sdl_aad_helper.cpp

 
#include <cstring>
#include <memory>
#include <sstream>
#include <string>
 
#include <winpr/library.h>
#include <winpr/path.h>
#include <winpr/string.h>
#include <freerdp/client.h>
#include <freerdp/client/aad_helper.h>
#include <freerdp/log.h>
#include <freerdp/utils/aad.h>
 
#include "sdl_aad_helper.hpp"
 
#define TAG CLIENT_TAG("SDL.aadhelper")
 
/* special /azure:auth-helper: value requesting the auto-probe order below, instead of a literal
 * path - also what's used when the option is omitted entirely. */
#define AAD_AUTH_HELPER_AUTODETECT "autodetect"
 
SdlAadAuthHelper::SdlAadAuthHelper(AadAuthHelper* helper) : _helper(helper)
{
}
 
SdlAadAuthHelper::~SdlAadAuthHelper()
{
  stop();
}
 
void SdlAadAuthHelper::stop()
{
  if (_helper)
  {
    aad_auth_helper_stop(_helper);
    _helper = nullptr;
  }
}
 
AadAuthHelper* SdlAadAuthHelper::get() const
{
  return _helper;
}
 
/* whether any auto-detectable helper was enabled at build time at all - see
 * WITH_XDG_AAD_AUTH_HELPER / WITH_WEBVIEW_AAD_AUTH_HELPER / WITH_QT_AAD_AUTH_HELPER in
 * client/common/CMakeLists.txt, propagated here as compile definitions by
 * client/SDL/common/CMakeLists.txt. Guards kHelperCandidates below: with none of the three
 * defined there's nothing to list, and a zero-size array isn't valid standard C++. */
#if defined(WITH_XDG_AAD_AUTH_HELPER) || defined(WITH_WEBVIEW_AAD_AUTH_HELPER) || \
    defined(WITH_QT_AAD_AUTH_HELPER)
#define SDL_AAD_HELPER_HAVE_CANDIDATES 1
 
namespace
{
  /* auto-pick order for /azure:auth-helper:autodetect (or the option omitted entirely): xdg-open
   * first (drives the user's actual default browser, so it inherits whatever SSO session/cookies
   * are already there instead of prompting again), then the embedded webview (lighter, native OS
   * look), then Qt. */
  constexpr const char* kHelperCandidates[] = {
#if defined(WITH_XDG_AAD_AUTH_HELPER)
    "freerdp-xdg-aad-helper",
#endif
#if defined(WITH_WEBVIEW_AAD_AUTH_HELPER)
    "freerdp-webview-aad-helper",
#endif
#if defined(WITH_QT_AAD_AUTH_HELPER)
    "freerdp-qt-aad-helper",
#endif
  };
} // namespace
#endif
 
#if defined(SDL_AAD_HELPER_HAVE_CANDIDATES)
/* directory this client binary itself lives in - where an installed (or freshly built) helper
 * binary is expected to sit alongside it. */
static std::string sdl_aad_helper_binary_dir()
{
  char path[4096] = {};
  if (GetModuleFileNameA(nullptr, path, sizeof(path)) == 0)
  {
    WLog_ERR(TAG, "[aad-auth] GetModuleFileNameA failed");
    return "";
  }
 
  char* sep = strrchr(path, '/');
#ifdef _WIN32
  char* sepWin = strrchr(path, '\\');
  if (!sep || (sepWin && (sepWin > sep)))
    sep = sepWin;
#endif
  if (!sep)
    return "";
  *sep = '\0';
  return path;
}
#endif
 
#if defined(SDL_AAD_HELPER_HAVE_CANDIDATES)
static std::string sdl_aad_helper_path_for_binary(const std::string& dir, const char* binaryName)
{
  std::string path = dir;
  path += "/";
  path += binaryName;
#ifdef _WIN32
  path += ".exe";
#endif
  return path;
}
#endif
 
/* /azure:auth-helper:autodetect (or the option omitted entirely): probe the well-known binaries
 * in kHelperCandidates order and use whichever is actually present. */
static std::string sdl_aad_helper_auto_locate()
{
#if defined(SDL_AAD_HELPER_HAVE_CANDIDATES)
  auto dir = sdl_aad_helper_binary_dir();
  if (dir.empty())
    return "";
 
  for (const auto& binaryName : kHelperCandidates)
  {
    auto path = sdl_aad_helper_path_for_binary(dir, binaryName);
    if (PathFileExistsA(path.c_str()))
      return path;
  }
#endif
  return "";
}
 
