okta-jwt 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c36ef2a88c57081ef6bcc849ed38d9748a5ecde2e22ca97736f450279ae7c06d
-  data.tar.gz: 33d2250564526da5d3fa3afad60b64938445bd7af8b8114d63d4df2d03e02cbc
+  metadata.gz: 8c34b0de2f8f7061f57dfd025d6edf9451c1d072d0389df51a2661759df804f5
+  data.tar.gz: 6836b11074b80434ff5783cffba88df4a04a135a15baddddf471a20d82b6474c
 SHA512:
-  metadata.gz: 7076073b437641283faf8636a55e043852892ab63ca34687969ca8b09e27445978cdef92907dddbc469194fbdec8239eb45d9055e39bf543e6221e89634bc742
-  data.tar.gz: b7a62844e4ec132db22b68188896e38546336a2e89f51471f96657120b361d0c7eba6e71a00d9fcf71beec8d42d2fa8133bc540176ab7ddbcf1e4ee6dd80014b
+  metadata.gz: 8c15287638cec9e58442dab0145820a7fb81d342d0f3591879346ed2a8a56b1ecea44f84283b181bc32e2888dc508b2ed7e10706c2f032aca7278a356b5154d3
+  data.tar.gz: a03afb95109f37b38a1f4b5ec0fbb1b1b44e9b73d1eaca2bd2582d586bd652fdb17e6e932132e462f3c863a6b2114b3e5fd0901da980bad93b52aa57cdb82964

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    okta-jwt (0.3.0)
+    okta-jwt (0.4.0)
       faraday
       json-jwt
 

data/README.md

@@ -1,6 +1,6 @@
 # Okta::Jwt
 
-Verify Okta JWT tokens using cached JWKs.
+Verify Okta JWT access tokens using cached JWKs.
 
 ## Installation
 
@@ -25,28 +25,34 @@ Configure the client to sign in user (optional):
 ```ruby
 # client for resource owner password flow
 Okta::Jwt.configure_client!(
-	issuer_url:     'https://organization.oktapreview.com,
-	auth_server_id: 'auth_server_id,
-	client_id:      'client_id,
-	client_secret:  'client_secret,
-	slogger:         Logger.new(STDOUT) # optional
+  issuer: 'https://<org>.oktapreview.com/oauth2<auth_server_id>,
+  client_id: 'client_id,
+  client_secret: 'client_secret,
+  logger: Logger.new(STDOUT) # optional
 )
 ```
 
-Sign in user to get tokens (default scope is openid):
+Sign in user to get access token (default scope is openid):
 
 ```ruby
-auth_response = Okta::Jwt.sign_in(username: 'user@example.org', password: 'password', scope: 'openid my_scope')
+auth_response = Okta::Jwt.sign_in(
+  username: 'user@example.org',
+  password: 'password',
+  scope: 'openid my_scope'
+)
 parsed_auth_response = JSON.parse(auth_response.body)
+access_token = parsed_auth_response['id_token']
 ```
 
-Verify tokens:
+Verify access token:
 
 ```ruby
-verified_id_token = Okta::Jwt.verify_token(parsed_auth_response['id_token'])
-verified_access_token = Okta::Jwt.verify_token(parsed_auth_response['access_token'])
+verified_access_token = Okta::Jwt.verify_token(access_token,
+  issuer: 'https://<org>.oktapreview.com/oauth2<auth_server_id>,
+  audience: 'http://localhost:3000,
+  client_id: 'client_id'
+)
 ```
-NOTE: tokens are validated using data from header and payload: kid, iss and cid/aud. If you are just verifying the tokens there is no need to store anything at the client side. 
 
