Merge lp:~dobey/ubuntuone-credentials/signon-plugin-part2 into lp:ubuntuone-credentials

[dobey]

Final pieces for switching to the new signon plug-in.

[Alberto Mardegan (mardy)]

Couple of inline commits.

review: Needs Fixing

[dobey (dobey)]

Replied inline.

[Alberto Mardegan (mardy)]

Replied inline, added one comment.

[lp:~dobey/ubuntuone-credentials/signon-plugin-part2]

266. By dobey on 2016-06-17

Refactor so createSession/process are called after identity is stored.
Fix invalidateCredentials to actually invalidate the credentials.

267. By dobey on 2016-06-17

Emit tokenNotFound immediately if no account is found.

268. By dobey on 2016-06-20

Need to depend on signond, since apparently nothing else does.

269. By dobey on 2016-06-20

Try to handle process() calls better.
Fix a few small typos.

[Alberto Mardegan (mardy)]

A couple of inline comments, it looks 99.9% good :-)

[lp:~dobey/ubuntuone-credentials/signon-plugin-part2]

270. By dobey on 2016-06-21

Set the m_invalidate flag properly.

271. By dobey on 2016-06-21

Refactor token clearing to separate method.
Handle existing secret separately from invalidation request.

[unity-api-1-bot (unity-api-1-bot)]

FAILED: Continuous integration, rev:271
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/1/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/unity-api-1/job/build/84/console
    FAILURE: https://jenkins.canonical.com/unity-api-1/job/build-0-fetch/91/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/1/rebuild

review: Needs Fixing (continuous-integration)

[unity-api-1-bot (unity-api-1-bot)]

FAILED: Continuous integration, rev:271
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/5/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/unity-api-1/job/build/89/console
    FAILURE: https://jenkins.canonical.com/unity-api-1/job/build-0-fetch/96/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/5/rebuild

review: Needs Fixing (continuous-integration)

[unity-api-1-bot (unity-api-1-bot)]

FAILED: Continuous integration, rev:271
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/6/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/unity-api-1/job/build/95/console
    FAILURE: https://jenkins.canonical.com/unity-api-1/job/build-0-fetch/102/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/6/rebuild

review: Needs Fixing (continuous-integration)

[unity-api-1-bot (unity-api-1-bot)]

FAILED: Continuous integration, rev:271
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/7/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/unity-api-1/job/build/98/console
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-0-fetch/105
    FAILURE: https://jenkins.canonical.com/unity-api-1/job/build-1-sourcepkg/release=vivid+overlay/62/console
    FAILURE: https://jenkins.canonical.com/unity-api-1/job/build-1-sourcepkg/release=xenial/62/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/7/rebuild

review: Needs Fixing (continuous-integration)

[unity-api-1-bot (unity-api-1-bot)]

PASSED: Continuous integration, rev:271
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/8/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build/99
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-0-fetch/106
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-1-sourcepkg/release=vivid+overlay/63
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-1-sourcepkg/release=xenial/63
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=amd64,release=vivid+overlay/40
        deb: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=amd64,release=vivid+overlay/40/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=amd64,release=xenial/40
        deb: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=amd64,release=xenial/40/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=armhf,release=vivid+overlay/40
        deb: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=armhf,release=vivid+overlay/40/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=armhf,release=xenial/40
        deb: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=armhf,release=xenial/40/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=i386,release=vivid+overlay/40
        deb: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=i386,release=vivid+overlay/40/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=i386,release=xenial/40
        deb: https://jenkins.canonical.com/unity-api-1/job/build-2-binpkg/arch=i386,release=xenial/40/artifact/output/*zip*/output.zip

Click here to trigger a rebuild:
https://jenkins.canonical.com/unity-api-1/job/lp-ubuntuone-credentials-ci/8/rebuild

review: Approve (continuous-integration)

[Natalia Bidart (nataliabidart)]

Started a massive cleanup of old MPs, closing this given its age, please update and re-open if still valid.

Unmerged revisions

271. By dobey on 2016-06-21

Refactor token clearing to separate method.
Handle existing secret separately from invalidation request.

270. By dobey on 2016-06-21

Set the m_invalidate flag properly.

269. By dobey on 2016-06-20

Try to handle process() calls better.
Fix a few small typos.

268. By dobey on 2016-06-20

Need to depend on signond, since apparently nothing else does.

267. By dobey on 2016-06-17

Emit tokenNotFound immediately if no account is found.

266. By dobey on 2016-06-17

Refactor so createSession/process are called after identity is stored.
Fix invalidateCredentials to actually invalidate the credentials.

265. By dobey on 2016-06-16

The login() call should never emit credentialsNotFound.
Don't emit an error in existingCredentialsId if there is no account.

264. By dobey on 2016-06-16

Must use 'unsigned int' in symbols file for quint32.

263. By dobey on 2016-06-16

Hopefully store the token correctly now too.

262. By dobey on 2016-06-13

Try to store the credentials a different way.

=== modified file 'data/ubuntuone.provider'
--- data/ubuntuone.provider	2016-04-19 15:04:15 +0000
+++ data/ubuntuone.provider	2016-06-21 17:27:01 +0000
@@ -8,8 +8,8 @@
 
   <template>
     <group name="auth">
-      <setting name="method">password</setting>
-      <setting name="mechanism">password</setting>
+      <setting name="method">ubuntuone</setting>
+      <setting name="mechanism">ubuntuone</setting>
     </group>
   </template>
 </provider>
 
=== modified file 'debian/control'
--- debian/control	2016-05-19 17:41:38 +0000
+++ debian/control	2016-06-21 17:27:01 +0000
@@ -76,7 +76,7 @@
  ${misc:Pre-Depends},
 Depends:
  account-plugin-tools,
- signon-plugin-password,
+ signon-plugin-ubuntuone (= ${source:Version}),
  sqlite3,
  ubuntuone-credentials-common (= ${source:Version}),
  ${misc:Depends},
@@ -142,6 +142,7 @@
  ${misc:Pre-Depends},
 Depends:
  libubuntuoneauth-2.0-0 (= ${binary:Version}),
+ signond,
  ${misc:Depends},
  ${shlibs:Depends},
 Description: Ubuntu One authentication library - signon plug-in
 
=== modified file 'debian/libubuntuoneauth-2.0-0.symbols'
--- debian/libubuntuoneauth-2.0-0.symbols	2016-04-22 08:25:24 +0000
+++ debian/libubuntuoneauth-2.0-0.symbols	2016-06-21 17:27:01 +0000
@@ -122,6 +122,7 @@
  (c++)"UbuntuOne::Token::addOAuthTimestamp(QString) const@Base" 15.11+16.04.20151207.1
  (c++)"UbuntuOne::Keyring::storeToken(UbuntuOne::Token)@Base" 13.08
  (c++)"UbuntuOne::Keyring::storeToken(UbuntuOne::Token, QString const&)@Base" 14.04+14.10.20140802
+ (c++)"UbuntuOne::Keyring::storeToken(UbuntuOne::Token, QString const&, unsigned int)@Base" 0replaceme
  (c++)"UbuntuOne::Keyring::tokenFound(UbuntuOne::Token const&)@Base" 13.08
  (c++)"UbuntuOne::Keyring::deleteToken()@Base" 13.08
  (c++)"UbuntuOne::Keyring::handleError(SignOn::Error const&)@Base" 13.08
 
=== modified file 'libubuntuoneauth/CMakeLists.txt'
--- libubuntuoneauth/CMakeLists.txt	2016-04-21 09:25:58 +0000
+++ libubuntuoneauth/CMakeLists.txt	2016-06-21 17:27:01 +0000
@@ -13,6 +13,10 @@
   SET (LIB_TYPE STATIC)
 ENDIF (BUILD_STATIC_LIBS)
 
+# Some slots are deprecated; disable warnings on deprecations, because
+# moc-generated files are using these methods
+SET (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-deprecated-declarations")
+
 # The sources for building the library
 FILE (GLOB SOURCES *.cpp)
 # HEADERS only includes the public headers for installation.
 
=== added file 'libubuntuoneauth/authenticator.cpp'
--- libubuntuoneauth/authenticator.cpp	1970-01-01 00:00:00 +0000
+++ libubuntuoneauth/authenticator.cpp	2016-06-21 17:27:01 +0000
@@ -0,0 +1,211 @@
+/*
+ * Copyright 2016 Canonical Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of version 3 of the GNU Lesser General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "authenticator.h"
+#include "../signon-plugin/ubuntuonedata.h"
+
+#include <Accounts/Account>
+#include <Accounts/Service>
+#include <SignOn/AuthSession>
+#include <SignOn/Identity>
+#include <SignOn/IdentityInfo>
+
+#include <QDebug>
+
+using namespace Internal;
+using namespace UbuntuOne;
+
+Authenticator::Authenticator(Accounts::Manager *manager, QObject *parent):
+    QObject(parent),
+    m_manager(manager),
+    m_invalidate(false),
+    m_uiAllowed(true),
+    m_credentialsId(0)
+{
+    if (!m_manager) {
+        m_manager = new Accounts::Manager(this);
+    }
+}
+
+void Authenticator::handleError(const SignOn::Error &e)
+{
+    qCritical() << "Authentication error:" << e.message();
+    Q_EMIT error(AuthenticationError, e.message());
+}
+
+void Authenticator::handleSessionData(const SignOn::SessionData &data)
+{
+    PluginData reply = data.data<PluginData>();
+
+    auto errorCode = PluginData::ErrorCode(reply.U1ErrorCode());
+    auto message = reply.U1ErrorMessage();
+    if (errorCode != PluginData::NoError) {
+        switch (errorCode) {
+        case PluginData::OneTimePasswordRequired:
+            qDebug() << "Error: OTP required";
+            Q_EMIT error(OneTimePasswordRequired, message);
+            break;
+        case PluginData::InvalidPassword:
+            qDebug() << "Error: invalid password";
+            Q_EMIT error(InvalidPassword, message);
+            break;
+        default:
+            qWarning() << "Unknown error:" << message;
+            Q_EMIT error(AuthenticationError, message);
+        }
+        return;
+    }
+
+    Token token(reply.TokenKey(), reply.TokenSecret(),
+                reply.ConsumerKey(), reply.ConsumerSecret(),
+                reply.DateCreated(), reply.DateUpdated());
+    Q_EMIT authenticated(token);
+}
+
+quint32 Authenticator::credentialsId()
+{
+    return m_credentialsId;
+}
+
+quint32 Authenticator::existingCredentialsId()
+{
+    QString providerId("ubuntuone");
+    Accounts::AccountIdList accountIds = m_manager->accountList(providerId);
+
+    if (accountIds.isEmpty()) {
+        qDebug() << "authenticate(): No UbuntuOne accounts found";
+        return 0;
+    }
+
+    if (Q_UNLIKELY(accountIds.count() > 1)) {
+        qWarning() << "authenticate(): Found '" << accountIds.count() <<
+            "' accounts. Using first.";
+    }
+
+    qDebug() << "authenticate(): Using account '" << accountIds[0] << "'.";
+
+    auto account = m_manager->account(accountIds[0]);
+    if (Q_UNLIKELY(!account)) {
+        qDebug() << "Couldn't load account";
+        /* This could either happen because the account was deleted right while
+         * we were loading it, or because the accounts DB was locked by another
+         * app. Let's just return an authentication error here, so the client
+         * can retry.
+         */
+        Q_EMIT error(AuthenticationError, "");
+        return 0;
+    }
+
+    /* Here we should check that the account service is enabled; but since the
+     * old code was not doing this check, and that from the API there is no way
+     * of knowing which service we are interested in, let's leave it as a TODO.
+     */
+
+    return account->credentialsId();
+}
+
+void Authenticator::process(SignOn::Identity *identity,
+                            const QString &tokenName,
+                            const QString &userName,
+                            const QString &password,
+                            const QString &otp)
+{
+    auto session = identity->createSession(QStringLiteral("ubuntuone"));
+    if (Q_UNLIKELY(!session)) {
+        qCritical() << "Unable to create AuthSession.";
+        Q_EMIT error(AuthenticationError, "");
+        return;
+    }
+
+    connect(session, SIGNAL(response(const SignOn::SessionData&)),
+            this, SLOT(handleSessionData(const SignOn::SessionData&)));
+    connect(session, SIGNAL(error(const SignOn::Error&)),
+            this, SLOT(handleError(const SignOn::Error&)));
+
+    PluginData data;
+    data.setTokenName(tokenName);
+    data.setUserName(userName);
+    data.setSecret(password);
+    data.setOneTimePassword(otp);
+    int uiPolicy = m_uiAllowed ?
+        SignOn::DefaultPolicy : SignOn::NoUserInteractionPolicy;
+    data.setUiPolicy(uiPolicy);
+    if (m_invalidate) {
+        data.setInvalidateToken(true);
+        m_invalidate = false;
+    }
+
+    session->process(data, QStringLiteral("ubuntuone"));
+}
+
+void Authenticator::authenticate(const QString &tokenName,
+                                 const QString &userName,
+                                 const QString &password,
+                                 const QString &otp)
+{
+    SignOn::Identity *identity;
+    m_credentialsId = existingCredentialsId();
+
+    if (m_credentialsId == 0) {
+        SignOn::IdentityInfo info = SignOn::IdentityInfo();
+
+        info.setAccessControlList(QStringList() << "unconfined");
+        info.setStoreSecret(false);
+
+        identity = SignOn::Identity::newIdentity(info, this);
+        connect(identity, &SignOn::Identity::credentialsStored,
+                [=](const quint32 id) {
+                    m_credentialsId = id;
+                    process(identity, tokenName, userName, password, otp);
+                });
+        connect(identity, &SignOn::Identity::error,
+                [=](const SignOn::Error &err) {
+                    qCritical() << "authenticate(): unable to store identity";
+                    Q_EMIT error(AccountNotFound, "");
+                });
+        identity->storeCredentials(info);
+    } else {
+        identity = SignOn::Identity::existingIdentity(m_credentialsId, this);
+        if (Q_UNLIKELY(!identity)) {
+            qCritical() << "authenticate(): unable to load credentials" << m_credentialsId;
+            Q_EMIT error(AccountNotFound, "");
+            return;
+        }
+        process(identity, tokenName, userName, password, otp);
+    }
+
+}
+
+void Authenticator::invalidateCredentials()
+{
+    m_credentialsId = existingCredentialsId();
+    if (m_credentialsId == 0) {
+        qCritical() << "invalidateCredentials(): no existing credentials.";
+        Q_EMIT error(AccountNotFound, "");
+        return;
+    }
+
+    m_invalidate = true;
+    auto identity = SignOn::Identity::existingIdentity(m_credentialsId, this);
+    process(identity, Token::buildTokenName());
+}
+
+void Authenticator::setUiAllowed(bool allowed)
+{
+    m_uiAllowed = allowed;
+}
 
