Merge lp:~roadmr/canonical-identity-provider/bulk-caveat-id-macaroon-discharge into lp:canonical-identity-provider/release

[Daniel Manrique]

lalala

[lp:~roadmr/canonical-identity-provider/bulk-caveat-id-macaroon-discharge]

1593. By Daniel Manrique on 2018-01-25

Test for mixed caveat_ids: a good one and a bogus, corrupty one

1594. By Daniel Manrique on 2018-01-25

Small simplification of test

1595. By Daniel Manrique on 2018-01-26

Documentation for the discharge endpoint explaining the single/multiple caveat_id flow.

Didn't document the old "root_macaroon(s)" API on purpose because it's deprecated and consumers
should NOT use it.

1596. By Daniel Manrique on 2018-01-26

Ahh, so that's what simple_macaroon is for

Unmerged revisions

1596. By Daniel Manrique on 2018-01-26

Ahh, so that's what simple_macaroon is for

1595. By Daniel Manrique on 2018-01-26

Documentation for the discharge endpoint explaining the single/multiple caveat_id flow.

Didn't document the old "root_macaroon(s)" API on purpose because it's deprecated and consumers
should NOT use it.

1594. By Daniel Manrique on 2018-01-25

Small simplification of test

1593. By Daniel Manrique on 2018-01-25

Test for mixed caveat_ids: a good one and a bogus, corrupty one

1592. By Daniel Manrique on 2018-01-23

Allow sending multiple caveat_ids to MacaroonDischargeHandler.

The semantics are similar to the old macaroons parameter (contrast with
macaroon). A new payload parameter caveat_ids is supported, should receive
a list of lists/tuples with numeric_id/caveat_id and should send back a
list of numeric_id/3rd_party_discharge (or a nice error) for each.

1591. By Daniel Manrique on 2018-01-23

Test for multiple 'good' caveat_id macaroon discharging

=== modified file 'docs/login.txt'
--- docs/login.txt	2013-12-04 13:49:39 +0000
+++ docs/login.txt	2018-01-26 19:53:09 +0000
@@ -1,8 +1,16 @@
 .. vim: ft=rst
 
+=====
 Login
 =====
 
+API-based logins return a token for the client to use in subsequent requests to
+prove its identity and authorization. The token can be in one of two formats: either
+an OAuth token or a discharge macaroon.
+
+OAuth
+=====
+
 Login is performed by creating an :ref:`OAuth token <token_oauth>` resource.
 Refer to :ref:`"Create an oauth token" <token_oauth-create>` for details.
 
@@ -15,3 +23,62 @@
         -H 'Content-Type: application/json' \
         -X POST \
         https://login.ubuntu.com/api/v2/tokens/oauth
+
+Macaroon
+========
+
+In this case, logging in returns one or more discharge macaroons which satisfy
+the given 3rd-party caveats. The macaroons can be presented along with the
+corresponding root macaroon to complete requests in services which require SSO
+authentication.
+
+Two ways of using this mechanism are supported:
+
+1. Provide a single extracted caveat_id with the "caveat_id" parameter. A
+   single "discharge_macaroon" will be returned.
+2. Provide a list of caveat_ids with the "caveat_ids" parameter. The list
+   should consist of N sub-lists, each with two elements: an identifier and the
+   corresponding serialized caveat_id. A "discharge_macaroons" list will be
+   returned. It will contain N sub-lists, with the given identifiers and the
+   corresponding discharge for each caveat_id. If any of the caveat_ids is
+   invalid, a global "invalid-data" error code will be returned.
+
+
+
+Examples
+--------
+Single caveat_id request:
+
+.. code-block:: bash
+
+   curl -d '{"email": "[e-mail]", "password": "thepassword", "otp": "1234567","caveat_id":"serialized-caveat-id"}' \
+        -H 'Content-Type: application/json' \
+        -X POST \
+        https://login.ubuntu.com/api/v2/tokens/discharge
+
+Response:
+
+.. sourcecode:: json
+
+   {
+     "discharge_macaroon": "a-serialized-discharge-macaroon"
+   }
+
+Multiple caveat_id request:
+
+.. code-block:: bash
+
+   curl -d '{"email": "[e-mail]", "password": "thepassword", "otp": "1234567","caveat_ids": [[0, "serialized-caveat-id-0"], [1, "serialized-caveat-id-1"]]}' \
+        -H 'Content-Type: application/json' \
+        -X POST \
+        https://login.ubuntu.com/api/v2/tokens/discharge
+
+Response:
+
+.. sourcecode:: json
+
+   {
+     "discharge_macaroons": [[0, "serialized-discharge-macaroon-0"], [1, "serialized-discharge-macaroon-1"]]
+   }
+
+