/* @p helper is the caller's own per-connection storage slot (e.g. a member of its SdlContext) -
 * this file never stores anything itself, so it stays usable as one binary shared between the
 * SDL2 and SDL3 clients regardless of their (different) concrete SdlContext type. */
static AadAuthHelper* sdl_aad_helper_get(rdpContext* context, SdlAadAuthHelperPtr& helper)
{
  if (helper)
    return helper->get();
 
  std::string path;
  const char* source = nullptr;
 
  const rdpSettings* settings = context->settings;
  const char* fromSettings =
      settings ? freerdp_settings_get_string(settings, FreeRDP_AadAuthHelper) : nullptr;
  if (fromSettings && fromSettings[0] && (strcmp(fromSettings, AAD_AUTH_HELPER_AUTODETECT) != 0))
  {
    path = fromSettings;
    source = "/azure:auth-helper:";
  }
 
  if (path.empty())
  {
    path = sdl_aad_helper_auto_locate();
    source = "auto-detected";
  }
 
  if (path.empty())
  {
    WLog_ERR(TAG, "[aad-auth] could not determine expected helper binary location");
    return nullptr;
  }
 
  if (!PathFileExistsA(path.c_str()))
  {
    WLog_ERR(
        TAG,
        "[aad-auth] helper binary not found at '%s' (from %s) - was FreeRDP built and "
        "installed with -DWITH_XDG_AAD_AUTH_HELPER=ON, -DWITH_WEBVIEW_AAD_AUTH_HELPER=ON or "
        "-DWITH_QT_AAD_AUTH_HELPER=ON? Falling back to manual copy/paste login",
        path.c_str(), source);
    return nullptr;
  }
 
  WLog_DBG(TAG, "[aad-auth] using helper path from %s: %s", source, path.c_str());
  auto* raw = aad_auth_helper_start(path.c_str());
  if (!raw)
  {
    WLog_ERR(TAG, "[aad-auth] failed to start '%s'", path.c_str());
    return nullptr;
  }
 
  helper = std::make_shared<SdlAadAuthHelper>(raw);
  return raw;
}
 
[[nodiscard]]
static std::string sdl_aad_helper_extract_query_param(const std::string& url,
                                                      const std::string& name)
{
  auto qpos = url.find('?');
  if (qpos == std::string::npos)
    return "";
 
  std::istringstream stream(url.substr(qpos + 1));
  std::string pair;
  while (std::getline(stream, pair, '&'))
  {
    auto eq = pair.find('=');
    if (eq == std::string::npos)
      continue;
    if (pair.compare(0, eq, name) != 0)
      continue;
 
    auto value = pair.substr(eq + 1);
    auto decoded = winpr_str_url_decode(value.c_str(), value.length());
    std::string result = decoded ? decoded : "";
    free(decoded);
    return result;
  }
  return "";
}
 
static AadAuthHelperNavigateStatus
sdl_aad_helper_navigate(rdpContext* context, SdlAadAuthHelperPtr& helper, const std::string& title,
                        const std::string& url, std::string& redirectUrl)
{
  auto redirectUri = sdl_aad_helper_extract_query_param(url, "redirect_uri");
  if (redirectUri.empty())
  {
    WLog_ERR(TAG, "[aad-auth] url %s has no redirect_uri parameter", url.c_str());
    return AAD_AUTH_HELPER_NAVIGATE_ERROR;
  }
 
  auto* rawHelper = sdl_aad_helper_get(context, helper);
  if (!rawHelper)
    return AAD_AUTH_HELPER_NAVIGATE_ERROR;
 
  char* out = nullptr;
  const AadAuthHelperNavigateStatus status = aad_auth_helper_navigate(
      rawHelper, title.c_str(), url.c_str(), redirectUri.c_str(), 180000, &out);
  if (status != AAD_AUTH_HELPER_NAVIGATE_OK)
    return status;
 
  redirectUrl = out;
  free(out);
  return AAD_AUTH_HELPER_NAVIGATE_OK;
}
 
static BOOL sdl_aad_helper_get_rdsaad_access_token(freerdp* instance, SdlAadAuthHelperPtr& helper,
                                                   const char* scope, const char* req_cnf,
                                                   char** token)
{
  WINPR_ASSERT(instance);
  WINPR_ASSERT(scope);
  WINPR_ASSERT(req_cnf);
  WINPR_ASSERT(token);
 
  auto context = instance->context;
  WINPR_ASSERT(context);
  WINPR_ASSERT(context->settings);
 
  std::shared_ptr<char> request(
      freerdp_client_get_aad_url(reinterpret_cast<rdpClientContext*>(instance->context),
                                 FREERDP_CLIENT_AAD_AUTH_REQUEST, scope),
      winpr_zfree);
 
  std::string redirectUrl;
  const AadAuthHelperNavigateStatus status = sdl_aad_helper_navigate(
      context, helper, "FreeRDP WebView - AAD access token", request.get(), redirectUrl);
  if (status == AAD_AUTH_HELPER_NAVIGATE_CANCELLED)
  {
    WLog_INFO(TAG, "[aad-auth] user cancelled the authentication");
    return FALSE;
  }
  if (status == AAD_AUTH_HELPER_NAVIGATE_TIMEOUT)
  {
    WLog_ERR(TAG, "[aad-auth] authentication timed out");
    return FALSE;
  }
  if (status != AAD_AUTH_HELPER_NAVIGATE_OK)
    return client_cli_get_access_token(instance, ACCESS_TOKEN_TYPE_AAD, token, 2, scope,
                                       req_cnf);
 