=== added file 'libubuntuoneauth/authenticator.h'
--- libubuntuoneauth/authenticator.h	1970-01-01 00:00:00 +0000
+++ libubuntuoneauth/authenticator.h	2016-06-21 17:27:01 +0000
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2016 Canonical Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of version 3 of the GNU Lesser General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+#ifndef _U1_AUTHENTICATOR_H_
+#define _U1_AUTHENTICATOR_H_
+
+#include <Accounts/Manager>
+#include <SignOn/Identity>
+
+#include <QObject>
+
+#include "token.h"
+
+namespace Internal {
+
+class Authenticator : public QObject
+{
+    Q_OBJECT
+
+public:
+    enum ErrorCode {
+        NoError = 0,
+        AccountNotFound,
+        OneTimePasswordRequired,
+        InvalidPassword,
+        AuthenticationError, // will create more specific codes if needed
+    };
+
+    explicit Authenticator(Accounts::Manager *manager = 0, QObject *parent = 0);
+
+    void process(SignOn::Identity *identity,
+                 const QString &tokenName,
+                 const QString &userName = QString(),
+                 const QString &password = QString(),
+                 const QString &otp = QString());
+    void authenticate(const QString &tokenName,
+                      const QString &userName = QString(),
+                      const QString &password = QString(),
+                      const QString &otp = QString());
+    void invalidateCredentials();
+    void setUiAllowed(bool allowed);
+    quint32 credentialsId();
+
+Q_SIGNALS:
+    void authenticated(const UbuntuOne::Token& token);
+    void error(Internal::Authenticator::ErrorCode code, const QString& message);
+
+private:
+    quint32 existingCredentialsId();
+
+private Q_SLOTS:
+    void handleError(const SignOn::Error &error);
+    void handleSessionData(const SignOn::SessionData &data);
+
+private:
+    Accounts::Manager *m_manager;
+    bool m_invalidate;
+    bool m_uiAllowed;
+    quint32 m_credentialsId;
+};
+
+} /* namespace */
+
+#endif /* _U1_AUTHENTICATOR_H_ */
 
=== modified file 'libubuntuoneauth/keyring.cpp'
--- libubuntuoneauth/keyring.cpp	2016-04-19 15:04:15 +0000
+++ libubuntuoneauth/keyring.cpp	2016-06-21 17:27:01 +0000
@@ -23,7 +23,9 @@
 
 #include <QDebug>
 
+#include "authenticator.h"
 #include "keyring.h"
+#include "../signon-plugin/ubuntuonedata.h"
 
 using namespace Accounts;
 using namespace SignOn;
@@ -68,36 +70,35 @@
 
     void Keyring::findToken()
     {
+        using namespace Internal;
+
         QString _acctName("ubuntuone");
         AccountIdList _ids = _manager.accountList(_acctName);
-        Identity *identity;
-        Account *account;
 
-        if (_ids.length() > 0) {
-            if (_ids.length() > 1) {
-                qDebug() << "findToken(): Found '" << _ids.length() << "' accounts. Using first.";
-            }
-            account = _manager.account(_ids[0]);
-            qDebug() << "findToken(): Using Ubuntu One account '" << _ids[0] << "'.";
-            identity = Identity::existingIdentity(account->credentialsId());
-            if (identity == NULL) {
-                qCritical() << "findToken(): disabled account " << _acctName << _ids[0];
-                emit tokenNotFound();
-                return;
-            }
-            AuthSession *session = identity->createSession(QStringLiteral("password"));
-            if (session != NULL) {
-                connect(session, SIGNAL(response(const SignOn::SessionData&)),
-                        this, SLOT(handleSessionData(const SignOn::SessionData&)));
-                connect(session, SIGNAL(error(const SignOn::Error&)),
-                        this, SLOT(handleError(const SignOn::Error&)));
-                session->process(SessionData(), QStringLiteral("password"));
-                return;
-            }
-            qCritical() << "Unable to create AuthSession.";
+        if (_ids.isEmpty()) {
+            qDebug() << "authenticate(): No UbuntuOne accounts found";
+            Q_EMIT tokenNotFound();
+            return;
         }
-        qDebug() << "findToken(): No accounts found matching " << _acctName;
-        emit tokenNotFound();
+
+        auto authenticator = new Authenticator(&_manager);
+        authenticator->setUiAllowed(false);
+
+        connect(authenticator, &Authenticator::authenticated,
+                [=](const Token &token) {
+            Q_EMIT tokenFound(token);
+            authenticator->deleteLater();
+        });
+        connect(authenticator, &Authenticator::error,
+                [=](Authenticator::ErrorCode code) {
+            if (code == Authenticator::AccountNotFound) {
+                Q_EMIT tokenNotFound();
+            } else {
+                Q_EMIT keyringError("Authentication failed");
+            }
+            authenticator->deleteLater();
+        });
+        authenticator->authenticate(Token::buildTokenName());
     }
 
     void Keyring::handleCredentialsStored(const quint32 id)
@@ -123,6 +124,11 @@
 
     void Keyring::storeToken(Token token, const QString& displayName)
     {
+        storeToken(token, displayName, 0);
+    }
+
+    void Keyring::storeToken(Token token, const QString& displayName, quint32 credentialsId)
+    {
         QString _acctName("ubuntuone");
         AccountIdList _ids = _manager.accountList(_acctName);
         Identity *identity = NULL;
@@ -143,26 +149,26 @@
             _account->setDisplayName(displayName);
         }
 
-        if(_account->credentialsId() == 0) {
-            qDebug() << "storeToken() : creating new Identity for account " << _account->id() ;
-            identity = Identity::newIdentity();
+        if (credentialsId == 0) {
+            if(_account->credentialsId() == 0) {
+                qDebug() << "storeToken() : creating new Identity for account " << _account->id() ;
+                identity = Identity::newIdentity();
+            } else {
+                qDebug() << "storeToken(): identity found.";
+                identity = Identity::existingIdentity(_account->credentialsId());
+            }
+
+            Q_ASSERT(identity != NULL);
+
+            connect(identity, SIGNAL(error(const SignOn::Error&)),
+                    this, SLOT(handleError(const SignOn::Error&)));
+            connect(identity, SIGNAL(credentialsStored(const quint32)),
+                    this, SLOT(handleCredentialsStored(const quint32)));
+
+            identity->storeCredentials();
         } else {
-            qDebug() << "storeToken(): identity found.";
-            identity = Identity::existingIdentity(_account->credentialsId());
+            handleCredentialsStored(credentialsId);
         }
-
-        Q_ASSERT(identity != NULL);
-
-        connect(identity, SIGNAL(error(const SignOn::Error&)),
-                this, SLOT(handleError(const SignOn::Error&)));
-        connect(identity, SIGNAL(credentialsStored(const quint32)),
-                this, SLOT(handleCredentialsStored(const quint32)));
-
-        IdentityInfo info = IdentityInfo();
-
-        info.setSecret(token.toQuery(), true);
-        info.setAccessControlList(QStringList() << "unconfined");
-        identity->storeCredentials(info);
     }
 
     void Keyring::handleAccountRemoved()
 
=== modified file 'libubuntuoneauth/keyring.h'
--- libubuntuoneauth/keyring.h	2016-04-21 09:25:58 +0000
+++ libubuntuoneauth/keyring.h	2016-06-21 17:27:01 +0000
@@ -38,22 +38,24 @@
         void findToken();
         void storeToken(Token token);
         void storeToken(Token token, const QString& displayName);
-        void deleteToken();
+        void storeToken(Token token, const QString& displayName,
+                        quint32 credentialsId);
+        Q_DECL_DEPRECATED void deleteToken();
 
     Q_SIGNALS:
         void tokenFound(const Token& token);
         void tokenNotFound();
         void tokenStored();
-        void tokenDeleted();
+        Q_DECL_DEPRECATED void tokenDeleted();
 
         void keyringError(QString message);
 
     private Q_SLOTS:
         void handleError(const SignOn::Error &error);
-        void handleSessionData(const SignOn::SessionData &data);
+        Q_DECL_DEPRECATED void handleSessionData(const SignOn::SessionData &data);
         void handleCredentialsStored(const quint32 id);
-        void handleAccountRemoved();
-        void handleDeleteError(const SignOn::Error &error);
+        Q_DECL_DEPRECATED void handleAccountRemoved();
+        Q_DECL_DEPRECATED void handleDeleteError(const SignOn::Error &error);
 
     private:
         Accounts::Manager _manager;
 
=== modified file 'libubuntuoneauth/libubuntuoneauth.symbols'
--- libubuntuoneauth/libubuntuoneauth.symbols	2013-07-22 15:54:02 +0000
+++ libubuntuoneauth/libubuntuoneauth.symbols	2016-06-21 17:27:01 +0000
@@ -1,7 +1,8 @@
 {
   global:
     extern "C++" {
-      *UbuntuOne::*;
+      UbuntuOne::*;
+      *for?UbuntuOne::*;
     };
     qt_*;
   local:
 
=== modified file 'libubuntuoneauth/ssoservice.cpp'
--- libubuntuoneauth/ssoservice.cpp	2016-04-19 15:04:15 +0000
+++ libubuntuoneauth/ssoservice.cpp	2016-06-21 17:27:01 +0000
@@ -22,6 +22,7 @@
 #include <QNetworkRequest>
 #include <QUrlQuery>
 
+#include "authenticator.h"
 #include "logging.h"
 #include "ssoservice.h"
 #include "requests.h"
@@ -45,8 +46,6 @@
 
         // create the keyring that will be used to store and retrieve the different tokens
         _keyring = new Keyring(this);
-        _nam = new QNetworkAccessManager(this);
-
         connect(_keyring, SIGNAL(tokenFound(const Token&)),
                 this, SLOT(handleCredentialsFound(const Token&)));
         connect(_keyring, SIGNAL(tokenNotFound()),
@@ -54,18 +53,9 @@
 
         connect(_keyring, SIGNAL(tokenStored()),
                 this, SLOT(handleTokenStored()));
-        connect(_keyring, SIGNAL(tokenDeleted()),
-                this, SLOT(handleTokenDeleted()));
-
         connect(_keyring, SIGNAL(keyringError(QString)),
                 this, SLOT(handleKeyringError(QString)));
 
-        connect(_nam, SIGNAL(finished(QNetworkReply*)),
-                this, SLOT(accountPinged(QNetworkReply*)));
-
-        connect(&(_provider),
-                SIGNAL(OAuthTokenGranted(const OAuthTokenResponse&)),
-                this, SLOT(tokenReceived(const OAuthTokenResponse&)));
         connect(&(_provider),
                 SIGNAL(AccountGranted(const AccountResponse&)),
                 this, SLOT(accountRegistered(const AccountResponse&)));
@@ -116,12 +106,35 @@
 
     void SSOService::login(QString email, QString password, QString twoFactorCode)
     {
-        OAuthTokenRequest request(getAuthBaseUrl(),
-                                  email, password,
-                                  Token::buildTokenName(), twoFactorCode);
-        _tempEmail = email;
-
-        _provider.GetOAuthToken(request);
+        using namespace Internal;
+
+        // Keep this here for now to ensure ABI compat.
+        OAuthTokenRequest request;
+
+        auto authenticator = new Authenticator;
+        /* The caller of this API is assumed to have his own UI, so no support
+         * from SignOn UI is needed or even desired. */
+        authenticator->setUiAllowed(false);
+
+        connect(authenticator, &Authenticator::authenticated,
+                [=](const Token &token) {
+            _keyring->storeToken(token, email, authenticator->credentialsId());
+            authenticator->deleteLater();
+        });
+        connect(authenticator, &Authenticator::error,
+                [=](Authenticator::ErrorCode code, const QString& message) {
+            if (code == Authenticator::AccountNotFound) {
+                Q_EMIT requestFailed(ErrorResponse(0, "", "LOGIN_FAILED", message));
+            } else if (code == Authenticator::OneTimePasswordRequired) {
+                Q_EMIT twoFactorAuthRequired();
+            } else {
+                /* TODO: deliver a proper error response. */
+                Q_EMIT requestFailed(ErrorResponse(400, "", "LOGIN_FAILED", message));
+            }
+            authenticator->deleteLater();
+        });
+        authenticator->authenticate(Token::buildTokenName(),
+                                    email, password, twoFactorCode);
     }
 
