cf-uaa-lib 4.0.9 → 4.0.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b1bef252c395d0a9dfbd30cb9b4e60be278d01ae09b496d97d7f8665ff273ba5
-  data.tar.gz: 0bfd4b2af11ca2261e399bf2c73e4710ba49de67fed16766e22ac110cac19ad9
+  metadata.gz: 1c58cae634831cdd1f201b726d1f6ea95155b41cdc4a39731292ca9e4857852e
+  data.tar.gz: c48636814742c86d34a2869e9810d5c8d4a1ef13e9319c0686db109dbb742dc9
 SHA512:
-  metadata.gz: c7ebce508854b456f17ca0980cbaa10326cc472c81008d0956d5c70401bd671a17a959ab41e6e3d1a4829819985daa9076f4a627c399726249fad9104aa9c787
-  data.tar.gz: 0d2a4528589995a7e5b9cf4badef1e8612232fdc07fa1af02bc5ee8d7211ad2e94489af2332f2a4e7271ea0d2bb0e8000361d6f8a446596c070618cc7e8974c9
+  metadata.gz: 18704cf4ebeba101c2525df2ba5639ef162442f31fa8bc5640324daf8ff28b319074a787eb61ea552a00add0c2c4ce1777ef1d44a0a15f0d310bdb55441e03b0
+  data.tar.gz: bb592b860bca147025efa396ae66c4254dc2ff2eddcb16dc75043a3dbef9c1d3c22fe38192be2358c9c2c864b5dab5b6758cd89845948d761fb6111224398512

data/.github/workflows/gem-push.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
       # Set up
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:

data/.github/workflows/ruby.yml

@@ -11,11 +11,12 @@ jobs:
 
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
-        ruby-version: ['2.5', '2.7', '3.1', '3.2', '3.3', '3.4']
+        ruby-version: ['3.3', '3.4', '4.0']
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:

data/cf-uaa-lib.gemspec

@@ -25,22 +25,24 @@ Gem::Specification.new do |s|
   s.description = %q{Client library for interacting with the CloudFoundry User Account and Authorization (UAA) server.  The UAA is an OAuth2 Authorization Server so it can be used by webapps and command line apps to obtain access tokens to act on behalf of users.  The tokens can then be used to access protected resources in a Resource Server.  This library is for use by UAA client applications or resource servers.}
 
   s.license       = "Apache-2.0"
+  s.required_ruby_version = '>= 3.3'
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
   s.executables   = `git ls-files -- bin/*`.split('\n').map{ |f| File.basename(f) }
   s.require_paths = ['lib']
 
   # dependencies
-  s.add_dependency 'json', '~>2.7'
+  s.add_dependency 'json', '>=2.7', '<4.0'
   s.add_dependency 'mutex_m'
   s.add_dependency 'base64'
+  s.add_dependency 'logger'
   s.add_dependency 'httpclient', '~> 2.8', '>= 2.8.2.4'
   s.add_dependency 'addressable', '~> 2.8', '>= 2.8.0'
 
-  s.add_development_dependency 'bundler', '~> 2.2'
+  s.add_development_dependency 'bundler', '>= 2.2'
   s.add_development_dependency 'rake', '>= 10.3.2', '~> 13.0'
   s.add_development_dependency 'rspec', '>= 2.14.1', '~> 3.9'
-  s.add_development_dependency 'simplecov', '~> 0.22.0'
+  s.add_development_dependency 'simplecov', '~> 1.3.0'
   s.add_development_dependency 'simplecov-rcov', '~> 0.3.0'
   s.add_development_dependency 'ci_reporter', '>= 1.9.2', '~> 2.0'
   s.add_development_dependency 'ci_reporter_rspec', '~> 1.0'

data/lib/uaa/http.rb

@@ -184,7 +184,7 @@ module Http
     raise SSLException, "Invalid SSL Cert for #{url}. Use '--skip-ssl-validation' to continue with an insecure target"
   rescue URI::Error, SocketError, SystemCallError => e
     raise BadTarget, "error: #{e.message}"
-  rescue HTTPClient::ConnectTimeoutError => e
+  rescue HTTPClient::ConnectTimeoutError, HTTPClient::ReceiveTimeoutError
     raise HTTPException.new "http timeout"
   end
 

