authenticator_server 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 4ee8fb9d34d02688c3ac99f5f98d36a534a75c90
+  data.tar.gz: 6ff12d221468a10314298c95528386f8ad8cc9ea
+SHA512:
+  metadata.gz: 3b27df060f23c851f98d9e336a05d11541909196da2745c133cba10a3da3d3d64e0bd3d2ea8525e27023367763c62c54f580b5f172a1615b7258de2e4224c5af
+  data.tar.gz: acc68cfa1e033558d12ac052ff4547e4182af8226cca8e28170de7b5a1cc2848242976b0e93ee6a9778df021c1c6b1d1cf83f3c6338f19eba7b68296e6f299d5

data/lib/authenticator_server.rb

@@ -0,0 +1,6 @@
+require "authenticator_server/version"
+require "authenticator_server/token_verifier"
+require "authenticator_server/rsa_key_pair_provider"
+
+module AuthenticatorServer
+end

data/lib/authenticator_server/rsa_key_pair_provider.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+require 'openssl'
+
+# AuthenticatorServer::RSAKeyPairProvider class is to generate RSA public/private key pair.
+# It uses openssl for key pair generation.
+# @author Shobhit Dixit
+module AuthenticatorServer
+  class RSAKeyPairProvider
+    KEY_LENGTH = 2048
+
+    @rsa_public_key = nil
+    @rsa_private_key = nil
+
+    # Constructor to initialize class fields
+    #
+    # @author Shobhit Dixit
+    def initialize
+      @rsa_private_key = OpenSSL::PKey::RSA.generate KEY_LENGTH
+      @rsa_public_key = @rsa_private_key.public_key
+    end
+
+    # Method to return OpenSSL::PKey::RSA public_key in base64 string
+    #
+    # @return [String] public_key in base64 string format
+    # @author Shobhit Dixit
+    def public_key_base64
+      @rsa_public_key.to_s
+    end
+
+    # Method to return OpenSSL::PKey::RSA private_key in base64 string
+    #
+    # @return [String] private_key in base64 string format
+    # @author Shobhit Dixit
+    def private_key_base64
+      @rsa_private_key.to_s
+    end
+
+    # Method to convert public key base64 string to OpenSSL::PKey::RSA object
+    #
+    # @param public_key_base64 [String] string which will be converted into OpenSSL::PKey::RSA object
+    # @return [Object] OpenSSL::PKey::RSA object
+    # @author Shobhit Dixit
+    def self.public_key_from_base64(public_key_base64)
+      raise ArgumentError.new('String argument is expected')  unless public_key_base64.kind_of? String
+      public_key = OpenSSL::PKey::RSA.new public_key_base64
+      raise ArgumentError.new('Not a valid public key') if public_key.private?
+      public_key
+    end
+
+    # Method to convert private key base64 string to OpenSSL::PKey::RSA object
+    #
+    # @param private_key_base64 [String] string which will be converted into OpenSSL::PKey::RSA object
+    # @return [Object] OpenSSL::PKey::RSA object
+    # @author Shobhit Dixit
+    def self.private_key_from_base64(private_key_base64)
+      raise ArgumentError.new('String argument is expected')  unless private_key_base64.kind_of? String
+      private_key = OpenSSL::PKey::RSA.new private_key_base64
+      raise ArgumentError.new('Not a valid private key') unless private_key.private?
+      private_key
+    end
+  end
+end