     void SSOService::handleTwoFactorAuthRequired()
@@ -160,7 +173,29 @@
 
     void SSOService::invalidateCredentials()
     {
-        _keyring->deleteToken();
+        using namespace Internal;
+
+        auto authenticator = new Authenticator;
+        /* The caller of this API is assumed to have his own UI, so no support
+         * from SignOn UI is needed or even desired. */
+        authenticator->setUiAllowed(false);
+
+        connect(authenticator, &Authenticator::authenticated,
+                [=](const Token &token) {
+            Q_EMIT credentialsFound(token);
+            authenticator->deleteLater();
+        });
+        connect(authenticator, &Authenticator::error,
+                [=](Authenticator::ErrorCode code, const QString& message) {
+            if (code == Authenticator::AccountNotFound) {
+                Q_EMIT credentialsNotFound();
+            } else {
+                /* TODO: deliver a proper error response. */
+                Q_EMIT requestFailed(ErrorResponse(400, "", "LOGIN_FAILED", message));
+            }
+            authenticator->deleteLater();
+        });
+        authenticator->invalidateCredentials();
     }
 
     void SSOService::errorOccurred(const ErrorResponse& error)
 
=== modified file 'libubuntuoneauth/ssoservice.h'
--- libubuntuoneauth/ssoservice.h	2016-04-21 09:25:58 +0000
+++ libubuntuoneauth/ssoservice.h	2016-06-21 17:27:01 +0000
@@ -58,10 +58,10 @@
         private slots:
             void accountPinged(QNetworkReply*);
             void handleTokenStored();
-            void handleTokenDeleted() { emit credentialsDeleted(); };
+            Q_DECL_DEPRECATED void handleTokenDeleted() { emit credentialsDeleted(); };
             void handleCredentialsFound(const Token& token);
             void handleCredentialsNotFound();
-            void tokenReceived(const OAuthTokenResponse& token);
+            Q_DECL_DEPRECATED void tokenReceived(const OAuthTokenResponse& token);
             void accountRegistered(const AccountResponse& account);
             void errorOccurred(const ErrorResponse&);
             void handleTwoFactorAuthRequired();
 
=== modified file 'signon-plugin/tests/test_plugin.cpp'
--- signon-plugin/tests/test_plugin.cpp	2016-05-27 18:14:38 +0000
+++ signon-plugin/tests/test_plugin.cpp	2016-06-21 17:27:01 +0000
@@ -150,7 +150,6 @@
     void testPluginMechanisms();
     void testStoredToken_data();
     void testStoredToken();
-    void testUserInteraction();
     void testTokenCreation_data();
     void testTokenCreation();
 
@@ -223,7 +222,6 @@
 {
     QTest::addColumn<QVariantMap>("sessionData");
     QTest::addColumn<int>("expectedErrorCode");
-    QTest::addColumn<bool>("uiExpected");
     QTest::addColumn<QVariantMap>("expectedResponse");
     QTest::addColumn<QVariantMap>("expectedStore");
 
@@ -233,23 +231,8 @@
 
     QTest::newRow("empty") <<
         sessionData.toMap() <<
-        -1 <<
-        true << QVariantMap() << QVariantMap();
-
-    sessionData.setTokenName("helloworld");
-    sessionData.setSecret("consumer_key=aAa&consumer_secret=bBb&name=helloworld&token=cCc&token_secret=dDd");
-    response.setConsumerKey("aAa");
-    response.setConsumerSecret("bBb");
-    response.setTokenKey("cCc");
-    response.setTokenSecret("dDd");
-    QVariantMap storedData;
-    storedData[sessionData.TokenName()] = response.toMap();
-    stored.setStoredData(storedData);
-    response.setTokenName(sessionData.TokenName());
-    QTest::newRow("in secret, valid") <<
-        sessionData.toMap() <<
-        -1 <<
-        false << response.toMap() << stored.toMap();
+        103 <<
+        QVariantMap() << QVariantMap();
 
     sessionData = UbuntuOne::PluginData();
     QString tokenName = UbuntuOne::Token::buildTokenName();
@@ -268,18 +251,46 @@
     response.setTokenSecret("ts");
     response.setTokenName(tokenName);
     stored = UbuntuOne::PluginData();
-    storedData.clear();
     QTest::newRow("stored, valid") <<
         sessionData.toMap() <<
         -1 <<
-        false << response.toMap() << stored.toMap();
+        response.toMap() << stored.toMap();
+
+    sessionData = UbuntuOne::PluginData();
+    sessionData.setStoredData(QVariantMap {
+        { tokenName, QVariantMap {
+            { "ConsumerKey", "ck" },
+            { "ConsumerSecret", "cs" },
+            { "TokenKey", "tk" },
+            { "TokenSecret", "ts" },
+        }},
+    });
+    sessionData.setInvalidateToken(true);
+    response = UbuntuOne::PluginData();
+    stored = UbuntuOne::PluginData();
+    QVariantMap storedData;
+    stored.setStoredData(storedData);
+    QTest::newRow("clearing token") <<
+        sessionData.toMap() <<
+        -1 <<
+        response.toMap() << stored.toMap();
+
+    sessionData = UbuntuOne::PluginData();
+    sessionData.setSecret("consumer_key=aAa&consumer_secret=bBb&name=helloworld&token=cCc&token_secret=dDd");
+    response = UbuntuOne::PluginData();
+    response.setTokenName(tokenName);
+    stored = UbuntuOne::PluginData();
+    stored.setStoredData(QVariantMap());
+    QTest::newRow("in secret, clearing") <<
+        sessionData.toMap() <<
+        -1 <<
+        response.toMap() << stored.toMap();
 }
 
 void PluginTest::testStoredToken()
 {
     QFETCH(QVariantMap, sessionData);
     QFETCH(int, expectedErrorCode);
-    QFETCH(bool, uiExpected);
     QFETCH(QVariantMap, expectedResponse);
     QFETCH(QVariantMap, expectedStore);
 
@@ -292,7 +303,7 @@
     m_testPlugin->process(sessionData, "ubuntuone");
     if (expectedErrorCode < 0) {
         QCOMPARE(error.count(), 0);
-        QTRY_COMPARE(userActionRequired.count(), uiExpected ? 1 : 0);
+        QTRY_COMPARE(userActionRequired.count(), 0);
         if (!expectedResponse.isEmpty()) {
             QTRY_COMPARE(result.count(), 1);
             QVariantMap resp = result.at(0).at(0).value<SessionData>().toMap();
@@ -316,66 +327,6 @@
     }
 }
 