data/lib/uaa/token_issuer.rb

@@ -75,6 +75,8 @@ class TokenIssuer
     if scope = Util.arglist(params.delete(:scope))
       params[:scope] = Util.strlist(scope)
     end
+    client_assertion = params[:client_assertion]
+    params.delete(:client_assertion)
     headers = {'content-type' => FORM_UTF8, 'accept' => JSON_UTF8}
     if @client_auth_method == 'client_secret_basic' && @client_secret && @client_id
       if @basic_auth
@@ -88,6 +90,10 @@ class TokenIssuer
       params[:client_secret] = @client_secret
     elsif @client_id && params[:code_verifier]
       params[:client_id] = @client_id
+    elsif client_assertion && @client_id && @client_secret.nil?
+      params[:client_id] = @client_id
+      params[:client_assertion] = client_assertion
+      params[:client_assertion_type] = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
     else
       headers['X-CF-ENCODED-CREDENTIALS'] = 'true'
       headers['authorization'] = Http.basic_auth(CGI.escape(@client_id || ''), CGI.escape(@client_secret || ''))
@@ -129,6 +135,7 @@ class TokenIssuer
   #   * +:symbolize_keys+, if true, returned hash keys are symbols.
   def initialize(target, client_id, client_secret = nil, options = {})
     @target, @client_id, @client_secret = target, client_id, client_secret
+    @client_assertion = options[:client_assertion] || nil
     @token_target = options[:token_target] || target
     @key_style = options[:symbolize_keys] ? :sym : nil
     @basic_auth = options[:basic_auth] == true ? true : false
@@ -310,8 +317,8 @@ class TokenIssuer
   # Uses the instance client credentials to get a token with a client
   # credentials grant. See http://tools.ietf.org/html/rfc6749#section-4.4
   # @return [TokenInfo]
-  def client_credentials_grant(scope = nil)
-    request_token(grant_type: 'client_credentials', scope: scope)
+  def client_credentials_grant(scope = nil, client_assertion = nil)
+    request_token(grant_type: 'client_credentials', scope: scope, client_assertion: client_assertion)
   end
 
   # Uses the instance client credentials and the given +refresh_token+ to get
@@ -321,6 +328,15 @@ class TokenIssuer
     request_token(grant_type: 'refresh_token', refresh_token: refresh_token, scope: scope)
   end
 
+  # Gets an access token with the user assertion used for authentication
+  # via the jwt bearer authorization grant.
+  # See {http://tools.ietf.org/html/rfc7523#section-2.1}.
+  # @param assertion should be an id_token from a previous IdP token request
+  # @return [TokenInfo]
+  def jwt_bearer_grant(assertion, scope = nil, client_assertion = nil)
+    request_token(grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion: assertion, scope: scope, client_assertion: client_assertion)
+  end
+
 end
 
 end

data/lib/uaa/version.rb

@@ -14,6 +14,6 @@
 # Cloud Foundry namespace
 module CF
   module UAA
-    VERSION = '4.0.9'
+    VERSION = '4.0.11'
   end
 end

data/spec/scim_spec.rb

@@ -297,9 +297,9 @@ describe Scim do
         method.should == :get
         check_headers(headers, nil, :json, nil)
 
-        query_params = CGI::parse(URI.parse(url).query)
-        start_index = query_params['startIndex'].first
-        count = query_params['count'].first
+        query_params = URI.decode_www_form(URI.parse(url).query).to_h
+        start_index = query_params['startIndex']
+        count = query_params['count']
 
         start_index.should == '3'
         count.should == '10'

