider.tests import DEFAULT_USER_PASSWORD
@@ -1131,71 +1130,71 @@
     def setUp(self):
         super(MacaroonRequestFormTestCase, self).setUp()
         self.account = self.factory.make_account()
+        self.trust_root = 'http://localhost/'
         self.rpconfig = OpenIDRPConfig.objects.create(
-            trust_root='http://localhost/', description="Some description")
+            trust_root=self.trust_root, description="Some description")
 
     def test_field_for_trusted_site(self):
         """The server always returns discharge macaroons to trusted sites,
         regardless of the state of the checkbox in the UI.
         """
-        root_macaroon, _, _ = self.build_macaroon()
-        macaroon_request = MacaroonRequest(root_macaroon.serialize())
+        macaroon_request = self.build_macaroon_request()
         form = MacaroonRequestForm(
             request=self._get_request_with_post_args(),
-            macaroon_request=macaroon_request, rpconfig=self.rpconfig)
+            macaroon_request=macaroon_request, rpconfig=self.rpconfig,
+            trust_root=self.trust_root)
         self.assertIn('macaroon', form.data_approved_for_request)
 
     def test_checked_field_for_untrusted_site(self):
         """The server returns discharge macaroons to untrusted sites when
         the user checks the checkbox in the UI.
         """
-        root_macaroon, _, _ = self.build_macaroon()
-        macaroon_request = MacaroonRequest(root_macaroon.serialize())
+        macaroon_request = self.build_macaroon_request()
         form = MacaroonRequestForm(
             request=self._get_request_with_post_args(macaroon='macaroon'),
-            macaroon_request=macaroon_request, rpconfig=None)
+            macaroon_request=macaroon_request, rpconfig=None,
+            trust_root=self.trust_root)
         self.assertIn('macaroon', form.data_approved_for_request)
 
     def test_unchecked_field_for_untrusted_site(self):
         """The server does not return discharge macaroons to untrusted sites
         when the user does not check the checkbox in the UI.
         """
-        root_macaroon, _, _ = self.build_macaroon()
-        macaroon_request = MacaroonRequest(root_macaroon.serialize())
+        macaroon_request = self.build_macaroon_request()
         form = MacaroonRequestForm(
             request=self._get_request_with_post_args(),
-            macaroon_request=macaroon_request, rpconfig=None)
+            macaroon_request=macaroon_request, rpconfig=None,
+            trust_root=self.trust_root)
         self.assertNotIn('macaroon', form.data_approved_for_request)
 
     def test_checkbox_status_for_trusted_site(self):
         """Checkboxes are always checked if the site is trusted."""
-        root_macaroon, _, _ = self.build_macaroon()
-        macaroon_request = MacaroonRequest(root_macaroon.serialize())
+        macaroon_request = self.build_macaroon_request()
         form = MacaroonRequestForm(
             request=self._get_request_with_post_args(),
-            macaroon_request=macaroon_request, rpconfig=self.rpconfig)
+            macaroon_request=macaroon_request, rpconfig=self.rpconfig,
+            trust_root=self.trust_root)
         self.assertTrue(form.check_test('macaroon')(True))
 
     def test_checkbox_status_for_untrusted_site(self):
         """Checkboxes are checked by default if the site is untrusted."""
-        root_macaroon, _, _ = self.build_macaroon()
-        macaroon_request = MacaroonRequest(root_macaroon.serialize())
+        macaroon_request = self.build_macaroon_request()
         form = MacaroonRequestForm(
             request=self._get_request_with_post_args(),
-            macaroon_request=macaroon_request, rpconfig=None)
+            macaroon_request=macaroon_request, rpconfig=None,
+            trust_root=self.trust_root)
         self.assertTrue(form.check_test('macaroon')(True))
 
