cf-uaac 4.15.0 → 4.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3d94ad3cb51d11a269c37db22e0192eb3ad33beb11413994650db7a1eee96704
-  data.tar.gz: c6a9d43f901ef43e146ae5ba1237b93c1e25cbc7c5e4df690afe37dba4f276b5
+  metadata.gz: 59c20844fe851fa5ee2b6a2cfaee7841a362044e647a98abe417616549bebee9
+  data.tar.gz: be7dc84aadceee22588768f956c717cdc6073b534366d90b1778deb882bcfb6a
 SHA512:
-  metadata.gz: 90dc3285e451dd7d435d7eada8edce46449dce10cea09415b58e80d37269867f265bd3b10485093e1e44604c5ab187633b7b4c9b561748a22f2b0ea8e1d036b8
-  data.tar.gz: b8088a02f28b76a828df8e2a4a898b69dbce15db166a97fba76d3d881b7b378a0eceb19bbd378173db90e4f2267b6e3b465502d4d75fc83586df05a74e8ca338
+  metadata.gz: 12a1f968a42a661efe5a9e695ce3ea2914c9f36f17343981594b4336b919d818d5d01d6b77ffe7d5a35eb2b78d3c5cbc21dda516cd6aa5fbfba4f7113a5457c7
+  data.tar.gz: 8fc709d8d477a19969e60b2b550a75987dee6cdd97d4f5c1f0b8e57e826a56ed5ea909e9019c437fedc22336d85d622560179970ca3ca0da2221c72b0327f072

data/.github/workflows/ruby.yml

@@ -16,7 +16,7 @@ jobs:
         ruby-version: ['2.5', '2.7', '3.0', '3.1', '3.2']
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:

data/cf-uaac.gemspec

@@ -31,7 +31,7 @@ Gem::Specification.new do |s|
   s.require_paths = ['lib']
 
   # dependencies
-  s.add_runtime_dependency 'cf-uaa-lib', '~> 4.0'
+  s.add_runtime_dependency 'cf-uaa-lib', '~> 4.0.4'
   s.add_development_dependency 'rake', '~> 13.0'
   s.add_development_dependency 'rspec', '~> 3.12'
   s.add_development_dependency 'simplecov', '~> 0.22.0'

data/lib/uaa/cli/client_reg.rb

@@ -121,6 +121,31 @@ class ClientCli < CommonCli
     }
   end
 
+  define_option :jwks_uri, '--jwks_uri <token_keys endpoint>', 'JWKS token key endpoint'
+  define_option :jwks, '--jwks <json token key set>', 'JWKS token key'
+  desc 'client jwt add [id]', 'Add client jwt trust', :jwks_uri, :jwks do |id|
+    pp scim_request { |cr|
+      ###change_clientjwt(client_id, jwks_uri = nil, jwks = nil, kid = nil, changeMode = nil)
+      cr.change_clientjwt(clientid(id), opts[:jwks_uri], opts[:jwks], nil, 'ADD')
+      'client jwt successfully added'
+    }
+  end
+
+  desc 'client jwt update [id]', 'Update client jwt trust', :jwks_uri, :jwks do |id|
+    pp scim_request { |cr|
+      cr.change_clientjwt(clientid(id), opts[:jwks_uri], opts[:jwks], nil, 'UPDATE')
+      'client jwt successfully set'
+    }
+  end
+
+  define_option :kid, '--kid <key id in json token keys>', 'JWKS token key'
+  desc 'client jwt delete [id]', 'Delete client jwt trust', :kid do |id|
+    pp scim_request { |cr|
+      cr.change_clientjwt(clientid(id), '*', nil, opts[:kid], 'DELETE')
+      'client jwt successfully deleted'
+    }
+  end
+
   private
 
   def update_client(cr, info)

data/lib/uaa/cli/token.rb

@@ -23,11 +23,14 @@ class TokenCatcher < Stub::Base
   def process_grant(data)
     server.logger.debug "processing grant for path #{request.path}"
     secret = server.info.delete(:client_secret)
+    do_authcode = server.info.delete(:do_authcode)
     ti = TokenIssuer.new(Config.target, server.info.delete(:client_id), secret,
         { token_target: Config.target_value(:token_target),
           basic_auth: Config.target_value(:basic_auth),
+          use_pkce: true,
+          code_verifier: server.info.delete(:code_verifier),
           skip_ssl_validation: Config.target_value(:skip_ssl_validation)})
-    tkn = secret ? ti.authcode_grant(server.info.delete(:uri), data) :
+    tkn = do_authcode ? ti.authcode_grant(server.info.delete(:uri), data) :
         ti.implicit_grant(server.info.delete(:uri), data)
     server.info.update(token_info: tkn.info)
     reply.text "you are now logged in and can close this window"
@@ -87,11 +90,13 @@ class TokenCli < CommonCli
     did_save
   end
 
