bankid 0.1.2 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd9a18973962f369cd1bcca36382198a88401549f967f9896d0eaba2bf375afa
-  data.tar.gz: 38dd6d6d7fbbc9f3d8e4669e828ef991f1b054d4c542c28a8350a1e52793b49c
+  metadata.gz: 9fca94ae716a23222cc841afe001128223f92ab1c7bb3ec9062d172438e065df
+  data.tar.gz: 6124c99b716cd7aa411d16615e1145e8518f53c043a359aa8011ab0bc49f4388
 SHA512:
-  metadata.gz: 8909aa90d7693ff7818d8a445ee9437d146a822063f41a4fc9d09c81bd267f0a9a8093e3b0fa5d7cc934ac1b73bc3dff800d0882bf9446659cd8920a6e95e947
-  data.tar.gz: c3e0199dcc32101ee5ebc4c620a3f4fcf197818a82d7bca85adc714c0fd9cdd3cd3a665abbf93261534bf2edc170ec1faafea71c7ac397fe548358a54b7c79ad
+  metadata.gz: ea6b8806a339b2d06669b2eaec28959c9d07bde5d13d2d4635957a3b3aa7e6ea614c52de02f36b5495388897673253d70ff52b711fba5cc0c1059a072bc013a1
+  data.tar.gz: b62d199d0aab2f433f33bbbd6b8f02884d2ba32af7bcc2e0e1e22c149968bc73dd2b296e44dc82a40c89408adea702bd36486a67cf5097cfa834ea5850519f93

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## [Unreleased]
 
+## [1.0.0] - 2022-09-30
+
+- Deprecate the `PKCS12` algorithm in favor of `X509`: [issue #3](https://github.com/johanhalse/bankid/issues/3)
+
 ## [0.1.2] - 2022-09-08
 
 - Add `pending?` method call for poll response object

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    bankid (0.1.1)
+    bankid (0.1.2)
       http (~> 5.0.4)
       rqrcode (~> 2.1.0)
 
@@ -46,7 +46,7 @@ GEM
     rake (13.0.6)
     regexp_parser (2.2.0)
     rexml (3.2.5)
-    rqrcode (2.1.1)
+    rqrcode (2.1.2)
       chunky_png (~> 1.0)
       rqrcode_core (~> 1.0)
     rqrcode_core (1.2.0)

data/README.md

@@ -58,6 +58,26 @@ raise "logged in!" if response.status == "complete"
 
 Keep polling until your response status changes to "complete", and the response object will be a struct containing the `completion_data` property you're ultimately looking for.
 
+## Certificates
+
+Your BankID provider will have given you a certificate. It might be in `.p12` format. If that's the case, you'll need to convert it to an OpenSSL X509 certificate - version 0.1.x of the BankID gem relied on PKCS12 which saw [big changes in OpenSSL v3](https://github.com/johanhalse/bankid/issues/3), so the implementation has been switched to X509 instead. The gem looks for a certificate and a key in these default locations:
+
+```
+./config/certs/#{environment}_client_certificate.pem
+./config/certs/#{environment}_client_certificate.key
+```
+
+If you're upgrading from 0.1.x and want to convert an existing p12 key, it's pretty straightforward:
+
+```
+# Export certificate
+openssl pkcs12 -legacy -in my_certificate.p12 -clcerts -nokeys -out my_certificate.pem
+# Export key
+openssl pkcs12 -legacy -in my_certificate.p12 -clcerts -nocerts -out my_certificate.key
+```
+
+That should hopefully get things running again.
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/config/certs/development_client_certificate.key