     def test_checkbox_status_for_untrusted_site_with_approved_data(self):
         """Checkboxes respect user preferences on untrusted sites where
         available.
         """
-        root_macaroon, _, _ = self.build_macaroon()
-        macaroon_request = MacaroonRequest(root_macaroon.serialize())
+        macaroon_request = self.build_macaroon_request()
         approved_data = {
             'requested': ['macaroon'],
             'approved': []}
         form = MacaroonRequestForm(
             request=self._get_request_with_post_args(),
             macaroon_request=macaroon_request, rpconfig=None,
-            approved_data=approved_data)
+            trust_root=self.trust_root, approved_data=approved_data)
         self.assertFalse(form.check_test('macaroon')(True))
 
=== modified file 'src/identityprovider/tests/test_macaroon.py'
--- src/identityprovider/tests/test_macaroon.py	2016-05-05 11:39:43 +0000
+++ src/identityprovider/tests/test_macaroon.py	2016-05-11 17:42:55 +0000
@@ -45,19 +45,17 @@
     def setUp(self):
         super(MacaroonRequestTestCase, self).setUp()
 
-        self.root_macaroon, self.macaroon_random_key, _ = self.build_macaroon()
-        self.req = MacaroonRequest(self.root_macaroon.serialize())
-
-    def assertMacaroonsEqual(self, expected, observed):
-        self.assertEqual(expected.serialize(), observed.serialize())
+        root_macaroon, _, _ = self.build_macaroon(version=1)
+        sso_caveat = self.get_sso_caveat(root_macaroon)
+        self.caveat_id = sso_caveat.caveat_id
+        self.req = MacaroonRequest(self.caveat_id)
 
     def test_init(self):
         req = MacaroonRequest()
-        self.assertIsNone(req.root_macaroon_raw)
-        self.assertIsNone(req.root_macaroon)
+        self.assertIsNone(req.caveat_id)
         self.assertEqual(MACAROON_NS, req.ns_uri)
 
-        self.assertMacaroonsEqual(self.root_macaroon, self.req.root_macaroon)
+        self.assertEqual(self.caveat_id, self.req.caveat_id)
 
     def test_fromOpenIDRequest(self):
         params = {'openid.mode': 'checkid_setup',
@@ -68,8 +66,7 @@
         openid_server = server._get_openid_server(request)
         orequest = openid_server.decodeRequest(params)
         req = MacaroonRequest.fromOpenIDRequest(orequest)
-        self.assertIsNone(req.root_macaroon_raw)
-        self.assertIsNone(req.root_macaroon)
+        self.assertIsNone(req.caveat_id)
         self.assertEqual(MACAROON_NS, req.ns_uri)
 
     def test_fromOpenIDRequest_with_root(self):
@@ -77,22 +74,21 @@
                   'openid.trust_root': 'http://localhost/',
                   'openid.return_to': 'http://localhost/',
                   'openid.identity': IDENTIFIER_SELECT,
-                  'openid.macaroon.root': self.root_macaroon.serialize()}
+                  'openid.macaroon.caveat_id': self.caveat_id}
         request = self.factory.make_request(**params)
         openid_server = server._get_openid_server(request)
         orequest = openid_server.decodeRequest(params)
         req = MacaroonRequest.fromOpenIDRequest(orequest)
-        self.assertMacaroonsEqual(self.root_macaroon, req.root_macaroon)
+        self.assertEqual(self.caveat_id, req.caveat_id)
         self.assertEqual(MACAROON_NS, req.ns_uri)
 
     def test_parseExtensionArgs(self):
         req = MacaroonRequest()
-        req.parseExtensionArgs(
-            {'root': self.root_macaroon.serialize()})
-        self.assertMacaroonsEqual(self.root_macaroon, req.root_macaroon)
+        req.parseExtensionArgs({'caveat_id': self.caveat_id})
+        self.assertEqual(self.caveat_id, req.caveat_id)
 
     def test_getExtensionArgs(self):
-        expected = {'root': self.root_macaroon.serialize()}
+        expected = {'caveat_id': self.caveat_id}
         self.assertEqual(expected, self.req.getExtensionArgs())
 
     def test_getExtensionArgs_no_root(self):
 