data/spec/token_issuer_spec.rb

@@ -345,6 +345,37 @@ describe TokenIssuer do
     end
   end
 
+  context 'with client_assertion using client credentials grant' do
+    let(:client_id) { 'test_client' }
+    let(:client_secret) { nil }
+
+    it 'use client_secret_post in authorization code and expect client_id and secret in body' do
+      subject.set_request_handler do |url, method, body, headers|
+        headers['content-type'].should =~ /application\/x-www-form-urlencoded/
+        headers['accept'].should =~ /application\/json/
+        headers['X-CF-ENCODED-CREDENTIALS'].should_not
+        headers['authorization'].should_not
+        params = Util.decode_form(body)
+        params['grant_type'].should == 'client_credentials'
+        params['client_id'].should == 'test_client'
+        params['client_assertion'].should == 'any-jwt-token'
+        params['client_assertion_type'].should == 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
+        params['client_secret'].should_not
+        url.should match 'http://test.uaa.target/oauth/token'
+        method.should == :post
+        reply = {access_token: 'test_access_token', token_type: 'BEARER',
+                 scope: 'logs.read', expires_in: 98765}
+        [200, Util.json(reply), {'content-type' => 'application/json'}]
+      end
+      token = subject.client_credentials_grant('logs.read', 'any-jwt-token')
+      token.should be_an_instance_of TokenInfo
+      token.info['access_token'].should == 'test_access_token'
+      token.info['token_type'].should =~ /^bearer$/i
+      token.info['scope'].should == 'logs.read'
+      token.info['expires_in'].should == 98765
+    end
+  end
+
   context 'pkce with own code verifier' do
     let(:options) { {basic_auth: false, code_verifier: 'umoq1e_4XMYXvfHlaO9mSlSI17OKfxnwfR5ZD-oYreFxyn8yQZ-ZHPZfUZ4n3WjY_tkOB_MAisSy4ddqsa6aoTU5ZOcX4ps3de933PczYlC8pZpKL8EQWaDZOnpOyB2W'} }
 
@@ -439,6 +470,55 @@ describe TokenIssuer do
     end
   end
 
+  context 'with jwt bearer grant' do
+
+    it 'gets a token with jwt bearer' do
+      subject.set_request_handler do |url, method, body, headers|
+        headers['content-type'].should =~ /application\/x-www-form-urlencoded/
+        headers['accept'].should =~ /application\/json/
+        headers['X-CF-ENCODED-CREDENTIALS'].should == 'true'
+        headers['authorization'].should == 'Basic dGVzdF9jbGllbnQ6dGVzdCUyMXNlY3JldA=='
+        url.should == 'http://test.uaa.target/oauth/token'
+        method.should == :post
+        reply = {access_token: 'test_access_token', token_type: 'BEARER',
+                 scope: 'openid', expires_in: 98765}
+        [200, Util.json(reply), {'content-type' => 'application/json'}]
+      end
+      token = subject.jwt_bearer_grant('assertion', 'openid')
+      token.should be_an_instance_of TokenInfo
+      token.info['access_token'].should == 'test_access_token'
+      token.info['token_type'].should =~ /^bearer$/i
+      token.info['scope'].should == 'openid'
+      token.info['expires_in'].should == 98765
+    end
+
+    context "when client & client secret are nil" do
+      let(:client_id) { nil }
+      let(:client_secret) { nil }
+
+      it 'does not error' do
+        subject.set_request_handler do |url, method, body, headers|
+          headers['content-type'].should =~ /application\/x-www-form-urlencoded/
+          headers['accept'].should =~ /application\/json/
+          headers['X-CF-ENCODED-CREDENTIALS'].should == 'true'
+          headers['authorization'].should == 'Basic Og=='
+          url.should == 'http://test.uaa.target/oauth/token'
+          method.should == :post
+          reply = {access_token: 'test_access_token', token_type: 'BEARER',
+                   scope: 'openid', expires_in: 98765}
+          [200, Util.json(reply), {'content-type' => 'application/json'}]
+        end
+        token = subject.jwt_bearer_grant('assertion', 'openid')
+        token.should be_an_instance_of TokenInfo
+        token.info['access_token'].should == 'test_access_token'
+        token.info['token_type'].should =~ /^bearer$/i
+        token.info['scope'].should == 'openid'
+        token.info['expires_in'].should == 98765
+      end
+    end
+
+  end
+
 end
 
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cf-uaa-lib
 version: !ruby/object:Gem::Version
-  version: 4.0.9
+  version: 4.0.11
 platform: ruby
 authors:
 - Dave Syer
@@ -11,22 +11,28 @@ authors:
 - Luke Taylor
 bindir: bin
 cert_chain: []
-date: 2025-02-19 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: mutex_m
   requirement: !ruby/object:Gem::Requirement
@@ -55,6 +61,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: httpclient
   requirement: !ruby/object:Gem::Requirement
@@ -99,14 +119,14 @@ dependencies:
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.2'
 - !ruby/object:Gem::Dependency
@@ -155,14 +175,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: 1.3.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: 1.3.0
 - !ruby/object:Gem::Dependency
   name: simplecov-rcov
   requirement: !ruby/object:Gem::Requirement
@@ -266,14 +286,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Client library for CloudFoundry UAA
 test_files: []