git.basschouten.com Git - openhab-addons.git/blob

   1 /**
   2  * Copyright (c) 2010-2022 Contributors to the openHAB project
   3  *
   4  * See the NOTICE file(s) distributed with this work for additional
   5  * information.
   6  *
   7  * This program and the accompanying materials are made available under the
   8  * terms of the Eclipse Public License 2.0 which is available at
   9  * http://www.eclipse.org/legal/epl-2.0
  10  *
  11  * SPDX-License-Identifier: EPL-2.0
  12  */
  13 package org.openhab.binding.tesla.internal.handler;
  14
  15 import static org.openhab.binding.tesla.internal.TeslaBindingConstants.*;
  16
  17 import java.security.MessageDigest;
  18 import java.security.NoSuchAlgorithmException;
  19 import java.util.Base64;
  20 import java.util.Iterator;
  21 import java.util.Random;
  22 import java.util.concurrent.ExecutionException;
  23 import java.util.concurrent.TimeUnit;
  24 import java.util.concurrent.TimeoutException;
  25
  26 import org.eclipse.jdt.annotation.NonNullByDefault;
  27 import org.eclipse.jdt.annotation.Nullable;
  28 import org.eclipse.jetty.client.HttpClient;
  29 import org.eclipse.jetty.client.api.ContentResponse;
  30 import org.eclipse.jetty.client.util.FormContentProvider;
  31 import org.eclipse.jetty.client.util.StringContentProvider;
  32 import org.eclipse.jetty.http.HttpHeader;
  33 import org.eclipse.jetty.http.HttpMethod;
  34 import org.eclipse.jetty.util.Fields;
  35 import org.eclipse.jetty.util.Fields.Field;
  36 import org.jsoup.Jsoup;
  37 import org.jsoup.nodes.Document;
  38 import org.jsoup.nodes.Element;
  39 import org.openhab.binding.tesla.internal.protocol.sso.AuthorizationCodeExchangeRequest;
  40 import org.openhab.binding.tesla.internal.protocol.sso.AuthorizationCodeExchangeResponse;
  41 import org.openhab.binding.tesla.internal.protocol.sso.RefreshTokenRequest;
  42 import org.openhab.binding.tesla.internal.protocol.sso.TokenExchangeRequest;
  43 import org.openhab.binding.tesla.internal.protocol.sso.TokenResponse;
  44 import org.slf4j.Logger;
  45 import org.slf4j.LoggerFactory;
  46
  47 import com.google.gson.Gson;
  48
  49 /**
  50  * The {@link TeslaSSOHandler} is responsible for authenticating with the Tesla SSO service.
  51  *
  52  * @author Christian Güdel - Initial contribution
  53  */
  54 @NonNullByDefault
  55 public class TeslaSSOHandler {
  56
  57     private final HttpClient httpClient;
  58     private final Gson gson = new Gson();
  59     private final Logger logger = LoggerFactory.getLogger(TeslaSSOHandler.class);
  60
  61     public TeslaSSOHandler(HttpClient httpClient) {
  62         this.httpClient = httpClient;
  63     }
  64
  65     @Nullable
  66     public TokenResponse getAccessToken(String refreshToken) {
  67         logger.debug("Exchanging SSO refresh token for API access token");
  68
  69         // get a new access token for the owner API token endpoint
  70         RefreshTokenRequest refreshRequest = new RefreshTokenRequest(refreshToken);
  71         String refreshTokenPayload = gson.toJson(refreshRequest);
  72
  73         final org.eclipse.jetty.client.api.Request request = httpClient.newRequest(URI_SSO + "/" + PATH_TOKEN);
  74         request.content(new StringContentProvider(refreshTokenPayload));
  75         request.header(HttpHeader.CONTENT_TYPE, "application/json");
  76         request.method(HttpMethod.POST);
  77
  78         ContentResponse refreshResponse = executeHttpRequest(request);
  79
  80         if (refreshResponse != null && refreshResponse.getStatus() == 200) {
  81             String refreshTokenResponse = refreshResponse.getContentAsString();
  82             TokenResponse tokenResponse = gson.fromJson(refreshTokenResponse.trim(), TokenResponse.class);
  83
  84             if (tokenResponse != null && tokenResponse.access_token != null && !tokenResponse.access_token.isEmpty()) {
  85                 TokenExchangeRequest token = new TokenExchangeRequest();
  86                 String tokenPayload = gson.toJson(token);
  87
  88                 final org.eclipse.jetty.client.api.Request logonRequest = httpClient
  89                         .newRequest(URI_OWNERS + "/" + PATH_ACCESS_TOKEN);
  90                 logonRequest.content(new StringContentProvider(tokenPayload));
  91                 logonRequest.header(HttpHeader.CONTENT_TYPE, "application/json");
  92                 logonRequest.header(HttpHeader.AUTHORIZATION, "Bearer " + tokenResponse.access_token);
  93                 logonRequest.method(HttpMethod.POST);
  94
  95                 ContentResponse logonTokenResponse = executeHttpRequest(logonRequest);
  96
  97                 if (logonTokenResponse != null && logonTokenResponse.getStatus() == 200) {
  98                     String tokenResponsePayload = logonTokenResponse.getContentAsString();
  99                     TokenResponse tr = gson.fromJson(tokenResponsePayload.trim(), TokenResponse.class);
 100
 101                     if (tr != null && tr.token_type != null && !tr.access_token.isEmpty()) {
 102                         return tr;
 103                     }
 104                 } else {
 105                     logger.debug("An error occurred while exchanging SSO access token for API access token: {}",
 106                             (logonTokenResponse != null ? logonTokenResponse.getStatus() : "no response"));
 107                 }
 108             }
 109         } else {
 110             logger.debug("An error occurred during refresh of SSO token: {}",
 111                     (refreshResponse != null ? refreshResponse.getStatus() : "no response"));
 112         }
 113
 114         return null;
 115     }
 116
 117     /**
 118      * Authenticates using username/password against Tesla SSO endpoints.