-  def issuer_request(client_id, secret = nil)
+  def issuer_request(client_id, secret = nil, code_verifier = nil)
     update_target_info
     yield TokenIssuer.new(Config.target.to_s, client_id, secret,
         { token_target: Config.target_value(:token_endpoint),
           basic_auth: Config.target_value(:basic_auth),
+          use_pkce: true,
+          code_verifier: code_verifier,
           skip_ssl_validation: Config.target_value(:skip_ssl_validation),
           ssl_ca_file: Config.target_value(:ca_cert) })
   rescue Exception => e
@@ -159,24 +164,26 @@ class TokenCli < CommonCli
   CF_TOKEN_FILE = File.join ENV["HOME"], ".cf_token"
   CF_TARGET_FILE = File.join ENV["HOME"], ".cf_target"
 
-  def use_browser(client_id, secret = nil)
+  def use_browser(client_id, secret = nil, grant = nil)
+    do_authcode = (not grant.nil?) && (grant == 'authcode')
+    code_verifier = SecureRandom.base64(96).tr("+/", "-_").tr("=", "")
     catcher = Stub::Server.new(TokenCatcher,
         logger: Util.default_logger(debug? ? :debug : trace? ? :trace : :info),
-        info: {client_id: client_id, client_secret: secret},
+        info: {client_id: client_id, client_secret: secret, code_verifier: code_verifier, do_authcode: do_authcode},
         port: opts[:port]).run_on_thread
-    uri = issuer_request(client_id, secret) { |ti|
-      secret ? ti.authcode_uri("#{catcher.url}/authcode", opts[:scope]) :
+    uri = issuer_request(client_id, secret, code_verifier) { |ti|
+      do_authcode ? ti.authcode_uri("#{catcher.url}/authcode", opts[:scope]) :
           ti.implicit_uri("#{catcher.url}/callback", opts[:scope])
     }
     return unless catcher.info[:uri] = uri
-    say "launching browser with #{uri}" if trace?
-    Launchy.open(uri, debug: true, dry_run: false)
+    say " and launching browser with #{uri}"
+    Launchy.open(uri, debug: false, dry_run: false)
     print "waiting for token "
     while catcher.info[:uri] || !catcher.info[:token_info]
       sleep 5
       print "."
     end
-    say_success(secret ? "authorization code" : "implicit") if set_context(catcher.info[:token_info])
+    say_success(do_authcode ? "authorization code" : "implicit") if set_context(catcher.info[:token_info])
     return unless opts[:cf]
     begin
       cf_target = File.open(CF_TARGET_FILE, 'r') { |f| f.read.strip }
@@ -193,7 +200,7 @@ class TokenCli < CommonCli
   define_option :port, "--port <number>", "pin internal server to specific port"
   define_option :cf, "--[no-]cf", "save token in the ~/.cf_tokens file"
   desc "token authcode get", "Gets a token using the authcode flow with browser",
-      :client, :secret, :scope, :cf, :port do use_browser(clientid, clientsecret) end
+      :client, :secret, :scope, :cf, :port do use_browser(clientid, opts[:secret], 'authcode') end
 
   desc "token implicit get", "Gets a token using the implicit flow with browser",
       :client, :scope, :cf, :port do use_browser opts[:client] || "cf" end

data/lib/uaa/stub/uaa.rb

@@ -414,6 +414,13 @@ class StubUAAConn < Stub::Base
     reply.json(status: 'ok', message: 'secret updated')
   end
 
+  route :put, %r{^/oauth/clients/([^/]+)/clientjwt$}, 'content-type' => %r{application/json} do
+    info = Util.json_parse(request.body, :down)
+    return not_found(match[1]) unless id = server.scim.id(match[1], :client)
+    return bad_request('no client_id given') unless info['client_id']
+    reply.json(status: 'ok', message: 'client jwt updated')
+  end
+
   #----------------------------------------------------------------------------
   # users and groups endpoints
   #

data/spec/client_reg_spec.rb

@@ -78,6 +78,14 @@ describe ClientCli do
       Cli.output.string.should include 'access_denied'
     end
 
+    it "changes it's client jwt" do
+      Cli.run("token client get #{@test_client} -s #{@test_secret}").should be
+      Cli.run('token decode').should be
+      Cli.run("client jwt add #{@test_client} --jwks_uri http://localhost:8080/uaa/token_keys").should be
+      Cli.run("client jwt update #{@test_client} --jwks_uri http://localhost:8080/uaa/token_keys").should be
+      Cli.run("client jwt delete #{@test_client} ").should be
+    end
+
     context 'as updated client' do
 
       before :all do

data/version.txt

@@ -1 +1 @@
-4.15.0
+4.17.0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cf-uaac
 version: !ruby/object:Gem::Version
-  version: 4.15.0
+  version: 4.17.0
 platform: ruby
 authors:
 - Dave Syer
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-08-09 00:00:00.000000000 Z
+date: 2023-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cf-uaa-lib
@@ -20,14 +20,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: 4.0.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: 4.0.4
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement