better_auth-sso 0.6.2 → 0.8.0

data/lib/better_auth/sso/plugin/saml_validation_and_state.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_parse_saml_response(value, config = {}, provider = nil, ctx = nil)
+      parser = config.dig(:saml, :parse_response)
+      if parser.respond_to?(:call)
+        sso_validate_single_saml_assertion!(value) if sso_base64_xml?(value)
+        parsed = parser.call(raw_response: value.to_s, provider: provider, context: ctx)
+        return normalize_hash(parsed)
+      end
+
+      JSON.parse(Base64.decode64(value.to_s), symbolize_names: true)
+    rescue APIError
+      raise APIError.new("BAD_REQUEST", message: "Invalid SAML response")
+    rescue
+      raise APIError.new("BAD_REQUEST", message: "Invalid SAML response")
+    end
+
+    def sso_validate_single_saml_assertion!(saml_response)
+      xml = Base64.decode64(saml_response.to_s)
+      raise APIError.new("BAD_REQUEST", message: "Invalid base64-encoded SAML response") unless xml.include?("<")
+
+      assertions = xml.scan(/<(?:\w+:)?Assertion(?:\s|>|\/)/).length
+      encrypted_assertions = xml.scan(/<(?:\w+:)?EncryptedAssertion(?:\s|>|\/)/).length
+      total = assertions + encrypted_assertions
+      raise APIError.new("BAD_REQUEST", message: "SAML response contains no assertions") if total.zero?
+      if total > 1
+        raise APIError.new("BAD_REQUEST", message: "SAML response contains #{total} assertions, expected exactly 1")
+      end
+
+      true
+    rescue APIError
+      raise
+    rescue
+      raise APIError.new("BAD_REQUEST", message: "Invalid base64-encoded SAML response")
+    end
+
+    def sso_validate_saml_timestamp!(conditions, config = {}, now: Time.now.utc)
+      conditions = normalize_hash(conditions || {})
+      not_before = conditions[:not_before] || conditions[:notBefore]
+      not_on_or_after = conditions[:not_on_or_after] || conditions[:notOnOrAfter]
+      if not_before.to_s.empty? && not_on_or_after.to_s.empty?
+        raise APIError.new("BAD_REQUEST", message: "SAML assertion missing required timestamp conditions") if config.dig(:saml, :require_timestamps)
+
+        return true
+      end
+
+      clock_skew_seconds = ((config.dig(:saml, :clock_skew) || SSO_DEFAULT_CLOCK_SKEW_MS).to_f / 1000.0)
+      parsed_not_before = sso_parse_saml_timestamp(not_before, "SAML assertion has invalid NotBefore timestamp") unless not_before.to_s.empty?
+      parsed_not_on_or_after = sso_parse_saml_timestamp(not_on_or_after, "SAML assertion has invalid NotOnOrAfter timestamp") unless not_on_or_after.to_s.empty?
+
+      raise APIError.new("BAD_REQUEST", message: "SAML assertion is not yet valid") if parsed_not_before && now < (parsed_not_before - clock_skew_seconds)
+      raise APIError.new("BAD_REQUEST", message: "SAML assertion has expired") if parsed_not_on_or_after && now > (parsed_not_on_or_after + clock_skew_seconds)
+
+      true
+    end
+
+    def sso_parse_saml_timestamp(value, error_message)
+      Time.parse(value.to_s).utc
+    rescue
+      raise APIError.new("BAD_REQUEST", message: error_message)
+    end
+
+    def sso_saml_timestamp_conditions(assertion)
+      assertion = normalize_hash(assertion || {})
+      conditions = normalize_hash(assertion[:conditions] || {})
+      conditions[:not_before] ||= assertion[:not_before] || assertion[:notBefore]
+      conditions[:not_on_or_after] ||= assertion[:not_on_or_after] || assertion[:notOnOrAfter]
+      conditions
+    end
+
+    def sso_base64_xml?(value)
+      Base64.decode64(value.to_s).lstrip.start_with?("<")
+    rescue
+      false
+    end
+
+    def sso_validate_saml_algorithms!(xml, options = {})
+      on_deprecated = (options[:on_deprecated] || "warn").to_s
+      signature_algorithms = xml.to_s.scan(/SignatureMethod[^>]+Algorithm=["']([^"']+)["']/).flatten.map { |algorithm| sso_normalize_saml_signature_algorithm(algorithm) }
+      digest_algorithms = xml.to_s.scan(/DigestMethod[^>]+Algorithm=["']([^"']+)["']/).flatten.map { |algorithm| sso_normalize_saml_digest_algorithm(algorithm) }
+      key_encryption_algorithms = xml.to_s.scan(/<[^\/>]*EncryptedKey\b[\s\S]*?EncryptionMethod[^>]+Algorithm=["']([^"']+)["']/).flatten
+      data_encryption_algorithms = xml.to_s.scan(/<[^\/>]*EncryptedData\b[\s\S]*?EncryptionMethod[^>]+Algorithm=["']([^"']+)["']/).flatten
+
+      sso_validate_saml_algorithm_group!(
+        signature_algorithms,
+        allowed: options[:allowed_signature_algorithms]&.map { |algorithm| sso_normalize_saml_signature_algorithm(algorithm) },
+        secure: SSO_SAML_SECURE_SIGNATURE_ALGORITHMS,
+        deprecated: ["http://www.w3.org/2000/09/xmldsig#rsa-sha1"],
+        on_deprecated: on_deprecated,
+        label: "signature"
+      )
+      sso_validate_saml_algorithm_group!(
+        digest_algorithms,
+        allowed: options[:allowed_digest_algorithms]&.map { |algorithm| sso_normalize_saml_digest_algorithm(algorithm) },
+        secure: SSO_SAML_SECURE_DIGEST_ALGORITHMS,
+        deprecated: ["http://www.w3.org/2000/09/xmldsig#sha1"],
+        on_deprecated: on_deprecated,
+        label: "digest"
+      )
+      sso_validate_saml_algorithm_group!(
+        key_encryption_algorithms,
+        allowed: options[:allowed_key_encryption_algorithms],
+        secure: SSO_SAML_SECURE_KEY_ENCRYPTION_ALGORITHMS,
+        deprecated: ["http://www.w3.org/2001/04/xmlenc#rsa-1_5"],
+        on_deprecated: on_deprecated,
+        label: "key encryption"
+      )
+      sso_validate_saml_algorithm_group!(
+        data_encryption_algorithms,
+        allowed: options[:allowed_data_encryption_algorithms],
+        secure: SSO_SAML_SECURE_DATA_ENCRYPTION_ALGORITHMS,
+        deprecated: ["http://www.w3.org/2001/04/xmlenc#tripledes-cbc"],
+        on_deprecated: on_deprecated,
+        label: "data encryption"
+      )
+
+      true
+    end
+
+    def sso_normalize_saml_signature_algorithm(algorithm)
+      SSO_SAML_SIGNATURE_ALGORITHMS.fetch(algorithm.to_s.downcase, algorithm.to_s)
+    end
+
+    def sso_normalize_saml_digest_algorithm(algorithm)
+      SSO_SAML_DIGEST_ALGORITHMS.fetch(algorithm.to_s.downcase, algorithm.to_s)
+    end
+
+    def sso_validate_saml_algorithm_group!(algorithms, allowed:, secure:, deprecated:, on_deprecated:, label:)
+      algorithms.each do |algorithm|
+        if allowed
+          next if allowed.include?(algorithm)
+
+          raise APIError.new("BAD_REQUEST", message: "SAML #{label} algorithm not in allow-list: #{algorithm}")
+        end
+
+        if deprecated.include?(algorithm)
+          raise APIError.new("BAD_REQUEST", message: "SAML response uses deprecated #{label} algorithm: #{algorithm}") if on_deprecated == "reject"
+          next
+        end
+        next if secure.include?(algorithm)
+
+        raise APIError.new("BAD_REQUEST", message: "SAML #{label} algorithm not recognized: #{algorithm}")
+      end
+    end
+
+    def sso_generate_saml_relay_state(ctx, state_data)
+      ttl_ms = 10 * 60 * 1000
+      relay_state = BetterAuth::Crypto.random_string(32)
+      now_ms = (Time.now.to_f * 1000).to_i
+      stored = state_data.each_with_object({}) { |(key, value), result| result[key.to_s] = value }.merge(
+        "codeVerifier" => BetterAuth::Crypto.random_string(128),
+        "expiresAt" => now_ms + ttl_ms
+      )
+      ctx.context.internal_adapter.create_verification_value(
+        identifier: "#{SSO_SAML_RELAY_STATE_KEY_PREFIX}#{relay_state}",
+        value: JSON.generate(stored),
+        expiresAt: Time.at((now_ms + ttl_ms) / 1000.0)
+      )
+      ctx.set_signed_cookie("relay_state", relay_state, ctx.context.secret, path: "/", max_age: ttl_ms / 1000, http_only: true, same_site: "lax")
+      relay_state
+    end
+
+    def sso_parse_saml_relay_state(ctx, relay_state)
+      state = sso_verify_state(relay_state, ctx.context.secret)
+      return state if state
+
+      verification = ctx.context.internal_adapter.find_verification_value("#{SSO_SAML_RELAY_STATE_KEY_PREFIX}#{relay_state}")
+      return nil unless verification
+      return nil unless sso_future_time?(verification.fetch("expiresAt"))
+
+      parsed = JSON.parse(verification.fetch("value"))
+      return nil if parsed["expiresAt"].to_i <= (Time.now.to_f * 1000).to_i
+
+      parsed
+    rescue
+      nil
+    end
+  end
+end