-void PluginTest::testUserInteraction()
-{
-    QSignalSpy result(m_testPlugin, SIGNAL(result(const SignOn::SessionData&)));
-    QSignalSpy error(m_testPlugin, SIGNAL(error(const SignOn::Error &)));
-    QSignalSpy userActionRequired(m_testPlugin,
-                                  SIGNAL(userActionRequired(const SignOn::UiSessionData&)));
-    QSignalSpy store(m_testPlugin, SIGNAL(store(const SignOn::SessionData&)));
-
-    TestNetworkAccessManager *nam = new TestNetworkAccessManager;
-    m_testPlugin->m_networkAccessManager = nam;
-
-    UbuntuOne::PluginData sessionData;
-    sessionData.setTokenName("helloworld");
-    sessionData.setUserName("[e-mail]");
-    m_testPlugin->process(sessionData, "ubuntuone");
-
-    QTRY_COMPARE(userActionRequired.count(), 1);
-    QVariantMap data =
-        userActionRequired.at(0).at(0).value<UiSessionData>().toMap();
-    /* We want the title to be there, but we don't care about its value here */
-    QVERIFY(data.contains(SSOUI_KEY_TITLE));
-    data.remove(SSOUI_KEY_TITLE);
-    QVariantMap expectedUserInteraction;
-    expectedUserInteraction[SSOUI_KEY_USERNAME] = "[e-mail]";
-    expectedUserInteraction[SSOUI_KEY_QUERYPASSWORD] = true;
-    QCOMPARE(data, expectedUserInteraction);
-    userActionRequired.clear();
-
-    /* Prepare network reply */
-    TestNetworkReply *reply = new TestNetworkReply(this);
-    reply->setStatusCode(401);
-    reply->setContent("{\n"
-                      "  \"code\": \"TWOFACTOR_REQUIRED\",\n"
-                      "  \"message\": \"This account requires 2-factor authentication.\",\n"
-                      "  \"extra\": {}\n"
-                      "}");
-    nam->setNextReply(reply);
-
-    QVariantMap userReply;
-    userReply[SSOUI_KEY_USERNAME] = "[e-mail]";
-    userReply[SSOUI_KEY_PASSWORD] = "s3cr3t";
-    m_testPlugin->userActionFinished(userReply);
-
-    /* Again the plugin should request user interaction, as OTP is required */
-    QTRY_COMPARE(userActionRequired.count(), 1);
-    data = userActionRequired.at(0).at(0).value<UiSessionData>().toMap();
-    expectedUserInteraction.clear();
-    expectedUserInteraction[SSOUI_KEY_USERNAME] = "[e-mail]";
-    expectedUserInteraction[SSOUI_KEY_PASSWORD] = "s3cr3t";
-    expectedUserInteraction[SSOUI_KEY_QUERY2FA] = true;
-    /* We want the map to contain the SSOUI_KEY_2FA_TEXT, but we don't care
-     * about the value */
-    QVERIFY(data.contains(SSOUI_KEY_2FA_TEXT));
-    data.remove(SSOUI_KEY_2FA_TEXT);
-    /* Same goes for the title */
-    QVERIFY(data.contains(SSOUI_KEY_TITLE));
-    data.remove(SSOUI_KEY_TITLE);
-    QCOMPARE(data, expectedUserInteraction);
-}
-
 void PluginTest::testTokenCreation_data()
 {
     QTest::addColumn<QVariantMap>("sessionData");
@@ -385,12 +336,10 @@
     QTest::addColumn<int>("expectedErrorCode");
     QTest::addColumn<QVariantMap>("expectedResponse");
     QTest::addColumn<QVariantMap>("expectedStore");
-    QTest::addColumn<QVariantMap>("expectedUserInteraction");
 
     UbuntuOne::PluginData sessionData;
     UbuntuOne::PluginData response;
     UbuntuOne::PluginData stored;
-    QVariantMap userInteraction;
 
     // Successful creation, with password only
     sessionData.setTokenName("helloworld");
@@ -420,7 +369,7 @@
                        "  \"date_updated\": \"2013-01-11 12:43:23\"\n"
                        "}") <<
         -1 <<
-        response.toMap() << stored.toMap() << userInteraction;
+        response.toMap() << stored.toMap();
     sessionData = UbuntuOne::PluginData();
     response = UbuntuOne::PluginData();
     stored = UbuntuOne::PluginData();
@@ -430,8 +379,6 @@
     sessionData.setTokenName("helloworld");
     sessionData.setUserName("[e-mail]");
     sessionData.setSecret("s3cr3t");
-    userInteraction[SSOUI_KEY_USERNAME] = "[e-mail]";
-    userInteraction[SSOUI_KEY_QUERYPASSWORD] = true;
     QTest::newRow("wrong password") <<
         sessionData.toMap() <<
         -1 <<
@@ -441,28 +388,8 @@
                        "  \"extra\": {}\n"
                        "}") <<
         -1 <<
-        response.toMap() << stored.toMap() << userInteraction;
-    sessionData = UbuntuOne::PluginData();
-    userInteraction.clear();
-
-    // Empty username
-    sessionData.setTokenName("helloworld");
-    sessionData.setSecret("s3cr3t");
-    userInteraction[SSOUI_KEY_QUERYUSERNAME] = true;
-    userInteraction[SSOUI_KEY_USERNAME] = "";
-    userInteraction[SSOUI_KEY_QUERYPASSWORD] = true;
-    QTest::newRow("empty username") <<
-        sessionData.toMap() <<
-        -1 <<
-        401 << QString("{\n"
-                       "  \"code\": \"INVALID_CREDENTIALS\",\n"
-                       "  \"message\": \"Missing username\",\n"
-                       "  \"extra\": {}\n"
-                       "}") <<
-        -1 <<
-        response.toMap() << stored.toMap() << userInteraction;
-    sessionData = UbuntuOne::PluginData();
-    userInteraction.clear();
+        response.toMap() << stored.toMap();
+    sessionData = UbuntuOne::PluginData();
 
     // Network error while creating token
     sessionData.setTokenName("helloworld");
@@ -473,14 +400,13 @@
         int(QNetworkReply::SslHandshakeFailedError) <<
         -1 << QString() <<
         int(SignOn::Error::Ssl) <<
-        response.toMap() << stored.toMap() << userInteraction;
+        response.toMap() << stored.toMap();
     sessionData = UbuntuOne::PluginData();
 
     // Account needs reset
     sessionData.setTokenName("helloworld");
     sessionData.setUserName("[e-mail]");
     sessionData.setSecret("s3cr3t");
-    userInteraction[SSOUI_KEY_OPENURL] = "http://www.example.com/reset";
     QTest::newRow("reset needed") <<
         sessionData.toMap() <<
         -1 <<
@@ -492,9 +418,8 @@
                        "  }\n"
                        "}") <<
         -1 <<
-        response.toMap() << stored.toMap() << userInteraction;
+        response.toMap() << stored.toMap();
     sessionData = UbuntuOne::PluginData();
-    userInteraction.clear();
 }
 
 void PluginTest::testTokenCreation()
@@ -506,7 +431,6 @@
     QFETCH(int, expectedErrorCode);
     QFETCH(QVariantMap, expectedResponse);
     QFETCH(QVariantMap, expectedStore);
-    QFETCH(QVariantMap, expectedUserInteraction);
 
