Merge lp:~dobey/ubuntuone-credentials/signon-plugin-part2 into lp:ubuntuone-credentials

[dobey]

Final pieces for switching to the new signon plug-in.

[lp:~dobey/ubuntuone-credentials/signon-plugin-part2]

260. By dobey on 2016-06-07

Restore ABI compat.

261. By dobey on 2016-06-10

Restore some of the removed code to reduce diff size and use storeToken hack.

262. By dobey on 2016-06-13

Try to store the credentials a different way.

263. By dobey on 2016-06-16

Hopefully store the token correctly now too.

264. By dobey on 2016-06-16

Must use 'unsigned int' in symbols file for quint32.

265. By dobey on 2016-06-16

The login() call should never emit credentialsNotFound.
Don't emit an error in existingCredentialsId if there is no account.

266. By dobey on 2016-06-17

Refactor so createSession/process are called after identity is stored.
Fix invalidateCredentials to actually invalidate the credentials.

267. By dobey on 2016-06-17

Emit tokenNotFound immediately if no account is found.

268. By dobey on 2016-06-20

Need to depend on signond, since apparently nothing else does.

269. By dobey on 2016-06-20

Try to handle process() calls better.
Fix a few small typos.

270. By dobey on 2016-06-21

Set the m_invalidate flag properly.

271. By dobey on 2016-06-21

Refactor token clearing to separate method.
Handle existing secret separately from invalidation request.

Unmerged revisions

271. By dobey on 2016-06-21

Refactor token clearing to separate method.
Handle existing secret separately from invalidation request.

270. By dobey on 2016-06-21

Set the m_invalidate flag properly.

269. By dobey on 2016-06-20

Try to handle process() calls better.
Fix a few small typos.

268. By dobey on 2016-06-20

Need to depend on signond, since apparently nothing else does.

267. By dobey on 2016-06-17

Emit tokenNotFound immediately if no account is found.

266. By dobey on 2016-06-17

Refactor so createSession/process are called after identity is stored.
Fix invalidateCredentials to actually invalidate the credentials.

265. By dobey on 2016-06-16

The login() call should never emit credentialsNotFound.
Don't emit an error in existingCredentialsId if there is no account.

264. By dobey on 2016-06-16

Must use 'unsigned int' in symbols file for quint32.

263. By dobey on 2016-06-16

Hopefully store the token correctly now too.

262. By dobey on 2016-06-13

Try to store the credentials a different way.

=== modified file 'data/ubuntuone.provider'
--- data/ubuntuone.provider	2016-04-19 15:04:15 +0000
+++ data/ubuntuone.provider	2016-06-07 18:42:38 +0000
@@ -8,8 +8,8 @@
 
   <template>
     <group name="auth">
-      <setting name="method">password</setting>
-      <setting name="mechanism">password</setting>
+      <setting name="method">ubuntuone</setting>
+      <setting name="mechanism">ubuntuone</setting>
     </group>
   </template>
 </provider>

=== modified file 'debian/control'
--- debian/control	2016-04-27 14:07:35 +0000
+++ debian/control	2016-06-07 18:42:38 +0000
@@ -76,7 +76,7 @@
  ${misc:Pre-Depends},
 Depends:
  account-plugin-tools,
- signon-plugin-password,
+ signon-plugin-ubuntuone (= ${source:Version}),
  sqlite3,
  ubuntuone-credentials-common (= ${source:Version}),
  ${misc:Depends},

=== modified file 'libubuntuoneauth/CMakeLists.txt'
--- libubuntuoneauth/CMakeLists.txt	2016-04-21 09:25:58 +0000
+++ libubuntuoneauth/CMakeLists.txt	2016-06-07 18:42:38 +0000
@@ -13,6 +13,10 @@
   SET (LIB_TYPE STATIC)
 ENDIF (BUILD_STATIC_LIBS)
 
+# Some slots are deprecated; disable warnings on deprecations, because
+# moc-generated files are using these methods
+SET (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-deprecated-declarations")
+
 # The sources for building the library
 FILE (GLOB SOURCES *.cpp)
 # HEADERS only includes the public headers for installation.