data/lib/better_auth/sso/plugin/sign_in_and_oidc_callbacks.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_sign_in_endpoint(config = {})
+      Endpoint.new(path: "/sign-in/sso", method: "POST") do |ctx|
+        body = normalize_hash(ctx.body)
+        provider = sso_select_provider(ctx, body, config)
+        provider_type = body[:provider_type].to_s
+        if provider_type == "oidc" && !provider["oidcConfig"]
+          raise APIError.new("BAD_REQUEST", message: "OIDC provider is not configured")
+        end
+        if provider_type == "saml" && !provider["samlConfig"]
+          raise APIError.new("BAD_REQUEST", message: "SAML provider is not configured")
+        end
+        if config.dig(:domain_verification, :enabled) && !(provider.key?("domainVerified") && provider["domainVerified"])
+          raise APIError.new("UNAUTHORIZED", message: "Provider domain has not been verified")
+        end
+
+        state_data = {
+          providerId: provider.fetch("providerId"),
+          callbackURL: body[:callback_url] || "/",
+          errorURL: body[:error_callback_url],
+          newUserURL: body[:new_user_callback_url],
+          requestSignUp: body[:request_sign_up]
+        }
+
+        if provider["oidcConfig"] && provider_type != "saml"
+          provider = sso_ensure_runtime_oidc_provider(ctx, provider, config)
+          state = BetterAuth::Crypto.sign_jwt(
+            state_data.merge({nonce: BetterAuth::Crypto.random_string(32)}).merge(sso_oidc_pkce_state(provider)),
+            ctx.context.secret,
+            expires_in: 600
+          )
+          url = sso_oidc_authorization_url(provider, ctx, state, config, body)
+        elsif provider["samlConfig"]
+          relay_state = sso_generate_saml_relay_state(ctx, state_data)
+          url = sso_saml_authorization_url(provider, relay_state, ctx, config)
+          sso_store_saml_authn_request(ctx, provider, url, config)
+        else
+          raise APIError.new("BAD_REQUEST", message: "OIDC provider is not configured")
+        end
+        ctx.json({url: url, redirect: true})
+      end
+    end
+
+    def sso_oidc_callback_endpoint(config = {})
+      Endpoint.new(path: "/sso/callback/:providerId", method: "GET") do |ctx|
+        sso_handle_oidc_callback(ctx, config, sso_fetch(ctx.params, :provider_id))
+      end
+    end
+
+    def sso_oidc_shared_callback_endpoint(config = {})
+      Endpoint.new(path: "/sso/callback", method: "GET") do |ctx|
+        state = sso_verify_state(ctx.query[:state] || ctx.query["state"], ctx.context.secret)
+        next ctx.redirect("#{ctx.context.base_url}/error?error=invalid_state") unless state
+
+        sso_handle_oidc_callback(ctx, config, state["providerId"], state: state)
+      end
+    end
+
+    def sso_handle_oidc_callback(ctx, config, provider_id, state: nil)
+      state ||= sso_verify_state(ctx.query[:state] || ctx.query["state"], ctx.context.secret)
+      return ctx.redirect("#{ctx.context.base_url}/error?error=invalid_state") unless state
+
+      callback_url = state["callbackURL"] || "/"
+      error_url = state["errorURL"] || callback_url
+      if ctx.query[:error] || ctx.query["error"]
+        error = ctx.query[:error] || ctx.query["error"]