 119      *
 120      * @param username Username
 121      * @param password Password
 122      * @return Refresh token for use with {@link getAccessToken}
 123      */
 124     @Nullable
 125     public String authenticate(String username, String password) {
 126         String codeVerifier = generateRandomString(86);
 127         String codeChallenge = null;
 128         String state = generateRandomString(10);
 129
 130         try {
 131             codeChallenge = getCodeChallenge(codeVerifier);
 132         } catch (NoSuchAlgorithmException e) {
 133             logger.error("An exception occurred while building login page request: '{}'", e.getMessage());
 134             return null;
 135         }
 136
 137         final org.eclipse.jetty.client.api.Request loginPageRequest = httpClient
 138                 .newRequest(URI_SSO + "/" + PATH_AUTHORIZE);
 139         loginPageRequest.method(HttpMethod.GET);
 140         loginPageRequest.followRedirects(false);
 141
 142         addQueryParameters(loginPageRequest, codeChallenge, state);
 143
 144         ContentResponse loginPageResponse = executeHttpRequest(loginPageRequest);
 145         if (loginPageResponse == null
 146                 || (loginPageResponse.getStatus() != 200 && loginPageResponse.getStatus() != 302)) {
 147             logger.debug("Failed to obtain SSO login page, response status code: {}",
 148                     (loginPageResponse != null ? loginPageResponse.getStatus() : "no response"));
 149             return null;
 150         }
 151
 152         logger.debug("Obtained SSO login page");
 153
 154         String authorizationCode = null;
 155
 156         if (loginPageResponse.getStatus() == 302) {
 157             String redirectLocation = loginPageResponse.getHeaders().get(HttpHeader.LOCATION);
 158             if (isValidRedirectLocation(redirectLocation)) {
 159                 authorizationCode = extractAuthorizationCodeFromUri(redirectLocation);
 160             } else {
 161                 logger.debug("Unexpected redirect location received when fetching login page: {}", redirectLocation);
 162                 return null;
 163             }
 164         } else {
 165             Fields postData = new Fields();
 166
 167             try {
 168                 Document doc = Jsoup.parse(loginPageResponse.getContentAsString());
 169                 logger.trace("{}", doc.toString());
 170                 Element loginForm = doc.getElementsByTag("form").first();
 171
 172                 Iterator<Element> elIt = loginForm.getElementsByTag("input").iterator();
 173                 while (elIt.hasNext()) {
 174                     Element input = elIt.next();
 175                     if (input.attr("type").equalsIgnoreCase("hidden")) {
 176                         postData.add(input.attr("name"), input.attr("value"));
 177                     }
 178                 }
 179             } catch (Exception e) {
 180                 logger.error("Failed to parse login page: {}", e.getMessage());
 181                 logger.debug("login page response {}", loginPageResponse.getContentAsString());
 182                 return null;
 183             }
 184
 185             postData.add("identity", username);
 186             postData.add("credential", password);
 187
 188             final org.eclipse.jetty.client.api.Request formSubmitRequest = httpClient
 189                     .newRequest(URI_SSO + "/" + PATH_AUTHORIZE);
 190             formSubmitRequest.method(HttpMethod.POST);
 191             formSubmitRequest.content(new FormContentProvider(postData));
 192             formSubmitRequest.followRedirects(false); // this should return a 302 ideally, but that location doesn't
 193                                                       // exist
 194             addQueryParameters(formSubmitRequest, codeChallenge, state);
 195
 196             ContentResponse formSubmitResponse = executeHttpRequest(formSubmitRequest);
 197             if (formSubmitResponse == null || formSubmitResponse.getStatus() != 302) {
 198                 logger.debug("Failed to obtain code from SSO login page when submitting form, response status code: {}",
 199                         (formSubmitResponse != null ? formSubmitResponse.getStatus() : "no response"));
 200                 return null;
 201             }
 202
 203             String redirectLocation = formSubmitResponse.getHeaders().get(HttpHeader.LOCATION);
 204             if (!isValidRedirectLocation(redirectLocation)) {
 205                 logger.debug("Redirect location not set or doesn't match expected callback URI {}: {}", URI_CALLBACK,
 206                         redirectLocation);
 207                 return null;
 208             }
 209
 210             logger.debug("Obtained valid redirect location");
 211             authorizationCode = extractAuthorizationCodeFromUri(redirectLocation);
 212         }
 213
 214         if (authorizationCode == null) {
 215             logger.debug("Did not receive an authorization code");
 216             return null;
 217         }
 218
 219         // exchange authorization code for SSO access + refresh token
 220         AuthorizationCodeExchangeRequest request = new AuthorizationCodeExchangeRequest(authorizationCode,
 221                 codeVerifier);
 222         String payload = gson.toJson(request);
 223
 224         final org.eclipse.jetty.client.api.Request tokenExchangeRequest = httpClient
 225                 .newRequest(URI_SSO + "/" + PATH_TOKEN);
 226         tokenExchangeRequest.content(new StringContentProvider(payload));
 227         tokenExchangeRequest.header(HttpHeader.CONTENT_TYPE, "application/json");
 228         tokenExchangeRequest.method(HttpMethod.POST);
 229
 230         ContentResponse response = executeHttpRequest(tokenExchangeRequest);
 231         if (response != null && response.getStatus() == 200) {
 232             String responsePayload = response.getContentAsString();
 233             AuthorizationCodeExchangeResponse ssoTokenResponse = gson.fromJson(responsePayload.trim(),
 234                     AuthorizationCodeExchangeResponse.class);
 235             if (ssoTokenResponse != null && ssoTokenResponse.token_type != null
 236                     && !ssoTokenResponse.access_token.isEmpty()) {
 237                 logger.debug("Obtained valid SSO refresh token");
 238                 return ssoTokenResponse.refresh_token;
 239             }
 240         } else {
 241             logger.debug("An error occurred while exchanging authorization code for SSO refresh token: {}",
 242                     (response != null ? response.getStatus() : "no response"));
 243         }
 244
 245         return null;
 246     }
 247
 248     private Boolean isValidRedirectLocation(@Nullable String redirectLocation) {
 249         return redirectLocation != null && redirectLocation.startsWith(URI_CALLBACK);
 250     }
 251
 252     @Nullable
 253     private String extractAuthorizationCodeFromUri(String uri) {
 254         Field code = httpClient.newRequest(uri).getParams().get("code");
 255         return code != null ? code.getValue() : null;
 256     }
 257
 258     private String getCodeChallenge(String codeVerifier) throws NoSuchAlgorithmException {
 259         MessageDigest digest = MessageDigest.getInstance("SHA-256");
 260         byte[] hash = digest.digest(codeVerifier.getBytes());
 261
 262         StringBuilder hashStr = new StringBuilder(hash.length * 2);
 263         for (byte b : hash) {
 264             hashStr.append(String.format("%02x", b));
 265         }
 266
 267         return Base64.getUrlEncoder().encodeToString(hashStr.toString().getBytes());
 268     }
 269
 270     private String generateRandomString(int length) {
 271         Random random = new Random();
 272
 273         String generatedString = random.ints('a', 'z' + 1).limit(length)
 274                 .collect(StringBuilder::new, StringBuilder::appendCodePoint, StringBuilder::append).toString();
 275
 276         return generatedString;
 277     }
 278
 279     private void addQueryParameters(org.eclipse.jetty.client.api.Request request, String codeChallenge, String state) {
 280         request.param("client_id", CLIENT_ID);
 281         request.param("code_challenge", codeChallenge);
 282         request.param("code_challenge_method", "S256");
 283         request.param("redirect_uri", URI_CALLBACK);
 284         request.param("response_type", "code");
 285         request.param("scope", SSO_SCOPES);
 286         request.param("state", state);
 287     }
 288
 289     @Nullable
 290     private ContentResponse executeHttpRequest(org.eclipse.jetty.client.api.Request request) {
 291         request.timeout(10, TimeUnit.SECONDS);
 292
 293         ContentResponse response;
 294         try {
 295             response = request.send();
 296             return response;
 297         } catch (InterruptedException | TimeoutException | ExecutionException e) {
 298             logger.debug("An exception occurred while invoking a HTTP request: '{}'", e.getMessage());
 299             return null;
 300         }
 301     }
 302 }