=== added file 'libubuntuoneauth/authenticator.cpp'
--- libubuntuoneauth/authenticator.cpp	1970-01-01 00:00:00 +0000
+++ libubuntuoneauth/authenticator.cpp	2016-06-07 18:42:38 +0000
@@ -0,0 +1,174 @@
+/*
+ * Copyright 2016 Canonical Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of version 3 of the GNU Lesser General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "authenticator.h"
+#include "../signon-plugin/ubuntuonedata.h"
+
+#include <Accounts/Account>
+#include <Accounts/Service>
+#include <SignOn/AuthSession>
+#include <SignOn/Identity>
+#include <SignOn/IdentityInfo>
+
+#include <QDebug>
+
+using namespace Internal;
+using namespace UbuntuOne;
+
+Authenticator::Authenticator(Accounts::Manager *manager, QObject *parent):
+    QObject(parent),
+    m_manager(manager),
+    m_invalidate(false),
+    m_uiAllowed(true)
+{
+    if (!m_manager) {
+        m_manager = new Accounts::Manager(this);
+    }
+}
+
+void Authenticator::handleError(const SignOn::Error &e)
+{
+    qCritical() << "Authentication error:" << e.message();
+    Q_EMIT error(AuthenticationError, e.message());
+}
+
+void Authenticator::handleSessionData(const SignOn::SessionData &data)
+{
+    PluginData reply = data.data<PluginData>();
+
+    auto errorCode = PluginData::ErrorCode(reply.U1ErrorCode());
+    auto message = reply.U1ErrorMessage();
+    if (errorCode != PluginData::NoError) {
+        switch (errorCode) {
+        case PluginData::OneTimePasswordRequired:
+            qDebug() << "Error: OTP required";
+            Q_EMIT error(OneTimePasswordRequired, message);
+            break;
+        case PluginData::InvalidPassword:
+            qDebug() << "Error: invalid password";
+            Q_EMIT error(InvalidPassword, message);
+            break;
+        default:
+            qWarning() << "Unknown error:" << message;
+            Q_EMIT error(AuthenticationError, message);
+        }
+        return;
+    }
+
+    Token token(reply.TokenKey(), reply.TokenSecret(),
+                reply.ConsumerKey(), reply.ConsumerSecret(),
+                reply.DateCreated(), reply.DateUpdated());
+    Q_EMIT authenticated(token);
+}
+
+quint32 Authenticator::credentialsId()
+{
+    QString providerId("ubuntuone");
+    Accounts::AccountIdList accountIds = m_manager->accountList(providerId);
+
+    if (accountIds.isEmpty()) {
+        qDebug() << "authenticate(): No UbuntuOne accounts found";
+        Q_EMIT error(AccountNotFound, "");
+        return 0;
+    }
+
+    if (Q_UNLIKELY(accountIds.count() > 1)) {
+        qWarning() << "authenticate(): Found '" << accountIds.count() <<
+            "' accounts. Using first.";
+    }
+
+    qDebug() << "authenticate(): Using account '" << accountIds[0] << "'.";
+
+    auto account = m_manager->account(accountIds[0]);
+    if (Q_UNLIKELY(!account)) {
+        qDebug() << "Couldn't load account";
+        /* This could either happen because the account was deleted right while
+         * we were loading it, or because the accounts DB was locked by another
+         * app. Let's just return an authentication error here, so the client
+         * can retry.
+         */
+        Q_EMIT error(AuthenticationError, "");
+        return 0;
+    }
+
+    /* Here we should check that the account service is enabled; but since the
+     * old code was not doing this check, and that from the API there is no way
+     * of knowing which service we are interested in, let's leave it as a TODO.
+     */
+
+    return account->credentialsId();
+}
+
+void Authenticator::authenticate(const QString &tokenName,
+                                 const QString &userName,
+                                 const QString &password,
+                                 const QString &otp)
+{
+    SignOn::Identity *identity;
+    if (userName.isEmpty()) {
+        // Use existing account
+        quint32 id = credentialsId();
+        if (Q_UNLIKELY(!id)) return;
+
+        identity = SignOn::Identity::existingIdentity(id, this);
+        if (Q_UNLIKELY(!identity)) {
+            qCritical() << "authenticate(): unable to load credentials" << id;
+            Q_EMIT error(AccountNotFound, "");
+            return;
+        }
+    } else {
+        identity = SignOn::Identity::newIdentity(SignOn::IdentityInfo(), this);
+    }
+
+    auto session = identity->createSession(QStringLiteral("ubuntuone"));
+    if (Q_UNLIKELY(!session)) {
+        qCritical() << "Unable to create AuthSession.";
+        Q_EMIT error(AuthenticationError, "");
+        return;
+    }
+
+    connect(session, SIGNAL(response(const SignOn::SessionData&)),
+            this, SLOT(handleSessionData(const SignOn::SessionData&)));
+    connect(session, SIGNAL(error(const SignOn::Error&)),
+            this, SLOT(handleError(const SignOn::Error&)));
+
+    PluginData data;
+    data.setTokenName(tokenName);
+    data.setUserName(userName);
+    data.setSecret(password);
+    data.setOneTimePassword(otp);
+    int uiPolicy = m_uiAllowed ?
+        SignOn::DefaultPolicy : SignOn::NoUserInteractionPolicy;
+    data.setUiPolicy(uiPolicy);
+    if (m_invalidate) {
+        data.setInvalidateToken(true);
+        m_invalidate = false;
+    }
+
+    session->process(data, QStringLiteral("ubuntuone"));
+}
+
+void Authenticator::invalidateCredentials()
+{
+    m_invalidate = true;
+}
+
+void Authenticator::setUiAllowed(bool allowed)
+{
+    m_uiAllowed = allowed;
+}

=== added file 'libubuntuoneauth/authenticator.h'
--- libubuntuoneauth/authenticator.h	1970-01-01 00:00:00 +0000
+++ libubuntuoneauth/authenticator.h	2016-06-07 18:42:38 +0000
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2016 Canonical Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of version 3 of the GNU Lesser General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+#ifndef _U1_AUTHENTICATOR_H_
+#define _U1_AUTHENTICATOR_H_
+
+#include <Accounts/Manager>
+#include <SignOn/Identity>
+
+#include <QObject>
+
+#include "token.h"
+
+namespace Internal {
+
+class Authenticator : public QObject
+{
+    Q_OBJECT
+
+public:
+    enum ErrorCode {
+        NoError = 0,
+        AccountNotFound,
+        OneTimePasswordRequired,
+        InvalidPassword,
+        AuthenticationError, // will create more specific codes if needed
+    };
+
+    explicit Authenticator(Accounts::Manager *manager = 0, QObject *parent = 0);
+
+    void authenticate(const QString &tokenName,
+                      const QString &userName = QString(),
+                      const QString &password = QString(),
+                      const QString &otp = QString());
+    void invalidateCredentials();
+    void setUiAllowed(bool allowed);
+
+Q_SIGNALS:
+    void authenticated(const UbuntuOne::Token& token);
+    void error(Internal::Authenticator::ErrorCode code, const QString& message);
+
+private:
+    quint32 credentialsId();
+
+private Q_SLOTS:
+    void handleError(const SignOn::Error &error);
+    void handleSessionData(const SignOn::SessionData &data);
+
+private:
+    Accounts::Manager *m_manager;
+    bool m_invalidate;
+    bool m_uiAllowed;
+};
+
+} /* namespace */
+
+#endif /* _U1_AUTHENTICATOR_H_ */

=== modified file 'libubuntuoneauth/keyring.cpp'
--- libubuntuoneauth/keyring.cpp	2016-04-19 15:04:15 +0000
+++ libubuntuoneauth/keyring.cpp	2016-06-07 18:42:38 +0000
@@ -23,7 +23,9 @@
 
 #include <QDebug>
 
+#include "authenticator.h"
 #include "keyring.h"
+#include "../signon-plugin/ubuntuonedata.h"
 
 using namespace Accounts;
 using namespace SignOn;
@@ -38,166 +40,28 @@
         _account = nullptr;
     }
 
