device_oauth2_token_service.h revision 424c4d7b64af9d0d8fd9624f381f469654d5e3d2
1c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// Copyright 2013 The Chromium Authors. All rights reserved. 2c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 3c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// found in the LICENSE file. 4c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 5c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#ifndef CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_OAUTH2_TOKEN_SERVICE_H_ 6c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#define CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_OAUTH2_TOKEN_SERVICE_H_ 7c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 8eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch#include <set> 9c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include <string> 10c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 11c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "base/basictypes.h" 12c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "base/gtest_prod_util.h" 13c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "base/memory/scoped_ptr.h" 14eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch#include "base/stl_util.h" 15eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch#include "base/time/time.h" 16eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch#include "google_apis/gaia/gaia_oauth_client.h" 17424c4d7b64af9d0d8fd9624f381f469654d5e3d2Torne (Richard Coles)#include "google_apis/gaia/oauth2_token_service.h" 18c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "net/url_request/url_request_context_getter.h" 19c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 20c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)namespace net { 21c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)class URLRequestContextGetter; 22c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)} 23c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 24c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)class GoogleServiceAuthError; 25c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)class PrefRegistrySimple; 26c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)class PrefService; 27c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)class Profile; 28c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 29c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)namespace chromeos { 30c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 31c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// DeviceOAuth2TokenService retrieves OAuth2 access tokens for a given 32c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// set of scopes using the device-level OAuth2 any-api refresh token 33c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// obtained during enterprise device enrollment. 34c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// 35c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// See |OAuth2TokenService| for usage details. 36c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// 37c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)// Note that requests must be made from the UI thread. 38c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)class DeviceOAuth2TokenService : public OAuth2TokenService { 39c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) public: 40eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch // Specialization of StartRequest that in parallel validates that the refresh 41eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch // token stored on the device is owned by the device service account. 42eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch virtual scoped_ptr<Request> StartRequest(const ScopeSet& scopes, 43eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch Consumer* consumer) OVERRIDE; 44eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch 45c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) // Persist the given refresh token on the device. Overwrites any previous 46c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) // value. Should only be called during initial device setup. 47c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) void SetAndSaveRefreshToken(const std::string& refresh_token); 48c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 49c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) static void RegisterPrefs(PrefRegistrySimple* registry); 50c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 51c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) virtual std::string GetRefreshToken() OVERRIDE; 52c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 53eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch protected: 54eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch // Pull the robot account ID from device policy. 55eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch virtual std::string GetRobotAccountId(); 56eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch 573551c9c881056c480085172ff9840cab31610854Torne (Richard Coles) // Implementation of OAuth2TokenService. 583551c9c881056c480085172ff9840cab31610854Torne (Richard Coles) virtual net::URLRequestContextGetter* GetRequestContext() OVERRIDE; 593551c9c881056c480085172ff9840cab31610854Torne (Richard Coles) 60c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) private: 61eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch class ValidatingConsumer; 62eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch friend class ValidatingConsumer; 63c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) friend class DeviceOAuth2TokenServiceFactory; 64eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch friend class DeviceOAuth2TokenServiceTest; 65eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch friend class TestDeviceOAuth2TokenService; 66c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 67c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) // Use DeviceOAuth2TokenServiceFactory to get an instance of this class. 68c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) explicit DeviceOAuth2TokenService(net::URLRequestContextGetter* getter, 69c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) PrefService* local_state); 70c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) virtual ~DeviceOAuth2TokenService(); 71c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 72a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles) void OnValidationComplete(bool token_is_valid); 73eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch 74eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch bool refresh_token_is_valid_; 75eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch int max_refresh_token_validation_retries_; 76eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch 77ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch scoped_refptr<net::URLRequestContextGetter> url_request_context_getter_; 78ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch 79c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) // Cache the decrypted refresh token, so we only decrypt once. 80c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) std::string refresh_token_; 81c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) PrefService* local_state_; 82c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) DISALLOW_COPY_AND_ASSIGN(DeviceOAuth2TokenService); 83c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)}; 84c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 85c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)} // namespace chromeos 86c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 87c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#endif // CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_OAUTH2_TOKEN_SERVICE_H_ 88