cf-uaa-lib 4.0.8 → 4.0.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c1d85a9e186e6f61fe473527aac3465589b12f415d30b22d05f99731c4d604bf
-  data.tar.gz: 71a5e80bebadaa224e51f39ef59ccdb3bf263bfc375f3d9624d5c888b79c1094
+  metadata.gz: 749fd6ab4d2b12f32a72cd0b15a573c051c42c779676c9c4a0f9582a74d13836
+  data.tar.gz: acbdddc308c40af517a356ffa492160ca39c5b97c84da512b2be966f184c329c
 SHA512:
-  metadata.gz: 1d12f9f7255e3e7728bbcbccf89593d3e3e13edc7547b9b420a985442903d91c29f708d79593b536e02619332060a18c74198ff530dac264d1048d923412bf08
-  data.tar.gz: 35e4042dccf44ff0e1dd36fd1ef639759648d226e09fe175c7fbe477d75ac601b9fc74c2c8e6a3665a1cb9ea4288c532c48f98e53b5018714f33a13113643ae4
+  metadata.gz: 8f1f81e5eff52915a9cb233b56dc00ead5ff773c4311f76434e516cce33277afa13c3956212686e43e781333451085a259c5fa7a816d2eb6e8c5b439c57e8868
+  data.tar.gz: 451e6cb18fdd7226f320bca418a5e243c6c6e9768dafa57063f6236217178d23f775fb72a176dfa7f750469a0e25c7c4524ff7598c2a5f50f0b113aad31b1497

data/.github/workflows/gem-push.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
       # Set up
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:

data/.github/workflows/ruby.yml

@@ -11,11 +11,12 @@ jobs:
 
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
-        ruby-version: ['2.5', '2.7', '3.1', '3.2', '3.3', '3.4']
+        ruby-version: ['3.3', '3.4', '4.0']
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:

data/cf-uaa-lib.gemspec

@@ -25,6 +25,7 @@ Gem::Specification.new do |s|
   s.description = %q{Client library for interacting with the CloudFoundry User Account and Authorization (UAA) server.  The UAA is an OAuth2 Authorization Server so it can be used by webapps and command line apps to obtain access tokens to act on behalf of users.  The tokens can then be used to access protected resources in a Resource Server.  This library is for use by UAA client applications or resource servers.}
 
   s.license       = "Apache-2.0"
+  s.required_ruby_version = '>= 3.3'
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
   s.executables   = `git ls-files -- bin/*`.split('\n').map{ |f| File.basename(f) }
@@ -34,10 +35,11 @@ Gem::Specification.new do |s|
   s.add_dependency 'json', '~>2.7'
   s.add_dependency 'mutex_m'
   s.add_dependency 'base64'
+  s.add_dependency 'logger'
   s.add_dependency 'httpclient', '~> 2.8', '>= 2.8.2.4'
   s.add_dependency 'addressable', '~> 2.8', '>= 2.8.0'
 
-  s.add_development_dependency 'bundler', '~> 2.2'
+  s.add_development_dependency 'bundler', '>= 2.2'
   s.add_development_dependency 'rake', '>= 10.3.2', '~> 13.0'
   s.add_development_dependency 'rspec', '>= 2.14.1', '~> 3.9'
   s.add_development_dependency 'simplecov', '~> 0.22.0'

data/lib/uaa/http.rb

@@ -184,7 +184,7 @@ module Http
     raise SSLException, "Invalid SSL Cert for #{url}. Use '--skip-ssl-validation' to continue with an insecure target"
   rescue URI::Error, SocketError, SystemCallError => e
     raise BadTarget, "error: #{e.message}"
-  rescue HTTPClient::ConnectTimeoutError => e
+  rescue HTTPClient::ConnectTimeoutError, HTTPClient::ReceiveTimeoutError
     raise HTTPException.new "http timeout"
   end
 

data/lib/uaa/scim.rb

@@ -380,13 +380,19 @@ class Scim
   # @param [String] jwks the JSON Web Key Set
   # @param [String] kid If changeMode is DELETE provide the id of key
   # @param [String] changeMode Change mode, possible is ADD, UPDATE, DELETE
+  # @param [String] iss Issuer in case of federation JWT trust
+  # @param [String] sub Subject in case of federation JWT trust
+  # @param [String] aud Audience in case of federation JWT trust
   # @return [Hash] success message from server
-  def change_clientjwt(client_id, jwks_uri = nil, jwks = nil, kid = nil, changeMode = nil)
+  def change_clientjwt(client_id, jwks_uri = nil, jwks = nil, kid = nil, changeMode = nil, iss = nil, sub = nil, aud = nil)
     req = {"client_id" => client_id }
     req["jwks_uri"] = jwks_uri if jwks_uri
     req["jwks"] = jwks if jwks
     req["kid"] = kid if kid
     req["changeMode"] = changeMode if changeMode
+    req["iss"] = iss if iss
+    req["sub"] = sub if sub
+    req["aud"] = aud if aud
     json_parse_reply(@key_style, *json_put(@target,
                                            "#{type_info(:client, :path)}/#{Addressable::URI.encode(client_id)}/clientjwt", req, headers))
   end

