iap-jwt-assertion 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: f92e00d10a48d3cc3accc01e5ec87ed669b792d2acbae3ee1a5659b7b54909cf
+  data.tar.gz: 327b5e961e2fc7b1a4dd0919659c5ab44053cd1feaf1cdb88c8cf56ade9992be
+SHA512:
+  metadata.gz: 77c266b5c5d30f1c33ba9be067d6f7f0c511351c55dd8ec72fca06fef915d7a042b661baffa50d41f8cfbdf904cf6c9ff324533b1858958d0d4edbdfb461f38f
+  data.tar.gz: f06836111caead675a8eac07c7fd4e1f7e4fd2b4ef09467ca20291fc7ef8eb972856a7372038fe556c1c0912218cd53751e5d78c9cbe707212051f59eaffe93d

data/lib/iap_jwt_assertion.rb

@@ -0,0 +1,59 @@
+require 'net/http'
+require 'json'
+require 'jwt'
+
+module IapJwtAssertion
+  ALGORITHM = 'ES256'
+  PUBLIC_KEYS_URL = 'https://www.gstatic.com/iap/verify/public_key'
+
+  module_function
+
+  def authenticate? token, aud:
+    kid = get_kid(token)
+    pubkey = get_key(kid)
+
+    begin
+      payload, header = JWT.decode(token, pubkey, true, {algorithm: ALGORITHM})
+
+      if payload['aud'] != aud
+        return false
+      end
+    rescue => e
+      return false
+    end
+
+    return true
+  end
+
+  def decode token
+    kid = get_kid(token)
+    pubkey = get_key(kid)
+
+    return JWT.decode(token, pubkey, false, {algorithm: ALGORITHM})
+  end
+
+  def get_kid token
+    payload, header = JWT.decode(token, nil, false)
+    return header['kid']
+  end
+
+  def get_key kid
+    if @public_keys.nil? || !@public_keys.has_key?(kid)
+      @public_keys = fetch_public_keys
+
+      if !@public_keys.has_key?(kid)
+        raise "kid was not found in the list of public keys."
+      end
+    end
+
+    return @public_keys[kid]
+  end
+
+  def fetch_public_keys
+    response = Net::HTTP.get(URI(PUBLIC_KEYS_URL))
+    response_hash = JSON.parse(response)
+    public_keys = response_hash.map {|kid, pubkey| [kid, OpenSSL::PKey::EC.new(pubkey)]}.to_h
+
+    return public_keys
+  end
+end

metadata

@@ -0,0 +1,57 @@
+--- !ruby/object:Gem::Specification
+name: iap-jwt-assertion
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- shinkbr
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2021-05-21 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+description:
+email: shinkbr@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/iap_jwt_assertion.rb
+homepage: https://rubygems.org/gems/iap-jwt-assertion
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.2
+signing_key:
+specification_version: 4
+summary: A Ruby gem for handling Google Identity Aware Proxy's signed JWT header.
+test_files: []