-    void Keyring::handleError(const SignOn::Error &error)
-    {
-        qCritical() << "Error:" << error.message();
-        emit keyringError(error.message());
-    }
-
-    void Keyring::handleSessionData(const SignOn::SessionData &data)
-    {
-        QString secret = data.Secret();
-
-        if (secret.length() == 0) {
-            QString msg("Could not read credentials secret value.");
-            qCritical() << msg;
-            emit keyringError(msg);
-            return;
-        }
-
-        Token *token = Token::fromQuery(secret);
-        if (token->isValid()) {
-            emit tokenFound(*token);
-        } else {
-            QString message("Failed to convert result to Token object.");
-            qCritical() << message;
-            emit keyringError(message);
-        }
-        delete token;
-    }
-
     void Keyring::findToken()
     {
-        QString _acctName("ubuntuone");
-        AccountIdList _ids = _manager.accountList(_acctName);
-        Identity *identity;
-        Account *account;
-
-        if (_ids.length() > 0) {
-            if (_ids.length() > 1) {
-                qDebug() << "findToken(): Found '" << _ids.length() << "' accounts. Using first.";
-            }
-            account = _manager.account(_ids[0]);
-            qDebug() << "findToken(): Using Ubuntu One account '" << _ids[0] << "'.";
-            identity = Identity::existingIdentity(account->credentialsId());
-            if (identity == NULL) {
-                qCritical() << "findToken(): disabled account " << _acctName << _ids[0];
-                emit tokenNotFound();
-                return;
-            }
-            AuthSession *session = identity->createSession(QStringLiteral("password"));
-            if (session != NULL) {
-                connect(session, SIGNAL(response(const SignOn::SessionData&)),
-                        this, SLOT(handleSessionData(const SignOn::SessionData&)));
-                connect(session, SIGNAL(error(const SignOn::Error&)),
-                        this, SLOT(handleError(const SignOn::Error&)));
-                session->process(SessionData(), QStringLiteral("password"));
-                return;
-            }
-            qCritical() << "Unable to create AuthSession.";
-        }
-        qDebug() << "findToken(): No accounts found matching " << _acctName;
-        emit tokenNotFound();
-    }
-
-    void Keyring::handleCredentialsStored(const quint32 id)
-    {
-        QString _acctName("ubuntuone");
-        AccountIdList _ids = _manager.accountList(_acctName);
-
-        _account->selectService();
-        _account->setCredentialsId(id);
-
-        for (auto service: _account->services()) {
-            _account->selectService(service);
-            _account->setEnabled(true);
-        }
-        _account->sync();
-        emit tokenStored();
-    }
-
-    void Keyring::storeToken(Token token)
-    {
-        storeToken(token, "");
-    }
-
-    void Keyring::storeToken(Token token, const QString& displayName)
-    {
-        QString _acctName("ubuntuone");
-        AccountIdList _ids = _manager.accountList(_acctName);
-        Identity *identity = NULL;
-
-        if (_ids.length() > 0) {
-            if (_ids.length() > 1) {
-                qDebug() << "storeToken(): Found '" << _ids.length() << "' accounts. Using first.";
-            }
-            _account = _manager.account(_ids[0]);
-            qDebug() << "storeToken(): Using Ubuntu One account '" << _ids[0] << "'.";
-        } else {
-            qDebug() << "in storeToken(): no accounts found in accountList, creating new";
-            _account = _manager.createAccount(_acctName);
-        }
-        _account->setEnabled(true);
-
-        if (!displayName.isEmpty()) {
-            _account->setDisplayName(displayName);
-        }
-
-        if(_account->credentialsId() == 0) {
-            qDebug() << "storeToken() : creating new Identity for account " << _account->id() ;
-            identity = Identity::newIdentity();
-        } else {
-            qDebug() << "storeToken(): identity found.";
-            identity = Identity::existingIdentity(_account->credentialsId());
-        }
-
-        Q_ASSERT(identity != NULL);
-
-        connect(identity, SIGNAL(error(const SignOn::Error&)),
-                this, SLOT(handleError(const SignOn::Error&)));
-        connect(identity, SIGNAL(credentialsStored(const quint32)),
-                this, SLOT(handleCredentialsStored(const quint32)));
-
-        IdentityInfo info = IdentityInfo();
-
-        info.setSecret(token.toQuery(), true);
-        info.setAccessControlList(QStringList() << "unconfined");
-        identity->storeCredentials(info);
-    }
-
-    void Keyring::handleAccountRemoved()
-    {
-        emit tokenDeleted();
-    }
-
-    void Keyring::handleDeleteError(const SignOn::Error &error)
-    {
-        // Just log the error here, as we don't want to infinite loop.
-        qWarning() << "Error deleting token:" << error.message();
-    }
-
-    void Keyring::deleteToken()
-    {
-        QString _acctName("ubuntuone");
-        AccountIdList _ids = _manager.accountList(_acctName);
-        if (_ids.length() > 0) {
-            if (_ids.length() > 1) {
-                qDebug() << "deleteToken(): Found '" << _ids.length() << "' accounts. Using first.";
-            }
-            Account *account = _manager.account(_ids[0]);
-            qDebug() << "deleteToken(): Using Ubuntu One account '" << _ids[0] << "'.";
-            Identity *identity = Identity::existingIdentity(account->credentialsId());
-            connect(account, SIGNAL(removed()),
-                    this, SLOT(handleAccountRemoved()));
-            connect(identity, SIGNAL(error(const SignOn::Error&)),
-                    this, SLOT(handleDeleteError(const SignOn::Error&)));
-
-            identity->remove();
-            account->remove();
-            account->sync();
-            return;
-        }
-        emit tokenNotFound();
+        using namespace Internal;
+
+        auto authenticator = new Authenticator(&_manager);
+        authenticator->setUiAllowed(false);
+
+        connect(authenticator, &Authenticator::authenticated,
+                [=](const Token &token) {
+            Q_EMIT tokenFound(token);
+            authenticator->deleteLater();
+        });
+        connect(authenticator, &Authenticator::error,
+                [=](Authenticator::ErrorCode code) {
+            if (code == Authenticator::AccountNotFound) {
+                Q_EMIT tokenNotFound();
+            } else {
+                Q_EMIT keyringError("Authentication failed");
+            }
+            authenticator->deleteLater();
+        });
+        authenticator->authenticate(Token::buildTokenName());
     }
 
 } // namespace UbuntuOne

=== modified file 'libubuntuoneauth/keyring.h'
--- libubuntuoneauth/keyring.h	2016-04-21 09:25:58 +0000
+++ libubuntuoneauth/keyring.h	2016-06-07 18:42:38 +0000
@@ -36,24 +36,24 @@
         explicit Keyring(QObject *parent=NULL);
 
         void findToken();
-        void storeToken(Token token);
-        void storeToken(Token token, const QString& displayName);
-        void deleteToken();
+        Q_DECL_DEPRECATED void storeToken(Token token);
+        Q_DECL_DEPRECATED void storeToken(Token token, const QString& displayName);
+        Q_DECL_DEPRECATED void deleteToken() {};
 
     Q_SIGNALS:
         void tokenFound(const Token& token);
         void tokenNotFound();
-        void tokenStored();
-        void tokenDeleted();
+        Q_DECL_DEPRECATED void tokenStored();
+        Q_DECL_DEPRECATED void tokenDeleted();
 
         void keyringError(QString message);
 
     private Q_SLOTS:
-        void handleError(const SignOn::Error &error);
-        void handleSessionData(const SignOn::SessionData &data);
-        void handleCredentialsStored(const quint32 id);
-        void handleAccountRemoved();
-        void handleDeleteError(const SignOn::Error &error);
+        Q_DECL_DEPRECATED void handleError(const SignOn::Error &error) {};
+        Q_DECL_DEPRECATED void handleSessionData(const SignOn::SessionData &data) {};
+        Q_DECL_DEPRECATED void handleCredentialsStored(const quint32 id) {};
+        Q_DECL_DEPRECATED void handleAccountRemoved() {};
+        Q_DECL_DEPRECATED void handleDeleteError(const SignOn::Error &error) {};
 
     private:
         Accounts::Manager _manager;