data/lib/authenticator_server/token_verifier.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+require 'jwt'
+
+# AuthenticatorServer::TokenVerifier is used to verify the given token using the given
+# token_verification_key. This is an abstract class that uses jwt under the hood.
+# It is mainly created so as to include this gem in every ROR microservice and use
+# it for token verification or authentication.
+# @author Shobhit Dixit
+module AuthenticatorServer
+  class TokenVerifier
+
+    # ALGORITHM = 'RS256'
+    ALGORITHM = 'HS512'
+
+    # This method verifies the token using token_verification_key
+    #
+    # @param token [String] jwt to be verified
+    # @param token_verification_key [String] secret key use to verify the token
+    # @return [Object] on success return the payload
+    # @author Shobhit Dixit
+    def self.verify(token, token_verification_key)
+      begin
+        raise ArgumentError.new('String argument is expected')  unless token_verification_key.kind_of? String
+        # rsa_public_key = AuthenticatorServer::RSAKeyPairProvider.public_key_from_base64 token_verification_key
+        output = JWT.decode(token, token_verification_key, true, { algorithm: ALGORITHM })
+        output.first
+      rescue ArgumentError => e
+        argument_error_message e
+      rescue JWT::IncorrectAlgorithm => e
+        incorrect_algorithm_message e
+      rescue JWT::ExpiredSignature => e
+        expired_signature_message e
+      rescue JWT::VerificationError => e
+        verification_error_message e
+      rescue JWT::DecodeError => e
+        decode_error_message e
+      rescue Exception => e
+        server_exception_message e
+      end
+    end
+
+    class << self
+
+      private
+
+      def argument_error_message(exception)
+        {
+          'error' => exception.message,
+          'reason' => "IncorrectArgument"
+        }
+      end
+
+      def incorrect_algorithm_message(exception)
+        {
+          'error' => 'Expected a different algorithm',
+          'reason' => "IncorrectAlgorithm"
+        }
+      end
+
+      def expired_signature_message(exception)
+        {
+          'error' => 'Token is expired',
+          'reason' => "ExpiredToken"
+        }
+      end
+
+      def verification_error_message(exception)
+        {
+          'error' => 'Invalid signature',
+          'reason' => "InvalidSignature"
+        }
+      end
+
+      def decode_error_message(exception)
+        {
+          'error' => exception.message,
+          'reason' => "DecodeError"
+        }
+      end
+
+      def server_exception_message(exception)
+        {
+          'error' => exception.message,
+          'reason' => "ServerException"
+        }
+      end
+
+    end
+  end
+end