=== modified file 'src/identityprovider/tests/test_views_server.py'
--- src/identityprovider/tests/test_views_server.py	2016-05-10 00:44:27 +0000
+++ src/identityprovider/tests/test_views_server.py	2016-05-11 17:42:55 +0000
@@ -227,7 +227,7 @@
         self._test_auto_auth(sreg=['fullname'])
 
     def test_handle_user_response_auto_auth_discharge_macaroon(self):
-        root_macaroon, macaroon_random_key, _ = self.build_macaroon()
+        root_macaroon, macaroon_random_key, _ = self.build_macaroon(version=1)
         # Add padding to force a POST after signing.  We don't know exactly
         # how long the serialized discharge macaroon will be yet, but it
         # will probably be at least 1024 bytes.
@@ -290,9 +290,10 @@
                                   for k, v in expected_values.iteritems()
                                   if k not in sreg or v is None]
         if root_macaroon and macaroon_key:
+            sso_caveat = self.get_sso_caveat(root_macaroon)
             self.params.update({
                 'openid.ns.macaroon': MACAROON_NS,
-                'openid.macaroon.root': root_macaroon.serialize(),
+                'openid.macaroon.caveat_id': sso_caveat.caveat_id,
             })
             unexpected_fields.remove('openid.macaroon.discharge')
         response = self.client.post(self.url, self.params)
@@ -314,6 +315,8 @@
             verifier.satisfy_general(lambda caveat: True)
             discharge_macaroon = Macaroon.deserialize(
                 forms[0].fields['openid.macaroon.discharge'])
+            discharge_macaroon = root_macaroon.prepare_for_request(
+                discharge_macaroon)
             self.assertRaises(
                 MacaroonUnmetCaveatException, verifier.verify,
                 root_macaroon, macaroon_key, [])
@@ -1066,10 +1069,11 @@
         # make sure rpconfig is set to auto authorize
         OpenIDRPConfig.objects.create(
             trust_root='http://localhost/', auto_authorize=True)
-        root_macaroon, macaroon_random_key, _ = self.build_macaroon()
+        root_macaroon, macaroon_random_key, _ = self.build_macaroon(version=1)
+        sso_caveat = self.get_sso_caveat(root_macaroon)
         param_overrides = {
             'openid.ns.macaroon': MACAROON_NS,
-            'openid.macaroon.root': root_macaroon.serialize(),
+            'openid.macaroon.caveat_id': sso_caveat.caveat_id,
         }
         self._prepare_openid_token(param_overrides=param_overrides)
         response = self.client.post(self.url)
@@ -1086,14 +1090,17 @@
         self.assertRaises(
             MacaroonUnmetCaveatException, verifier.verify,
             root_macaroon, macaroon_random_key, [])
+        discharge_macaroon = root_macaroon.prepare_for_request(
+            discharge_macaroon)
         self.assertTrue(verifier.verify(
             root_macaroon, macaroon_random_key, [discharge_macaroon]))
 
     def test_state_of_checkboxes_and_data_formats_macaroon(self):
-        root_macaroon, _, _ = self.build_macaroon()
+        root_macaroon, _, _ = self.build_macaroon(version=1)
+        sso_caveat = self.get_sso_caveat(root_macaroon)
         param_overrides = {
             'openid.ns.macaroon': MACAROON_NS,
-            'openid.macaroon.root': root_macaroon.serialize(),
+            'openid.macaroon.caveat_id': sso_caveat.caveat_id,
         }
         self._prepare_openid_token(param_overrides=param_overrides)
         response = self.client.post(self.url)
@@ -1101,7 +1108,7 @@
         # This field is checked regardless of whether a site is trusted.
         self._test_optional_trusted_field(
             dom, field='macaroon',
-            value='Service authorization for The store ;)')
+            value='Service authorization for http://localhost/')
 