  std::unique_ptr<char, void (*)(char*)> code(
      freerdp_client_extract_aad_code(reinterpret_cast<rdpClientContext*>(instance->context),
                                      redirectUrl.c_str(), redirectUrl.size()),
      winpr_zfree);
 
  if (!code)
    return client_cli_get_access_token(instance, ACCESS_TOKEN_TYPE_AAD, token, 2, scope,
                                       req_cnf);
 
  std::shared_ptr<char> token_request(
      freerdp_client_get_aad_url(reinterpret_cast<rdpClientContext*>(instance->context),
                                 FREERDP_CLIENT_AAD_TOKEN_REQUEST, scope, code.get(), req_cnf),
      winpr_zfree);
  return client_common_get_access_token(instance, token_request.get(), token);
}
 
static BOOL sdl_aad_helper_get_avd_access_token(freerdp* instance, SdlAadAuthHelperPtr& helper,
                                                char** token)
{
  WINPR_ASSERT(token);
  WINPR_ASSERT(instance);
  WINPR_ASSERT(instance->context);
 
  std::shared_ptr<char> request(
      freerdp_client_get_aad_url(reinterpret_cast<rdpClientContext*>(instance->context),
                                 FREERDP_CLIENT_AAD_AVD_AUTH_REQUEST),
      winpr_zfree);
 
  std::string redirectUrl;
  const AadAuthHelperNavigateStatus status =
      sdl_aad_helper_navigate(instance->context, helper, "FreeRDP WebView - AVD access token",
                              request.get(), redirectUrl);
  if (status == AAD_AUTH_HELPER_NAVIGATE_CANCELLED)
  {
    WLog_INFO(TAG, "[aad-auth] user cancelled the authentication");
    return FALSE;
  }
  if (status == AAD_AUTH_HELPER_NAVIGATE_TIMEOUT)
  {
    WLog_ERR(TAG, "[aad-auth] authentication timed out");
    return FALSE;
  }
  if (status != AAD_AUTH_HELPER_NAVIGATE_OK)
    return client_cli_get_access_token(instance, ACCESS_TOKEN_TYPE_AVD, token, 0);
 
  std::unique_ptr<char, void (*)(char*)> code(
      freerdp_client_extract_aad_code(reinterpret_cast<rdpClientContext*>(instance->context),
                                      redirectUrl.c_str(), redirectUrl.size()),
      winpr_zfree);
  if (!code)
    return client_cli_get_access_token(instance, ACCESS_TOKEN_TYPE_AVD, token, 0);
 
  std::shared_ptr<char> token_request(
      freerdp_client_get_aad_url(reinterpret_cast<rdpClientContext*>(instance->context),
                                 FREERDP_CLIENT_AAD_AVD_TOKEN_REQUEST, code.get()),
      winpr_zfree);
  return client_common_get_access_token(instance, token_request.get(), token);
}
 
BOOL sdl_aad_helper_get_access_token_v(freerdp* instance, SdlAadAuthHelperPtr& helper,
                                       AccessTokenType tokenType, char** token, size_t count,
                                       va_list args)
{
  WINPR_ASSERT(instance);
  WINPR_ASSERT(token);
  switch (tokenType)
  {
    case ACCESS_TOKEN_TYPE_AAD:
    {
      if (count < 2)
      {
        WLog_ERR(TAG,
                 "ACCESS_TOKEN_TYPE_AAD expected 2 additional arguments, but got %" PRIuz
                 ", aborting",
                 count);
        return FALSE;
      }
      else if (count > 2)
        WLog_WARN(TAG,
                  "ACCESS_TOKEN_TYPE_AAD expected 2 additional arguments, but got %" PRIuz
                  ", ignoring",
                  count);
      const char* scope = va_arg(args, const char*);
      const char* req_cnf = va_arg(args, const char*);
      return sdl_aad_helper_get_rdsaad_access_token(instance, helper, scope, req_cnf, token);
    }
    case ACCESS_TOKEN_TYPE_AVD:
      if (count != 0)
        WLog_WARN(TAG,
                  "ACCESS_TOKEN_TYPE_AVD expected 0 additional arguments, but got %" PRIuz
                  ", ignoring",
                  count);
      return sdl_aad_helper_get_avd_access_token(instance, helper, token);
    default:
      WLog_ERR(TAG, "Unexpected value for AccessTokenType [%" PRIu32 "], aborting",
               tokenType);
      return FALSE;
  }
}
 
BOOL sdl_aad_helper_get_access_token(freerdp* instance, SdlAadAuthHelperPtr& helper,
                                     AccessTokenType tokenType, char** token, size_t count, ...)
{
  va_list ap = {};
  va_start(ap, count);
  const BOOL rc =
      sdl_aad_helper_get_access_token_v(instance, helper, tokenType, token, count, ap);
  va_end(ap);
  return rc;
}