data/lib/authenticator_server/version.rb

@@ -0,0 +1,3 @@
+module AuthenticatorServer
+  VERSION = "0.1.0"
+end

data/spec/authenticator_server/rsa_key_pair_provider_spec.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+RSpec.describe AuthenticatorServer::RSAKeyPairProvider do
+  let(:provider) { AuthenticatorServer::RSAKeyPairProvider.new }
+
+  describe "constants and fields" do
+
+    it "should have a constant KEY_LENGTH" do
+      expect(AuthenticatorServer::RSAKeyPairProvider::KEY_LENGTH).to equal 2048
+    end
+
+    it "should have exactly two instance variables rsa_private_key and rsa_public_key" do
+      expect(AuthenticatorServer::RSAKeyPairProvider.instance_variables).to contain_exactly(:@rsa_public_key, :@rsa_private_key)
+    end
+  end
+
+  describe ".initialize" do
+
+    it "should initialize instance variables rsa_private_key and rsa_public_key" do
+      expect(provider.instance_variable_get(:@rsa_public_key)).not_to be_nil
+      expect(provider.instance_variable_get(:@rsa_private_key)).not_to be_nil
+    end
+
+    it "should initialize instance variables rsa_private_key and rsa_public_key with OpenSSL::PKey::RSA object" do
+      expect(provider.instance_variable_get(:@rsa_public_key)).to be_a_kind_of(OpenSSL::PKey::RSA)
+      expect(provider.instance_variable_get(:@rsa_private_key)).to be_a_kind_of(OpenSSL::PKey::RSA)
+    end
+
+    it "should derive @rsa_public_key from @rsa_private_key" do
+      expect(provider.instance_variable_get(:@rsa_public_key).to_s).to be_eql((provider.instance_variable_get(:@rsa_private_key)).public_key.to_s)
+    end
+  end
+
+  describe "#public_key_base64" do
+
+    it "should be present" do
+      expect(provider).to respond_to(:public_key_base64)
+    end
+
+    it "should not return nil or empty string" do
+      expect(provider.public_key_base64).not_to be_nil
+      expect(provider.public_key_base64.strip).not_to be_empty
+    end
+
+    it "should call to_s method on @rsa_public_key" do
+      expect(provider.instance_variable_get(:@rsa_public_key)).to receive(:to_s)
+      provider.public_key_base64
+    end
+  end
+
+  describe "#private_key_base64" do
+
+    it "should be present" do
+      expect(provider).to respond_to(:private_key_base64)
+    end
+
+    it "should not return nil or empty string" do
+      expect(provider.private_key_base64).not_to be_nil
+      expect(provider.private_key_base64.strip).not_to be_empty
+    end
+
+    it "should call to_s method on @rsa_private_key" do
+      expect(provider.instance_variable_get(:@rsa_private_key)).to receive(:to_s)
+      provider.private_key_base64
+    end
+  end
+
+  describe ".public_key_from_base64" do
+    let(:private_key) { OpenSSL::PKey::RSA.generate 2048 }
+
+    it "should be present and accept exactly 1 argument" do
+      expect(AuthenticatorServer::RSAKeyPairProvider).to respond_to(:public_key_from_base64).with(1).argument
+    end
+
+    context "when argument is not a string" do
+      it "should raise ArgumentError" do
+        expect{AuthenticatorServer::RSAKeyPairProvider.public_key_from_base64(private_key)}.to raise_error(ArgumentError, "String argument is expected")
+      end
+    end
+
+    context "when argument is not a valid RSA public/private base64 key" do
+      it "should raise OpenSSL::PKey::RSAError" do
+        expect{AuthenticatorServer::RSAKeyPairProvider.public_key_from_base64("")}.to raise_error(OpenSSL::PKey::RSAError)
+        expect{AuthenticatorServer::RSAKeyPairProvider.public_key_from_base64("Some random text")}.to raise_error(OpenSSL::PKey::RSAError)
+      end
+    end
+
+    context "when argument is a valid RSA private base64 key" do
+      it "should raise ArgumentError" do
+        expect{ AuthenticatorServer::RSAKeyPairProvider.public_key_from_base64(private_key.to_s)}.to raise_error(ArgumentError, "Not a valid public key")
+      end
+    end
+
+    context "when argument is a valid RSA public base64 key" do
+      let(:public_key) { private_key.public_key }
+
+      it "should not return nil" do
+        expect( AuthenticatorServer::RSAKeyPairProvider.public_key_from_base64 public_key.to_s ).not_to be_nil
+      end
+
+      it "should return OpenSSL::PKey::RSA object" do
+        expect(AuthenticatorServer::RSAKeyPairProvider.public_key_from_base64 public_key.to_s).to be_a_kind_of OpenSSL::PKey::RSA
+      end
+    end
+  end
+
+  describe ".private_key_from_base64" do
+    let(:private_key) { OpenSSL::PKey::RSA.generate 2048 }
+
+    it "should be present and accept exactly 1 argument" do
+      expect(AuthenticatorServer::RSAKeyPairProvider).to respond_to(:private_key_from_base64).with(1).argument
+    end
+
+    context "when argument is not a string" do
+      it "should raise ArgumentError" do
+        expect{AuthenticatorServer::RSAKeyPairProvider.private_key_from_base64(private_key)}.to raise_error(ArgumentError, "String argument is expected")
+      end
+    end
+
+    context "when argument is not a valid RSA public/private base64 key" do
+      it "should raise OpenSSL::PKey::RSAError" do
+        expect{AuthenticatorServer::RSAKeyPairProvider.private_key_from_base64("")}.to raise_error(OpenSSL::PKey::RSAError)
+        expect{AuthenticatorServer::RSAKeyPairProvider.private_key_from_base64("Some random text")}.to raise_error(OpenSSL::PKey::RSAError)
+      end
+    end
+
+    context "when argument is a valid RSA public base64 key" do
+      let(:public_key) { private_key.public_key }
+      it "should raise ArgumentError" do
+        expect{ AuthenticatorServer::RSAKeyPairProvider.private_key_from_base64(public_key.to_s)}.to raise_error(ArgumentError, "Not a valid private key")
+      end
+    end
+
+    context "when argument is a valid RSA private base64 key" do
+      it "should not return nil" do
+        expect( AuthenticatorServer::RSAKeyPairProvider.private_key_from_base64 private_key.to_s ).not_to be_nil
+      end
+
+      it "should return OpenSSL::PKey::RSA object" do
+        expect(AuthenticatorServer::RSAKeyPairProvider.private_key_from_base64 private_key.to_s).to be_a_kind_of OpenSSL::PKey::RSA
+      end
+    end
+  end
+
+end

data/spec/authenticator_server/token_verifier_spec.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+require 'spec_helper'
+require 'securerandom'
+
+RSpec.describe AuthenticatorServer::TokenVerifier do
+  # let (:rsa_private_key) {OpenSSL::PKey::RSA.generate 2048}
+  # let (:public_key_base64) {rsa_private_key.public_key.to_s}
+  let (:hmac_secret) { SecureRandom.hex }
+  let (:encode_key) { hmac_secret }
+  let (:decode_key) { hmac_secret }
+  let (:payload) { {"data"=>"test payload"} }
+  IMPROPER_HEADER = 0
+  IMPROPER_PAYLOAD = 1
+  IMPROPER_SIGNATURE = 2
+
+  # here number_format will represent improper_token number_format
+  # if number_format = 0, improper_header
+  # if number_format = 1, improper_payload
+  # if number_format = 2, improper_signature
+  def get_improper_token (number_format)
+    splitted_token = get_token(payload).split('.')
+    splitted_token[number_format] = splitted_token[number_format][2..-5]
+    splitted_token.join('.')
+  end
+
+  def get_token(custom_payload)
+    JWT.encode custom_payload, encode_key, AuthenticatorServer::TokenVerifier::ALGORITHM
+  end
+
+  def get_expired_token
+    claimed_payload = payload.merge({'exp' => Time.now.to_i - 100})
+    get_token(claimed_payload)
+  end
+
+  describe ".verify" do
+    it "should be present" do
+      expect(AuthenticatorServer::TokenVerifier).to respond_to(:verify)
+    end
+
+    context "when arguments are absent" do
+      it "should raise ArgumentError" do
+        expect { AuthenticatorServer::TokenVerifier.verify}.to raise_error(ArgumentError)
+      end
+    end
+
+    context "when arguments are present" do
+      it "should accept exactly 2 argument" do
+        expect(AuthenticatorServer::TokenVerifier).to respond_to(:verify).with(2).argument
+      end
+      context "when token is nil/blank/empty string" do
+        it "should return {\"error\"=>\"Nil JSON web token\"}" do
+          result = AuthenticatorServer::TokenVerifier.verify(nil, decode_key)
+          expect(result).to be_eql({"error"=>"Nil JSON web token", "reason"=>"DecodeError"})
+        end
+        it "should return {\"error\"=>\"Not enough or too many segments\"}" do
+          result = AuthenticatorServer::TokenVerifier.verify('  ', decode_key)
+          expect(result).to be_eql({"error"=>"Not enough or too many segments", "reason"=>"DecodeError"})
+        end
+      end
+    end
+
+    context "when token is not in jwt json format" do
+      context "when header is not proper" do
+        it "should return error hash with proper message" do
+          result = AuthenticatorServer::TokenVerifier.verify(get_improper_token(IMPROPER_HEADER), decode_key)
+          expect(result['error']).to be_eql('Invalid segment encoding')
+        end
+      end
+      context "when payload is not proper" do
+        it "should return error hash with proper message" do
+          result = AuthenticatorServer::TokenVerifier.verify(get_improper_token(IMPROPER_PAYLOAD), decode_key)
+          expect(result['error']).to be_eql('Invalid segment encoding')
+        end
+      end
+      context "when signature is not proper" do
+        it "should return error hash with proper message" do
+          result = AuthenticatorServer::TokenVerifier.verify(get_improper_token(IMPROPER_SIGNATURE), decode_key)
+          expect(result['error']).to be_eql('Invalid signature')
+        end
+      end
+
+      # it "should return {error: 'Expected a different algorithm'}" do
+      #
+      # end
+    end
+
+    context "when token is expired" do
+      it "should return error hash" do
+        result = AuthenticatorServer::TokenVerifier.verify(get_expired_token, decode_key)
+        expect(result).to have_key('error')
+      end
+      it "should return {'error' => 'Signature has expired'} " do
+        result = AuthenticatorServer::TokenVerifier.verify(get_expired_token, decode_key)
+        expect(result['error']).to be_eql('Token is expired')
+      end
+    end
+
+    context "when signature/public_key base64 string is not valid" do
+      it "should return error hash" do
+        result = AuthenticatorServer::TokenVerifier.verify(get_token(payload), {})
+        expect(result).to have_key('error')
+      end
+      it "should return {'error' => 'String argument is expected'}" do
+        result = AuthenticatorServer::TokenVerifier.verify(get_token(payload), {})
+        expect(result['error']).to be_eql('String argument is expected')
+      end
+    end
+
+    context "when token and signature base64 string is valid" do
+      it "should return payload hash" do
+        result = AuthenticatorServer::TokenVerifier.verify(get_token(payload), decode_key)
+        expect(result).to be_eql(payload)
+      end
+    end
+
+  end
+
+  # TODO: token generation
+  # TODO: make sure, payload hash keys should be strings, or else reserved claims exceptions will occur
+  # From Sarah Mei
+  # http://stackoverflow.com/questions/800122/best-way-to-convert-strings-to-symbols-in-hash
+  # my_hash.inject({}){|memo,(k,v)| memo[k.to_s] = v; memo}
+
+  # TODO: handle EncodeError
+
+
+end

data/spec/authenticator_server_spec.rb

@@ -0,0 +1,5 @@
+RSpec.describe AuthenticatorServer do
+  it "has a version number" do
+    expect(AuthenticatorServer::VERSION).not_to be nil
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,19 @@
+require "bundler/setup"
+
+require 'jwt'
+require "authenticator_server"
+require 'authenticator_server/rsa_key_pair_provider'
+require 'authenticator_server/token_verifier'
+
+
+RSpec.configure do |config|
+  # Enable flags like --only-failures and --next-failure
+  config.example_status_persistence_file_path = ".rspec_status"
+
+  # Disable RSpec exposing methods globally on `Module` and `main`
+  config.disable_monkey_patching!
+
+  config.expect_with :rspec do |c|
+    c.syntax = :expect
+  end
+end

metadata

@@ -0,0 +1,112 @@
+--- !ruby/object:Gem::Specification
+name: authenticator_server
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Shobhit Dixit
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2018-07-03 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.16'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.16'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+description: This gem is a wrapper for auth jwt. This is made in order to be consistent
+  or uniform while implementing the security in all the microservices.
+email:
+- shobhit.dixit@metacube.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/authenticator_server.rb
+- lib/authenticator_server/rsa_key_pair_provider.rb
+- lib/authenticator_server/token_verifier.rb
+- lib/authenticator_server/version.rb
+- spec/authenticator_server/rsa_key_pair_provider_spec.rb
+- spec/authenticator_server/token_verifier_spec.rb
+- spec/authenticator_server_spec.rb
+- spec/spec_helper.rb
+homepage: http://www.github.com
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.8
+signing_key: 
+specification_version: 4
+summary: This gem is to provide authentication for ruby microservices server
+test_files:
+- spec/authenticator_server_spec.rb
+- spec/authenticator_server/rsa_key_pair_provider_spec.rb
+- spec/authenticator_server/token_verifier_spec.rb
+- spec/spec_helper.rb