+        description = ctx.query[:error_description] || ctx.query["error_description"]
+        return sso_redirect(ctx, sso_append_error(error_url, error, description))
+      end
+      state_provider_id = state["providerId"] || state[:providerId]
+      if state_provider_id.to_s != provider_id.to_s
+        return sso_redirect(ctx, sso_append_error(error_url, "invalid_state", "provider mismatch"))
+      end
+
+      provider = sso_callback_provider(ctx, config, provider_id)
+      return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "provider not found")) unless provider
+      if config.dig(:domain_verification, :enabled) && !(provider.key?("domainVerified") && provider["domainVerified"])
+        raise APIError.new("UNAUTHORIZED", message: "Provider domain has not been verified")
+      end
+
+      provider = sso_ensure_runtime_oidc_provider(ctx, provider, config)
+      oidc_config = normalize_hash(provider["oidcConfig"] || {})
+      oidc_config[:issuer] ||= provider["issuer"]
+      return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "provider not found")) if oidc_config.empty?
+
+      tokens = sso_oidc_tokens(ctx, provider, oidc_config, state, config)
+      unless tokens
+        return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "token_response_not_found"))
+      end
+      if oidc_config[:user_info_endpoint].to_s.empty? && tokens[:id_token] && oidc_config[:jwks_endpoint].to_s.empty?
+        begin
+          provider = sso_ensure_runtime_oidc_provider(ctx, provider, config, require_jwks: true)
+          oidc_config = normalize_hash(provider["oidcConfig"] || {})
+          oidc_config[:issuer] ||= provider["issuer"]
+        rescue APIError
+          # Fall through to the upstream callback error when JWKS is still unavailable.
+        end
+      end
+      user_info = sso_oidc_user_info(ctx, oidc_config, tokens, config, expected_nonce: state["nonce"] || state[:nonce])
+      if user_info[:_sso_error]
+        return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", user_info[:_sso_error]))
+      end
+      if user_info[:email].to_s.empty? || user_info[:id].to_s.empty?
+        return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "missing_user_info"))
+      end
+      if config[:disable_implicit_sign_up] && !state["requestSignUp"] && !ctx.context.internal_adapter.find_user_by_email(user_info[:email].to_s.downcase)
+        return sso_redirect(ctx, sso_append_error(error_url, "signup disabled"))
+      end
+
+      result = sso_find_or_create_user_result(ctx, provider, user_info, config)
+      if config[:provision_user].respond_to?(:call) && (result.fetch(:created) || config[:provision_user_on_every_login])
+        config[:provision_user].call(user: result.fetch(:user), userInfo: user_info, token: tokens, provider: provider)
+      end
+      session = ctx.context.internal_adapter.create_session(result.fetch(:user).fetch("id"))
+      Cookies.set_session_cookie(ctx, {session: session, user: result.fetch(:user)})
+      redirect_to = (result.fetch(:created) && state["newUserURL"].to_s != "") ? state["newUserURL"] : callback_url
+      sso_redirect(ctx, redirect_to || "/")
+    end
+  end
+end

data/lib/better_auth/sso/routes/schemas.rb

@@ -44,17 +44,18 @@ module BetterAuth
 
         def plugin_schema(config = {})
           normalized = BetterAuth::Plugins.normalize_hash(config || {})
+          field_mappings = BetterAuth::Plugins.normalize_hash(normalized[:fields] || {})
           fields = {
-            issuer: {type: "string", required: true},
-            oidcConfig: {type: "string", required: false},
-            samlConfig: {type: "string", required: false},
-            userId: {type: "string", required: true},
-            providerId: {type: "string", required: true, unique: true},
-            domain: {type: "string", required: true},
-            organizationId: {type: "string", required: false}
+            issuer: field("issuer", {type: "string", required: true}, field_mappings),
+            oidcConfig: field("oidcConfig", {type: "string", required: false}, field_mappings),
+            samlConfig: field("samlConfig", {type: "string", required: false}, field_mappings),
+            userId: field("userId", {type: "string", required: true, references: {model: "user", field: "id"}}, field_mappings),
+            providerId: field("providerId", {type: "string", required: true, unique: true}, field_mappings),
+            domain: field("domain", {type: "string", required: true}, field_mappings),
+            organizationId: field("organizationId", {type: "string", required: false}, field_mappings)
           }
           if normalized.dig(:domain_verification, :enabled)
-            fields[:domainVerified] = {type: "boolean", required: false, default_value: false}
+            fields[:domainVerified] = field("domainVerified", {type: "boolean", required: false, default_value: false}, field_mappings)
           end
           {
             ssoProvider: {
@@ -71,6 +72,11 @@ module BetterAuth
         def saml_config_key?(key)
           SAML_CONFIG_KEYS.include?(BetterAuth::Plugins.normalize_key(key))
         end
+
+        def field(logical_name, attributes, mappings)
+          mapping = mappings[BetterAuth::Plugins.normalize_key(logical_name)]
+          mapping ? attributes.merge(field_name: mapping) : attributes
+        end
       end
     end
   end

data/lib/better_auth/sso/routes/sso.rb

@@ -20,7 +20,7 @@ module BetterAuth
             initiate_slo: BetterAuth::Plugins.sso_initiate_slo_endpoint(normalized),
             list_sso_providers: BetterAuth::Plugins.sso_list_providers_endpoint,
             get_sso_provider: BetterAuth::Plugins.sso_get_provider_endpoint,
-            update_sso_provider: BetterAuth::Plugins.sso_update_provider_endpoint,
+            update_sso_provider: BetterAuth::Plugins.sso_update_provider_endpoint(normalized),
             delete_sso_provider: BetterAuth::Plugins.sso_delete_provider_endpoint
           }
           if normalized.dig(:domain_verification, :enabled)

data/lib/better_auth/sso/saml_state.rb

@@ -7,7 +7,7 @@ module BetterAuth
 
       def generate_relay_state(ctx, link = nil, additional_data = {})
         callback_url = BetterAuth::Plugins.sso_fetch(ctx.body, :callback_url)
-        raise APIError.new("BAD_REQUEST", message: "callbackURL is required") if callback_url.to_s.empty?
+        raise BetterAuth::APIError.new("BAD_REQUEST", message: "callbackURL is required") if callback_url.to_s.empty?
 
         extra = (additional_data == false) ? {} : (additional_data || {})
         BetterAuth::Plugins.sso_generate_saml_relay_state(

data/lib/better_auth/sso/version.rb

@@ -2,7 +2,7 @@
 
 module BetterAuth
   module SSO
-    VERSION = "0.6.2"
+    VERSION = "0.8.0"
     PACKAGE_VERSION = VERSION
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: better_auth-sso
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.8.0
 platform: ruby
 authors:
 - Sebastian Sala
@@ -43,6 +43,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.8'
 - !ruby/object:Gem::Dependency
   name: logger
   requirement: !ruby/object:Gem::Requirement
@@ -140,7 +154,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.0'
 description: Adds SSO provider management, OIDC SSO, and SAML SSO integration for
-  Better Auth Ruby.
+  Better Auth Ruby. Better Auth Ruby is an independent modern authentication framework
+  for Ruby inspired by Better Auth.
 email:
 - sebastian.sala.tech@gmail.com
 executables: []
@@ -161,6 +176,16 @@ files:
 - lib/better_auth/sso/oidc/discovery.rb
 - lib/better_auth/sso/oidc/errors.rb
 - lib/better_auth/sso/oidc/types.rb
+- lib/better_auth/sso/plugin/core.rb
+- lib/better_auth/sso/plugin/endpoints.rb
+- lib/better_auth/sso/plugin/oidc_discovery.rb
+- lib/better_auth/sso/plugin/oidc_runtime.rb
+- lib/better_auth/sso/plugin/provider_utils.rb
+- lib/better_auth/sso/plugin/providers.rb
+- lib/better_auth/sso/plugin/saml_metadata_and_logout.rb
+- lib/better_auth/sso/plugin/saml_response.rb
+- lib/better_auth/sso/plugin/saml_validation_and_state.rb
+- lib/better_auth/sso/plugin/sign_in_and_oidc_callbacks.rb
 - lib/better_auth/sso/routes/domain_verification.rb
 - lib/better_auth/sso/routes/helpers.rb
 - lib/better_auth/sso/routes/providers.rb