lex-identity-entra 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7076abeb6fcf3e837854a909a38bbe46ab78ff6dd8372fb0df53d507484170e
-  data.tar.gz: 6d9347e6aedc921ee6c16fc8a2004d0eb986e15eb8faf150a3a26787363e0d04
+  metadata.gz: d2664847cdf119f5e114612d95e09b67f81d6964f466960a56cd246f01cbfa4d
+  data.tar.gz: 62c37fb1dabee26a49dfa806f995b6b5b8d144a8dd2e1559bb304947886ebfa4
 SHA512:
-  metadata.gz: 6245ce699161036398ccfb11d141587f0188ebabe38944862fe693fcf7f6210c935cf4a493119de46d1b0b42691aa69a5f6459c2f0e11dc2d39b81bde8dad706
-  data.tar.gz: 0b2a7fae7d074dc4fe580f7289c79105ca6761227b6bbbd7045844d4e75b0fb0be90a4c46f92af04fd2ff4a112fa86a3dd12440f1cb6b805d2174cd52b809999
+  metadata.gz: 33c9ee548f2fd6a709a3b8a48411f74fcd47f69cc41a566993f9cb6077461041cb0b3a6dcc7e22054d238dae66c9b7968aec0272a999bd979a67f2221187a27c
+  data.tar.gz: b05f2770649c3321adfebf21c7bc352e75fce1872768fe8425fa65a08385bba5b07b96a027d1d21632e129f2157d11fa1a3b3ec7db3fe726be08edc093c6a430

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.7.0] - 2026-10-31
+### Security
+- Qualify delegated identity keys by verified Graph token tenant and object ID (`tenant:oid`), including multi-account discovery. A successful `/me` response must match the accepted token's object ID; opaque or mismatched token subjects cannot resolve an authenticated shared identity.
+- Preserve human canonical names without treating them as cross-tenant account-linking evidence. Existing unscoped object-ID links require explicit tenant verification before migration; they are not automatically merged by name.
+
 ## [0.6.1] - 2026-10-19
 ### Fixed
 - **Browser tab storm**: `Delegated::Actor::TokenRefresher` opened a new login tab on every 15-minute tick once the refresh token went bad (about 50 tabs overnight). It now respects `browser_auth.auto_authenticate`, and every interactive attempt goes through the new `Helpers::InteractiveAuthGuard`, which provides:

data/README.md

@@ -133,11 +133,24 @@ identity:
   canonical_name:    "jdoe",       # normalized from onPremisesSamAccountName or mailNickname
   kind:              :human,
   source:            :entra_delegated,
-  provider_identity: "object-id-guid",
-  profile:           { ... }           # full Graph /me response
+  provider_identity: "tenant-id-guid:object-id-guid",
+  tenant_id:         "tenant-id-guid",
+  object_id:         "object-id-guid",
+  profile:           { ... }           # normalized Graph /me profile and verified subject context
 }
 ```
 
+The tenant/object key is derived only after Graph accepts the exact bearer token and
+the token's `oid` matches `/me.id`. Opaque tokens still allow profile retrieval but
+cannot establish a shared authenticated identity without verifiable tenant context.
+Canonical names and display names are not account-linking evidence. LegionIO 1.9.53+
+reuses a discovered Teams principal through this immutable key without granting
+access to the discovering reader's stored Teams content.
+
+Existing object-ID-only identity rows are not automatically adopted: their tenant
+must be established explicitly before linking them to the new scoped key. No tokens
+or source profiles are copied into the shared identity registry by Teams discovery.
+
 ## Development
 
 ```bash

data/lex-identity-entra.gemspec

@@ -28,6 +28,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   # Core framework dependencies
+  spec.add_dependency 'base64',          '>= 0.2'
   spec.add_dependency 'concurrent-ruby', '>= 1.2'
   spec.add_dependency 'faraday',         '>= 2.0'
   spec.add_dependency 'legion-crypt',    '>= 1.5.13'

data/lib/legion/extensions/identity/entra/delegated/identity.rb

@@ -31,6 +31,11 @@ module Legion
                 return nil
               end
 
+              unless profile[:provider_identity_key]
+                log.warn('Delegated::Identity.resolve: no verified tenant/object subject in profile')
+                return nil
+              end
+
               canonical = profile[:on_premises_sam_account_name] || profile[:mail_nickname]
               if canonical.nil? || canonical.empty?
                 log.warn('Delegated::Identity.resolve: no canonical name in profile')
@@ -42,7 +47,9 @@ module Legion
                 canonical_name:    normalize(canonical),
                 kind:              :human,
                 source:            :entra_delegated,
-                provider_identity: profile[:id],
+                provider_identity: profile[:provider_identity_key],
+                tenant_id:         profile[:tenant_id],
+                object_id:         profile[:object_id],
                 profile:           profile,
                 employee_id:       profile[:employee_id]
               }

data/lib/legion/extensions/identity/entra/helpers/account_discovery.rb

@@ -43,7 +43,7 @@ module Legion
                 next unless token
 
                 profile = Legion::Extensions::Identity::Entra::Helpers::GraphClient.fetch_me(token)
-                next unless profile
+                next unless profile && profile[:provider_identity_key]
 
                 canonical = profile[:on_premises_sam_account_name] || profile[:mail_nickname]
                 next if canonical.nil? || canonical.empty?
@@ -54,7 +54,9 @@ module Legion
                   source:            :entra,
                   qualifier:         qualifier,
                   account_type:      account_type_for(qualifier, canonical),
-                  provider_identity: profile[:id],
+                  provider_identity: profile[:provider_identity_key],
+                  tenant_id:         profile[:tenant_id],
+                  object_id:         profile[:object_id],
                   profile:           profile,
                   employee_id:       profile[:employee_id]
                 }

data/lib/legion/extensions/identity/entra/helpers/graph_client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'faraday'
+require 'base64'
 
 module Legion
   module Extensions
@@ -26,7 +27,8 @@ module Legion
               end
 
               log.debug('GraphClient.fetch_me: profile fetched successfully')
-              parse_profile(json_load(response.body))
+              profile = parse_profile(json_load(response.body))
+              profile.merge(authenticated_subject(access_token: access_token, object_id: profile[:id]))
             rescue StandardError => e
               handle_exception(e, level: :warn, operation: 'graph_client.fetch_me')
               nil
@@ -55,6 +57,29 @@ module Legion
                 f.options.timeout = 10
               end
             end
+
+            private
+
+            # Graph has accepted this exact bearer token. Only then may its tenant/object
+            # claims qualify the /me subject; configured tenants and names are not evidence.
+            def authenticated_subject(access_token:, object_id:)
+              parts = access_token.to_s.split('.')
+              return {} unless parts.length == 3
+
+              claims = json_load(Base64.urlsafe_decode64(parts[1]))
+              tenant = claims[:tid].to_s.downcase
+              oid = claims[:oid].to_s.downcase
+              guid = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/
+              unless guid.match?(tenant) && guid.match?(oid) && oid == object_id.to_s.downcase
+                log.warn('Graph /me subject does not have matching tenant/object token claims')
+                return {}
+              end
+
+              { tenant_id: tenant, object_id: oid, provider_identity_key: "#{tenant}:#{oid}" }
+            rescue StandardError => e
+              log.warn("Graph /me subject context unavailable: #{e.class}")
+              {}
+            end
           end
         end
       end

data/lib/legion/extensions/identity/entra/helpers/interactive_auth_guard.rb

@@ -106,7 +106,7 @@ module Legion
               out, status = Open3.capture2('/usr/sbin/ioreg', '-n', 'Root', '-d1')
               status.success? && out.include?('"CGSSessionScreenIsLocked"=Yes')
             rescue StandardError => e
-              handle_exception(e, level: :debug, operation: 'entra.auth_guard.screen_locked?')
+              handle_exception(e, level: :warn, operation: 'entra.auth_guard.screen_locked?')
               false
             end
 
@@ -120,7 +120,7 @@ module Legion
               match = out.match(/"HIDIdleTime"\s*=\s*(\d+)/)
               match ? match[1].to_i / 1_000_000_000 : nil
             rescue StandardError => e
-              handle_exception(e, level: :debug, operation: 'entra.auth_guard.idle_seconds')
+              handle_exception(e, level: :warn, operation: 'entra.auth_guard.idle_seconds')
               nil
             end
 
@@ -316,7 +316,7 @@ module Legion
             def setting(key)
               Legion::Settings.dig(:identity, :entra, :delegated, :browser_auth, key)
             rescue StandardError => e
-              handle_exception(e, level: :debug, operation: 'entra.auth_guard.setting', key: key)
+              handle_exception(e, level: :warn, operation: 'entra.auth_guard.setting', key: key)
               nil
             end
 

data/lib/legion/extensions/identity/entra/version.rb

@@ -4,7 +4,7 @@ module Legion
   module Extensions
     module Identity
       module Entra
-        VERSION = '0.6.1'
+        VERSION = '0.7.0'
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-identity-entra
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.7.0
 platform: ruby
 authors:
 - Esity
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
   requirement: !ruby/object:Gem::Requirement