func getAccessToken(c *api.Context, w http.ResponseWriter, r *http.Request) { if !utils.Cfg.ServiceSettings.EnableOAuthServiceProvider { c.Err = model.NewAppError("getAccessToken", "The system admin has turned off OAuth service providing.", "") c.Err.StatusCode = http.StatusNotImplemented return } c.LogAudit("attempt") r.ParseForm() grantType := r.FormValue("grant_type") if grantType != model.ACCESS_TOKEN_GRANT_TYPE { c.Err = model.NewAppError("getAccessToken", "invalid_request: Bad grant_type", "") return } clientId := r.FormValue("client_id") if len(clientId) != 26 { c.Err = model.NewAppError("getAccessToken", "invalid_request: Bad client_id", "") return } secret := r.FormValue("client_secret") if len(secret) == 0 { c.Err = model.NewAppError("getAccessToken", "invalid_request: Missing client_secret", "") return } code := r.FormValue("code") if len(code) == 0 { c.Err = model.NewAppError("getAccessToken", "invalid_request: Missing code", "") return } redirectUri := r.FormValue("redirect_uri") achan := api.Srv.Store.OAuth().GetApp(clientId) tchan := api.Srv.Store.OAuth().GetAccessDataByAuthCode(code) authData := api.GetAuthData(code) if authData == nil { c.LogAudit("fail - invalid auth code") c.Err = model.NewAppError("getAccessToken", "invalid_grant: Invalid or expired authorization code", "") return } uchan := api.Srv.Store.User().Get(authData.UserId) if authData.IsExpired() { c.LogAudit("fail - auth code expired") c.Err = model.NewAppError("getAccessToken", "invalid_grant: Invalid or expired authorization code", "") return } if authData.RedirectUri != redirectUri { c.LogAudit("fail - redirect uri provided did not match previous redirect uri") c.Err = model.NewAppError("getAccessToken", "invalid_request: Supplied redirect_uri does not match authorization code redirect_uri", "") return } if !model.ComparePassword(code, fmt.Sprintf("%v:%v:%v:%v", clientId, redirectUri, authData.CreateAt, authData.UserId)) { c.LogAudit("fail - auth code is invalid") c.Err = model.NewAppError("getAccessToken", "invalid_grant: Invalid or expired authorization code", "") return } var app *model.OAuthApp if result := <-achan; result.Err != nil { c.Err = model.NewAppError("getAccessToken", "invalid_client: Invalid client credentials", "") return } else { app = result.Data.(*model.OAuthApp) } if !model.ComparePassword(app.ClientSecret, secret) { c.LogAudit("fail - invalid client credentials") c.Err = model.NewAppError("getAccessToken", "invalid_client: Invalid client credentials", "") return } callback := redirectUri if len(callback) == 0 { callback = app.CallbackUrls[0] } if result := <-tchan; result.Err != nil { c.Err = model.NewAppError("getAccessToken", "server_error: Encountered internal server error while accessing database", "") return } else if result.Data != nil { c.LogAudit("fail - auth code has been used previously") accessData := result.Data.(*model.AccessData) // Revoke access token, related auth code, and session from DB as well as from cache if err := api.RevokeAccessToken(accessData.Token); err != nil { l4g.Error("Encountered an error revoking an access token, err=" + err.Message) } c.Err = model.NewAppError("getAccessToken", "invalid_grant: Authorization code already exchanged for an access token", "") return } var user *model.User if result := <-uchan; result.Err != nil { c.Err = model.NewAppError("getAccessToken", "server_error: Encountered internal server error while pulling user from database", "") return } else { user = result.Data.(*model.User) } session := &model.Session{UserId: user.Id, TeamId: user.TeamId, Roles: user.Roles, IsOAuth: true} if result := <-api.Srv.Store.Session().Save(session); result.Err != nil { c.Err = model.NewAppError("getAccessToken", "server_error: Encountered internal server error while saving session to database", "") return } else { session = result.Data.(*model.Session) api.AddSessionToCache(session) } accessData := &model.AccessData{AuthCode: authData.Code, Token: session.Token, RedirectUri: callback} if result := <-api.Srv.Store.OAuth().SaveAccessData(accessData); result.Err != nil { l4g.Error(result.Err) c.Err = model.NewAppError("getAccessToken", "server_error: Encountered internal server error while saving access token to database", "") return } accessRsp := &model.AccessResponse{AccessToken: session.Token, TokenType: model.ACCESS_TOKEN_TYPE, ExpiresIn: model.SESSION_TIME_OAUTH_IN_SECS} w.Header().Set("Content-Type", "application/json") w.Header().Set("Cache-Control", "no-store") w.Header().Set("Pragma", "no-cache") c.LogAuditWithUserId(user.Id, "success") w.Write([]byte(accessRsp.ToJson())) }