=== modified file 'libubuntuoneauth/libubuntuoneauth.symbols'
--- libubuntuoneauth/libubuntuoneauth.symbols	2013-07-22 15:54:02 +0000
+++ libubuntuoneauth/libubuntuoneauth.symbols	2016-06-07 18:42:38 +0000
@@ -1,7 +1,8 @@
 {
   global:
     extern "C++" {
-      *UbuntuOne::*;
+      UbuntuOne::*;
+      *for?UbuntuOne::*;
     };
     qt_*;
   local:

=== modified file 'libubuntuoneauth/ssoservice.cpp'
--- libubuntuoneauth/ssoservice.cpp	2016-04-19 15:04:15 +0000
+++ libubuntuoneauth/ssoservice.cpp	2016-06-07 18:42:38 +0000
@@ -22,6 +22,7 @@
 #include <QNetworkRequest>
 #include <QUrlQuery>
 
+#include "authenticator.h"
 #include "logging.h"
 #include "ssoservice.h"
 #include "requests.h"
@@ -45,27 +46,14 @@
 
         // create the keyring that will be used to store and retrieve the different tokens
         _keyring = new Keyring(this);
-        _nam = new QNetworkAccessManager(this);
-
         connect(_keyring, SIGNAL(tokenFound(const Token&)),
                 this, SLOT(handleCredentialsFound(const Token&)));
         connect(_keyring, SIGNAL(tokenNotFound()),
                 this, SLOT(handleCredentialsNotFound()));
 
-        connect(_keyring, SIGNAL(tokenStored()),
-                this, SLOT(handleTokenStored()));
-        connect(_keyring, SIGNAL(tokenDeleted()),
-                this, SLOT(handleTokenDeleted()));
-
         connect(_keyring, SIGNAL(keyringError(QString)),
                 this, SLOT(handleKeyringError(QString)));
 
-        connect(_nam, SIGNAL(finished(QNetworkReply*)),
-                this, SLOT(accountPinged(QNetworkReply*)));
-
-        connect(&(_provider),
-                SIGNAL(OAuthTokenGranted(const OAuthTokenResponse&)),
-                this, SLOT(tokenReceived(const OAuthTokenResponse&)));
         connect(&(_provider),
                 SIGNAL(AccountGranted(const AccountResponse&)),
                 this, SLOT(accountRegistered(const AccountResponse&)));
@@ -92,11 +80,6 @@
         emit credentialsFound(token);
     }
 
-    void SSOService::handleTokenStored()
-    {
-        emit credentialsStored(); 
-    }
-
     void SSOService::registerUser(QString email, QString password,
                                   QString display_name)
     {
@@ -116,12 +99,33 @@
 
     void SSOService::login(QString email, QString password, QString twoFactorCode)
     {
-        OAuthTokenRequest request(getAuthBaseUrl(),
-                                  email, password,
-                                  Token::buildTokenName(), twoFactorCode);
-        _tempEmail = email;
-
-        _provider.GetOAuthToken(request);
+        using namespace Internal;
+
+        auto authenticator = new Authenticator;
+        /* The caller of this API is assumed to have his own UI, so no support
+         * from SignOn UI is needed or even desired. */
+        authenticator->setUiAllowed(false);
+
+        connect(authenticator, &Authenticator::authenticated,
+                [=](const Token &token) {
+            Q_EMIT credentialsStored();
+            Q_EMIT credentialsFound(token);
+            authenticator->deleteLater();
+        });
+        connect(authenticator, &Authenticator::error,
+                [=](Authenticator::ErrorCode code, const QString& message) {
+            if (code == Authenticator::AccountNotFound) {
+                Q_EMIT credentialsNotFound();
+            } else if (code == Authenticator::OneTimePasswordRequired) {
+                Q_EMIT twoFactorAuthRequired();
+            } else {
+                /* TODO: deliver a proper error response. */
+                Q_EMIT requestFailed(ErrorResponse(400, "", "LOGIN_FAILED", message));
+            }
+            authenticator->deleteLater();
+        });
+        authenticator->authenticate(Token::buildTokenName(),
+                                    email, password, twoFactorCode);
     }
 
     void SSOService::handleTwoFactorAuthRequired()
@@ -145,14 +149,6 @@
         return baseUrl;
     }
 
-    void SSOService::tokenReceived(const OAuthTokenResponse& token)
-    {
-        Token realToken = Token(token.token_key(), token.token_secret(),
-                                token.consumer_key(), token.consumer_secret(),
-                                token.date_created(), token.date_updated());
-        _keyring->storeToken(realToken, _tempEmail);
-    }
-
     void SSOService::accountPinged(QNetworkReply*)
     {
         /* DEPRECATED */
@@ -160,7 +156,29 @@
 
     void SSOService::invalidateCredentials()
     {
-        _keyring->deleteToken();
+        using namespace Internal;
+
+        auto authenticator = new Authenticator;
+        /* The caller of this API is assumed to have his own UI, so no support
+         * from SignOn UI is needed or even desired. */
+        authenticator->setUiAllowed(false);
+
+        connect(authenticator, &Authenticator::authenticated,
+                [=](const Token &token) {
+            Q_EMIT credentialsFound(token);
+            authenticator->deleteLater();
+        });
+        connect(authenticator, &Authenticator::error,
+                [=](Authenticator::ErrorCode code, const QString& message) {
+            if (code == Authenticator::AccountNotFound) {
+                Q_EMIT credentialsNotFound();
+            } else {
+                /* TODO: deliver a proper error response. */
+                Q_EMIT requestFailed(ErrorResponse(400, "", "LOGIN_FAILED", message));
+            }
+            authenticator->deleteLater();
+        });
+        authenticator->invalidateCredentials();
     }
 
     void SSOService::errorOccurred(const ErrorResponse& error)

=== modified file 'libubuntuoneauth/ssoservice.h'
--- libubuntuoneauth/ssoservice.h	2016-04-21 09:25:58 +0000
+++ libubuntuoneauth/ssoservice.h	2016-06-07 18:42:38 +0000
@@ -57,11 +57,11 @@
 
         private slots:
             void accountPinged(QNetworkReply*);
-            void handleTokenStored();
-            void handleTokenDeleted() { emit credentialsDeleted(); };
+            Q_DECL_DEPRECATED void handleTokenStored() {};
+            Q_DECL_DEPRECATED void handleTokenDeleted() {};
             void handleCredentialsFound(const Token& token);
             void handleCredentialsNotFound();
-            void tokenReceived(const OAuthTokenResponse& token);
+            Q_DECL_DEPRECATED void tokenReceived(const OAuthTokenResponse& token) {};
             void accountRegistered(const AccountResponse& account);
             void errorOccurred(const ErrorResponse&);
             void handleTwoFactorAuthRequired();