     QSignalSpy result(m_testPlugin, SIGNAL(result(const SignOn::SessionData&)));
     QSignalSpy error(m_testPlugin, SIGNAL(error(const SignOn::Error &)));
@@ -530,16 +454,7 @@
 
     m_testPlugin->process(sessionData, "ubuntuone");
     if (expectedErrorCode < 0) {
-        if (!expectedUserInteraction.isEmpty()) {
-            QTRY_COMPARE(userActionRequired.count(), 1);
-            QVariantMap data =
-                userActionRequired.at(0).at(0).value<UiSessionData>().toMap();
-            /* We don't care about the title here */
-            data.remove(SSOUI_KEY_TITLE);
-            QCOMPARE(data, expectedUserInteraction);
-        } else {
-            QCOMPARE(userActionRequired.count(), 0);
-        }
+        QCOMPARE(userActionRequired.count(), 0);
 
         if (!expectedResponse.isEmpty()) {
             QTRY_COMPARE(result.count(), 1);
 
=== modified file 'signon-plugin/ubuntuone-plugin.cpp'
--- signon-plugin/ubuntuone-plugin.cpp	2016-05-27 15:36:40 +0000
+++ signon-plugin/ubuntuone-plugin.cpp	2016-06-21 17:27:01 +0000
@@ -69,62 +69,17 @@
     {
     }
 
-    bool SignOnPlugin::respondWithStoredData()
+    void SignOnPlugin::respondWithStoredData()
     {
         QVariantMap storedData = m_data.StoredData();
 
-        /* When U1 was using the password plugin, it was storing the token data
-         * in the password field. So, if we don't have any data stored in the
-         * plugin's data, try to get a token from the password field.
-         */
-        if (storedData.isEmpty() && !m_data.Secret().isEmpty()) {
-            Token *token = Token::fromQuery(m_data.Secret());
-            if (token->isValid()) {
-                PluginData tokenData;
-                tokenData.setConsumerKey(token->consumerKey());
-                tokenData.setConsumerSecret(token->consumerSecret());
-                tokenData.setTokenKey(token->tokenKey());
-                tokenData.setTokenSecret(token->tokenSecret());
-                QDateTime time = token->updated();
-                if (time.isValid()) {
-                    tokenData.setDateUpdated(time.toString(Qt::ISODate));
-                }
-                time = token->created();
-                if (time.isValid()) {
-                    tokenData.setDateCreated(time.toString(Qt::ISODate));
-                }
-                storedData[token->name()] = tokenData.toMap();
-                PluginData pluginData;
-                pluginData.setStoredData(storedData);
-                Q_EMIT store(pluginData);
-
-                /* We know that the given secret is a valid token, so it cannot
-                 * be a valid password as well: let's clear it out now, so that
-                 * if it turns out that the token is no longer valid and that
-                 * we need to create a new one, we won't make a useless attempt
-                 * to create one with a wrong password.
-                 */
-                m_data.setSecret(QString());
-            }
-            delete token;
-        } else {
-            /* Always use the same token name for now */
-            m_data.setTokenName(Token::buildTokenName());
-        }
+        /* Always use the same token name for now */
+        m_data.setTokenName(Token::buildTokenName());
 
         /* Check if we have stored data for this token name */
         PluginData tokenData(storedData[m_data.TokenName()].toMap());
-        Token token(tokenData.TokenKey(), tokenData.TokenSecret(),
-                    tokenData.ConsumerKey(), tokenData.ConsumerSecret(),
-                    tokenData.DateCreated(), tokenData.DateUpdated());
-        if (!token.isValid()) {
-            return false;
-        }
-        qDebug() << "Token is valid!" << tokenData.TokenKey();
-
         tokenData.setTokenName(m_data.TokenName());
         Q_EMIT result(tokenData);
-        return true;
     }
 
     void SignOnPlugin::emitErrorFromReply(QNetworkReply *reply)
@@ -145,6 +100,13 @@
         Q_EMIT error(SignOn::Error(type, reply->errorString()));
     }
 
+    void SignOnPlugin::clearToken() {
+        qDebug() << "Clearing stored token";
+        PluginData pluginData;
+        pluginData.setStoredData(QVariantMap());
+        Q_EMIT store(pluginData);
+    }
+
     void SignOnPlugin::process(const SignOn::SessionData &inData,
                                const QString &mechanism)
     {
@@ -158,15 +120,23 @@
         PluginData response;
         m_data = inData.data<PluginData>();
 
-        /* It may be that the stored token is valid; however, do the check only
-         * if no OTP was provided (since the presence of an OTP is a clear
-         * signal that the caller wants to get a new token). */
-        if (m_data.OneTimePassword().isEmpty() &&
-            respondWithStoredData()) {
-            return;
+        if (!m_data.UserName().isEmpty() && !m_data.Secret().isEmpty()) {
+            createNewToken();
+        } else if (m_data.InvalidateToken()) {
+            clearToken();
+        } else if (m_data.StoredData().isEmpty() && m_data.UserName().isEmpty() && !m_data.Secret().isEmpty()) {
+            /* If there's a secret stored in password field, clear it, and
+             * respond with the empty token result, as if it's invalid.
+             */
+            m_data.setSecret(QString());
+            clearToken();
+            respondWithStoredData();
+        } else if (!m_data.StoredData().isEmpty()) {
+            respondWithStoredData();
+        } else {
+            Q_EMIT error(SignOn::Error(SignOn::Error::InvalidQuery,
+                                       "invalid query parameters"));
         }
-
-        getCredentialsAndCreateNewToken();
     }
 
     void SignOnPlugin::onCreationFinished()
@@ -180,8 +150,6 @@
         QJsonDocument json = QJsonDocument::fromJson(data);
         QJsonObject object = json.object();
 
-        QString error = object.value("code").toString();
-
         int statusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
         qDebug() << "Status code:" << statusCode;
         if (statusCode == 200 || statusCode == 201) {
@@ -203,27 +171,22 @@
             Q_EMIT store(pluginData);
 