 
 class DecideUserUnverifiedTestCase(DecideBaseTestCase):
@@ -1865,9 +1872,10 @@
         if with_teams:
             params['openid.lp.query_membership'] = 'ubuntu-team'
         if with_macaroon:
-            root_macaroon, _, _ = self.build_macaroon()
+            root_macaroon, _, _ = self.build_macaroon(version=1)
+            sso_caveat = self.get_sso_caveat(root_macaroon)
             params['openid.ns.macaroon'] = MACAROON_NS
-            params['openid.macaroon.root'] = root_macaroon.serialize()
+            params['openid.macaroon.caveat_id'] = sso_caveat.caveat_id
         provider_url = get_provider_url(request)
         openid_server = server._get_openid_server(provider_url)
         return openid_server.decodeRequest(params)
 
=== modified file 'src/identityprovider/tests/utils.py'
--- src/identityprovider/tests/utils.py	2016-05-10 16:12:20 +0000
+++ src/identityprovider/tests/utils.py	2016-05-11 17:42:55 +0000
@@ -33,6 +33,7 @@
 # import signals to ensure all the handlers are connected and tests use the
 # same logic as prod systems
 from identityprovider import signed, signals  # noqa
+from identityprovider.macaroon import MacaroonRequest
 from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.factory import SSOObjectFactory
 from identityprovider.utils import generate_random_string
@@ -181,7 +182,7 @@
         self.addCleanup(p.disable)
         return test_rsa_priv_key, test_rsa_pub_key
 
-    def build_macaroon(self, service_location=None):
+    def build_macaroon(self, service_location=None, version=1):
         if service_location is None:
             service_location = settings.MACAROON_SERVICE_LOCATION
         test_rsa_priv_key, test_rsa_pub_key = self.setup_key_pair()
@@ -194,16 +195,37 @@
             identifier='A test macaroon',
         )
         random_key = binascii.hexlify(os.urandom(32))
-        info = {
-            'roothash': macaroon_random_key,
-            '3rdparty': random_key,
-        }
-        info_encrypted = base64.b64encode(
-            test_rsa_pub_key.encrypt(json.dumps(info), 32)[0])
+        if version == 0:
+            info = {
+                'roothash': macaroon_random_key,
+                '3rdparty': random_key,
+            }
+            payload = base64.b64encode(
+                test_rsa_pub_key.encrypt(json.dumps(info), 32)[0])
+        else:
+            payload = json.dumps({
+                'version': 1,
+                'secret': base64.b64encode(
+                    test_rsa_pub_key.encrypt(random_key, 32)[0]),
+            })
         root_macaroon.add_third_party_caveat(
-            service_location, random_key, info_encrypted)
+            service_location, random_key, payload)
         return root_macaroon, macaroon_random_key, random_key
 
+    def get_sso_caveat(self, macaroon, service_location=None):
+        """Extract the SSO caveat from a macaroon."""
+        if service_location is None:
+            service_location = settings.MACAROON_SERVICE_LOCATION
+        (sso_caveat,) = [c for c in macaroon.third_party_caveats()
+                         if c.location == service_location]
+        return sso_caveat
+
+    def build_macaroon_request(self):
+        """Build a macaroon and a MacaroonRequest to discharge it."""
+        root_macaroon, _, _ = self.build_macaroon(version=1)
+        sso_caveat = self.get_sso_caveat(root_macaroon)
+        return MacaroonRequest(sso_caveat.caveat_id)
+
     def use_fixture(self, fixture):
         """Set up 'fixture' to be used with the current test.
 