 ## Development
 

data/lib/okta/jwt.rb

@@ -8,22 +8,24 @@ module Okta
   module Jwt
     module_function
 
+    class InvalidToken < Exception; end 
+
     # keys are cached under their kid value
     JWKS_CACHE  = {}
   
     class << self
-      attr_accessor :issuer_url, :auth_server_id, :client_id, :client_secret, :public_key_ttl, :client, :logger
+      attr_accessor :issuer, :auth_server_id, :client_id, :client_secret, :public_key_ttl, :client, :logger
     end
   
     # configure the client for signing in
-    def configure_client!(issuer_url:, auth_server_id:, client_id:, client_secret:, logger: Logger.new(IO::NULL))
-      @issuer_url     = issuer_url
-      @auth_server_id = auth_server_id
+    def configure_client!(issuer:, client_id:, client_secret:, logger: Logger.new(IO::NULL))
+      @issuer         = issuer
       @client_id      = client_id
       @client_secret  = client_secret
       @logger         = logger
-  
-      @client = Faraday.new(url: issuer_url) do |f|
+      @auth_server_id = issuer.split('/').last
+
+      @client = Faraday.new(url: issuer) do |f|
         f.use Faraday::Adapter::NetHttp
         f.headers['Accept'] = 'application/json'
       end
@@ -40,14 +42,22 @@ module Okta
     end
   
     # validate the token
-    def verify_token(token)
-      jwk = JSON::JWK.new(get_jwk(token))
+    def verify_token(token, issuer:, audience:, client_id:)
+      header, payload = token.split('.').first(2).map{|encoded| JSON.parse(Base64.decode64(encoded))}
+
+      # validate claims
+      raise InvalidToken.new('Invalid issuer')    if payload['iss'] != issuer
+      raise InvalidToken.new('Invalid audience')  if payload['aud'] != audience
+      raise InvalidToken.new('Invalid client')    if payload['cid'] != client_id
+      raise InvalidToken.new('Token is expired')  if payload['exp'].to_i <= Time.now.to_i
+
+      # validate signature
+      jwk = JSON::JWK.new(get_jwk(header, payload))
       JSON::JWT.decode(token, jwk.to_key)
     end
   
     # extract public key from metadata's jwks_uri using kid
-    def get_jwk(token)
-      header, payload = token.split('.').first(2).map{|encoded| JSON.parse(Base64.decode64(encoded))}
+    def get_jwk(header, payload)
 
       kid = header['kid']
       return JWKS_CACHE[kid] if JWKS_CACHE[kid] # cache hit
@@ -67,7 +77,7 @@ module Okta
     # fetch client metadata using cid/aud
     def get_metadata(payload)
       auth_server_id  = payload['iss'].split('/').last    # iss: "https://<org>.oktapreview.com/oauth2/<auth_server_id>"
-      client_id       = payload['cid'] || payload['aud']  # id_token has client_id value under aud key
+      client_id       = payload['cid']
 
       client = Faraday.new(url: payload['iss']) do |f|
         f.use Faraday::Adapter::NetHttp

data/lib/okta/jwt/version.rb

@@ -1,5 +1,5 @@
 module Okta
   module Jwt
-    VERSION = "0.3.0"
+    VERSION = "0.4.0"
   end
 end

data/okta-jwt.gemspec

@@ -9,8 +9,8 @@ Gem::Specification.new do |spec|
   spec.authors       = ["Damir Roso"]
   spec.email         = ["damir.roso@nih.gov"]
 
-  spec.summary       = "Okta JWT verifier"
-  spec.description   = "Okta JWT verifier"
+  spec.summary       = "Verify Okta JWT access tokens using cached JWKs"
+  spec.description   = "Verify Okta JWT access tokens using cached JWKs"
   spec.homepage      = "https://github.com/damir/okta-jwt"
   spec.license       = "MIT"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: okta-jwt
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Damir Roso
@@ -80,7 +80,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Okta JWT verifier
+description: Verify Okta JWT access tokens using cached JWKs
 email:
 - damir.roso@nih.gov
 executables: []
@@ -124,5 +124,5 @@ rubyforge_project:
 rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
-summary: Okta JWT verifier
+summary: Verify Okta JWT access tokens using cached JWKs
 test_files: []