=== modified file 'signon-plugin/tests/test_plugin.cpp'
--- signon-plugin/tests/test_plugin.cpp	2016-04-27 08:41:03 +0000
+++ signon-plugin/tests/test_plugin.cpp	2016-06-07 18:42:38 +0000
@@ -28,6 +28,7 @@
 
 #include <SignOn/uisessiondata_priv.h>
 
+#include "token.h"
 #include "ubuntuone-plugin.h"
 
 using namespace SignOn;
@@ -149,7 +150,6 @@
     void testPluginMechanisms();
     void testStoredToken_data();
     void testStoredToken();
-    void testUserInteraction();
     void testTokenCreation_data();
     void testTokenCreation();
 
@@ -222,7 +222,6 @@
 {
     QTest::addColumn<QVariantMap>("sessionData");
     QTest::addColumn<int>("expectedErrorCode");
-    QTest::addColumn<bool>("uiExpected");
     QTest::addColumn<QVariantMap>("expectedResponse");
     QTest::addColumn<QVariantMap>("expectedStore");
 
@@ -232,34 +231,65 @@
 
     QTest::newRow("empty") <<
         sessionData.toMap() <<
-        int(Error::MissingData) <<
-        false << QVariantMap() << QVariantMap();
-
-    sessionData.setTokenName("helloworld");
+        -1 <<
+        QVariantMap() << QVariantMap();
+
+    sessionData = UbuntuOne::PluginData();
+    QString tokenName = UbuntuOne::Token::buildTokenName();
+    sessionData.setStoredData(QVariantMap {
+        { tokenName, QVariantMap {
+            { "ConsumerKey", "ck" },
+            { "ConsumerSecret", "cs" },
+            { "TokenKey", "tk" },
+            { "TokenSecret", "ts" },
+        }},
+    });
+    response = UbuntuOne::PluginData();
+    response.setConsumerKey("ck");
+    response.setConsumerSecret("cs");
+    response.setTokenKey("tk");
+    response.setTokenSecret("ts");
+    response.setTokenName(tokenName);
+    stored = UbuntuOne::PluginData();
+    QTest::newRow("stored, valid") <<
+        sessionData.toMap() <<
+        -1 <<
+        response.toMap() << stored.toMap();
+
+    sessionData = UbuntuOne::PluginData();
+    sessionData.setStoredData(QVariantMap {
+        { tokenName, QVariantMap {
+            { "ConsumerKey", "ck" },
+            { "ConsumerSecret", "cs" },
+            { "TokenKey", "tk" },
+            { "TokenSecret", "ts" },
+        }},
+    });
+    sessionData.setInvalidateToken(true);
+    response = UbuntuOne::PluginData();
+    response.setTokenName(tokenName);
+    stored = UbuntuOne::PluginData();
+    QVariantMap storedData;
+    stored.setStoredData(storedData);
+    QTest::newRow("clearing token") <<
+        sessionData.toMap() <<
+        -1 <<
+        response.toMap() << stored.toMap();
+
+    sessionData = UbuntuOne::PluginData();
     sessionData.setSecret("consumer_key=aAa&consumer_secret=bBb&name=helloworld&token=cCc&token_secret=dDd");
-    response.setConsumerKey("aAa");
-    response.setConsumerSecret("bBb");
-    response.setTokenKey("cCc");
-    response.setTokenSecret("dDd");
-    QVariantMap storedData;
-    storedData[sessionData.TokenName()] = response.toMap();
-    stored.setStoredData(storedData);
-    response.setTokenName(sessionData.TokenName());
-    QTest::newRow("in secret, valid") <<
+    response = UbuntuOne::PluginData();
+    stored = UbuntuOne::PluginData();
+    QTest::newRow("in secret, clearing") <<
         sessionData.toMap() <<
         -1 <<
-        false << response.toMap() << stored.toMap();
-    sessionData = UbuntuOne::PluginData();
-    response = UbuntuOne::PluginData();
-    stored = UbuntuOne::PluginData();
-    storedData.clear();
+        response.toMap() << stored.toMap();
 }
 
 void PluginTest::testStoredToken()
 {
     QFETCH(QVariantMap, sessionData);
     QFETCH(int, expectedErrorCode);
-    QFETCH(bool, uiExpected);
     QFETCH(QVariantMap, expectedResponse);
     QFETCH(QVariantMap, expectedStore);
 
@@ -272,7 +302,7 @@
     m_testPlugin->process(sessionData, "ubuntuone");
     if (expectedErrorCode < 0) {
         QCOMPARE(error.count(), 0);
-        QTRY_COMPARE(userActionRequired.count(), uiExpected ? 1 : 0);
+        QTRY_COMPARE(userActionRequired.count(), 0);
         if (!expectedResponse.isEmpty()) {
             QTRY_COMPARE(result.count(), 1);
             QVariantMap resp = result.at(0).at(0).value<SessionData>().toMap();
@@ -296,66 +326,6 @@
     }
 }
 