=== modified file 'src/api/v20/handlers.py'
--- src/api/v20/handlers.py	2018-01-23 17:38:47 +0000
+++ src/api/v20/handlers.py	2018-01-26 19:53:09 +0000
@@ -501,7 +501,14 @@
             simple_macaroon = True
             root_macaroons_info = None
             caveat_id = data['caveat_id']
+            caveat_ids = None
             stats.increment('macaroon.discharge', key='caveat_id')
+        elif 'caveat_ids' in data:
+            simple_macaroon = False
+            root_macaroons_info = None
+            caveat_id = None
+            caveat_ids = data['caveat_ids']
+            stats.increment('macaroon.discharge', key='multi_caveat_ids')
         else:
             # let's flag the new one only, not the deprecated ones
             missing = {'caveat_id': [FIELD_REQUIRED]}
@@ -545,9 +552,16 @@
             return response
 
         try:
-            if root_macaroons_info is None:
+            if root_macaroons_info is None and caveat_id:
                 discharge = auth.build_discharge_macaroon(account, caveat_id)
                 all_discharges = [(None, discharge.serialize())]
+            elif root_macaroons_info is None and caveat_ids:
+                # Multiple
+                all_discharges = []
+                for mac_id, a_caveat_id in caveat_ids:
+                    discharge = auth.build_discharge_macaroon(
+                        account, a_caveat_id)
+                    all_discharges.append((mac_id, discharge.serialize()))
             else:
                 # 2016-05-03: this is deprecated, just supporting it until
                 # no more clients send root macaroon(s)
@@ -564,8 +578,10 @@
 
         response = rc.ALL_OK
         if simple_macaroon:
+            # either caveat_id or macaroon
             response.content = dict(discharge_macaroon=all_discharges[0][1])
         else:
+            # either caveat_ids or macaroons
             response.content = dict(discharge_macaroons=all_discharges)
 
         log_type = AuthLogType.API_MACAROON_DISCHARGE_NEW

=== modified file 'src/api/v20/tests/test_handlers.py'
--- src/api/v20/tests/test_handlers.py	2018-01-22 15:15:48 +0000
+++ src/api/v20/tests/test_handlers.py	2018-01-26 19:53:09 +0000
@@ -2784,6 +2784,49 @@
                                  expected_status_code=400,
                                  check_login_failed=False)
 
+    def test_multiple_caveat_ids_discharges_created(self):
+        # build *several* macaroons and send them all at once
+        roots, rkeys, _ = zip(*[
+            self.build_macaroon(version=1) for _ in range(3)])
+        ids = range(3)
+        roots = dict(zip(ids, roots))
+        rkeys = dict(zip(ids, rkeys))
+        caveat_ids = []
+        for mac_id, m in roots.items():
+            (caveat,) = [c for c in m.third_party_caveats()
+                         if c.location == settings.MACAROON_SERVICE_LOCATION]
+            caveat_ids.append((mac_id, caveat.caveat_id))
+        data = dict(email='[e-mail]', password='foobar123',
+                    caveat_ids=caveat_ids)
+        json_body = self.do_post(data=data)
+
+        # get all the discharges and verify their integrity
+        verifying_function = lambda c: True
+        for mac_id, discharge_macaroon_raw in json_body['discharge_macaroons']:
+            discharge_macaroon = Macaroon.deserialize(discharge_macaroon_raw)
+            root_macaroon = roots[mac_id]
+            key = rkeys[mac_id]
+            discharge_macaroon = root_macaroon.prepare_for_request(
+                discharge_macaroon)
+            v = Verifier()
+            v.satisfy_general(verifying_function)
+            v.verify(root_macaroon, key, [discharge_macaroon])
+
+        self.stats_increment.assert_any_call(
+            'macaroon.discharge', key='multi_caveat_ids')
+
+    def test_multiple_caveat_ids_mixed(self):
+        good_macaroon, _, _ = self.build_macaroon(version=1)
+        (good_caveat,) = [c for c in good_macaroon.third_party_caveats()
+                          if c.location == settings.MACAROON_SERVICE_LOCATION]
+        caveat_ids = [(0, good_caveat.caveat_id),
+                      (1, "A bad caveat id")]
+        data = dict(email='[e-mail]', password='foobar123',
+                    caveat_ids=caveat_ids)
+        self.assert_failed_login('INVALID_DATA', data,
+                                 expected_status_code=400,
+                                 check_login_failed=False)
+
 
 class MacaroonHandlerTimelineTestCase(MacaroonHandlerBaseTestCase,
                                       TimelineActionMixin):