keycloak-api-rails 2.0.0 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b23b08b9947c44a5c24411bf88b478a7042b574f9da4c18dcbc033d2b12c213f
-  data.tar.gz: c7f2b04da31060ff404dec1469d54df5e20cd8dbc91fc602047250039985d010
+  metadata.gz: 75cb985d142693a50337445bdde2608ee636c3ce77327e577a88f1d3ad6f12d7
+  data.tar.gz: a9220359016e6c96f594d2e43485bb2e5c2821da9d2055c6c622eef26fcdf33f
 SHA512:
-  metadata.gz: 8b7a27d90979f5a048f844a82def6876d42b734a6eb6af1a0ec5a99900f38c3b16009aea80c470068eb8d84fa4fd0ce671f3cddb53f853db8165f84f10808a12
-  data.tar.gz: 58408083f436a01e19fb3ba1b2efb5cbf0a8b2a1cfb793c439b33339150c39cebb5f6b499f5c83955b6d57657c7c94a9ffd932b390ee4ae830472e3d260fe26a
+  metadata.gz: fab532886c13b4e2b950ff31b591d9670b0d8a343e835afa8922b35cd742142f63a6943685332d9ad5baf1146344dd6ff452209793f8dc7864c5a3322a520fad
+  data.tar.gz: 0c8110fc856d3e74e49fb675749fcdac113808d140a15c29c01838abcd760ef10ff78527aec128e5c7eaa2c8d7d879ef1ebe111972fd1d0e8671ad188c2f638c

data/CHANGELOG.md

@@ -5,6 +5,58 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Security
+
+* The realm named by the `iss` claim is read before the signature of the token is verified, and is interpolated in the URL its public keys are downloaded from. It is now refused unless it is a plain name: the unreserved characters of RFC 3986, at most 128 of them, and not a relative path segment. `https://keycloak/realms/master?` and `https://keycloak/realms/..` both are the last segment of a well-formed `iss`, and both used to build another URL than the one of the realm they name. Such a token is answered a `401`, reason `:invalid_realm`, and no request is sent to Keycloak.
+* A token whose payload is not a JSON object, or whose `iss` claim is not a String, is answered a `401`. Reading such a payload used to raise a `NoMethodError` or a `TypeError` out of the middleware, and to be answered a `500`.
+* The number of realms whose public keys are cached is now bounded. 
+* A token was verified with whichever algorithm its `alg` header named. New `allowed_algorithms` option, defaulting to the asymmetric algorithms Keycloak signs with, and narrowable to the one of the realm. Symmetric algorithms are refused.
+
+* A `skip_paths` regexp anchored with `^` or `$` is warned about: in Ruby they match the beginning and the end of a line, and `PATH_INFO` is URL-decoded, so `"/private\n/health"` matches `/^\/health/` and skips authentication. Anchor with `\A` and `\z`.
+
+### Fixed
+
+* `base64` and `logger` are declared as runtime dependencies.
+* A `401` carries the `WWW-Authenticate: Bearer` header RFC 6750 requires of a resource protected by a Bearer token. A request carrying no token at all gets the bare challenge; any other gets `error="invalid_token"` and the reason it was refused.
+
+### Performance
+
+* An authenticated request took four locks to read two memoized objects: `KeycloakApiRails.service`, resolved three times per request, and the per-realm key cache. They are read without locking once memoized, and the middleware resolves the service once. Worth 0.3 µs per request, against the 50 µs of the RSA verification below.
+* Every authenticated request verified the signature of its token twice: `JSON::JWT.decode` already verifies the one it is given a key for. One RSA verification per request instead of two.
+* Added `# frozen_string_literal: true` to all ruby files and optimized Hot Path methods in `Service` and `Helper` (e.g., using `Regexp#match?`, avoiding redundant String-to-Symbol conversions) to significantly reduce CPU usage and memory allocations per request.
+
+### Added
+
+* CI checks the dependencies against the Ruby advisory database on every push, with `bundler-audit`, and Dependabot keeps the actions of the workflows up to date.
+* Integration tests ensuring E2E compatibility with a real Keycloak server using Docker.
+* Automated tests in CI against multiple Keycloak versions (19.0.3, 22.0.5, 25.0.0, 26.7.0).
+* Enforced that the Rake `release` task cannot be executed locally without passing the test suite first.
+* Multi-tenancy support: `realm_id` can now be a String, an Array of Strings, or a Proc (e.g. `->(realm) { Tenant.exists?(name: realm) }`) receiving the realm named by the token and answering whether it is allowed.
+* The middleware now validates the token against the allowed realms. A token carrying an `iss` claim that does not match one of the expected realms will be rejected. New `KeycloakApiRails::TokenError` reason: `:invalid_realm`.
+* `PublicKeyCachedResolver` caches public keys per-realm, ensuring safe operation in a multi-tenant environment.
+
+## [2.0.1] - 2026-08-02
+
+### Security
+
+* `skip_paths` declaring its paths as Strings, e.g. `{ get: ["/health/db"] }`, opened routes that had to be authenticated.
+* A path that is not a `Regexp` is discarded by the middleware rather than matched, and a warning is logged naming it.
+* With `verify_not_before` enabled, an `nbf` claim carried as null was read as an absent one, skipping the very check the option asks for. It is now rejected.
+* A token whose `exp` or `nbf` claim is not a number of seconds is answered a `401`, where `Time.at` used to raise a `TypeError` and answer a `500`. The 2.0.0 guard only checked that `exp` was present, not that it held a NumericDate. New `KeycloakApiRails::TokenError` reason: `:invalid_claim`.
+
+### Fixed
+
+* `custom_attributes` declared as Symbols, e.g. `[:tenant_id]`, matched no claim at all: those of a decoded token are keyed by String. Both forms are honoured.
+* `custom_attributes` holding something else than a claim name is reported by `Configuration#validate!`, instead of being silently read from no token.
+* `KeycloakApiRails.configure` discards the service, the public key resolver and the HTTP client it had memoized
+
+### Availability
+
+* A request whose token cannot be verified at all, Keycloak being unreachable and no public key having ever been retrieved, is answered a `503` carrying a `Retry-After` header. `KeycloakApiRails::HTTPError` and `KeycloakApiRails::MissingPublicKeysError` used to escape the middleware, and `keycloak_authenticate`, as a `500`: an outage of Keycloak was reported as a bug of the application. A request carrying no token at all is still answered a `401`, and the paths of `skip_paths` are still served.
+* With nothing cached, a Keycloak that is down was called again by every single request, one at a time behind the mutex of the resolver, each waiting for `http_open_timeout` and `http_read_timeout` to elapse: ten concurrent requests held ten threads for a hundred seconds. It is now called once per `FAILED_REFRESH_RETRY_DELAY_IN_SECONDS`, and the error of the last attempt is raised straight away in between.
+
 ## [2.0.0] - 2026-08-01
 
 ### Breaking changes

data/README.md

@@ -18,8 +18,7 @@ the recommended path.
 ## Install
 
 ```ruby
-gem "keycloak-api-rails", "2.0.0"
-```
+gem "keycloak-api-rails", "2.0.3"
 
 ## Token validation
 
@@ -36,7 +35,7 @@ _If both methods are used at the same time, the `Authorization` header takes pre
 
 By default, Keycloak-api-rails installs as a Rack Middleware. It processes all requests before any application logic. URIs/Paths can be excluded (opted-out) from this validation using the 'skip_paths' config option
 
-Alternatively, it can be configured to `opt-in` to validation. In this case, no Rack middleware is used, and controllers can request (opt-in) by including the module `KeycloakApiRails::Authentication` and calling `keycloak_authenticate`, for example in a `before_action`, like so: 
+Alternatively, it can be configured to `opt-in` to validation. The middleware is still installed and controllers request (opt-in) by including the module `KeycloakApiRails::Authentication` and calling `keycloak_authenticate`, for example in a `before_action`, like so: 
 
 ```ruby
 class MyApiController < ActionController::Base
@@ -60,17 +59,18 @@ All options have a default value. However, all of them can be changed in your in
 
 | Option | Default Value | Type | Required? | Description  | Example |
 | ---- | ----- | ------ | ----- | ------ | ----- |
-| `server_url` | `nil`| String | Required | The base url where your Keycloak server is located. This value can be retrieved in your Keycloak client configuration. | `auth:8080` |
-| `realm_id` | `nil`| String | Required | Realm's name (not id, actually) | `master` |
+| `server_url` | `nil`| String | Required | The base url where your Keycloak server is located, scheme included. Without one, the url cannot be parsed and no public key is ever downloaded | `https://keycloak.example.org` or `http://auth:8080` |
+| `realm_id` | `nil`| String, Array or Proc | Required | Realm's name(s) (not id, actually). A single String, an Array of Strings for multiple tenants, or a Proc receiving the realm named by the token and answering whether it is allowed | `"master"`, `["tenant1", "tenant2"]` or `->(realm) { Tenant.exists?(name: realm) }` |
 | `logger` | `Logger.new(STDOUT)`| Logger | Optional | The logger used by `keycloak-api-rails` | `Rails.logger` | 
-| `skip_paths` | `{}`| Hash of methods and paths regexp | Optional | Paths whose token must not be validated | `{ get: [/^\/health\/.+/] }`| 
+| `skip_paths` | `{}`| Hash of methods and paths regexp | Optional | Paths whose token must not be validated, matched against the URL-decoded path of the request. Each path must be a `Regexp`, anchored with `\A` and `\z`: a String is refused when the application boots, and `^` and `$` are warned about, for the reasons given below | `{ get: [/\A\/health\/.+/] }`| 
 | `opt_in` | `false` | Boolean | Optional | When false, every request is validated by the middleware, except the ones matching `skip_paths`. When true, no middleware validates anything and authentication must be requested explicitly, by calling `keycloak_authenticate` from a controller | `true`
 | `token_expiration_tolerance_in_seconds` | `10`| Integer | Optional | Safety margin: a token is rejected this number of seconds *before* the date of its `exp` claim, so that it cannot expire in the middle of a request | `15` |
-| `public_key_cache_ttl` | `86400`| Integer | Optional | Amount of time, in seconds, specifying maximum interval between two requests to Keycloak to retrieve new public keys. It is 86400 seconds (1 day) by default. At least once per this configured interval (1 day by default) will be new public key always downloaded. | `3600` |
-| `custom_attributes` | `[]`| Array Of String | Optional | List of token attributes to read from each token and to add to their http request env | `["originalFirstName", "originalLastName"]` |
+| `public_key_cache_ttl` | `86400`| Integer | Optional | Amount of time, in seconds, specifying maximum interval between two requests to Keycloak to retrieve new public keys. It is 86400 seconds (1 day) by default. At least once per this configured interval (1 day by default) will be new public key always downloaded. The refresh happens under a lock and blocks request threads if Keycloak hangs; reducing this TTL increases the frequency of this risk. | `3600` |
+| `custom_attributes` | `[]`| Array of String or Symbol | Optional | List of token attributes to read from each token and to add to their http request env | `["originalFirstName", "originalLastName"]` |
 | `ca_certificate_file` | `nil`| String | Optional | Path to the certificate authority used to validate the Keycloak server certificate | `/credentials/production_root_ca_cert.pem` |
 | `expected_audience` | `nil`| String or Array of String | Optional | When set, a token is rejected unless its `aud` claim carries one of these audiences. Left unset, every token signed by the realm is accepted, including its ID tokens and the tokens issued for its other clients | `"my-api"` |
-| `expected_token_type` | `nil`| String | Optional | When set, a token is rejected unless its `typ` claim matches. Keycloak types its access tokens `Bearer` | `"Bearer"` |
+| `expected_token_type` | `nil`| String | Optional | When set, a token is rejected unless its `typ` claim matches (case-insensitive). Keycloak types its access tokens `Bearer` | `"Bearer"` |
+| `allowed_algorithms` | every asymmetric algorithm Keycloak signs with: `[:RS256, :RS384, :RS512, :PS256, :PS384, :PS512, :ES256, :ES384, :ES512]` | Array of String or Symbol | Optional | The algorithms a token may be signed with. Narrow it down to the one of the realm, so that the `alg` header of a token cannot pick how its own signature is verified. Symmetric algorithms are refused: a token checked against a JWKS is checked against a public key, and a key that verifies is a key that signs | `[:RS256]` |
 | `verify_not_before` | `false`| Boolean | Optional | When true, a token whose `nbf` claim is in the future is rejected. Disabled by default: a clock skew between Keycloak and the API would reject valid tokens | `true` |
 | `allow_token_in_query_string` | `false`| Boolean | Optional | When true, a request carrying no `Authorization` header may be authenticated by the `authorizationToken` parameter of its query string | `true` |
 | `http_open_timeout` | `5`| Integer | Optional | Seconds to wait for the connection to Keycloak to open, when downloading the public keys | `2` |
@@ -90,12 +90,19 @@ KeycloakApiRails.configure do |config|
   config.realm_id   = ENV["KEYCLOAK_REALM_ID"]
   config.logger     = Rails.logger
   config.skip_paths = {
-    post:   [/^\/message/],
-    get:    [/^\/locales/, /^\/health\/.+/]
+    post:   [/\A\/message/],
+    get:    [/\A\/locales/, /\A\/health\/.+/]
   }
 end
 ```
 
+Anchor those regexps with `\A` and `\z`, never with `^` and `$`. In Ruby, `^` and `$` match the
+beginning and the end of a *line*, not of the string. The path they are matched against is
+`PATH_INFO`, which the server has already URL-decoded, so a `%0a` in the request reaches them as a
+real newline: `"/private\n/health"` matches `/^\/health/` and skips authentication on a path that
+was never meant to be open. A regexp anchored with `^` or `$` is warned about when the first request
+is served.
+
 Or using opt-in configuration:
 
 ```ruby
@@ -129,6 +136,32 @@ Keycloak only adds an API to the `aud` claim of a token once that API is declare
 `config.verify_not_before = true` additionally rejects a token whose `nbf` claim is in the future.
 It is disabled by default because a clock skew between Keycloak and the API rejects valid tokens.
 
+The `iss` claim is checked against `server_url` only when one is configured. A test environment replacing the public key resolver, as `keycloak-api-rails/testing` does, accepts any issuer.
+
+## Multi-tenancy (Multiple Realms)
+
+The library natively supports multi-tenancy by validating tokens issued by multiple Keycloak realms. 
+Instead of a static string, you can configure `realm_id` with an Array or a Proc. The library will dynamically extract the realm from the token's `iss` claim, check if it is permitted, and fetch the appropriate public keys for that specific realm.
+
+Those realms all live under the same `server_url`: a token whose `iss` names another server is rejected, however allowed the realm it names.
+Declaring `expected_audience` matters all the more here — without it, a token issued for any client of any allowed realm opens the API.
+
+Using an Array of allowed realms:
+```ruby
+KeycloakApiRails.configure do |config|
+  config.server_url = ENV["KEYCLOAK_SERVER_URL"]
+  config.realm_id   = ["master", "tenant-1", "tenant-2"]
+end
+```
+
+Using a Proc for dynamic validation (e.g., querying the database):
+```ruby
+KeycloakApiRails.configure do |config|
+  config.server_url = ENV["KEYCLOAK_SERVER_URL"]
+  config.realm_id   = ->(realm) { Tenant.exists?(name: realm) }
+end
+```
+
 ## Use cases
 
 Once this gem is configured in your Rails project, you can read, validate and use tokens in your controllers.
@@ -212,7 +245,7 @@ For instance, to read a provided token:
 ```ruby
 class RenderTokenController < ApplicationController
   def show
-    uri     = request.env["REQUEST_URI"]
+    uri     = KeycloakApiRails::Helper.request_uri(request.env)
     headers = request.env
     token   = KeycloakApiRails.service.read_token(uri, headers)
     render json: { token: token }, status: :ok
@@ -280,9 +313,23 @@ Assigning `KeycloakApiRails.public_key_resolver = nil` restores the regular reso
 
 From the `keycloak-rails-api` directory:
 
+```
+  $ bundle exec rspec
+```
+
+The examples of `spec/integration` are excluded: they start a Keycloak container, and without Docker
+they wait for a server that never answers. Run them, against the Keycloak version of your choice,
+with:
+
+```
+  $ KEYCLOAK_INTEGRATION=1 KEYCLOAK_VERSION=26.7.0 bundle exec rspec spec/integration
+```
+
+Or run everything in a container, which needs a Docker socket of its own to reach Keycloak:
+
 ```
   $ docker build . -t keycloak-rails-api:test
-  $ docker run -v `pwd`:/usr/src/app/ keycloak-rails-api:test bundle exec rspec spec
+  $ docker run -v `pwd`:/usr/src/app/ keycloak-rails-api:test bundle exec rspec
 ```
 
 ## How to release a new version
@@ -297,13 +344,9 @@ scoped RubyGems credential.
 3. Tag the commit and push the tag:
 
 ```
-  $ git tag -a v2.0.0 -m "Version 2.0.0"
-  $ git push origin v2.0.0
+  $ git tag -a v2.0.3 -m "Version 2.0.3"
+  $ git push origin v2.0.3
 ```
 
 The workflow then checks that the tag matches `KeycloakApiRails::VERSION`, runs the tests, builds the gem
 and pushes it. It only publishes tags starting with `v`.
-
-## Next developments
-
-* Manage multiple realms

data/keycloak-api-rails.gemspec

@@ -31,10 +31,14 @@ Gem::Specification.new do |spec|
   spec.add_dependency "railties",    ">= 4.2"
   spec.add_dependency "json-jwt",    ">= 1.11.0"
 
+  spec.add_dependency "base64"
+  spec.add_dependency "logger"
+
   spec.add_development_dependency "rspec",   "3.13.2"
   spec.add_development_dependency "timecop", "0.9.11"
   spec.add_development_dependency "rails",   ">= 4.2"
   spec.add_development_dependency "rack"
   spec.add_development_dependency "rake",    ">= 13.0"
   spec.add_development_dependency "byebug", ">= 11.1.3"
+  spec.add_development_dependency "bundler-audit", ">= 0.9"
 end

data/lib/keycloak-api-rails/authentication.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
   module Authentication
     def self.included(base)
@@ -14,11 +16,15 @@ module KeycloakApiRails
       path   = env["PATH_INFO"]
 
       KeycloakApiRails.logger.debug("Start authentication for #{method} : #{path}")
-      token         = KeycloakApiRails.service.read_token(Helper.request_uri(env), env)
-      decoded_token = KeycloakApiRails.service.decode_and_verify(token)
+      service       = KeycloakApiRails.service
+      token         = service.read_token(Helper.request_uri(env), env)
+      decoded_token = service.decode_and_verify(token)
       authentication_succeeded(env, decoded_token)
     rescue TokenError => e
+      response.headers["WWW-Authenticate"] = e.challenge
       authentication_failed(e.message)
+    rescue KeycloakApiRails::HTTPError, KeycloakApiRails::MissingPublicKeysError => e
+      authentication_unavailable(e)
     end
 
     def authentication_failed(message)
@@ -26,6 +32,12 @@ module KeycloakApiRails
       render status: :unauthorized, json: { error: message }
     end
 
+    def authentication_unavailable(error)
+      KeycloakApiRails.logger.error("KeycloakApiRails: no token can be verified. #{error.class}: #{error.message}")
+      response.headers["Retry-After"] = KeycloakApiRails::PublicKeyCachedResolver::FAILED_REFRESH_RETRY_DELAY_IN_SECONDS.to_s
+      render status: :service_unavailable, json: { error: "Authentication is temporarily unavailable" }
+    end
+
     def authentication_succeeded(env, decoded_token)
       Helper.assign_token(env, decoded_token, KeycloakApiRails.config.custom_attributes)
     end

data/lib/keycloak-api-rails/configuration.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
   class InvalidConfigurationError < StandardError; end
 
@@ -19,17 +21,17 @@ module KeycloakApiRails
     attr_accessor :allow_token_in_query_string
     attr_accessor :http_open_timeout
     attr_accessor :http_read_timeout
+    attr_accessor :allowed_algorithms
 
     def validate!
       errors = []
 
       errors.push("'server_url' must be a String or nil, got #{server_url.inspect}") unless server_url.nil? || server_url.is_a?(String)
-      errors.push("'realm_id' must be a String or nil, got #{realm_id.inspect}") unless realm_id.nil? || realm_id.is_a?(String)
+      errors.push("'realm_id' must be a String, an Array of Strings, a Proc, or nil, got #{realm_id.inspect}") unless valid_realm_id?(realm_id)
       errors.push("'logger' must respond to #{LOGGER_METHODS.join(', ')}") unless LOGGER_METHODS.all? { |method| logger.respond_to?(method) }
       errors.push("'opt_in' must be true or false, got #{opt_in.inspect}") unless boolean?(opt_in)
       errors.push("'verify_not_before' must be true or false, got #{verify_not_before.inspect}") unless boolean?(verify_not_before)
       errors.push("'allow_token_in_query_string' must be true or false, got #{allow_token_in_query_string.inspect}") unless boolean?(allow_token_in_query_string)
-      errors.push("'custom_attributes' must be an Array of claim names, got #{custom_attributes.inspect}") unless custom_attributes.is_a?(Array)
       errors.push("'token_expiration_tolerance_in_seconds' must be a number of seconds, got #{token_expiration_tolerance_in_seconds.inspect}") unless number?(token_expiration_tolerance_in_seconds, allow_zero: true)
       errors.push("'public_key_cache_ttl' must be a positive number of seconds, got #{public_key_cache_ttl.inspect}") unless number?(public_key_cache_ttl)
       errors.push("'http_open_timeout' must be a positive number of seconds, got #{http_open_timeout.inspect}") unless number?(http_open_timeout)
@@ -37,8 +39,10 @@ module KeycloakApiRails
       errors.push("'expected_token_type' must be a String or nil, got #{expected_token_type.inspect}") unless expected_token_type.nil? || expected_token_type.is_a?(String)
       errors.push("'ca_certificate_file' must be the path of a readable file, got #{ca_certificate_file.inspect}") unless ca_certificate_file.nil? || File.readable?(ca_certificate_file.to_s)
 
+      errors.concat(custom_attributes_errors)
       errors.concat(skip_paths_errors)
       errors.concat(expected_audience_errors)
+      errors.concat(allowed_algorithms_errors)
 
       raise InvalidConfigurationError, "Invalid Keycloak configuration: #{errors.join('; ')}" unless errors.empty?
 
@@ -61,13 +65,26 @@ module KeycloakApiRails
 
     private
 
+    def custom_attributes_errors
+      if custom_attributes.is_a?(Array)
+        invalid_names = custom_attributes.reject { |name| name.is_a?(String) || name.is_a?(Symbol) }
+        if invalid_names.empty?
+          []
+        else
+          ["'custom_attributes' must only contain claim names, as Strings or Symbols, got #{invalid_names.inspect}"]
+        end
+      else
+        ["'custom_attributes' must be an Array of claim names, got #{custom_attributes.inspect}"] 
+      end
+    end
+
     def skip_paths_errors
       return ["'skip_paths' must be a Hash of HTTP methods and path regexps, got #{skip_paths.inspect}"] unless skip_paths.is_a?(Hash)
 
       skip_paths.filter_map do |method, paths|
-        next if paths.is_a?(Array) && paths.all? { |path| path.respond_to?(:match) }
+        next if paths.is_a?(Array) && paths.all? { |path| path.is_a?(Regexp) }
 
-        "'skip_paths[#{method.inspect}]' must be an Array of regexps, got #{paths.inspect}"
+        "'skip_paths[#{method.inspect}]' must be an Array of regexps, got #{paths.inspect}. A String is refused because 'String#match' compiles its argument into a regexp: the path of the request would become the pattern, and routes that must be authenticated would be skipped"
       end
     end
 
@@ -82,6 +99,19 @@ module KeycloakApiRails
       end
     end
 
+    def allowed_algorithms_errors
+      unless allowed_algorithms.is_a?(Array) && !allowed_algorithms.empty?
+        return ["'allowed_algorithms' must be a non-empty Array of algorithm names, got #{allowed_algorithms.inspect}"]
+      end
+
+      unsupported = allowed_algorithms.reject { |algorithm| Service::SUPPORTED_ALGORITHMS.include?(algorithm.to_s.to_sym) }
+      if unsupported.empty?
+        []
+      else
+        ["'allowed_algorithms' declares #{unsupported.inspect}, which this library does not verify. It accepts #{Service::SUPPORTED_ALGORITHMS.inspect}"]
+      end
+    end
+
     def boolean?(value)
       value == true || value == false
     end
@@ -91,7 +121,20 @@ module KeycloakApiRails
     end
 
     def missing?(value)
-      value.nil? || value.to_s.strip.empty?
+      if value.is_a?(Array)
+        value.empty?
+      elsif value.is_a?(String)
+        value.strip.empty?
+      else
+        value.nil?
+      end
+    end
+
+    def valid_realm_id?(realm_id)
+      realm_id.nil? ||
+        realm_id.is_a?(String) ||
+        (realm_id.is_a?(Array) && realm_id.all? { |r| r.is_a?(String) }) ||
+        realm_id.respond_to?(:call)
     end
   end
 end

data/lib/keycloak-api-rails/helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
   class Helper
 
@@ -76,15 +78,18 @@ module KeycloakApiRails
     end
 
     def self.assign_resource_roles(env, token)
-      env[RESOURCE_ROLES_KEY] = token.fetch("resource_access", {}).inject({}) do |resource_roles, (name, resource_attributes)|
+      env[RESOURCE_ROLES_KEY] = token.fetch("resource_access", {}).each_with_object({}) do |(name, resource_attributes), resource_roles|
         resource_roles[name] = resource_attributes.fetch("roles", [])
-        resource_roles
       end
     end
 
     def self.assign_current_user_custom_attributes(env, token, attribute_names)
-      names = Array(attribute_names)
-      env[CURRENT_USER_ATTRIBUTES] = token.select { |key, _value| names.include?(key) }
+      attributes = {}
+      Array(attribute_names).each do |name|
+        name_str = name.to_s
+        attributes[name_str] = token[name_str] if token.key?(name_str)
+      end
+      env[CURRENT_USER_ATTRIBUTES] = attributes
     end
 
     def self.current_user_custom_attributes(env)

data/lib/keycloak-api-rails/http_client.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
   class HTTPError < StandardError
     attr_reader :status

data/lib/keycloak-api-rails/middleware.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
 
   class Middleware
@@ -6,16 +8,20 @@ module KeycloakApiRails
     end
 
     def call(env)
-      method = env["REQUEST_METHOD"]
-      path   = env["PATH_INFO"]
+      method  = env["REQUEST_METHOD"]
+      path    = env["PATH_INFO"]
+      service = KeycloakApiRails.service
 
       if service.need_middleware_authentication?(method, path, env)
         logger.debug("Start authentication for #{method} : #{path}")
         begin
-          authenticate(env)
+          authenticate(service, env)
         rescue TokenError => e
           logger.debug("The error causing the Token to fail: #{e.original_error&.message || e.message}")
-          return authentication_failed(e.message)
+          return authentication_failed(e)
+        rescue HTTPError, MissingPublicKeysError => e
+          logger.error("KeycloakApiRails: no token can be verified for #{method} : #{path}. #{e.class}: #{e.message}")
+          return authentication_unavailable
         end
       else
         logger.debug("Skip authentication for #{method} : #{path}")
@@ -26,19 +32,25 @@ module KeycloakApiRails
 
     private
 
-    def authenticate(env)
+    def authenticate(service, env)
       token         = service.read_token(Helper.request_uri(env), env)
       decoded_token = service.decode_and_verify(token)
       Helper.assign_token(env, decoded_token, config.custom_attributes)
     end
 
-    def authentication_failed(message)
+    def authentication_failed(error)
       # Rack 3 requires header names to be lowercase.
-      [401, { "content-type" => "application/json" }, [{ error: message }.to_json]]
+      [401,
+       { "content-type"     => "application/json",
+         "www-authenticate" => error.challenge },
+       [{ error: error.message }.to_json]]
     end
 
-    def service
-      KeycloakApiRails.service
+    def authentication_unavailable
+      [503,
+       { "content-type" => "application/json",
+         "retry-after"  => PublicKeyCachedResolver::FAILED_REFRESH_RETRY_DELAY_IN_SECONDS.to_s },
+       [{ error: "Authentication is temporarily unavailable" }.to_json]]
     end
 
     def logger

data/lib/keycloak-api-rails/public_key_cached_resolver.rb

@@ -1,49 +1,120 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
   class PublicKeyCachedResolver
     FAILED_REFRESH_RETRY_DELAY_IN_SECONDS = 10
+    MAX_CACHED_REALMS                     = 64
+
+    class RealmCache
+      attr_reader :cached_public_key_retrieved_at
+
+      def initialize(http_client, realm_id)
+        @resolver                       = PublicKeyResolver.new(http_client, realm_id)
+        @cached_public_keys             = nil
+        @cached_public_key_retrieved_at = nil
+        @last_refresh_failure_at        = nil
+        @last_refresh_error             = nil
+        @mutex                          = Mutex.new
+      end
+
+      def find_public_keys(public_key_cache_ttl, logger)
+        @mutex.synchronize do
+          raise @last_refresh_error if refresh_recently_failed_without_any_cache?
+
+          refresh_public_keys(logger) if public_keys_are_outdated?(public_key_cache_ttl)
+          @cached_public_keys
+        end
+      end
+
+      private
 
-    attr_reader :cached_public_key_retrieved_at
+      def refresh_public_keys(logger)
+        @cached_public_keys             = @resolver.find_public_keys
+        @cached_public_key_retrieved_at = Time.now
+        @last_refresh_failure_at        = nil
+        @last_refresh_error             = nil
+      rescue StandardError => e
+        @last_refresh_failure_at = Time.now
+        @last_refresh_error      = e
+        raise if @cached_public_keys.nil?
+
+        logger&.warn("KeycloakApiRails: could not refresh the public keys (#{e.class}: #{e.message}). Keeping the ones retrieved at #{@cached_public_key_retrieved_at}.")
+      end
+
+      def refresh_recently_failed_without_any_cache?
+        @cached_public_keys.nil? &&
+          !@last_refresh_failure_at.nil? &&
+          Time.now <= @last_refresh_failure_at + FAILED_REFRESH_RETRY_DELAY_IN_SECONDS
+      end
+
+      def public_keys_are_outdated?(public_key_cache_ttl)
+        @cached_public_keys.nil? ||
+          @cached_public_key_retrieved_at.nil? ||
+          (Time.now > @cached_public_key_retrieved_at + public_key_cache_ttl &&
+            (@last_refresh_failure_at.nil? ||
+              Time.now > @last_refresh_failure_at + FAILED_REFRESH_RETRY_DELAY_IN_SECONDS))
+      end
+    end
 
     def initialize(http_client, realm_id, public_key_cache_ttl, logger = nil)
-      @resolver                       = PublicKeyResolver.new(http_client, realm_id)
-      @public_key_cache_ttl           = public_key_cache_ttl
-      @logger                         = logger
-      @cached_public_keys             = nil
-      @cached_public_key_retrieved_at = nil
-      @last_refresh_failure_at        = nil
-      @mutex                          = Mutex.new
+      @http_client          = http_client
+      @realm_id             = realm_id
+      @configured_realms    = configured_realms(realm_id)
+      @public_key_cache_ttl = public_key_cache_ttl
+      @logger               = logger
+      @caches               = {}
+      @caches_mutex         = Mutex.new
+      @refusal_logged       = false
     end
 
     def self.from_configuration(http_client, configuration)
       new(http_client, configuration.realm_id, configuration.public_key_cache_ttl, configuration.logger)
     end
 
-    def find_public_keys
-      @mutex.synchronize do
-        refresh_public_keys if public_keys_are_outdated?
-        @cached_public_keys
-      end
+    def find_public_keys(realm_id = nil)
+      cache_for(realm_id || default_realm).find_public_keys(@public_key_cache_ttl, @logger)
+    end
+
+    # Keep this method backward-compatible for testing
+    def cached_public_key_retrieved_at(realm_id = nil)
+      cache_for(realm_id || default_realm).cached_public_key_retrieved_at
     end
 
     private
 
-    def refresh_public_keys
-      @cached_public_keys             = @resolver.find_public_keys
-      @cached_public_key_retrieved_at = Time.now
-      @last_refresh_failure_at        = nil
-    rescue StandardError => e
-      raise if @cached_public_keys.nil?
+    def default_realm
+      @realm_id if @realm_id.is_a?(String)
+    end
+
+    def configured_realms(realm_id)
+      case realm_id
+      when String then [realm_id].freeze
+      when Array  then realm_id.dup.freeze
+      end
+    end
+
+    def cache_for(realm_id)
+      @caches[realm_id] || @caches_mutex.synchronize { @caches[realm_id] || create_cache(realm_id) }
+    end
+
+    def create_cache(realm_id)
+      refuse(realm_id, "it is not one of the configured realms")         unless cacheable?(realm_id)
+      refuse(realm_id, "#{MAX_CACHED_REALMS} realms are already cached") if     @caches.size >= MAX_CACHED_REALMS
 
-      @last_refresh_failure_at = Time.now
-      @logger&.warn("KeycloakApiRails: could not refresh the public keys (#{e.class}: #{e.message}). Keeping the ones retrieved at #{@cached_public_key_retrieved_at}.")
+      @caches[realm_id] = RealmCache.new(@http_client, realm_id)
     end
 
-    def public_keys_are_outdated?
-      @cached_public_keys.nil? ||
-        @cached_public_key_retrieved_at.nil? ||
-        (Time.now > @cached_public_key_retrieved_at + @public_key_cache_ttl &&
-          (@last_refresh_failure_at.nil? ||
-            Time.now > @last_refresh_failure_at + FAILED_REFRESH_RETRY_DELAY_IN_SECONDS))
+    def cacheable?(realm_id)
+      !realm_id.nil? && (@configured_realms.nil? || @configured_realms.include?(realm_id))
+    end
+
+    def refuse(realm_id, reason)
+      unless @refusal_logged
+        @refusal_logged = true
+        @logger&.warn("KeycloakApiRails: no public key is downloaded for the realm #{realm_id.inspect}, #{reason}. The requests naming it are answered a 503. Further refusals are not logged.")
+      end
+
+      raise MissingPublicKeysError, "No Keycloak public key can be downloaded for the realm #{realm_id.inspect}"
     end
   end
 end

data/lib/keycloak-api-rails/public_key_resolver.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
   class PublicKeyResolver
     def initialize(http_client, realm_id)

data/lib/keycloak-api-rails/railtie.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
   class Railtie < Rails::Railtie
     railtie_name :keycloak_api_rails

data/lib/keycloak-api-rails/service.rb

@@ -1,34 +1,84 @@
+# frozen_string_literal: true
+
+require 'base64'
 module KeycloakApiRails
   class MissingPublicKeysError < StandardError; end
 
   class Service
+    REALM_NAME = /\A(?!\.+\z)[A-Za-z0-9._~-]{1,128}\z/.freeze
+    SUPPORTED_ALGORITHMS = %i[RS256 RS384 RS512 PS256 PS384 PS512 ES256 ES384 ES512].freeze
 
     def initialize(key_resolver)
       configuration                          = KeycloakApiRails.config
       @key_resolver                          = key_resolver
-      @skip_paths                            = normalize_skip_paths(configuration.skip_paths)
+      @skip_paths                            = normalize_skip_paths(configuration.skip_paths, configuration.logger)
       @opt_in                                = configuration.opt_in
       @token_expiration_tolerance_in_seconds = configuration.token_expiration_tolerance_in_seconds
       @expected_audiences                    = Array(configuration.expected_audience).map(&:to_s)
       @expected_token_type                   = configuration.expected_token_type
       @verify_not_before                     = configuration.verify_not_before
       @allow_token_in_query_string           = configuration.allow_token_in_query_string
+      @allowed_algorithms                    = Array(configuration.allowed_algorithms).map(&:to_sym)
     end
 
     def decode_and_verify(token)
       raise TokenError.no_token(token) if token.nil? || token.empty?
+      
+      parts = token.to_s.split('.')
+      raise TokenError.invalid_format(token) if parts.length < 3
 
-      public_keys = @key_resolver.find_public_keys
+      realm_id = extract_realm_from_token(token)
+      raise TokenError.invalid_realm(token) unless realm_allowed?(realm_id)
+      
+      public_keys = @key_resolver.find_public_keys(realm_id)
       
       if public_keys.nil?
         raise MissingPublicKeysError, "No Keycloak public key is available to verify the token" 
       end
 
       decoded_token = decode(token, public_keys)
-      verify_claims!(token, decoded_token)
+      verify_claims!(token, decoded_token, realm_id)
       decoded_token
     end
 
+    def extract_realm_from_token(token)
+      payload_segment = token.split('.', 3)[1]
+      return nil unless payload_segment
+
+      decoded_payload = Base64.urlsafe_decode64(payload_segment)
+      parsed_payload  = JSON.parse(decoded_payload)
+
+      if parsed_payload.is_a?(Hash)
+        iss = parsed_payload['iss']
+        return nil unless iss.is_a?(String)
+  
+        realm_id = iss.split('/').last
+        if realm_id&.match?(REALM_NAME)
+          realm_id 
+        else
+          nil
+        end
+      else
+        nil
+      end
+    rescue JSON::ParserError, ArgumentError
+      nil
+    end
+
+    def realm_allowed?(realm_id)
+      config_realm_id = KeycloakApiRails.config.realm_id
+      return true if config_realm_id.nil?
+      return false if realm_id.nil?
+
+      if config_realm_id.respond_to?(:call)
+        config_realm_id.call(realm_id)
+      elsif config_realm_id.is_a?(Array)
+        config_realm_id.include?(realm_id)
+      else
+        config_realm_id == realm_id
+      end
+    end
+
     def read_token(uri, headers)
       header_token = Helper.read_token_from_headers(headers)
       if !header_token.empty?
@@ -47,9 +97,7 @@ module KeycloakApiRails
     private
 
     def decode(token, public_keys)
-      decoded_token = JSON::JWT.decode(token, public_keys)
-      decoded_token.verify!(public_keys)
-      decoded_token
+      JSON::JWT.decode(token, public_keys, @allowed_algorithms)
     rescue JSON::JWT::VerificationFailed, JSON::JWK::Set::KidNotFound => e
       raise TokenError.verification_failed(token, e)
     rescue JSON::JWT::InvalidFormat => e
@@ -58,28 +106,60 @@ module KeycloakApiRails
       raise TokenError.unknown(token, e)
     end
 
-    def verify_claims!(token, decoded_token)
+    # RFC 7519 requires 'exp' and 'nbf' to be NumericDates.
+    def verify_claims!(token, decoded_token, realm_id)
       raise TokenError.missing_claim(token, "exp") unless decoded_token.key?("exp")
+      raise TokenError.invalid_claim(token, "exp") unless decoded_token["exp"].is_a?(Numeric)
+      raise TokenError.invalid_claim(token, "nbf") if not_before_is_invalid?(decoded_token)
       raise TokenError.expired(token)              if expired?(decoded_token)
       raise TokenError.not_yet_valid(token)        if not_yet_valid?(decoded_token)
       raise TokenError.invalid_audience(token)     unless audience_valid?(decoded_token)
       raise TokenError.invalid_token_type(token)   unless token_type_valid?(decoded_token)
+
+      if KeycloakApiRails.config.server_url
+        expected_iss = File.join(KeycloakApiRails.config.server_url.to_s, "realms", realm_id.to_s)
+        raise TokenError.invalid_realm(token) unless decoded_token["iss"] == expected_iss
+      end
+    end
+
+    def not_before_is_invalid?(token)
+      @verify_not_before && token.key?("nbf") && !token["nbf"].is_a?(Numeric)
     end
 
-    def normalize_skip_paths(skip_paths)
+    # Anything that is not a regexp is discarded rather than matched: 'String#match' compiles its
+    # argument into a regexp, so a String would be matched against the path of the request instead of
+    # the other way around, and would open every path that is a sub-pattern of it. The railtie rejects
+    # such a configuration when the application boots; a Rack application running without Rails never
+    # calls 'validate!', so the paths keep being authenticated here.
+    def normalize_skip_paths(skip_paths, logger)
       (skip_paths || {}).each_with_object({}) do |(method, paths), normalized|
-        normalized[method.to_s.downcase.to_sym] = Array(paths)
+        regexps, discarded = Array(paths).partition { |path| path.is_a?(Regexp) }
+
+        unless discarded.empty?
+          logger&.warn("KeycloakApiRails: 'skip_paths[#{method.inspect}]' declares #{discarded.map(&:inspect).join(', ')}, which are not regexps. They are ignored, and the paths they were meant to open keep being authenticated.")
+        end
+
+        line_anchored = regexps.select { |regexp| line_anchored?(regexp) }
+        unless line_anchored.empty?
+          logger&.warn("KeycloakApiRails: 'skip_paths[#{method.inspect}]' declares #{line_anchored.map(&:inspect).join(', ')}, anchored with '^' or '$'. In Ruby those match the beginning and the end of a line, not of the path: \"/private\\n/health\" matches /^\\/health/ and skips authentication. Anchor with '\\A' and '\\z'.")
+        end
+
+        normalized[method.to_s.upcase] = regexps
       end
     end
 
+    # Escaped pairs are dropped first, so that '\^' does not count and '[^/]' is read as a class.
+    def line_anchored?(regexp)
+      regexp.source.gsub(/\\./, "").gsub(/\[[^\]]*\]/, "").match?(/[\^$]/)
+    end
+
     def should_skip?(method, path)
-      skip_paths = @skip_paths[method&.to_s&.downcase&.to_sym]
-      !skip_paths.nil? && skip_paths.any? { |skip_path| skip_path.match(path) }
+      skip_paths = @skip_paths[method]
+      !skip_paths.nil? && skip_paths.any? { |skip_path| skip_path.match?(path) }
     end
 
     def is_preflight?(method, headers)
-      method_symbol = method&.to_s&.downcase&.to_sym
-      method_symbol == :options && !headers["HTTP_ACCESS_CONTROL_REQUEST_METHOD"].nil?
+      method == "OPTIONS" && !headers["HTTP_ACCESS_CONTROL_REQUEST_METHOD"].nil?
     end
 
     def expired?(token)

data/lib/keycloak-api-rails/testing.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Test helpers for the applications that authenticate their requests with this library.
 #
 # This file is *not* loaded by "keycloak-api-rails": it has to be required explicitly, so that
@@ -33,7 +35,7 @@ module KeycloakApiRails
         @public_keys = public_keys
       end
 
-      def find_public_keys
+      def find_public_keys(realm_id = nil)
         @public_keys
       end
     end
@@ -85,6 +87,12 @@ module KeycloakApiRails
         payload["realm_access"]    = { "roles" => roles.map(&:to_s) } unless roles.nil? || roles.empty?
         payload["resource_access"] = build_resource_access(resource_roles) unless resource_roles.nil? || resource_roles.empty?
 
+        unless claims.key?(:iss) || claims.key?("iss")
+          config_realm_id = KeycloakApiRails.config.realm_id
+          realm_id = config_realm_id.is_a?(String) ? config_realm_id : "master"
+          payload["iss"] = File.join(KeycloakApiRails.config.server_url.to_s, "realms", realm_id)
+        end
+
         claims.each { |name, value| payload[name.to_s] = value }
 
         JSON::JWT.new(payload).sign(signing_key, ALGORITHM).to_s

data/lib/keycloak-api-rails/token_error.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
   class TokenError < StandardError
     attr_reader :token, :reason, :original_error
@@ -9,14 +11,27 @@ module KeycloakApiRails
       @original_error = original_error
     end
 
+    # RFC 6750: a request that carried no credentials at all gets the bare challenge, no error code.
+    def challenge
+      if reason == :no_token
+        "Bearer"
+      else
+        %(Bearer error="invalid_token", error_description="#{message.gsub(/["\\]/, '')}")
+      end
+    end
+
     def self.verification_failed(token, original_error)
       new(token, :verification_failed, "Failed to verify JWT token", original_error)
     end
 
-    def self.invalid_format(token, original_error)
+    def self.invalid_format(token, original_error = nil)
       new(token, :invalid_format, "Wrong JWT Format", original_error)
     end
 
+    def self.invalid_realm(token)
+      new(token, :invalid_realm, "JWT token does not have a valid realm")
+    end
+
     def self.no_token(token)
       new(token, :no_token, "No JWT token provided")
     end
@@ -41,6 +56,10 @@ module KeycloakApiRails
       new(token, :missing_claim, "JWT token does not carry the mandatory claim '#{claim}'")
     end
 
+    def self.invalid_claim(token, claim)
+      new(token, :invalid_claim, "JWT token carries an invalid '#{claim}' claim: it must be a number of seconds since the Epoch")
+    end
+
     def self.unknown(token, original_error)
       new(token, :unknown, "Failed to read JWT token", original_error)
     end

data/lib/keycloak-api-rails/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module KeycloakApiRails
-  VERSION = "2.0.0"
+  VERSION = "2.0.3"
 end

data/lib/keycloak-api-rails.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "logger"
 require "json/jwt"
 require "uri"
@@ -21,22 +23,37 @@ module KeycloakApiRails
   # These objects are memoized lazily, on the first request each process serves -- which several
   # threads of a threaded server reach at the same time. A Monitor rather than a Mutex: the
   # memoizations nest, 'service' needing 'public_key_resolver', which needs 'http_client'.
+  #
+  # Once memoized they are read without taking it: the assignment publishes an object that is fully
+  # built, and MRI reads an instance variable atomically. A 'configure' running while requests are
+  # already being served may then be picked up one request late, which is one more reason for it to
+  # belong in an initializer.
   MONITOR = Monitor.new
 
   def self.configure
-    MONITOR.synchronize { yield @configuration ||= KeycloakApiRails::Configuration.new }
+    MONITOR.synchronize do
+      yield @configuration ||= KeycloakApiRails::Configuration.new
+      discard_configured_objects
+    end
+  end
+
+  def self.discard_configured_objects
+    @http_client         = nil
+    @public_key_resolver = nil unless @public_key_resolver_assigned
+    @service             = nil
   end
+  private_class_method :discard_configured_objects
 
   def self.config
     @configuration
   end
 
   def self.http_client
-    MONITOR.synchronize { @http_client ||= KeycloakApiRails::HTTPClient.new(config, logger) }
+    @http_client || MONITOR.synchronize { @http_client ||= KeycloakApiRails::HTTPClient.new(config, logger) }
   end
 
   def self.public_key_resolver
-    MONITOR.synchronize { @public_key_resolver ||= PublicKeyCachedResolver.from_configuration(http_client, config) }
+    @public_key_resolver || MONITOR.synchronize { @public_key_resolver ||= PublicKeyCachedResolver.from_configuration(http_client, config) }
   end
 
   # Mainly used by "keycloak-api-rails/testing" to validate tokens without a Keycloak server.
@@ -44,13 +61,14 @@ module KeycloakApiRails
   # a reference to the resolver that is being replaced.
   def self.public_key_resolver=(resolver)
     MONITOR.synchronize do
-      @public_key_resolver = resolver
-      @service             = nil
+      @public_key_resolver          = resolver
+      @public_key_resolver_assigned = !resolver.nil?
+      @service                      = nil
     end
   end
 
   def self.service
-    MONITOR.synchronize { @service ||= KeycloakApiRails::Service.new(public_key_resolver) }
+    @service || MONITOR.synchronize { @service ||= KeycloakApiRails::Service.new(public_key_resolver) }
   end
 
   def self.logger
@@ -74,6 +92,7 @@ module KeycloakApiRails
       config.allow_token_in_query_string            = false
       config.http_open_timeout                      = 5
       config.http_read_timeout                      = 5
+      config.allowed_algorithms                     = KeycloakApiRails::Service::SUPPORTED_ALGORITHMS
     end
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: keycloak-api-rails
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.3
 platform: ruby
 authors:
 - Lorent Lempereur
@@ -37,6 +37,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.11.0
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -121,6 +149,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 11.1.3
+- !ruby/object:Gem::Dependency
+  name: bundler-audit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.9'
 description: Rack middleware that validates the Keycloak JWT access token carried
   by every request of a Ruby on Rails API. It verifies the token signature against
   the realm public keys, exposes the authenticated user, its roles and the custom