 
=== modified file 'src/identityprovider/views/server.py'
--- src/identityprovider/views/server.py	2016-05-05 11:39:43 +0000
+++ src/identityprovider/views/server.py	2016-05-11 17:42:55 +0000
@@ -42,7 +42,7 @@
 from openid.yadis.constants import YADIS_HEADER_NAME
 
 from identityprovider import signed
-from identityprovider.auth import build_discharge_macaroon_from_root
+from identityprovider.auth import build_discharge_macaroon
 from identityprovider.const import (
     AX_DATA_FIELDS,
     MACAROON_NS,
@@ -321,7 +321,7 @@
     teams_form = TeamsRequestForm(request, teams_request, rpconfig,
                                   approved_data=approved_data.get('teams'))
     macaroon_form = MacaroonRequestForm(
-        request, macaroon_request, rpconfig,
+        request, macaroon_request, rpconfig, orequest.trust_root,
         approved_data=approved_data.get('macaroon'))
     context = {
         'account': request.user,
@@ -637,9 +637,10 @@
             'approved': teams_form.teams_approved_by_user}
 
     macaroon_args = orequest.message.getArgs(MACAROON_NS)
-    if macaroon_args.get('root'):
+    if macaroon_args.get('caveat_id'):
         macaroon_form = MacaroonRequestForm(
-            request, MacaroonRequest.fromOpenIDRequest(orequest), rpconfig)
+            request, MacaroonRequest.fromOpenIDRequest(orequest), rpconfig,
+            orequest.trust_root)
         approved_data['macaroon'] = {
             'requested': macaroon_form.data.keys(),
             'approved': macaroon_form.data_approved_for_request.keys()}
@@ -767,10 +768,11 @@
     """Add discharge macaroon if requested and approved."""
     macaroon_request = MacaroonRequest.fromOpenIDRequest(openid_request)
     rpconfig = utils.get_rpconfig(openid_request.trust_root)
-    form = MacaroonRequestForm(request, macaroon_request, rpconfig)
+    form = MacaroonRequestForm(
+        request, macaroon_request, rpconfig, openid_request.trust_root)
     if form.data_approved_for_request:
-        discharge_macaroon = build_discharge_macaroon_from_root(
-            request.user, macaroon_request.root_macaroon_raw)
+        discharge_macaroon = build_discharge_macaroon(
+            request.user, macaroon_request.caveat_id)
         macaroon_response = MacaroonResponse.extractResponse(
             macaroon_request, discharge_macaroon.serialize())
         openid_response.addExtension(macaroon_response)
 
=== modified file 'src/webui/views/consumer.py'
--- src/webui/views/consumer.py	2016-04-11 08:57:57 +0000
+++ src/webui/views/consumer.py	2016-05-11 17:42:55 +0000
@@ -171,24 +171,13 @@
             auth_request.addExtension(teams_request_from_string(req_teams))
 
         if request.POST.get('macaroon', False):
-            macaroon_random_key = binascii.hexlify(os.urandom(32))
-            root_macaroon = Macaroon(
-                location='Test consumer',
-                key=macaroon_random_key,
-                identifier='A test macaroon',
-            )
             random_key = binascii.hexlify(os.urandom(32))
-            info = {
-                'roothash': macaroon_random_key,
-                '3rdparty': random_key,
-            }
             pubkey = settings.CRYPTO_SSO_PRIVKEY.publickey()
-            info_encrypted = base64.b64encode(
-                pubkey.encrypt(json.dumps(info), 32)[0])
-            root_macaroon.add_third_party_caveat(
-                settings.MACAROON_SERVICE_LOCATION, random_key, info_encrypted)
-            macaroon_request = macaroon.MacaroonRequest(
-                root_macaroon.serialize())
+            caveat_id = json.dumps({
+                'version': 1,
+                'secret': base64.b64encode(pubkey.encrypt(random_key, 32)[0]),
+            })
+            macaroon_request = macaroon.MacaroonRequest(caveat_id)
             auth_request.addExtension(macaroon_request)
 
         # Compute the trust root and return URL values to build the