sdk/fidl/fuchsia.auth/auth_provider.fidl

// Copyright 2017 The Fuchsia Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

library fuchsia.auth;

using fuchsia.ui.views;

// This file defines an auth provider service that can be used by Garnet's
// Token Manager service to mint oauth tokens for clients such as Framework,
// Ledger, gmail or chat module.

/// Specifies the success/failure status from auth provider.
enum AuthProviderStatus {
    OK = 0;
    BAD_REQUEST = 1;
    BAD_RESPONSE = 2;
    OAUTH_SERVER_ERROR = 3;
    USER_CANCELLED = 4;
    REAUTH_REQUIRED = 5;
    NETWORK_ERROR = 6;
    UNSUPPORTED_PROVIDER = 7;
    INTERNAL_ERROR = 8;
    UNKNOWN_ERROR = 9;
};

/// The type of token returned.
enum TokenType {
    ACCESS_TOKEN = 0;
    ID_TOKEN = 1;
};

/// OAuth token response populated after parsing JSON object that contains
/// short-lived access token or id token returned by the auth provider.
struct AuthToken {
    /// Type of token.
    TokenType token_type;

    /// Contains access token or a JWT identity token.
    string token;

    /// The remaining lifetime of the token in seconds.
    uint64 expires_in;
};

/// Stores attributes related to a firebase auth token for a given firebase api
/// key.
///
/// These tokens are minted by Firebase Auth server and are meant to be used for
/// authorizing users into Firebase services such as DB and storage.
struct FirebaseToken {
    /// Use this as the auth token in firebase database and storage requests.
    string id_token;

    /// Use this to uniquely identify users.
    string? local_id;

    /// Use this to uniquely identify user's email address provided by the
    /// Auth Provider Firebase server.
    string? email;

    /// The remaining lifetime of the token in seconds.
    uint64 expires_in;
};

/// Challenge response returned by the auth provider during remote attestation
/// based authentication.
struct AuthChallenge {
    /// The value of nonce to be used for the next token refresh request
    string challenge;

    /// The lifetime of `challenge` in seconds.
    uint64 expires_in;
};

/// Stores Elliptic Curve public key parameters of the credential key.
struct CredentialECKey {
    /// Supported elliptic curve value used in JWT attestation. Refer to Section
    /// 6.2.1.1 of RFC7518 for the canonical list of supported elliptic curves.
    /// For example:(P-256,P-384,P-521)
    string curve;

    /// Value of x of the generated EC key
    string key_x_val;

    /// Value of y of the generated EC key
    string key_y_val;

    /// Base64 encoded SHA256 hash of the EC public key
    string fingerprint_sha_256;
};

/// Contains parameters required by the auth provider component to build
/// attestation JWTs.
struct AttestationJWTParams {
    /// Contains the ephemeral Elliptic curve credential public key which will be
    /// bound to the newly generated refresh token grant.
    CredentialECKey credential_eckey;

    /// The full chain of certificates from the device attestation certificate
    /// to the root certificate that was registered on the OAuth client id.
    /// Each string should be base64-encoded DER PKIX certificate value.
    vector<string> certificate_chain;

    /// OAuth authorization code bound to the given user and device
    string auth_code;
};

/// Contains parameters required by the auth provider to build assertion JWTs.
struct AssertionJWTParams {
    /// Contains Elliptic curve credential public key which is bound to existing
    /// refresh token.
    CredentialECKey credential_eckey;

    /// An optional challenge that could be used for the next token refresh request
    string? challenge;
};

/// User attributes returned to callers on authorizing a new user at any auth
/// provider. These attributes are generated by calling the auth provider's
/// user profile apis.
struct UserProfileInfo {
    /// User identifier returned by the backend identity provider server to
    /// identify the user after successful authorization. Some identity providers
    /// send verified email address as the identifier, and some send an opaque
    /// string as the user identifier.
    string id;

    /// The name that is displayed on the base shell while logging in. Display
    /// name is fetched from user profile attributes as configured by the user at
    /// the given identity provider.
    string? display_name;

    /// User's profile url that is used by the base shell while logging in.
    /// Profile url is fetched from user profile attributes as configured by the
    /// user at the given identity provider.
    string? url;

    /// User's profile image url that is used by the base shell while logging in.
    /// Profile image url is fetched from user profile attributes as configured by
    /// the user at the given identity provider.
    string? image_url;
};

/// This interface is implemented by base shell. It is used to notify the
/// base shell that a view for login needs to be started / stopped.
protocol AuthenticationUIContext {
    /// Requests base shell to display `view_holder_token` for authentication.
    /// Another call to StartOverlay() will not be made until StopOverlay()
    /// has been called.
    StartOverlay(fuchsia.ui.views.ViewHolderToken view_holder_token);

    /// Requests base shell to stop displaying the auth view.
    StopOverlay();
};

/// OAuth identity service that provisions new users and provides authorization
/// tokens for the currently enrolled users. Some common Auth Providers are
/// Google, Facebook, Spotify and Twitter.
[Discoverable]
protocol AuthProvider {
    /// Authenticates and authorizes a user against an auth provider backend system
    /// using the OAuth protocol and returns the persistent credential such as
    /// Google's refresh token or Facebook's access token for this user. These
    /// persistent credentials are long lived and their expiration time is set by
    /// the identity provider, for example Google's refresh tokens are valid until
    /// the user changes their password or revokes access explicitly, whereas
    /// Facebook access tokens are valid for up to 60 days or until the user
    /// revokes access.
    ///
    /// During OAuth handshake, user needs to explicitly consent to the permissions
    /// as configured at the server. The consent is presented in a web_view using
    /// an `auth_ui_context` overlay provided by the base_shell.
    ///
    /// An optional `user_profile_id` is provided for simplifying reauthorization
    /// flow.
    GetPersistentCredential(AuthenticationUIContext? auth_ui_context,
                            string? user_profile_id)
        -> (AuthProviderStatus status, string? credential,
            UserProfileInfo? user_profile_info);

    /// Exchanges a persistent user `credential` for a short lived app specific
    /// OAuth access token for the specified `client_id` and `scopes`. The
    /// `credential` is a long lived OAuth token as generated by the external
    /// identity provider in the above GetPersistentCredential() call. If no
    /// client_id is specified a default will be used.
    ///
    /// Access tokens are used by applications to make API requests against
    /// services offered by the Auth Provider.
    ///
    /// Returns an `auth_token` response containing an access token, if successful.
    /// Otherwise, an error status is returned.
    GetAppAccessToken(string credential, string? client_id,
                      vector<string> scopes)
        -> (AuthProviderStatus status, AuthToken? auth_token);

    /// Exchanges a persistent user `credential` for an OAuth Identity token for
    /// the specified `audience`. The audience is the intended recipient of the
    /// id_token. The `credential` is a long lived OAuth token as generated by the
    /// external identity provider in the above GetPersistentCredential() call.
    ///
    /// OAuth Id tokens are JSON Web Tokens (JWT) that contains digitally signed
    /// identity information about the user for the intended recipient.
    ///
    /// Returns an `auth_token` response containing an id token, if successful.
    /// Otherwise, an error status is returned.
    GetAppIdToken(string credential, string? audience)
        -> (AuthProviderStatus status, AuthToken? auth_token);

    /// Gets a firebase auth token for the user identified by `id_token` and the
    /// requested |firebase_api key|. The `id_token` is a JWT Identity token
    /// returned from GetAppIdToken() call above.
    ///
    /// Returns a `firebase_token` from the server if successful. Otherwise, an
    /// error status is returned.
    GetAppFirebaseToken(string id_token, string firebase_api_key)
        -> (AuthProviderStatus status, FirebaseToken? firebase_token);

    /// Revokes user's grants at the Auth Provider by revoking a credential. The
    /// `credential` is either a long lived OAuth token as returned by the
    /// GetPersistentCredential() call or an app specific access token as returned
    /// by the GetAppAccessToken() call.
    RevokeAppOrPersistentCredential(string credential)
        -> (AuthProviderStatus status);

    /// Authenticates and authorizes a user against a remote attestation based
    /// auth provider backend system that mints bound persistent credentials.
    ///
    /// This method is capable of performing user authorization directly on the
    /// device or use the OAuth authorization code generated out-of-band on a
    /// secondary device that is sent over a secure channel to the target device.
    /// In the latter case, auth_code generated out-of-band is passed as an
    /// argument in the attestation `jwt_params`. Where as in the former case,
    /// user needs to explicitly consent to the permissions on the target device
    /// and the auth_code is returned to the device directly. The consent is
    /// presented in a web_view using an `auth_ui_context` overlay provided by the
    /// base_shell. An optional `user_profile_id` is provided for simplifying
    /// reauthorization flow.
    ///
    /// The authorization code is exchanged to a bound refresh token using an
    /// attestation JWT constructed from `jwt_params` and is signed by the
    /// `attestation_signer` component passed in the request.
    ///
    /// If the operation is successful, a long-lived `credential` that is bound to
    /// the originating device is returned along with an optional `auth_token`
    /// containing short-lived access token and an optional `nonce` that is used on
    /// next token exchange request. An optional `user_profile_info` containing
    /// user profile attributes is also returned if successful. Otherwise, an error
    /// status is returned.
    GetPersistentCredentialFromAttestationJWT(
        AttestationSigner attestation_signer, AttestationJWTParams jwt_params,
        AuthenticationUIContext? auth_ui_context,
        string? user_profile_id)
        -> (AuthProviderStatus status, string? credential, AuthToken? auth_token,
            AuthChallenge? auth_challenge, UserProfileInfo? user_profile_info);

    /// Exchanges a bound persistent user `credential` for a short lived app
    /// specific OAuth access token using the specified assertion JWT. The
    /// assertion JWT is constructed from `jwt_params` and is signed by the
    /// `attestation_signer` component passed in the request.
    ///
    /// Access tokens are used by applications to make API requests against
    /// services offered by the Auth Provider.
    ///
    /// Returns an `auth_token` response containing an access token and an optional
    /// `updated_credential` and `auth_challenge` to be used on next token refresh
    /// request, if successful. Otherwise, an error status is returned.
    GetAppAccessTokenFromAssertionJWT(AttestationSigner attestation_signer,
                                      AssertionJWTParams jwt_params, string credential,
                                      vector<string> scopes)
        -> (AuthProviderStatus status, string? updated_credential,
            AuthToken? auth_token, AuthChallenge? auth_challenge);

    // TODO(ukode): Add methods for bound IDToken and FirebaseToken.
};