code0-identities 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d2f9b0245b49ef731da01ee5592ffcb56c6211c478752fd8ec91690fe91372a
-  data.tar.gz: f55736bb0f4c49734b2ae95d93414ed514833131bed57bc7aeedf487a5766bef
+  metadata.gz: c123702886210d5646bd8b5bc8090334e2b4c4cd66a5c6cc2b016f30405d8ec2
+  data.tar.gz: 6d0829ce20accd660c8e478c85e3b5600ecd395495887d73266c5cd6070ac852
 SHA512:
-  metadata.gz: 390747996b868eb0db1558af9da5f64f55efc232f2e6bfa54b26b03df5e0bc828fab1fd5b61db9c279c59c4ccb63f3346fb04b893089076ccb39930908421b19
-  data.tar.gz: 75dee3614cc0ce7e361e40105333049fd947243417b32c6ab4647e94b821c462d2a841cb9f267fdcd83f281f8bbf58704fd678c0d0ecddf305b89338f1fcdc13
+  metadata.gz: 20a9b75f381cc363ff01d094f1058a3564047ea7e7b94bf2ece6314b87867daa64d700eb8b698510089d15786234816de57376a20d72660c3a70bf33e93ea28e
+  data.tar.gz: da743a997b959429bc8ec815075aba4a4f920036721de6932567425f4ca35ff3daf36bd09a22eb789892d1acd2e9be67e7419fcfb7bf49bc17b08506020213a7

data/.rubocop.yml

@@ -3,7 +3,7 @@ require:
   - rubocop-rspec
 
 AllCops:
-  TargetRubyVersion: 3.0.0
+  TargetRubyVersion: 3.2.0
   NewCops: enable
 
 Gemspec/DevelopmentDependencies:
@@ -38,6 +38,9 @@ RSpec/ExampleLength:
 Style/Documentation:
   Enabled: false
 
+Style/HashSyntax:
+  EnforcedShorthandSyntax: never
+
 RSpec/MultipleMemoizedHelpers:
   Enabled: false
 RSpec/MultipleExpectations:

data/.tool-versions

@@ -1 +1 @@
-ruby 3.2.2
+ruby 3.4.7

data/README.md

@@ -10,6 +10,8 @@ OAuth:
 - Microsoft
 - Github
 - Gitlab
+- OIDC / oAuth2
+- SAML
 
 ## Installation
 
@@ -91,4 +93,43 @@ def fetch_configuration
   }
 end
 
-```
+```
+
+# Configuration
+
+As you already know, we allow / require to pass in a configuration. Here are all avaiable configuration keys:
+
+
+## Oauth Based:
+Here is the updated table where each key in the JSON (`identifier`, `username`, etc.) is explicitly labeled:
+
+| Name                               | Description                                                                                | Default                                             |
+|------------------------------------|--------------------------------------------------------------------------------------------|-----------------------------------------------------|
+| `client_id`                        | The client id of the application (needs to be set)                                         | **(no default specified)**                          |
+| `client_secret`                    | The client secret of the application (needs to be set)                                     | **(no default specified)**                          |
+| `redirect_uri`                     | The redirect URL of the application (needs to be set)                                      | **(no default specified)**                          |
+| `provider_name`                    | The provider name (not necessarily)                                                        | depends on the provider (e.g., `discord`, `github`) |
+| `user_details_url`                 | The user details URL to gather user information (only for OIDC)                            | **(no default specified)**                          |
+| `authorization_url`                | The URL which the user has to access to authorize (only for OIDC)                          | **(no default specified)**                          |
+| `attribute_statements`             | The keys which the response of the user details has (id, name, email, ...) (only for OIDC) | `{}` (see below for more)                           |
+| `attribute_statements.identifier`  | The identifier of the user to identify (only for OIDC)                                     | `["id", "sub", "identifier"]`                       |
+| `attribute_statements.username`    | The username of the user (only for OIDC)                                                   | `["username", "name", "login"]`                     |
+| `attribute_statements.email`       | The email address of the user (only for OIDC)                                              | `["email", "mail"]`                                 |
+| `attribute_statements.firstname`   | The first name of the user (only for OIDC)                                                 | `["first_name", "firstname", ...]`                  |
+| `attribute_statements.lastname`    | The last name of the user (only for OIDC)                                                  | `["last_name", "lastname", ...]`                    |
+
+## SAML
+
+| Name                             | Description                                                                                                                                                        | Default                            |
+|----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------|
+| `provider_name`                  | The provider name (not necessarily)                                                                                                                                | `saml`                             |
+| `attribute_statements`           | The keys which the response of the user details has (id, name, email, ...) (only for OIDC)                                                                         | `{}` (see below for more)          |
+| `attribute_statements.username`  | The username of the user                                                                                                                                           | `["username", "name", ...]`        |
+| `attribute_statements.email`     | The email address of the user                                                                                                                                      | `["email", "mail", ...]`           |
+| `attribute_statements.firstname` | The first name of the user                                                                                                                                         | `["first_name", "firstname", ...]` |
+| `attribute_statements.lastname`  | The last name of the user                                                                                                                                          | `["last_name", "lastname", ...]`   |
+| `settings`                       | The settings to configure the saml response/requests (see [SAML-Toolkits#L200](https://github.com/SAML-Toolkits/ruby-saml/blob/master/README.md?plain=1#L200))     | `{}`                               |
+| `response_settings`              | The response settings to disable some checks if you want (see [SAML-Toolkits#L234](https://github.com/SAML-Toolkits/ruby-saml/blob/master/README.md?plain=1#L234)) | `{}`                               |
+| `metadata_url`                   | The metadata url to fetch the metadatas (replacement for `settings`)                                                                                               | **(no default specified)**         |
+
+

data/lib/code0/identities/provider/base_oauth.rb

@@ -68,9 +68,12 @@ module Code0
         end
 
         def config
-          return config_loader.call if config_loader.is_a?(Proc)
+          config = config_loader
+          config = config_loader.call if config_loader.is_a?(Proc)
 
-          config_loader
+          config[:provider_name] ||= self.class.name.downcase.split("::").last
+
+          config
         end
       end
     end

data/lib/code0/identities/provider/discord.rb

@@ -31,7 +31,7 @@ module Code0
           username = body["username"]
           email = body["email"]
 
-          Identity.new(:discord, identifier, username, email, nil, nil)
+          Identity.new(config[:provider_name], identifier, username, email, nil, nil)
         end
       end
     end

data/lib/code0/identities/provider/github.rb

@@ -43,7 +43,7 @@ module Code0
 
           email = private_email(access_token, token_type) if email.nil?
 
-          Identity.new(:github, identifier, username, email, nil, nil)
+          Identity.new(config[:provider_name], identifier, username, email, nil, nil)
         end
       end
     end

data/lib/code0/identities/provider/gitlab.rb

@@ -37,7 +37,7 @@ module Code0
           username = body["username"]
           email = body["email"]
 
-          Identity.new(config_loader.call[:provider_name], identifier, username, email, nil, nil)
+          Identity.new(config[:provider_name], identifier, username, email, nil, nil)
         end
       end
     end

data/lib/code0/identities/provider/google.rb

@@ -41,7 +41,7 @@ module Code0
           firstname = body["given_name"]
           lastname = body["family_name"]
 
-          Identity.new(:google, identifier, username, email, firstname, lastname)
+          Identity.new(config[:provider_name], identifier, username, email, firstname, lastname)
         end
       end
     end

data/lib/code0/identities/provider/microsoft.rb

@@ -36,7 +36,7 @@ module Code0
           lastname = body["familyname"]
           email = body["email"]
 
-          Identity.new(:microsoft, identifier, nil, email, firstname, lastname)
+          Identity.new(config[:provider_name], identifier, nil, email, firstname, lastname)
         end
       end
     end

data/lib/code0/identities/provider/oidc.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Code0
+  module Identities
+    module Provider
+      class Oidc < BaseOauth
+        def token_url
+          config[:token_url]
+        end
+
+        def token_payload(code)
+          { code: code,
+            grant_type: "authorization_code",
+            redirect_uri: config[:redirect_uri],
+            client_id: config[:client_id],
+            client_secret: config[:client_secret] }
+        end
+
+        def user_details_url
+          config[:user_details_url]
+        end
+
+        def authorization_url
+          config[:authorization_url]
+            .gsub("{client_id}", config[:client_id])
+            .gsub("{redirect_uri}", config[:redirect_uri])
+        end
+
+        def create_identity(response, *)
+          body = response.parsed_response
+
+          Identity.new(config[:provider_name],
+                       find_attribute(body, config[:attribute_statements][:identifier]),
+                       find_attribute(body, config[:attribute_statements][:username]),
+                       find_attribute(body, config[:attribute_statements][:email]),
+                       find_attribute(body, config[:attribute_statements][:firstname]),
+                       find_attribute(body, config[:attribute_statements][:lastname]))
+        end
+
+        def config
+          config = super
+
+          # rubocop:disable Layout/LineLength
+          config[:provider_name] ||= :oidc
+          config[:attribute_statements] ||= {}
+          config[:attribute_statements][:identifier] ||= %w[sub id identifier]
+          config[:attribute_statements][:username] ||= %w[username name login]
+          config[:attribute_statements][:email] ||= %w[email mail]
+          config[:attribute_statements][:firstname] ||= %w[first_name firstname firstName givenname given_name givenName]
+          config[:attribute_statements][:lastname] ||= %w[last_name lastname lastName family_name familyName familyname]
+          # rubocop:enable Layout/LineLength
+
+          config
+        end
+
+        def find_attribute(attributes, attribute_statements)
+          attribute_statements.each do |statement|
+            return attributes[statement] unless attributes[statement].nil?
+          end
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/code0/identities/provider/saml.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Code0
+  module Identities
+    module Provider
+      class Saml
+        attr_reader :config_loader
+
+        def initialize(config_loader)
+          @config_loader = config_loader
+        end
+
+        def authorization_url
+          request = OneLogin::RubySaml::Authrequest.new
+          request.create(create_settings)
+
+          request.instance_variable_get :@login_url
+        end
+
+        def load_identity(**params)
+          response = OneLogin::RubySaml::Response.new(params[:SAMLResponse],
+                                                      { **config[:response_settings], settings: create_settings })
+          attributes = response.attributes
+
+          Identity.new(config[:provider_name],
+                       response.name_id,
+                       find_attribute(attributes, config[:attribute_statements][:username]),
+                       find_attribute(attributes, config[:attribute_statements][:email]),
+                       find_attribute(attributes, config[:attribute_statements][:firstname]),
+                       find_attribute(attributes, config[:attribute_statements][:lastname]))
+        end
+
+        private
+
+        def find_attribute(attributes, attribute_statements)
+          attribute_statements.each do |statement|
+            return attributes[statement] unless attributes[statement].nil?
+          end
+          nil
+        end
+
+        def create_settings
+          if config[:metadata_url].nil?
+            settings = OneLogin::RubySaml::Settings.new
+          else
+            idp_metadata_parser = OneLogin::RubySaml::IdpMetadataParser.new
+            settings = idp_metadata_parser.parse_remote(config[:metadata_url])
+          end
+
+          settings.name_identifier_format = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
+
+          config[:settings].each do |key, value|
+            settings.send(:"#{key}=", value)
+          end
+          settings
+        end
+
+        def config
+          config = config_loader
+          config = config_loader.call if config_loader.is_a?(Proc)
+
+          # rubocop:disable Layout/LineLength
+          config[:provider_name] ||= :saml
+          config[:response_settings] ||= {}
+          config[:settings] ||= {}
+          config[:attribute_statements] ||= {}
+          config[:attribute_statements][:username] ||= %w[username name http://schemas.goauthentik.io/2021/02/saml/username]
+          config[:attribute_statements][:email] ||= %w[email mail http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress http://schemas.microsoft.com/ws/2008/06/identity/claims/emailaddress]
+          config[:attribute_statements][:firstname] ||= %w[first_name firstname firstName http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname http://schemas.microsoft.com/ws/2008/06/identity/claims/givenname]
+          config[:attribute_statements][:lastname] ||= %w[last_name lastname lastName http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname http://schemas.microsoft.com/ws/2008/06/identity/claims/surname]
+          # rubocop:enable Layout/LineLength
+
+          config
+        end
+      end
+    end
+  end
+end

data/lib/code0/identities/version.rb

@@ -2,6 +2,6 @@
 
 module Code0
   module Identities
-    VERSION = "0.0.1"
+    VERSION = "0.0.2"
   end
 end

data/lib/code0/identities.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "httparty"
+require "onelogin/ruby-saml"
 
 require_relative "identities/version"
 require_relative "identities/identity_provider"
@@ -10,6 +11,8 @@ require_relative "identities/provider/microsoft"
 require_relative "identities/provider/google"
 require_relative "identities/provider/discord"
 require_relative "identities/provider/github"
+require_relative "identities/provider/oidc"
+require_relative "identities/provider/saml"
 
 module Code0
   module Identities

data/renovate.json

@@ -1,8 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended",
-    ":label(dependencies)"
+    "github>code0-tech/monoceros//renovate/global.json5"
   ],
   "assignees": [
     "Taucher2003",

data/sig/code0/identities/provider/oidc.rbs

@@ -0,0 +1,17 @@
+module Code0
+  module Identities
+    module Provider
+      class Oidc < BaseOauth
+        def token_url: () -> String
+
+        def token_payload: (code: String) -> { code: String, grant_type: "authorization_code", redirect_uri: String, client_id: String, client_secret: String }
+
+        def user_details_url: () -> String
+
+        def authorization_url: () -> String
+
+        def create_identity: (response: Net::HTTPResponse) -> Identity
+      end
+    end
+  end
+end

data/sig/code0/identities/provider/saml.rbs

@@ -0,0 +1,11 @@
+module Code0
+  module Identities
+    module Provider
+      class Saml
+        def authorization_url: () -> String
+
+        def load_identity: (Hash[Symbol, any]) -> Identity
+      end
+    end
+  end
+end

metadata

@@ -1,15 +1,28 @@
 --- !ruby/object:Gem::Specification
 name: code0-identities
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Dario Pranjic
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-08-29 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.3.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.3.0
 - !ruby/object:Gem::Dependency
   name: httparty
   requirement: !ruby/object:Gem::Requirement
@@ -25,19 +38,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0.22'
 - !ruby/object:Gem::Dependency
-  name: webmock
+  name: ruby-saml
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.23.1
-  type: :development
+        version: '1.18'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.23.1
+        version: '1.18'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -108,7 +121,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.29'
-description: 
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.23.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.23.1
 email:
 - dpranjic@code0.tech
 executables: []
@@ -130,6 +156,8 @@ files:
 - lib/code0/identities/provider/gitlab.rb
 - lib/code0/identities/provider/google.rb
 - lib/code0/identities/provider/microsoft.rb
+- lib/code0/identities/provider/oidc.rb
+- lib/code0/identities/provider/saml.rb
 - lib/code0/identities/version.rb
 - renovate.json
 - sig/code0/identities.rbs
@@ -141,6 +169,8 @@ files:
 - sig/code0/identities/provider/gitlab.rbs
 - sig/code0/identities/provider/google.rbs
 - sig/code0/identities/provider/microsoft.rbs
+- sig/code0/identities/provider/oidc.rbs
+- sig/code0/identities/provider/saml.rbs
 - sig/code0/identities/version.rbs
 homepage: https://github.com/code0-tech/code0-identities
 licenses:
@@ -150,7 +180,6 @@ metadata:
   source_code_uri: https://github.com/code0-tech/code0-identities
   changelog_uri: https://github.com/code0-tech/code0-identities/releases
   rubygems_mfa_required: 'true'
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -158,15 +187,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Library to manage external identities
 test_files: []