data/lib/uaa/token_issuer.rb

@@ -75,6 +75,8 @@ class TokenIssuer
     if scope = Util.arglist(params.delete(:scope))
       params[:scope] = Util.strlist(scope)
     end
+    client_assertion = params[:client_assertion]
+    params.delete(:client_assertion)
     headers = {'content-type' => FORM_UTF8, 'accept' => JSON_UTF8}
     if @client_auth_method == 'client_secret_basic' && @client_secret && @client_id
       if @basic_auth
@@ -88,6 +90,10 @@ class TokenIssuer
       params[:client_secret] = @client_secret
     elsif @client_id && params[:code_verifier]
       params[:client_id] = @client_id
+    elsif client_assertion && @client_id && @client_secret.nil?
+      params[:client_id] = @client_id
+      params[:client_assertion] = client_assertion
+      params[:client_assertion_type] = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
     else
       headers['X-CF-ENCODED-CREDENTIALS'] = 'true'
       headers['authorization'] = Http.basic_auth(CGI.escape(@client_id || ''), CGI.escape(@client_secret || ''))
@@ -129,6 +135,7 @@ class TokenIssuer
   #   * +:symbolize_keys+, if true, returned hash keys are symbols.
   def initialize(target, client_id, client_secret = nil, options = {})
     @target, @client_id, @client_secret = target, client_id, client_secret
+    @client_assertion = options[:client_assertion] || nil
     @token_target = options[:token_target] || target
     @key_style = options[:symbolize_keys] ? :sym : nil
     @basic_auth = options[:basic_auth] == true ? true : false
@@ -310,8 +317,8 @@ class TokenIssuer
   # Uses the instance client credentials to get a token with a client
   # credentials grant. See http://tools.ietf.org/html/rfc6749#section-4.4
   # @return [TokenInfo]
-  def client_credentials_grant(scope = nil)
-    request_token(grant_type: 'client_credentials', scope: scope)
+  def client_credentials_grant(scope = nil, client_assertion = nil)
+    request_token(grant_type: 'client_credentials', scope: scope, client_assertion: client_assertion)
   end
 
   # Uses the instance client credentials and the given +refresh_token+ to get
@@ -321,6 +328,15 @@ class TokenIssuer
     request_token(grant_type: 'refresh_token', refresh_token: refresh_token, scope: scope)
   end
 
+  # Gets an access token with the user assertion used for authentication
+  # via the jwt bearer authorization grant.
+  # See {http://tools.ietf.org/html/rfc7523#section-2.1}.
+  # @param assertion should be an id_token from a previous IdP token request
+  # @return [TokenInfo]
+  def jwt_bearer_grant(assertion, scope = nil, client_assertion = nil)
+    request_token(grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion: assertion, scope: scope, client_assertion: client_assertion)
+  end
+
 end
 
 end

data/lib/uaa/version.rb

@@ -14,6 +14,6 @@
 # Cloud Foundry namespace
 module CF
   module UAA
-    VERSION = '4.0.8'
+    VERSION = '4.0.10'
   end
 end

data/spec/scim_spec.rb

@@ -184,6 +184,18 @@ describe Scim do
     result['id'].should == 'id12345'
   end
 
+  it "add federated client's jwt trust using issuer, subject and audience" do
+    subject.set_request_handler do |url, method, body, headers|
+      url.should == "#{@target}/oauth/clients/id12345/clientjwt"
+      method.should == :put
+      check_headers(headers, :json, :json, nil)
+      body.should include('"iss":"issuer"', '"sub":"subject"', '"aud":"audience"')
+      [200, '{"id":"id12345"}', {'content-type' => 'application/json'}]
+    end
+    result = subject.change_clientjwt('id12345', jwks_uri=nil, jwks=nil, kid=nil, changemod='ADD', iss='issuer', sub='subject', aud='audience')
+    result['id'].should == 'id12345'
+  end
+
   it 'unlocks a user' do
     subject.set_request_handler do |url, method, body, headers|
       url.should == "#{@target}/Users/id12345/status"
@@ -285,9 +297,9 @@ describe Scim do
         method.should == :get
         check_headers(headers, nil, :json, nil)
 