@@ -0,0 +1,33 @@
+Bag Attributes
+    localKeyID: 93 12 D6 E8 2C AA 74 2E 52 10 29 3F 33 3C 39 7B 02 73 34 25 
+Key Attributes: <No Attributes>
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIbee4rppk/vsCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECOmlvppFUN4xBIIEyDfJxmEJ0/mb
+OHFPRbWbcaGv1MggkjWYmeqJN/h8KPrY9MGQ3WS41qq1ox7ae32qZI1h3alvibeU
+0lwtfVJAdtOgAk7HKVjO9MJAwn9UJgfd5W6Vlcx7Y0GWHQ2TLyw7XxUi9d4hDHeS
+g/oV5hQ3kWKQMGHkUqoM7n2YKJ7yErU+hWrClzGc4l5sKSSzxf/1doZDnDJg3uR1
+VaSazx26U2ocCbtp0Y86DtxDHVyzZu0m82vRcpivLUDpYZkcWiriYGAamA0DKUGd
+CuZN+klPucTLjbrr1wxk+du8MkplBBh6jjVUeWmU8hw9Xon47B+0Qd7oW6s2d+AL
+I44X6AHImsnno/BddML4NytNCrIs2iLZXuOi6OiCtIxCxpS0evU5Lo8DpAG2Wmfu
+uZ7vgFzSAGQDB1kZwelC8h/dQe1dgQBTp3Y6If1ZTEMND/YqqLRPDM/Rwtj+Cxbt
+bnlY0IUTw7+KqSx7PKyB+P2dSFbwb9WcD3nbRdcKrjQpYGv5VQclTydICDAbuPyk
+TYJlYcrjbbc9PfyaOmD7nbwymRNfB1tPG6QGgTVc5O7FgQqPKba3zUZzwhIzjG37
+moiMatjdt2pYZbuhNXCiVS4I2th7Gu/WI5sVqq9OEBtsD/h+pKo3VeJJ/RQM3kO4
+6X+obZqIdXiOL7K4YzzqrkE71rWNfKcSjmGGfCIcw9dWFG0/mBoeFRjBkaKW5xry
+bk8K0iQvFThmdVQcXMGcXrc2l3efAwu5bK0j8o4C33DAqpOngcSBkrXsKPheXcHM
+R+ConNg9QM4sMuXtSDJZOHzSEt0d9lkn7poiad6Fcr7cm3RaY4rLfB5/8h7jrB4e
+WStcFjCVmENxkOc9rRqaFHWbD4Z7DambS4Nl7JfpjHOK0ifxAlIhIn0sRN5FKWGk
+UbDEHNg8Wl9p44BglsV7AwHAl8etmY2RiKvhKsHwMsE0P5RdauXq6FMOOxwaZsRs
+XN6lARqyQbPI4BM7/kySMKPQ7QUGsQ2oKUUBUSRxVQM5ULYRKZE4x3m6tMX8nNjF
+TK/kTaZx2ZN4Lv8Zuy65KKd5eKRrl2hnBfN/Vl6yzdgJx22WjCufDLCpeNZcK7lN
+Zca6UKebuCazunPUlJOTempn0Lfd4sXvnaR/mFEk01Rqwy3e6PvOTFRB3smWTIpM
+bCNJ2kWwqEc+x12j/29YmQx6aWc+IKFTXIa7tt6QrV2xZBATlld9xxeUmwdLkYyd
+K9GicnAovbaKwJBugdhkRDIsPLP9UQ/CE4C49GqzHa7sH2lWsST2h+ksWUptWUFl
+Izx0MzVaUWZR7AkKrZk3dkDNva1gQTmRLC3eI7jZJ2bUgwMGqPgj4XQKF3AsIKth
+RtMCV6N/GRH/0NWb+8GQHyShJhwIcqdI8Aimlgxrj4KuYeHTOe+bU8qgSbTgKlYp
+k2+sAdKN8lP7mT1YYZyj/NENX/8WS3nwvlJ4mfmBvmAGRGgSofsVMFsAmSI3t8pJ
+fWnjpacUXi9mF9gm8SgjUl2ekYU1r03ig1+cjMsaYkzTdVVMovwp0HRrL8Vs8pQf
+3JhG+mws+sWkEofOiyOYeoPtdoD+HqtgIQ8w9AswpNdqnLARUQ/fMVKgyQXFTqHQ
+YlQoSLz8brIM69Tp9W+frA==
+-----END ENCRYPTED PRIVATE KEY-----

data/config/certs/development_client_certificate.pem

@@ -0,0 +1,32 @@
+Bag Attributes
+    localKeyID: 93 12 D6 E8 2C AA 74 2E 52 10 29 3F 33 3C 39 7B 02 73 34 25 
+subject=C = SE, O = Testbank A AB (publ), serialNumber = 5566304928, name = Test av BankID, CN = FP Testcert 3
+issuer=C = SE, O = Testbank A AB (publ), serialNumber = 111111111111, CN = Testbank A RP CA v1 for BankID Test
+-----BEGIN CERTIFICATE-----
+MIIEyjCCArKgAwIBAgIILFi5Qu2eUu4wDQYJKoZIhvcNAQELBQAwcTELMAkGA1UE
+BhMCU0UxHTAbBgNVBAoMFFRlc3RiYW5rIEEgQUIgKHB1YmwpMRUwEwYDVQQFEwwx
+MTExMTExMTExMTExLDAqBgNVBAMMI1Rlc3RiYW5rIEEgUlAgQ0EgdjEgZm9yIEJh
+bmtJRCBUZXN0MB4XDTIwMDYxNzIyMDAwMFoXDTIyMDkwNTIxNTk1OVowcjELMAkG
+A1UEBhMCU0UxHTAbBgNVBAoMFFRlc3RiYW5rIEEgQUIgKHB1YmwpMRMwEQYDVQQF
+Ewo1NTY2MzA0OTI4MRcwFQYDVQQpDA5UZXN0IGF2IEJhbmtJRDEWMBQGA1UEAwwN
+RlAgVGVzdGNlcnQgMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMCb
+Fluh4O4TEl4vydPGIUc4kAFDSVk1RM5TDYn8UDlWVxHVbalbXaJbtNQFYFm7lmpk
+FXiif50iupanvIq+k4DIGm01MnGasWl4EW9uoExCoZC4EemZry+Hk7hm2vbwGudf
+uIR8P43AD1MV7kp/skJaTH16qEeWTKQSoVlC+XNP/7Tl6Z8JE1GOR3+oAXWs+f/o
+5SxXq4kIlBPkSK3tiTbEAP0/dNnSqSprv5MFHnTTWZyl8TK02TGrazyVUp/em6e6
+V/lTtJylBmHNJMpzl7PGixgXApRSMj4ltHwjqAizBMatDoXE6qXG0fEj+vhqSo/v
+wajY9t6FHNovhNdI+CcCAwEAAaNlMGMwEQYDVR0gBAowCDAGBgQqAwQFMA4GA1Ud
+DwEB/wQEAwIHgDAfBgNVHSMEGDAWgBTiuVUIvGKgRjldgAxQSpIBy0zvizAdBgNV
+HQ4EFgQU8xDQD1mLJ7MpUSxGB4lUDC5pdgswDQYJKoZIhvcNAQELBQADggIBAGWn
+PRoXUxPITv9Uo+4llmIHhHg5XR5ejenJOFyCvTAtteQozdFJ2rby+Q4WZNAdtP8Q
+tWcDaDigylDZSwi9TBGTRPSLH2cDFEWCQZVHs8svsF5VyBfkdtaRomiSAsk9KKLf
+6Vo6ik1hlh4+NTBMX3VW0LjUZrPXmQ14El/XiJmHOvs54kAYf9ZTcO332Gqo8RF+
+M3CRDVxPSrU34u6fvvxQuAvXvPumWvHaSAkOhpsn+Idr+KQ0Rip6fmgTG7UMicUi
+PxTE66xpaMsHDmuPaeC+cTK/iXAW60+X/Vv/ANn7UOz6tvrjo6Sd1DIpEEjqW/yE
+L4F05lbXhixKS2IRY+mAejoC66N2tz+0bv1grK4147jsYw4i9Y/rGyggkSrRd+1k
+QM7uBxW3Cu5fSKOUZ/0UTcBGf82Ze8SlbFFvpagELy9cJHwMKarzTkuX92hJ9KG0
+h26JBdOHzberG2tQiYzMPYVcch7WCAFWR++w6qInFs0WK7F7SBP0fyZew3hZZDoO
+snqLWMgG+YagjAsMAcr99RvwqX7TJtISejdxz9lxxN2jKM0b1f2v8K88tzRekrGG
+CPUQlnPu7sj7nPLVs5/sUEbaVRz8G8lKjYGsMuecRLpuVRQ/vPAd5whfiIzQFK76
+boWGbSHS6OXfIfDrowTNlzAP+/H9f7DyBZTdwrVX
+-----END CERTIFICATE-----

data/lib/bankid/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bankid
-  VERSION = "0.1.2"
+  VERSION = "1.0.0"
 end

data/lib/bankid.rb

@@ -36,7 +36,7 @@ module Bankid
       @env = env
       @url = Bankid.const_get("#{env.upcase}_URL")
       @cert_password = cert_password
-      @cert, @root_cert = load_certificates
+      @cert, @key, @root_cert = load_certificates
     end
 
     def generate_qr(start_token:, start_secret:, seconds:)
@@ -81,7 +81,8 @@ module Bankid
       return if @env == "test"
 
       [
-        OpenSSL::PKCS12.new(File.read(cert_path("client_certificate.p12")), @cert_password),
+        OpenSSL::X509::Certificate.new(File.read(cert_path("client_certificate.pem"))),
+        OpenSSL::PKey::RSA.new(File.read(cert_path("client_certificate.key")), @cert_password),
         OpenSSL::X509::Certificate.new(File.read(cert_path("bankid_certificate.pem")))
       ]
     end
@@ -95,8 +96,8 @@ module Bankid
     def ssl_context
       OpenSSL::SSL::SSLContext.new.tap do |ctx|
         ctx.add_certificate(
-          @cert.certificate,
-          @cert.key,
+          @cert,
+          @key,
           [@root_cert]
         )
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bankid
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 1.0.0
 platform: ruby
 authors:
 - Johan Halse
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-09-08 00:00:00.000000000 Z
+date: 2022-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: http
@@ -55,7 +55,9 @@ files:
 - bin/console
 - bin/setup
 - config/certs/development_bankid_certificate.pem
+- config/certs/development_client_certificate.key
 - config/certs/development_client_certificate.p12
+- config/certs/development_client_certificate.pem
 - config/certs/production_bankid_certificate.pem
 - lib/bankid.rb
 - lib/bankid/authentication.rb