-void PluginTest::testUserInteraction()
-{
-    QSignalSpy result(m_testPlugin, SIGNAL(result(const SignOn::SessionData&)));
-    QSignalSpy error(m_testPlugin, SIGNAL(error(const SignOn::Error &)));
-    QSignalSpy userActionRequired(m_testPlugin,
-                                  SIGNAL(userActionRequired(const SignOn::UiSessionData&)));
-    QSignalSpy store(m_testPlugin, SIGNAL(store(const SignOn::SessionData&)));
-
-    TestNetworkAccessManager *nam = new TestNetworkAccessManager;
-    m_testPlugin->m_networkAccessManager = nam;
-
-    UbuntuOne::PluginData sessionData;
-    sessionData.setTokenName("helloworld");
-    sessionData.setUserName("[e-mail]");
-    m_testPlugin->process(sessionData, "ubuntuone");
-
-    QTRY_COMPARE(userActionRequired.count(), 1);
-    QVariantMap data =
-        userActionRequired.at(0).at(0).value<UiSessionData>().toMap();
-    /* We want the title to be there, but we don't care about its value here */
-    QVERIFY(data.contains(SSOUI_KEY_TITLE));
-    data.remove(SSOUI_KEY_TITLE);
-    QVariantMap expectedUserInteraction;
-    expectedUserInteraction[SSOUI_KEY_USERNAME] = "[e-mail]";
-    expectedUserInteraction[SSOUI_KEY_QUERYPASSWORD] = true;
-    QCOMPARE(data, expectedUserInteraction);
-    userActionRequired.clear();
-
-    /* Prepare network reply */
-    TestNetworkReply *reply = new TestNetworkReply(this);
-    reply->setStatusCode(401);
-    reply->setContent("{\n"
-                      "  \"code\": \"TWOFACTOR_REQUIRED\",\n"
-                      "  \"message\": \"This account requires 2-factor authentication.\",\n"
-                      "  \"extra\": {}\n"
-                      "}");
-    nam->setNextReply(reply);
-
-    QVariantMap userReply;
-    userReply[SSOUI_KEY_USERNAME] = "[e-mail]";
-    userReply[SSOUI_KEY_PASSWORD] = "s3cr3t";
-    m_testPlugin->userActionFinished(userReply);
-
-    /* Again the plugin should request user interaction, as OTP is required */
-    QTRY_COMPARE(userActionRequired.count(), 1);
-    data = userActionRequired.at(0).at(0).value<UiSessionData>().toMap();
-    expectedUserInteraction.clear();
-    expectedUserInteraction[SSOUI_KEY_USERNAME] = "[e-mail]";
-    expectedUserInteraction[SSOUI_KEY_PASSWORD] = "s3cr3t";
-    expectedUserInteraction[SSOUI_KEY_QUERY2FA] = true;
-    /* We want the map to contain the SSOUI_KEY_2FA_TEXT, but we don't care
-     * about the value */
-    QVERIFY(data.contains(SSOUI_KEY_2FA_TEXT));
-    data.remove(SSOUI_KEY_2FA_TEXT);
-    /* Same goes for the title */
-    QVERIFY(data.contains(SSOUI_KEY_TITLE));
-    data.remove(SSOUI_KEY_TITLE);
-    QCOMPARE(data, expectedUserInteraction);
-}
-
 void PluginTest::testTokenCreation_data()
 {
     QTest::addColumn<QVariantMap>("sessionData");
@@ -365,12 +335,10 @@
     QTest::addColumn<int>("expectedErrorCode");
     QTest::addColumn<QVariantMap>("expectedResponse");
     QTest::addColumn<QVariantMap>("expectedStore");
-    QTest::addColumn<QVariantMap>("expectedUserInteraction");
 
     UbuntuOne::PluginData sessionData;
     UbuntuOne::PluginData response;
     UbuntuOne::PluginData stored;
-    QVariantMap userInteraction;
 
     // Successful creation, with password only
     sessionData.setTokenName("helloworld");
@@ -382,10 +350,10 @@
     response.setTokenSecret("dDd");
     response.setDateUpdated("2013-01-11 12:43:23");
     response.setDateCreated("2013-01-11 12:43:23");
+    response.setTokenName(sessionData.TokenName());
     QVariantMap storedData;
     storedData[sessionData.TokenName()] = response.toMap();
     stored.setStoredData(storedData);
-    response.setTokenName(sessionData.TokenName());
     QTest::newRow("no OTP needed, 201") <<
         sessionData.toMap() <<
         -1 <<
@@ -400,7 +368,7 @@
                        "  \"date_updated\": \"2013-01-11 12:43:23\"\n"
                        "}") <<
         -1 <<
-        response.toMap() << stored.toMap() << userInteraction;
+        response.toMap() << stored.toMap();
     sessionData = UbuntuOne::PluginData();
     response = UbuntuOne::PluginData();
     stored = UbuntuOne::PluginData();
@@ -410,8 +378,6 @@
     sessionData.setTokenName("helloworld");
     sessionData.setUserName("[e-mail]");
     sessionData.setSecret("s3cr3t");
-    userInteraction[SSOUI_KEY_USERNAME] = "[e-mail]";
-    userInteraction[SSOUI_KEY_QUERYPASSWORD] = true;
     QTest::newRow("wrong password") <<
         sessionData.toMap() <<
         -1 <<
@@ -421,16 +387,12 @@
                        "  \"extra\": {}\n"
                        "}") <<
         -1 <<
-        response.toMap() << stored.toMap() << userInteraction;
+        response.toMap() << stored.toMap();
     sessionData = UbuntuOne::PluginData();
-    userInteraction.clear();
 
     // Empty username
     sessionData.setTokenName("helloworld");
     sessionData.setSecret("s3cr3t");
-    userInteraction[SSOUI_KEY_QUERYUSERNAME] = true;
-    userInteraction[SSOUI_KEY_USERNAME] = "";
-    userInteraction[SSOUI_KEY_QUERYPASSWORD] = true;
     QTest::newRow("empty username") <<
         sessionData.toMap() <<
         -1 <<
@@ -440,9 +402,8 @@
                        "  \"extra\": {}\n"
                        "}") <<
         -1 <<
-        response.toMap() << stored.toMap() << userInteraction;
+        response.toMap() << stored.toMap();
     sessionData = UbuntuOne::PluginData();
-    userInteraction.clear();
 
     // Network error while creating token
     sessionData.setTokenName("helloworld");
@@ -453,14 +414,13 @@
         int(QNetworkReply::SslHandshakeFailedError) <<
         -1 << QString() <<
         int(SignOn::Error::Ssl) <<
-        response.toMap() << stored.toMap() << userInteraction;
+        response.toMap() << stored.toMap();
     sessionData = UbuntuOne::PluginData();
 
     // Account needs reset
     sessionData.setTokenName("helloworld");
     sessionData.setUserName("[e-mail]");
     sessionData.setSecret("s3cr3t");
-    userInteraction[SSOUI_KEY_OPENURL] = "http://www.example.com/reset";
     QTest::newRow("reset needed") <<
         sessionData.toMap() <<
         -1 <<
@@ -472,9 +432,8 @@
                        "  }\n"
                        "}") <<
         -1 <<
-        response.toMap() << stored.toMap() << userInteraction;
+        response.toMap() << stored.toMap();
     sessionData = UbuntuOne::PluginData();
-    userInteraction.clear();
 }
 
 void PluginTest::testTokenCreation()
@@ -486,7 +445,6 @@
     QFETCH(int, expectedErrorCode);
     QFETCH(QVariantMap, expectedResponse);
     QFETCH(QVariantMap, expectedStore);
-    QFETCH(QVariantMap, expectedUserInteraction);
 
     QSignalSpy result(m_testPlugin, SIGNAL(result(const SignOn::SessionData&)));
     QSignalSpy error(m_testPlugin, SIGNAL(error(const SignOn::Error &)));
@@ -510,16 +468,7 @@
 
     m_testPlugin->process(sessionData, "ubuntuone");
     if (expectedErrorCode < 0) {
-        if (!expectedUserInteraction.isEmpty()) {
-            QTRY_COMPARE(userActionRequired.count(), 1);
-            QVariantMap data =
-                userActionRequired.at(0).at(0).value<UiSessionData>().toMap();
-            /* We don't care about the title here */
-            data.remove(SSOUI_KEY_TITLE);
-            QCOMPARE(data, expectedUserInteraction);
-        } else {
-            QCOMPARE(userActionRequired.count(), 0);
-        }
+        QCOMPARE(userActionRequired.count(), 0);
 
         if (!expectedResponse.isEmpty()) {
             QTRY_COMPARE(result.count(), 1);

=== modified file 'signon-plugin/ubuntuone-plugin.cpp'
--- signon-plugin/ubuntuone-plugin.cpp	2016-04-27 14:07:35 +0000
+++ signon-plugin/ubuntuone-plugin.cpp	2016-06-07 18:42:38 +0000
@@ -69,71 +69,22 @@
     {
     }
 
-    bool SignOnPlugin::validateInput(const PluginData &data,
-                                     const QString &mechanism)
-    {
-        Q_UNUSED(mechanism);
-
-        if (data.TokenName().isEmpty()) {
-            return false;
-        }
-
-        return true;
-    }
-
-    bool SignOnPlugin::respondWithStoredData()
+    void SignOnPlugin::respondWithStoredData()
     {
         QVariantMap storedData = m_data.StoredData();
 
-        /* When U1 was using the password plugin, it was storing the token data
-         * in the password field. So, if we don't have any data stored in the
-         * plugin's data, try to get a token from the password field.
-         */
+        /* If there's a secret stored in password field, clear it. */
         if (storedData.isEmpty() && !m_data.Secret().isEmpty()) {
-            Token *token = Token::fromQuery(m_data.Secret());
-            if (token->isValid()) {
-                PluginData tokenData;
-                tokenData.setConsumerKey(token->consumerKey());
-                tokenData.setConsumerSecret(token->consumerSecret());
-                tokenData.setTokenKey(token->tokenKey());
-                tokenData.setTokenSecret(token->tokenSecret());
-                QDateTime time = token->updated();
-                if (time.isValid()) {
-                    tokenData.setDateUpdated(time.toString(Qt::ISODate));
-                }
-                time = token->created();
-                if (time.isValid()) {
-                    tokenData.setDateCreated(time.toString(Qt::ISODate));
-                }
-                storedData[token->name()] = tokenData.toMap();
-                PluginData pluginData;
-                pluginData.setStoredData(storedData);
-                Q_EMIT store(pluginData);
-
-                /* We know that the given secret is a valid token, so it cannot
-                 * be a valid password as well: let's clear it out now, so that
-                 * if it turns out that the token is no longer valid and that
-                 * we need to create a new one, we won't make a useless attempt
-                 * to create one with a wrong password.
-                 */
-                m_data.setSecret(QString());
-            }
-            delete token;
+            m_data.setSecret(QString());
         }
 
+        /* Always use the same token name for now */
+        m_data.setTokenName(Token::buildTokenName());
+
         /* Check if we have stored data for this token name */
         PluginData tokenData(storedData[m_data.TokenName()].toMap());
-        Token token(tokenData.TokenKey(), tokenData.TokenSecret(),
-                    tokenData.ConsumerKey(), tokenData.ConsumerSecret(),
-                    tokenData.DateCreated(), tokenData.DateUpdated());
-        if (!token.isValid()) {
-            return false;
-        }
-        qDebug() << "Token is valid!" << tokenData.TokenKey();
-
         tokenData.setTokenName(m_data.TokenName());
         Q_EMIT result(tokenData);
-        return true;
     }
 
     void SignOnPlugin::emitErrorFromReply(QNetworkReply *reply)
@@ -167,21 +118,18 @@
         PluginData response;
         m_data = inData.data<PluginData>();
 
-        if (!validateInput(m_data, mechanism)) {
-            qWarning() << "Invalid parameters passed";
-            Q_EMIT error(SignOn::Error(SignOn::Error::MissingData));
-            return;
-        }
-
-        /* It may be that the stored token is valid; however, do the check only
-         * if no OTP was provided (since the presence of an OTP is a clear
-         * signal that the caller wants to get a new token). */
-        if (m_data.OneTimePassword().isEmpty() &&
-            respondWithStoredData()) {
-            return;
-        }
-
-        getCredentialsAndCreateNewToken();
+        if (m_data.InvalidateToken()) {
+            qDebug() << "Clearing stored token";
+            PluginData pluginData;
+            pluginData.setStoredData(QVariantMap());
+            Q_EMIT store(pluginData);
+            m_data.setStoredData(QVariantMap());
+            respondWithStoredData();
+        } else if (!m_data.StoredData().isEmpty() && m_data.Secret().isEmpty()) {
+            respondWithStoredData();
+        } else {
+            createNewToken();
+        }
     }
 
     void SignOnPlugin::onCreationFinished()
@@ -195,8 +143,6 @@
         QJsonDocument json = QJsonDocument::fromJson(data);
         QJsonObject object = json.object();
 
-        QString error = object.value("code").toString();
-
         int statusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
         qDebug() << "Status code:" << statusCode;
         if (statusCode == 200 || statusCode == 201) {
@@ -208,6 +154,7 @@
             token.setTokenSecret(object.value("token_secret").toString());
             token.setDateCreated(Token::dateStringToISO(object.value("date_created").toString()));
             token.setDateUpdated(Token::dateStringToISO(object.value("date_updated").toString()));
+            token.setTokenName(tokenName);
 
             /* Store the token */
             QVariantMap storedData;
@@ -216,29 +163,23 @@
             pluginData.setStoredData(storedData);
             Q_EMIT store(pluginData);
 
-            token.setTokenName(tokenName);
             Q_EMIT result(token);
-        } else if (statusCode == 401 && error == ERR_INVALID_CREDENTIALS) {
-            m_data.setSecret(QString());
-            m_data.setOneTimePassword(QString());
-            getCredentialsAndCreateNewToken();
-        } else if (statusCode == 401 && error == ERR_TWOFACTOR_REQUIRED) {
-            m_needsOtp = true;
-            getCredentialsAndCreateNewToken();
-        } else if (statusCode == 403 && error == ERR_TWOFACTOR_FAILURE) {
-            m_data.setOneTimePassword(QString());
-            getCredentialsAndCreateNewToken();
-        } else if (statusCode == 403 && error == ERR_PASSWORD_POLICY_ERROR) {
-            QVariantMap data;
-            QJsonObject extra = object.value("extra").toObject();
-            data[SSOUI_KEY_OPENURL] = extra.value("location").toString();
-            Q_EMIT userActionRequired(data);
-        } else if (error == ERR_INVALID_DATA) {
-            // This error is received when the email address is invalid
-            m_data.setUserName(QString());
-            m_data.setSecret(QString());
-            m_data.setOneTimePassword(QString());
-            getCredentialsAndCreateNewToken();
+        } else if (statusCode == 401 || statusCode == 403) {
+            QString error = object.value("code").toString();
+            QString message = object.value("message").toString();
+
+            PluginData errorData;
+            if (error == ERR_TWOFACTOR_REQUIRED) {
+                errorData.setU1ErrorCode(PluginData::OneTimePasswordRequired);
+            } else {
+                errorData.setU1ErrorCode(PluginData::InvalidPassword);
+            }
+            errorData.setU1ErrorMessage(message);
+
+            // Emit a result with error data since this seems to be the
+            // only feasible way to get error messages from server back up
+            // to the UI.
+            Q_EMIT result(errorData);
         } else {
             emitErrorFromReply(reply);
         }
@@ -253,7 +194,7 @@
         QJsonObject formData;
         formData.insert("email", m_data.UserName());
         formData.insert("password", m_data.Secret());
-        formData.insert("token_name", m_data.TokenName());
+        formData.insert("token_name", Token::buildTokenName());
         if (!m_data.OneTimePassword().isEmpty()) {
             formData.insert("otp", m_data.OneTimePassword());
         }
@@ -265,94 +206,5 @@
                          this, SLOT(onCreationFinished()));
     }
 
