google-id-token 1.0.0

data/README.rdoc

@@ -0,0 +1,17 @@
+= GoogleIDToken
+
+GoogleIDToken currently provides a single useful class "Validator", which provides a single method "#check", which parses and validates an ID Token allegedly generated by Google auth servers.
+
+=== Installation
+
+  gem install google-id-token
+
+=== Examples
+
+  validator = GoogleIDToken::Validator.new
+  jwt = validator.validate(token, required_audience, required_client_id)
+  if jwt
+    email = jwt['email']
+  else
+    report "Cannot validate: #{validator.problem}"
+  end

data/lib/google-id-token.rb

@@ -0,0 +1,132 @@
+# encoding: utf-8
+# Copyright 2012 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#  
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+##
+# Validates strings alleged to be ID Tokens issued by Google; if validation
+#  succeeds, returns the decoded ID Token as a hash.
+# It's a good idea to keep an instance of this class around for a long time,
+#  because it caches the keys, performs validation statically, and only
+#  refreshes from Google when required (typically once per day)
+#
+# @author Tim Bray, adapted from code by Bob Aman
+
+require 'multi_json'
+require 'jwt'
+require 'openssl'
+require 'net/http'
+
+module GoogleIDToken
+  class Validator
+
+    GOOGLE_CERTS_URI = 'https://www.googleapis.com/oauth2/v1/certs'
+
+    # @!attribute [r] problem
+    #   Reason for failure, if #check returns nil
+    attr_reader :problem
+
+    def initialize
+      @certs = {}
+    end
+
+    ##
+    # If it validates, returns a hash with the JWT fields from the ID Token.
+    #  You have to provide an "aud" value, which must match the
+    #  token's field with that name, and will similarly check cid if provided.
+    #
+    # If something fails, returns nil; #problem returns error text
+    #
+    # @param [String] token
+    #   The string form of the token
+    # @param [String] aud
+    #   The required audience value
+    # @param [String] cid
+    #   The optional client-id value
+    #
+    # @return [Hash] The decoded ID token, or null
+    def check(token, aud, cid = nil)
+      case check_cached_certs(token, aud, cid)
+      when :valid
+        @token
+      when :problem
+        nil
+      else
+        # no certs worked, might've expired, refresh
+        if refresh_certs
+          @problem = 'Unable to retrieve Google public keys'
+          nil
+        else
+          case check_cached_certs(token, aud, cid)
+          when :valid
+            @token
+          when :problem
+            nil
+          else
+            @problem = 'Token not verified as issued by Google'
+            nil
+          end
+        end
+      end
+    end
+    
+    private
+
+    # tries to validate the token against each cached cert.
+    # Returns :valid (sets @token) or :problem (sets @problem) or
+    #  nil, which means none of the certs validated.
+    def check_cached_certs(token, aud, cid)
+      @problem = @token = nil
+
+      # find first public key that validates this token
+      @certs.detect do |key, cert|
+        begin
+          public_key = cert.public_key
+          @token = JWT.decode(token, public_key, !!public_key)
+        rescue JWT::DecodeError
+          nil # go on, try the next cert
+        end
+      end
+      
+      if @token
+        if !(@token.has_key?('aud') && (@token['aud'] == aud))
+          @problem = 'Token audience mismatch'
+        elsif cid && !(@token.has_key?('cid') && (@token['cid'] == cid))
+          @problem = 'Token client-id mismatch'
+        end
+        @problem ? :problem : :valid
+      else
+        nil
+      end
+    end
+
+    # returns true if there was a problem
+    def refresh_certs
+      uri = URI(GOOGLE_CERTS_URI)
+      get = Net::HTTP::Get.new uri.request_uri
+      res = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) do |http|
+        http.request(get)
+      end
+
+      if res.kind_of?(Net::HTTPSuccess)
+        new_certs = Hash[MultiJson.load(res.body).map do |key, cert|
+                           [key, OpenSSL::X509::Certificate.new(cert)]
+                         end]
+        @certs.merge! new_certs
+        false
+      else
+        true
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,128 @@
+--- !ruby/object:Gem::Specification
+name: google-id-token
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+  prerelease: 
+platform: ruby
+authors:
+- Tim Bray
+- Bob Aman
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2012-12-06 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: multi_json
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: fakeweb
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Google ID Token utilities; currently just a parser/checker
+email: tbray@textuality.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/google-id-token.rb
+- README.rdoc
+homepage: https://code.google.com/p/google-id-token/
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.21
+signing_key: 
+specification_version: 3
+summary: Google ID Token utilities
+test_files: []
+has_rdoc: