1 /*
2 * Copyright (C) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "auth_token_signer.h"
17
18 #include "securec.h"
19
20 #include "adaptor_log.h"
21 #include "adaptor_time.h"
22 #include "idm_database.h"
23
24 #ifdef IAM_TEST_ENABLE
25 #define IAM_STATIC
26 #else
27 #define IAM_STATIC static
28 #endif
29
GetAuthTokenDataPlain(const UserAuthContext * context,uint32_t authMode,TokenDataPlain * dataPlain)30 IAM_STATIC ResultCode GetAuthTokenDataPlain(
31 const UserAuthContext *context, uint32_t authMode, TokenDataPlain *dataPlain)
32 {
33 if (memcpy_s(dataPlain->challenge, CHALLENGE_LEN, context->challenge, CHALLENGE_LEN) != EOK) {
34 LOG_ERROR("failed to copy challenge");
35 return RESULT_BAD_COPY;
36 }
37 dataPlain->time = GetSystemTime();
38 dataPlain->authTrustLevel = context->authTrustLevel;
39 dataPlain->authType = context->authType;
40 dataPlain->authMode = authMode;
41 if (IsAllZero(context->collectorUdid, UDID_LEN)) {
42 dataPlain->tokenType = TOKEN_TYPE_LOCAL_AUTH;
43 } else {
44 dataPlain->tokenType = TOKEN_TYPE_COAUTH;
45 }
46 return RESULT_SUCCESS;
47 }
48
GetAuthTokenDataToEncrypt(const UserAuthContext * context,uint64_t credentialId,TokenDataToEncrypt * data)49 IAM_STATIC ResultCode GetAuthTokenDataToEncrypt(const UserAuthContext *context, uint64_t credentialId,
50 TokenDataToEncrypt *data)
51 {
52 EnrolledInfoHal enrolledInfo = {};
53 ResultCode ret = GetEnrolledInfoAuthType(context->userId, context->authType, &enrolledInfo);
54 if (ret != RESULT_SUCCESS) {
55 LOG_ERROR("get enrolled info failed");
56 return ret;
57 }
58 uint64_t secureUid;
59 ret = GetSecureUid(context->userId, &secureUid);
60 if (ret != RESULT_SUCCESS) {
61 LOG_ERROR("get secure uid failed");
62 return ret;
63 }
64 data->userId = context->userId;
65 data->secureUid = secureUid;
66 data->enrolledId = enrolledInfo.enrolledId;
67 data->credentialId = credentialId;
68 if (IsAllZero(context->collectorUdid, UDID_LEN)) {
69 if (memcpy_s(data->collectorUdid, sizeof(data->collectorUdid),
70 context->localUdid, sizeof(context->localUdid)) != EOK) {
71 LOG_ERROR("copy collectorUdid failed");
72 return RESULT_GENERAL_ERROR;
73 }
74 } else {
75 if (memcpy_s(data->collectorUdid, sizeof(data->collectorUdid),
76 context->collectorUdid, sizeof(context->collectorUdid)) != EOK) {
77 LOG_ERROR("copy collectorUdid failed");
78 return RESULT_GENERAL_ERROR;
79 }
80 }
81
82 if (memcpy_s(data->verifierUdid, sizeof(data->verifierUdid),
83 context->localUdid, sizeof(context->localUdid)) != EOK) {
84 LOG_ERROR("copy verifierUdid failed");
85 return RESULT_GENERAL_ERROR;
86 }
87 return RESULT_SUCCESS;
88 }
89
GetAuthTokenDataAndSign(const UserAuthContext * context,uint64_t credentialId,uint32_t authMode,UserAuthTokenHal * authToken)90 ResultCode GetAuthTokenDataAndSign(
91 const UserAuthContext *context, uint64_t credentialId, uint32_t authMode, UserAuthTokenHal *authToken)
92 {
93 if ((context == NULL) || (authToken == NULL)) {
94 LOG_ERROR("bad param");
95 return RESULT_BAD_PARAM;
96 }
97 (void)memset_s(authToken, sizeof(UserAuthTokenHal), 0, sizeof(UserAuthTokenHal));
98
99 UserAuthTokenPlainHal tokenPlain = {};
100 ResultCode ret = GetAuthTokenDataPlain(context, authMode, &(tokenPlain.tokenDataPlain));
101 if (ret != RESULT_SUCCESS) {
102 LOG_ERROR("GetAuthTokenDataPlain fail");
103 return ret;
104 }
105 ret = GetAuthTokenDataToEncrypt(context, credentialId, &(tokenPlain.tokenDataToEncrypt));
106 if (ret != RESULT_SUCCESS) {
107 LOG_ERROR("GetAuthTokenDataToEncrypt fail");
108 return ret;
109 }
110 ret = UserAuthTokenSign(&tokenPlain, authToken);
111 if (ret != RESULT_SUCCESS) {
112 LOG_ERROR("UserAuthTokenSign fail");
113 return ret;
114 }
115 return RESULT_SUCCESS;
116 }
117