sso_mib_tokens.c

/*
 * SPDX-License-Identifier: Apache-2.0
 * SPDX-FileCopyrightText: Copyright 2025 Siemens
 */
 
#include <sso-mib/sso-mib.h>
#include <freerdp/crypto/crypto.h>
#include <winpr/json.h>
#include <winpr/string.h>
 
#include "sso_mib_tokens.h"
 
#include <freerdp/log.h>
#define TAG CLIENT_TAG("common.sso")
 
enum sso_mib_state
{
  SSO_MIB_STATE_INIT = 0,
  SSO_MIB_STATE_FAILED = 1,
  SSO_MIB_STATE_SUCCESS = 2,
};
 
struct MIBClientWrapper
{
  MIBClientApp* app;
  enum sso_mib_state state;
  pGetCommonAccessToken GetCommonAccessToken;
};
 
WINPR_ATTR_NODISCARD
static BOOL sso_mib_get_avd_access_token(rdpClientContext* client_context, char** token)
{
  WINPR_ASSERT(client_context);
  WINPR_ASSERT(client_context->mibClientWrapper);
  WINPR_ASSERT(client_context->mibClientWrapper->app);
  WINPR_ASSERT(token);
 
  MIBAccount* account = nullptr;
  GSList* scopes = nullptr;
 
  BOOL rc = FALSE;
  *token = nullptr;
 
  account = mib_client_app_get_account_by_upn(client_context->mibClientWrapper->app, nullptr);
  if (!account)
  {
    goto cleanup;
  }
 
  scopes = g_slist_append(scopes, g_strdup("https://www.wvd.microsoft.com/.default"));
 
  MIBPrt* prt = mib_client_app_acquire_token_silent(client_context->mibClientWrapper->app,
                                                    account, scopes, nullptr, nullptr, nullptr);
  if (prt)
  {
    const char* access_token = mib_prt_get_access_token(prt);
    if (access_token)
    {
      *token = strdup(access_token);
    }
    g_object_unref(prt);
  }
 
  rc = TRUE && *token != nullptr;
cleanup:
  if (account)
    g_object_unref(account);
  g_slist_free_full(scopes, g_free);
  return rc;
}
 
WINPR_ATTR_NODISCARD
static BOOL sso_mib_get_rdsaad_access_token(rdpClientContext* client_context, const char* scope,
                                            const char* req_cnf, char** token)
{
  WINPR_ASSERT(client_context);
  WINPR_ASSERT(client_context->mibClientWrapper);
  WINPR_ASSERT(client_context->mibClientWrapper->app);
  WINPR_ASSERT(scope);
  WINPR_ASSERT(token);
  WINPR_ASSERT(req_cnf);
 
  GSList* scopes = nullptr;
  WINPR_JSON* json = nullptr;
  MIBPopParams* params = nullptr;
 
  BOOL rc = FALSE;
  *token = nullptr;
  BYTE* req_cnf_dec = nullptr;
  size_t req_cnf_dec_len = 0;
 
  scopes = g_slist_append(scopes, g_strdup(scope));
 
  // Parse the "kid" element from req_cnf
  crypto_base64_decode(req_cnf, strlen(req_cnf), &req_cnf_dec, &req_cnf_dec_len);
  if (!req_cnf_dec)
  {
    goto cleanup;
  }
 
  json = WINPR_JSON_Parse((const char*)req_cnf_dec);
  if (!json)
  {
    goto cleanup;
  }
  WINPR_JSON* prop = WINPR_JSON_GetObjectItemCaseSensitive(json, "kid");
  if (!prop)
  {
    goto cleanup;
  }
  const char* kid = WINPR_JSON_GetStringValue(prop);
  if (!kid)
  {
    goto cleanup;
  }
 
  params = mib_pop_params_new(MIB_AUTH_SCHEME_POP, MIB_REQUEST_METHOD_GET, "");
  mib_pop_params_set_kid(params, kid);
  MIBPrt* prt = mib_client_app_acquire_token_interactive(client_context->mibClientWrapper->app,
                                                         scopes, MIB_PROMPT_NONE, nullptr,
                                                         nullptr, nullptr, params);
  if (prt)
  {
    const gchar* str = mib_prt_get_access_token(prt);
    if (str)
      *token = strdup(str);
    rc = *token != nullptr;
    g_object_unref(prt);
  }
 
cleanup:
  if (params)
    g_object_unref(params);
  WINPR_JSON_Delete(json);
  free(req_cnf_dec);
  g_slist_free_full(scopes, g_free);
  return rc;
}
 
