oauth_im 0.7.4 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85fc483377f0cf348af3a8399c70fec84395915203cb6bfa203f7d147eedb7d6
-  data.tar.gz: 40f90809e1e7405640098732aa41ac1ab96771230d9721d22f41ebfed3b19e74
+  metadata.gz: be1d2aa7d9e5c1ac97a5e5aabd89671a48bfc2afc17c53276f961be0a29d357e
+  data.tar.gz: 64f150ae67c0b67efd6a8db20c1390bb69ca21f29837446ad07264947e8e863d
 SHA512:
-  metadata.gz: ec6f87a823e4ea3c8bd51bfc6ef09d65908840282c9228d88b78e98f686933c8eaaf2b0d844e0b2967bbed54e271f9f4c5c3b27cd7d4824b52539007018bbf29
-  data.tar.gz: dfbb145b3cf8658853b41f7d86e62024f957a21a5f6a99b69a9f682e49ad839734ab629c4a5d9ced89a53265726de029724645710dee9efa42760a0650bf2dd8
+  metadata.gz: 11624bb0650c05d8a5f63edee7b8918f6e043f6a4b6d15b25cd593da5940af18ab320a5d4587479ab96c836ef60b99b4e45f49fabfe3a08e23870dd1d1489499
+  data.tar.gz: 4018866ef76985ec65ccb37ab95e7e973caf0e8f07086a25ad3f55b2eb17659d130e75421466f60f8d526aa8929239c935d87fb905d7358edfceae6c81540ff5

data/README.md

@@ -40,16 +40,23 @@ module OauthIm
     ################################################
     config.iss_domain     = ENV.fetch 'FUSION_AUTH_ISS_DOMAIN',    DEFAULT_ISS_DOMAIN
 
-    ###############################
-    # on FA application OAuth tab #
-    ###############################
+    ####################################
+    # find on FA application OAuth tab #
+    ####################################
     config.client_id      = ENV['FUSION_AUTH_CLIENT_ID']
     config.client_secret  = ENV['FUSION_AUTH_CLIENT_SECRET']
 
-    ###################################################################################
-    # View default signing key: https://illustrativemath-dev.fusionauth.io/admin/key/ #
-    ###################################################################################
+    #################################################################################
+    # 1. Find signing key name on the app details name.                             #
+    # 2. Look up the key (by name) under Key Master tab under Settings:             #
+    #    https://illustrativemath-dev.fusionauth.io/admin/key/                      #
+    # 3. The key should be either HMAC or RSA.                                      #
+    #   - If HMAC, view the Secret under Details. You will need to click to reveal. #
+    #   - If RSA, copy the PEM encoded public key as-is.                            #
+    # Note: You don't need both keys --- TokenDecoder will use the one available.   #
+    #################################################################################
     config.hmac           = ENV['FUSION_AUTH_HMAC']
+    config.rsa_public     = ENV['FUSION_AUTH_RSA_PUBLIC]
   end
 end
 ```
@@ -142,6 +149,9 @@ After many false starts, this repo includes two (seemingly functional) github wo
   you.
 
 ## Version History
+### 0.8.0
+* Allow RSA signing keys in addition to HMAC.
+  This is because Terraform creates RSA keys during runs.
 ### 0.7.4
 * Use https protocol for callback in production; http otherwise
 

data/app/controllers/oauth_im/client_controller.rb

@@ -7,8 +7,6 @@ module OauthIm
     def callback
       session[:user_jwt] = user_jwt
       redirect_to main_app.root_path
-    rescue StandardError
-      head :forbidden
     end
 
     def login

data/app/services/oauth_im/token_decoder.rb

@@ -20,14 +20,30 @@ module OauthIm
     private
 
     delegate :configuration, to: OauthIm
-    delegate :hmac, :iss_domain, to: :configuration
+    delegate :hmac, :rsa_public, :iss_domain, to: :configuration
 
     def decoded_token
-      @decoded_token ||= JWT.decode token, hmac, true, decode_params
+      @decoded_token ||= JWT.decode token, key, verify?, decode_params
     end
 
-    def decode_algorithm
-      DEFAULT_DECODE_ALGORITHM
+    def decode_using_hmac?
+      hmac.present?
+    end
+
+    def key
+      @key ||= decode_using_hmac? ? hmac : rsa_public_key
+    end
+
+    def rsa_public_key
+      @rsa_public_key ||= OpenSSL::PKey::RSA.new rsa_public
+    end
+
+    def algorithm
+      @algorithm ||= decode_using_hmac? ? 'HS256' : 'RS256'
+    end
+
+    def verify?
+      true
     end
 
     def verify_iss?
@@ -43,7 +59,7 @@ module OauthIm
                            iss: iss_domain,
                            verify_aud: verify_aud?,
                            aud: aud,
-                           algorithm: decode_algorithm }.freeze
+                           algorithm: algorithm }.freeze
     end
   end
 end

data/lib/oauth_im/configuration.rb

@@ -15,6 +15,7 @@ module OauthIm
       client_id
       client_secret
       hmac
+      rsa_public
     ].freeze
 
   class Configuration

data/lib/oauth_im/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OauthIm
-  VERSION = '0.7.4'
+  VERSION = '0.8.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oauth_im
 version: !ruby/object:Gem::Version
-  version: 0.7.4
+  version: 0.8.0
 platform: ruby
 authors:
 - Eric Connally
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-24 00:00:00.000000000 Z
+date: 2022-05-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt