keratin-authn 0.6.1 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8c8460a42cb6b34ecd0115366206cbda19e4e474
-  data.tar.gz: 26ccf34ff11d3da767e8e78fea9df8f883f92442
+  metadata.gz: 675c925f05dfabe4bd0f21df787374d84656bb54
+  data.tar.gz: 6707f4d2b665485192152bf7a59c5a1d62800e7d
 SHA512:
-  metadata.gz: b1dc1e52c700b90568b3c9c6548f703c7f1c817d9667a2ebb6fea983169de7f5c2ddff3b329e07999044b426c9023e61ebbd7f5036179a28829ed6bfc49a1000
-  data.tar.gz: 3efd27f4e4a586f9f978fb735ac7ab5a8e8b7277bd8ac9ad6d55e6125c2ac3f8f5e35b35ff018c9727fffe6e0f780e0310feb35b4bd2228363125e47ac982a98
+  metadata.gz: 9c539082ff017a26237d848342769115ca0ad978ec470505e516fcb91879499fc7bb27d0f43601a434b480e70acfbb55ec2c124686e6b8bc3319e2d38a197d13
+  data.tar.gz: d41c0567fd3f85b164c82a8c0bb5237d4f0e0e9865fb3a0bfe6d2a5e6996381b55cb1c3658713be50525cdafce31480e34d1d73a4d0523a1530104f207ad8129

data/README.md

@@ -23,12 +23,18 @@ Keratin::AuthN.config.tap do |config|
   # The base URL of your Keratin AuthN service
   config.issuer = 'https://authn.myapp.com'
 
-  # The domain of your application
+  # The domain of your application (no protocol)
   config.audience = 'myapp.com'
 
   # HTTP basic auth for using AuthN's private endpoints
   config.username = 'secret'
   config.password = 'secret'
+
+  # OPTIONAL: enables debugging for the JWT verification process
+  config.logger   = Rails.logger
+
+  # OPTIONAL: allows private API calls to use private network routing
+  config.authn_url = 'https://authn.internal.dns/
 end
 ```
 
@@ -137,9 +143,9 @@ AuthN provides helpers for working with tokens in your application's controller
 In your `test/test_helper.rb` or equivalent:
 
 ```ruby
-# Configuring AuthN to use the MockSignatureVerifier will stop your tests from attempting to connect
-# to the remote issuer during tests.
-Keratin::AuthN.signature_verifier = Keratin::AuthN::MockSignatureVerifier.new
+# Configuring AuthN to use the MockKeychain will stop your tests from attempting to connect to the
+# remote issuer during tests.
+Keratin::AuthN.signature_verifier = Keratin::AuthN::MockKeychain.new
 
 # Including the Test::Helpers module grants access to `id_token_for(user.account_id)`, so that you
 # can test your system with real tokens.

data/keratin-authn.gemspec

@@ -29,7 +29,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'json-jwt'
+  spec.add_dependency 'json-jwt', '!= 1.8.0'
   spec.add_dependency 'lru_redux'
 
   spec.add_development_dependency 'bundler', '~> 1.13'

data/lib/keratin/authn.rb

@@ -1,17 +1,17 @@
 require_relative 'authn/version'
 require_relative 'authn/engine' if defined?(Rails)
 require_relative 'authn/id_token_verifier'
-require_relative 'authn/remote_signature_verifier'
-require_relative 'authn/mock_signature_verifier'
-require_relative 'authn/issuer'
+require_relative 'authn/fetching_keychain'
+require_relative 'authn/mock_keychain'
+require_relative 'authn/api'
 
 require 'lru_redux'
 require 'json/jwt'
 
 module Keratin
   def self.authn
-    @authn ||= AuthN::Issuer.new(
-      AuthN.config.issuer,
+    @authn ||= AuthN::API.new(
+      AuthN.config.authn_url || AuthN.config.issuer,
       username: AuthN.config.username,
       password: AuthN.config.password
     )
@@ -19,7 +19,7 @@ module Keratin
 
   module AuthN
     class Config
-      # the domain (host) of the main application.
+      # the domain (host) of the main application. no protocol.
       # e.g. "audience.tech"
       attr_accessor :audience
 