-        query_params = CGI::parse(URI.parse(url).query)
-        start_index = query_params['startIndex'].first
-        count = query_params['count'].first
+        query_params = URI.decode_www_form(URI.parse(url).query).to_h
+        start_index = query_params['startIndex']
+        count = query_params['count']
 
         start_index.should == '3'
         count.should == '10'

data/spec/token_issuer_spec.rb

@@ -345,6 +345,37 @@ describe TokenIssuer do
     end
   end
 
+  context 'with client_assertion using client credentials grant' do
+    let(:client_id) { 'test_client' }
+    let(:client_secret) { nil }
+
+    it 'use client_secret_post in authorization code and expect client_id and secret in body' do
+      subject.set_request_handler do |url, method, body, headers|
+        headers['content-type'].should =~ /application\/x-www-form-urlencoded/
+        headers['accept'].should =~ /application\/json/
+        headers['X-CF-ENCODED-CREDENTIALS'].should_not
+        headers['authorization'].should_not
+        params = Util.decode_form(body)
+        params['grant_type'].should == 'client_credentials'
+        params['client_id'].should == 'test_client'
+        params['client_assertion'].should == 'any-jwt-token'
+        params['client_assertion_type'].should == 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
+        params['client_secret'].should_not
+        url.should match 'http://test.uaa.target/oauth/token'
+        method.should == :post
+        reply = {access_token: 'test_access_token', token_type: 'BEARER',
+                 scope: 'logs.read', expires_in: 98765}
+        [200, Util.json(reply), {'content-type' => 'application/json'}]
+      end
+      token = subject.client_credentials_grant('logs.read', 'any-jwt-token')
+      token.should be_an_instance_of TokenInfo
+      token.info['access_token'].should == 'test_access_token'
+      token.info['token_type'].should =~ /^bearer$/i
+      token.info['scope'].should == 'logs.read'
+      token.info['expires_in'].should == 98765
+    end
+  end
+
   context 'pkce with own code verifier' do
     let(:options) { {basic_auth: false, code_verifier: 'umoq1e_4XMYXvfHlaO9mSlSI17OKfxnwfR5ZD-oYreFxyn8yQZ-ZHPZfUZ4n3WjY_tkOB_MAisSy4ddqsa6aoTU5ZOcX4ps3de933PczYlC8pZpKL8EQWaDZOnpOyB2W'} }
 
@@ -439,6 +470,55 @@ describe TokenIssuer do
     end
   end
 
+  context 'with jwt bearer grant' do
+
+    it 'gets a token with jwt bearer' do
+      subject.set_request_handler do |url, method, body, headers|
+        headers['content-type'].should =~ /application\/x-www-form-urlencoded/
+        headers['accept'].should =~ /application\/json/
+        headers['X-CF-ENCODED-CREDENTIALS'].should == 'true'
+        headers['authorization'].should == 'Basic dGVzdF9jbGllbnQ6dGVzdCUyMXNlY3JldA=='
+        url.should == 'http://test.uaa.target/oauth/token'
+        method.should == :post
+        reply = {access_token: 'test_access_token', token_type: 'BEARER',
+                 scope: 'openid', expires_in: 98765}
+        [200, Util.json(reply), {'content-type' => 'application/json'}]
+      end
+      token = subject.jwt_bearer_grant('assertion', 'openid')
+      token.should be_an_instance_of TokenInfo
+      token.info['access_token'].should == 'test_access_token'
+      token.info['token_type'].should =~ /^bearer$/i
+      token.info['scope'].should == 'openid'
+      token.info['expires_in'].should == 98765
+    end
+
+    context "when client & client secret are nil" do
+      let(:client_id) { nil }
+      let(:client_secret) { nil }
+
+      it 'does not error' do
+        subject.set_request_handler do |url, method, body, headers|
+          headers['content-type'].should =~ /application\/x-www-form-urlencoded/
+          headers['accept'].should =~ /application\/json/
+          headers['X-CF-ENCODED-CREDENTIALS'].should == 'true'
+          headers['authorization'].should == 'Basic Og=='
+          url.should == 'http://test.uaa.target/oauth/token'
+          method.should == :post
+          reply = {access_token: 'test_access_token', token_type: 'BEARER',
+                   scope: 'openid', expires_in: 98765}
+          [200, Util.json(reply), {'content-type' => 'application/json'}]
+        end
+        token = subject.jwt_bearer_grant('assertion', 'openid')
+        token.should be_an_instance_of TokenInfo
+        token.info['access_token'].should == 'test_access_token'
+        token.info['token_type'].should =~ /^bearer$/i
+        token.info['scope'].should == 'openid'
+        token.info['expires_in'].should == 98765
+      end
+    end
+
+  end
+
 end
 
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cf-uaa-lib
 version: !ruby/object:Gem::Version
-  version: 4.0.8
+  version: 4.0.10
 platform: ruby
 authors:
 - Dave Syer
@@ -11,7 +11,7 @@ authors:
 - Luke Taylor
 bindir: bin
 cert_chain: []
-date: 2025-01-21 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -55,6 +55,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: httpclient
   requirement: !ruby/object:Gem::Requirement
@@ -99,14 +113,14 @@ dependencies:
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.2'
 - !ruby/object:Gem::Dependency
@@ -266,14 +280,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Client library for CloudFoundry UAA
 test_files: []