663276 - Bring code in line with the 20110524 version of Verified Email Protocol

Status: RESOLVED FIXED

(Cloud Services :: Server: Identity, defect)

Description

[JR Conlin [:jrconlin,:jconlin]]

see https://wiki.mozilla.org/Identity/Verified_Email_Protocol for details and specifications.

Comment 1

[JR Conlin [:jrconlin,:jconlin]]

Attachment: Pretty sizable restructuring of the code

Fairly beefy redo of the code base:

* Changed the OIDController to UserController (since we no longer have any OpenID elements)
* Added functions for new version of VEP
* Switched to cjson (faster than native json, since we're doing a LOT of json calls)
* switched back to a redis storage engine
* put JWS into it's own class (rather than sub methods)
* fixes to the admin pages for new setup.

It's a lot of code, you said you wouldn't hate me. 
Happy to take pointers and dope slaps.

Comment 2

[JR Conlin [:jrconlin,:jconlin]]

Attachment: Updated patch based on feedback

Removed legacy function
Removed TODO
Added cert callback URL.
fixed base class for BaseController

Comment 3

[Rob Miller [:rmiller]]

Comment on attachment 539064 [details] [diff] [review]
Updated patch based on feedback

Review of attachment 539064 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good.  I added a couple of notes to places where some logging would probably be helpful (I actually did that the first time around, too, but it looks like splinter lost them).

::: oidserver/controllers/auth.py
@@ +53,5 @@
> +            cert_info = jws.parse(request.params.get('certificate', None))
> +            if cert_info is None:
> +                raise HTTPBadRequest()
> +        except JWSException:
> +            raise HTTPBadRequest()

seems like we're losing some context information when we catch one exception and raise another, some logging is probably a good idea.

@@ +401,5 @@
> +            email = self.app.storage.check_validation(uid, token)
> +        except OIDStorageException:
> +            raise HTTPBadRequest()
> +        if not email:
> +            raise HTTPBadRequest()

another place where logging would be helpful to distinguish btn these events after the fact.

Comment 4

[JR Conlin [:jrconlin,:jconlin]]

submitted code: tip 71:89589c709aac