@@ -27,6 +27,11 @@ module Keratin
       # e.g. "https://issuer.tech"
       attr_accessor :issuer
 
+      # the base url for API calls. this is useful if you've divided your network so private API
+      # requests can not be probed by public devices. it is optional, and will default to issuer.
+      # e.g. "https://authn.internal.dns"
+      attr_accessor :authn_url
+
       # how long (in seconds) to keep keys in the keychain before refreshing.
       # default: 3600
       attr_accessor :keychain_ttl
@@ -51,38 +56,29 @@ module Keratin
       config.logger.debug{ yield } if config.logger
     end
 
-    # The default strategy for signature verification will find the JWT's issuer, fetch the JWKs
-    # from that server, choose the correct key by id, and finally verify the JWT. The keys are
-    # then cached in memory to reduce network traffic.
-    def self.signature_verifier
-      @verifier ||= RemoteSignatureVerifier.new(
-        LruRedux::TTL::ThreadSafeCache.new(25, config.keychain_ttl)
-      )
+    # The default keychain will fetch JWKs from the configured issuer and return the correct key by
+    # id. Keys are cached in memory to reduce network traffic.
+    def self.keychain
+      @keychain ||= FetchingKeychain.new(issuer: config.issuer, ttl: config.keychain_ttl)
     end
 
-    # If the default strategy is not desired (as in host application tests), different strategies
-    # may be specified here. The strategy must define a `verify(jwt)` method.
-    def self.signature_verifier=(val)
-      unless val.respond_to?(:verify) && val.method(:verify).arity == 1
-        raise ArgumentError, 'Please ensure that your signature verifier has been instantiated and implements `def verify(jwt)`.'
+    # If the default keychain is not desired (as in host application tests), different keychain may
+    # be specified here. The keychain must define a `[](kid)` method.
+    def self.keychain=(val)
+      unless val.respond_to?(:[]) && val.method(:[]).arity == 1
+        raise ArgumentError, 'Please ensure that your keychain has been instantiated and implements `[](kid)`.'
       end
 
-      @verifier = val
+      @keychain = val
     end
 
     class << self
       # safely fetches a subject from the id token after checking relevant claims and
       # verifying the signature.
       def subject_from(id_token, audience: Keratin::AuthN.config.audience)
-        verifier = IDTokenVerifier.new(id_token, signature_verifier, audience)
+        verifier = IDTokenVerifier.new(id_token, keychain, audience)
         verifier.subject if verifier.verified?
       end
-
-      def logout_url(return_to: nil)
-        query = {redirect_uri: return_to}.to_param if return_to
-
-        "#{config.issuer}/sessions/logout#{'?' if query}#{query}"
-      end
     end
   end
 end

data/lib/keratin/authn/{issuer.rb → api.rb}

@@ -2,7 +2,11 @@ require 'keratin/client'
 require 'net/http'
 
 module Keratin::AuthN
-  class Issuer < Keratin::Client
+  class API < Keratin::Client
+    def get(account_id)
+      super(path: "/accounts/#{account_id}")
+    end
+
     def update(account_id, username:)
       patch(path: "/accounts/#{account_id}", body: {
         username: username
@@ -33,21 +37,5 @@ module Keratin::AuthN
     def expire_password(account_id)
       patch(path: "/accounts/#{account_id}/expire_password")
     end
-
-    def signing_key(kid)
-      keys.find{|k| k['use'] == 'sig' && (kid.blank? || kid == k['kid']) }
-    end
-
-    private def configuration
-      @configuration ||= get(path: '/configuration').data
-    end
-
-    private def keys
-      JSON::JWK::Set.new(
-        JSON.parse(
-          Net::HTTP.get(URI.parse(configuration['jwks_uri']))
-        )
-      )
-    end
   end
 end

data/lib/keratin/authn/fetching_keychain.rb

@@ -0,0 +1,25 @@
+module Keratin::AuthN
+  class FetchingKeychain
+    def initialize(issuer:, ttl:)
+      @cache = LruRedux::TTL::ThreadSafeCache.new(25, ttl)
+      @issuer = issuer.chomp('/')
+    end
+
+    def [](kid)
+      @cache.getset(kid){ fetch(kid) }
+    end
+
+    def clear
+      @cache.clear
+    end
+
+    private def fetch(kid)
+      keys = JSON::JWK::Set.new(
+        JSON.parse(
+          Net::HTTP.get(URI.parse("#{@issuer}/jwks"))
+        )
+      )
+      keys.find{|k| k['use'] == 'sig' && (kid.blank? || kid == k['kid']) }
+    end
+  end
+end

data/lib/keratin/authn/id_token_verifier.rb

@@ -2,9 +2,9 @@ require 'uri'
 
 module Keratin::AuthN
   class IDTokenVerifier
-    def initialize(str, signature_verifier, audience)
+    def initialize(str, keychain, audience)
       @id_token = str
-      @signature_verifier = signature_verifier
+      @keychain = keychain
       @audience = audience
       @time = Time.now.to_i
     end
@@ -51,7 +51,9 @@ module Keratin::AuthN
     end
 
     def token_intact?
-      @signature_verifier.verify(jwt)
+      jwt.verify!(@keychain[jwt.kid])
+    rescue JSON::JWT::VerificationFailed, JSON::JWT::UnexpectedAlgorithm
+      false
     end
 
     private def jwt

data/lib/keratin/authn/{mock_signature_verifier.rb → mock_keychain.rb}

@@ -1,6 +1,6 @@
 module Keratin::AuthN
-  class MockSignatureVerifier
-    def verify(_)
+  class MockKeychain
+    def [](kid)
       true
     end
   end

data/lib/keratin/authn/version.rb

@@ -1,5 +1,5 @@
 module Keratin # rubocop:disable Style/ClassAndModuleChildren
   module AuthN
-    VERSION = '0.6.1'
+    VERSION = '1.0.0'
   end
 end

metadata

@@ -1,29 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: keratin-authn
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 1.0.0
 platform: ruby
 authors:
 - Lance Ivy
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-09-26 00:00:00.000000000 Z
+date: 2017-12-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json-jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "!="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 1.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "!="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 1.8.0
 - !ruby/object:Gem::Dependency
   name: lru_redux
   requirement: !ruby/object:Gem::Requirement
@@ -155,11 +155,11 @@ files:
 - bin/setup
 - keratin-authn.gemspec
 - lib/keratin/authn.rb
+- lib/keratin/authn/api.rb
 - lib/keratin/authn/engine.rb
+- lib/keratin/authn/fetching_keychain.rb
 - lib/keratin/authn/id_token_verifier.rb
-- lib/keratin/authn/issuer.rb
-- lib/keratin/authn/mock_signature_verifier.rb
-- lib/keratin/authn/remote_signature_verifier.rb
+- lib/keratin/authn/mock_keychain.rb
 - lib/keratin/authn/test/helpers.rb
 - lib/keratin/authn/testing.rb
 - lib/keratin/authn/version.rb

data/lib/keratin/authn/remote_signature_verifier.rb

@@ -1,19 +0,0 @@
-module Keratin::AuthN
-  class RemoteSignatureVerifier
-    attr_reader :keychain
-
-    def initialize(keychain)
-      @keychain = keychain
-    end
-
-    def verify(jwt)
-      jwt.verify!(key(jwt['iss'], jwt.kid))
-    rescue JSON::JWT::VerificationFailed, JSON::JWT::UnexpectedAlgorithm
-      false
-    end
-
-    private def key(issuer, kid)
-      keychain.getset(kid){ Issuer.new(issuer).signing_key(kid) }
-    end
-  end
-end