func getAccessToken(c *api.Context, w http.ResponseWriter, r *http.Request) { if !utils.Cfg.ServiceSettings.EnableOAuthServiceProvider { c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.disabled.app_error", nil, "") c.Err.StatusCode = http.StatusNotImplemented return } c.LogAudit("attempt") r.ParseForm() grantType := r.FormValue("grant_type") if grantType != model.ACCESS_TOKEN_GRANT_TYPE { c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.bad_grant.app_error", nil, "") return } clientId := r.FormValue("client_id") if len(clientId) != 26 { c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.bad_client_id.app_error", nil, "") return } secret := r.FormValue("client_secret") if len(secret) == 0 { c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.bad_client_secret.app_error", nil, "") return } code := r.FormValue("code") if len(code) == 0 { c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.missing_code.app_error", nil, "") return } redirectUri := r.FormValue("redirect_uri") achan := api.Srv.Store.OAuth().GetApp(clientId) tchan := api.Srv.Store.OAuth().GetAccessDataByAuthCode(code) authData := api.GetAuthData(code) if authData == nil { c.LogAudit("fail - invalid auth code") c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.expired_code.app_error", nil, "") return } uchan := api.Srv.Store.User().Get(authData.UserId) if authData.IsExpired() { c.LogAudit("fail - auth code expired") c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.expired_code.app_error", nil, "") return } if authData.RedirectUri != redirectUri { c.LogAudit("fail - redirect uri provided did not match previous redirect uri") c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.redirect_uri.app_error", nil, "") return } if !model.ComparePassword(code, fmt.Sprintf("%v:%v:%v:%v", clientId, redirectUri, authData.CreateAt, authData.UserId)) { c.LogAudit("fail - auth code is invalid") c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.expired_code.app_error", nil, "") return } var app *model.OAuthApp if result := <-achan; result.Err != nil { c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.credentials.app_error", nil, "") return } else { app = result.Data.(*model.OAuthApp) } if !model.ComparePassword(app.ClientSecret, secret) { c.LogAudit("fail - invalid client credentials") c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.credentials.app_error", nil, "") return } callback := redirectUri if len(callback) == 0 { callback = app.CallbackUrls[0] } if result := <-tchan; result.Err != nil { c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.internal.app_error", nil, "") return } else if result.Data != nil { c.LogAudit("fail - auth code has been used previously") accessData := result.Data.(*model.AccessData) // Revoke access token, related auth code, and session from DB as well as from cache if err := api.RevokeAccessToken(accessData.Token); err != nil { l4g.Error(utils.T("web.get_access_token.revoking.error") + err.Message) } c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.exchanged.app_error", nil, "") return } var user *model.User if result := <-uchan; result.Err != nil { c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.internal_user.app_error", nil, "") return } else { user = result.Data.(*model.User) } session := &model.Session{UserId: user.Id, TeamId: user.TeamId, Roles: user.Roles, IsOAuth: true} if result := <-api.Srv.Store.Session().Save(session); result.Err != nil { c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.internal_session.app_error", nil, "") return } else { session = result.Data.(*model.Session) api.AddSessionToCache(session) } accessData := &model.AccessData{AuthCode: authData.Code, Token: session.Token, RedirectUri: callback} if result := <-api.Srv.Store.OAuth().SaveAccessData(accessData); result.Err != nil { l4g.Error(result.Err) c.Err = model.NewLocAppError("getAccessToken", "web.get_access_token.internal_saving.app_error", nil, "") return } accessRsp := &model.AccessResponse{AccessToken: session.Token, TokenType: model.ACCESS_TOKEN_TYPE, ExpiresIn: int32(*utils.Cfg.ServiceSettings.SessionLengthSSOInDays * 60 * 60 * 24)} w.Header().Set("Content-Type", "application/json") w.Header().Set("Cache-Control", "no-store") w.Header().Set("Pragma", "no-cache") c.LogAuditWithUserId(user.Id, "success") w.Write([]byte(accessRsp.ToJson())) }