WINPR_ATTR_NODISCARD
static BOOL sso_mib_get_access_token(rdpContext* context, AccessTokenType tokenType, char** token,
                                     size_t count, ...)
{
  BOOL rc = FALSE;
  rdpClientContext* client_context = (rdpClientContext*)context;
  WINPR_ASSERT(client_context);
  WINPR_ASSERT(client_context->mibClientWrapper);
 
  if (!client_context->mibClientWrapper->app)
  {
    const char* client_id =
        freerdp_settings_get_string(context->settings, FreeRDP_GatewayAvdClientID);
 
    /* Build the authority from the configured AAD host and tenant (see
     * freerdp_utils_aad_get_wellknown) so broker SSO works against sovereign clouds
     * (e.g. login.microsoftonline.us). Defaults resolve to MIB_AUTHORITY_COMMON. */
    const char* base =
        freerdp_settings_get_string(context->settings, FreeRDP_GatewayAzureActiveDirectory);
    const BOOL useTenant =
        freerdp_settings_get_bool(context->settings, FreeRDP_GatewayAvdUseTenantid);
    const char* tenantid = "common";
    if (useTenant)
      tenantid =
          freerdp_settings_get_string(context->settings, FreeRDP_GatewayAvdAadtenantid);
 
    char* authority = nullptr;
    if (base && tenantid)
    {
      size_t len = 0;
      winpr_asprintf(&authority, &len, "https://%s/%s", base, tenantid);
      if (!authority)
        return FALSE;
    }
 
    client_context->mibClientWrapper->app = mib_public_client_app_new(
        client_id, authority ? authority : MIB_AUTHORITY_COMMON, nullptr, nullptr);
    free(authority);
  }
 
  if (!client_context->mibClientWrapper->app)
    return FALSE;
 
  const char* scope = nullptr;
  const char* req_cnf = nullptr;
 
  va_list ap = WINPR_C_ARRAY_INIT;
  va_start(ap, count);
 
  if (tokenType == ACCESS_TOKEN_TYPE_AAD)
  {
    scope = va_arg(ap, const char*);
    req_cnf = va_arg(ap, const char*);
  }
 
  if ((client_context->mibClientWrapper->state == SSO_MIB_STATE_INIT) ||
      (client_context->mibClientWrapper->state == SSO_MIB_STATE_SUCCESS))
  {
    switch (tokenType)
    {
      case ACCESS_TOKEN_TYPE_AVD:
      {
        rc = sso_mib_get_avd_access_token(client_context, token);
        if (rc)
          client_context->mibClientWrapper->state = SSO_MIB_STATE_SUCCESS;
        else
        {
          WLog_WARN(TAG, "Getting AVD token from identity broker failed, falling back to "
                         "browser-based authentication.");
          client_context->mibClientWrapper->state = SSO_MIB_STATE_FAILED;
        }
      }
      break;
      case ACCESS_TOKEN_TYPE_AAD:
      {
        // Setup scope without URL encoding for sso-mib
        char* scope_copy = winpr_str_url_decode(scope, strlen(scope));
        if (!scope_copy)
          WLog_ERR(TAG, "Failed to decode scope");
        else
        {
          rc =
              sso_mib_get_rdsaad_access_token(client_context, scope_copy, req_cnf, token);
          free(scope_copy);
          if (rc)
            client_context->mibClientWrapper->state = SSO_MIB_STATE_SUCCESS;
          else
          {
            WLog_WARN(TAG,
                      "Getting RDS token from identity broker failed, falling back to "
                      "browser-based authentication.");
            client_context->mibClientWrapper->state = SSO_MIB_STATE_FAILED;
          }
        }
      }
      break;
      default:
        break;
    }
  }
  if (!rc && client_context->mibClientWrapper->GetCommonAccessToken)
    rc = client_context->mibClientWrapper->GetCommonAccessToken(context, tokenType, token,
                                                                count, scope, req_cnf);
  va_end(ap);
 
  return rc;
}
 
MIBClientWrapper* sso_mib_new(rdpContext* context)
{
 
  MIBClientWrapper* mibClientWrapper = (MIBClientWrapper*)calloc(1, sizeof(MIBClientWrapper));
  if (!mibClientWrapper)
    return nullptr;
 
  mibClientWrapper->GetCommonAccessToken = freerdp_get_common_access_token(context);
  if (!freerdp_set_common_access_token(context, sso_mib_get_access_token))
  {
    sso_mib_free(mibClientWrapper);
    return nullptr;
  }
  mibClientWrapper->state = SSO_MIB_STATE_INIT;
  return mibClientWrapper;
}
 
void sso_mib_free(MIBClientWrapper* sso)
{
  if (!sso)
    return;
 
  if (sso->app)
    g_object_unref(sso->app);
 
  free(sso);
}