             Q_EMIT result(token);
-        } else if (statusCode == 401 && error == ERR_INVALID_CREDENTIALS) {
-            m_data.setSecret(QString());
-            m_data.setOneTimePassword(QString());
-            getCredentialsAndCreateNewToken();
-        } else if (statusCode == 401 && error == ERR_TWOFACTOR_REQUIRED) {
-            m_needsOtp = true;
-            getCredentialsAndCreateNewToken();
-        } else if (statusCode == 403 && error == ERR_TWOFACTOR_FAILURE) {
-            m_data.setOneTimePassword(QString());
-            getCredentialsAndCreateNewToken();
-        } else if (statusCode == 403 && error == ERR_PASSWORD_POLICY_ERROR) {
-            QVariantMap data;
-            QJsonObject extra = object.value("extra").toObject();
-            data[SSOUI_KEY_OPENURL] = extra.value("location").toString();
-            Q_EMIT userActionRequired(data);
-        } else if (error == ERR_INVALID_DATA) {
-            // This error is received when the email address is invalid
-            m_data.setUserName(QString());
-            m_data.setSecret(QString());
-            m_data.setOneTimePassword(QString());
-            getCredentialsAndCreateNewToken();
+        } else if (statusCode == 401 || statusCode == 403) {
+            QString error = object.value("code").toString();
+            QString message = object.value("message").toString();
+
+            PluginData errorData;
+            if (error == ERR_TWOFACTOR_REQUIRED) {
+                errorData.setU1ErrorCode(PluginData::OneTimePasswordRequired);
+            } else {
+                errorData.setU1ErrorCode(PluginData::InvalidPassword);
+            }
+            errorData.setU1ErrorMessage(message);
+
+            // Emit a result with error data since this seems to be the
+            // only feasible way to get error messages from server back up
+            // to the UI.
+            Q_EMIT result(errorData);
         } else {
             emitErrorFromReply(reply);
         }
@@ -250,94 +213,5 @@
                          this, SLOT(onCreationFinished()));
     }
 
-    void SignOnPlugin::getCredentialsAndCreateNewToken()
-    {
-        if (!m_data.Secret().isEmpty() &&
-            (!m_needsOtp || !m_data.OneTimePassword().isEmpty())) {
-            createNewToken();
-        } else if (m_data.Secret().isEmpty()) {
-            QVariantMap data;
-            data[SSOUI_KEY_TITLE] =
-                QString::fromUtf8(_("Sign in to your Ubuntu One account"));
-            if (m_data.UserName().isEmpty()) {
-                data[SSOUI_KEY_QUERYUSERNAME] = true;
-            }
-            data[SSOUI_KEY_USERNAME] = m_data.UserName();
-            data[SSOUI_KEY_QUERYPASSWORD] = true;
-            m_didAskForPassword = true;
-            Q_EMIT userActionRequired(data);
-        } else {
-            QVariantMap data;
-            data[SSOUI_KEY_TITLE] =
-                QString::fromUtf8(_("Sign in to your Ubuntu One account"));
-            data[SSOUI_KEY_USERNAME] = m_data.UserName();
-            data[SSOUI_KEY_PASSWORD] = m_data.Secret();
-            data[SSOUI_KEY_QUERY2FA] = true;
-            data[SSOUI_KEY_2FA_TEXT] =
-                QString::fromUtf8(_("2-factor device code"));
-            Q_EMIT userActionRequired(data);
-        }
-    }
-
-    bool SignOnPlugin::handleUiError(const SignOn::UiSessionData &data)
-    {
-        using namespace SignOn;
-
-        int code = data.QueryErrorCode();
-        if (code == QUERY_ERROR_NONE) {
-            return false;
-        }
-
-        qDebug() << "userActionFinished with error: " << code;
-        if (code == QUERY_ERROR_CANCELED) {
-            Q_EMIT error(Error(Error::SessionCanceled,
-                               QLatin1String("Cancelled by user")));
-        } else if (code == QUERY_ERROR_NETWORK) {
-            Q_EMIT error(Error(Error::Network, QLatin1String("Network error")));
-        } else if (code == QUERY_ERROR_SSL) {
-            Q_EMIT error(Error(Error::Ssl, QLatin1String("SSL error")));
-        } else {
-            QVariantMap map = data.toMap();
-            if (map.contains(SSOUI_KEY_QUERY2FA)) {
-                PluginData reply;
-                reply.setU1ErrorCode(PluginData::OneTimePasswordRequired);
-                Q_EMIT result(reply);
-            } else if (map.contains(SSOUI_KEY_QUERYPASSWORD)) {
-                PluginData reply;
-                reply.setU1ErrorCode(PluginData::InvalidPassword);
-                Q_EMIT result(reply);
-            } else {
-                Q_EMIT error(Error(Error::UserInteraction,
-                                   QString("userActionFinished error: ")
-                                   + QString::number(data.QueryErrorCode())));
-            }
-        }
-        return true;
-    }
-
-    void SignOnPlugin::userActionFinished(const SignOn::UiSessionData &data)
-    {
-        if (handleUiError(data)) {
-            return;
-        }
-
-        PluginData uiData = data.data<PluginData>();
-        if (!uiData.UserName().isEmpty()) {
-            m_data.setUserName(uiData.UserName());
-        }
-
-        if (!uiData.Secret().isEmpty()) {
-            m_data.setSecret(uiData.Secret());
-        }
-
-        QVariantMap map = data.toMap();
-        QString oneTimePassword = map.value(SSOUI_KEY_2FA).toString();
-        if (!oneTimePassword.isEmpty()) {
-            m_data.setOneTimePassword(oneTimePassword);
-        }
-
-        getCredentialsAndCreateNewToken();
-    }
-
     SIGNON_DECL_AUTH_PLUGIN(SignOnPlugin)
 } // namespace UbuntuOne
 
=== modified file 'signon-plugin/ubuntuone-plugin.h'
--- signon-plugin/ubuntuone-plugin.h	2016-05-24 20:57:27 +0000
+++ signon-plugin/ubuntuone-plugin.h	2016-06-21 17:27:01 +0000
@@ -51,14 +51,12 @@
         void cancel() Q_DECL_OVERRIDE;
         void process(const SignOn::SessionData &inData,
                      const QString &mechanism = 0) Q_DECL_OVERRIDE;
-        void userActionFinished(const SignOn::UiSessionData &data) Q_DECL_OVERRIDE;
 
     private:
-        bool respondWithStoredData();
+        void respondWithStoredData();
         void emitErrorFromReply(QNetworkReply *reply);
+        void clearToken();
         void createNewToken();
-        void getCredentialsAndCreateNewToken();
-        bool handleUiError(const SignOn::UiSessionData &data);
 
     private Q_SLOTS:
         void onCreationFinished();
 
=== modified file 'signon-plugin/ubuntuonedata.h'
--- signon-plugin/ubuntuonedata.h	2016-04-27 08:36:19 +0000
+++ signon-plugin/ubuntuonedata.h	2016-06-21 17:27:01 +0000
@@ -46,6 +46,10 @@
         SIGNON_SESSION_DECLARE_PROPERTY(QString, DateCreated);
         SIGNON_SESSION_DECLARE_PROPERTY(QString, DateUpdated);
 
+        // Set this to true if the token returned by the previous
+        // authentication is invalid.
+        SIGNON_SESSION_DECLARE_PROPERTY(bool, InvalidateToken);
+
         // Error code
         enum ErrorCode {
             NoError = 0,
@@ -53,6 +57,7 @@
             InvalidPassword,
         };
         SIGNON_SESSION_DECLARE_PROPERTY(int, U1ErrorCode);
+        SIGNON_SESSION_DECLARE_PROPERTY(QString, U1ErrorMessage);
 
         // Data which the plugin has stored into signond
         SIGNON_SESSION_DECLARE_PROPERTY(QVariantMap, StoredData);