-    void SignOnPlugin::getCredentialsAndCreateNewToken()
-    {
-        if (!m_data.Secret().isEmpty() &&
-            (!m_needsOtp || !m_data.OneTimePassword().isEmpty())) {
-            createNewToken();
-        } else if (m_data.Secret().isEmpty()) {
-            QVariantMap data;
-            data[SSOUI_KEY_TITLE] =
-                QString::fromUtf8(_("Sign in to your Ubuntu One account"));
-            if (m_data.UserName().isEmpty()) {
-                data[SSOUI_KEY_QUERYUSERNAME] = true;
-            }
-            data[SSOUI_KEY_USERNAME] = m_data.UserName();
-            data[SSOUI_KEY_QUERYPASSWORD] = true;
-            m_didAskForPassword = true;
-            Q_EMIT userActionRequired(data);
-        } else {
-            QVariantMap data;
-            data[SSOUI_KEY_TITLE] =
-                QString::fromUtf8(_("Sign in to your Ubuntu One account"));
-            data[SSOUI_KEY_USERNAME] = m_data.UserName();
-            data[SSOUI_KEY_PASSWORD] = m_data.Secret();
-            data[SSOUI_KEY_QUERY2FA] = true;
-            data[SSOUI_KEY_2FA_TEXT] =
-                QString::fromUtf8(_("2-factor device code"));
-            Q_EMIT userActionRequired(data);
-        }
-    }
-
-    bool SignOnPlugin::handleUiError(const SignOn::UiSessionData &data)
-    {
-        using namespace SignOn;
-
-        int code = data.QueryErrorCode();
-        if (code == QUERY_ERROR_NONE) {
-            return false;
-        }
-
-        qDebug() << "userActionFinished with error: " << code;
-        if (code == QUERY_ERROR_CANCELED) {
-            Q_EMIT error(Error(Error::SessionCanceled,
-                               QLatin1String("Cancelled by user")));
-        } else if (code == QUERY_ERROR_NETWORK) {
-            Q_EMIT error(Error(Error::Network, QLatin1String("Network error")));
-        } else if (code == QUERY_ERROR_SSL) {
-            Q_EMIT error(Error(Error::Ssl, QLatin1String("SSL error")));
-        } else {
-            QVariantMap map = data.toMap();
-            if (map.contains(SSOUI_KEY_QUERY2FA)) {
-                PluginData reply;
-                reply.setU1ErrorCode(PluginData::OneTimePasswordRequired);
-                Q_EMIT result(reply);
-            } else if (map.contains(SSOUI_KEY_QUERYPASSWORD)) {
-                PluginData reply;
-                reply.setU1ErrorCode(PluginData::InvalidPassword);
-                Q_EMIT result(reply);
-            } else {
-                Q_EMIT error(Error(Error::UserInteraction,
-                                   QString("userActionFinished error: ")
-                                   + QString::number(data.QueryErrorCode())));
-            }
-        }
-        return true;
-    }
-
-    void SignOnPlugin::userActionFinished(const SignOn::UiSessionData &data)
-    {
-        if (handleUiError(data)) {
-            return;
-        }
-
-        PluginData uiData = data.data<PluginData>();
-        if (!uiData.UserName().isEmpty()) {
-            m_data.setUserName(uiData.UserName());
-        }
-
-        if (!uiData.Secret().isEmpty()) {
-            m_data.setSecret(uiData.Secret());
-        }
-
-        QVariantMap map = data.toMap();
-        QString oneTimePassword = map.value(SSOUI_KEY_2FA).toString();
-        if (!oneTimePassword.isEmpty()) {
-            m_data.setOneTimePassword(oneTimePassword);
-        }
-
-        getCredentialsAndCreateNewToken();
-    }
-
     SIGNON_DECL_AUTH_PLUGIN(SignOnPlugin)
 } // namespace UbuntuOne

=== modified file 'signon-plugin/ubuntuone-plugin.h'
--- signon-plugin/ubuntuone-plugin.h	2016-04-26 08:45:29 +0000
+++ signon-plugin/ubuntuone-plugin.h	2016-06-07 18:42:38 +0000
@@ -51,15 +51,11 @@
         void cancel() Q_DECL_OVERRIDE;
         void process(const SignOn::SessionData &inData,
                      const QString &mechanism = 0) Q_DECL_OVERRIDE;
-        void userActionFinished(const SignOn::UiSessionData &data) Q_DECL_OVERRIDE;
 
     private:
-        bool validateInput(const PluginData &data, const QString &mechanism);
-        bool respondWithStoredData();
+        void respondWithStoredData();
         void emitErrorFromReply(QNetworkReply *reply);
         void createNewToken();
-        void getCredentialsAndCreateNewToken();
-        bool handleUiError(const SignOn::UiSessionData &data);
 
     private Q_SLOTS:
         void onCreationFinished();

=== modified file 'signon-plugin/ubuntuonedata.h'
--- signon-plugin/ubuntuonedata.h	2016-04-27 08:36:19 +0000
+++ signon-plugin/ubuntuonedata.h	2016-06-07 18:42:38 +0000
@@ -46,6 +46,10 @@
         SIGNON_SESSION_DECLARE_PROPERTY(QString, DateCreated);
         SIGNON_SESSION_DECLARE_PROPERTY(QString, DateUpdated);
 
+        // Set this to true if the token returned by the previous
+        // authentication is invalid.
+        SIGNON_SESSION_DECLARE_PROPERTY(bool, InvalidateToken);
+
         // Error code
         enum ErrorCode {
             NoError = 0,
@@ -53,6 +57,7 @@
             InvalidPassword,
         };
         SIGNON_SESSION_DECLARE_PROPERTY(int, U1ErrorCode);
+        SIGNON_SESSION_DECLARE_PROPERTY(QString, U1ErrorMessage);
 
         // Data which the plugin has stored into signond
         SIGNON_SESSION_DECLARE_PROPERTY(QVariantMap, StoredData);