okta-jwt 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c34b0de2f8f7061f57dfd025d6edf9451c1d072d0389df51a2661759df804f5
-  data.tar.gz: 6836b11074b80434ff5783cffba88df4a04a135a15baddddf471a20d82b6474c
+  metadata.gz: c95b336fb7297f4ebb61661e9be2f297120140df657acb290b04b7568313bb33
+  data.tar.gz: 8d9397202b711994674e159f7b8e4c95cddefe06e47aacbd72feffd8d9782bdf
 SHA512:
-  metadata.gz: 8c15287638cec9e58442dab0145820a7fb81d342d0f3591879346ed2a8a56b1ecea44f84283b181bc32e2888dc508b2ed7e10706c2f032aca7278a356b5154d3
-  data.tar.gz: a03afb95109f37b38a1f4b5ec0fbb1b1b44e9b73d1eaca2bd2582d586bd652fdb17e6e932132e462f3c863a6b2114b3e5fd0901da980bad93b52aa57cdb82964
+  metadata.gz: e86570f91963ca59a3e140069e4e7eb50885d31935d633651935593303deccb230abc7d1707b115ab4236b90603d6adaa312c1e15837a21f7edfe2276492de9b
+  data.tar.gz: 2be63b2da3ec1632fb2337417c51f6d2a8531fda8e016be897ba2ed4557c13d9bd21c8accca341fed0c440d61bd5bd254ccab60fcfdae2e25ca25e57fe43bbb3

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    okta-jwt (0.4.0)
+    okta-jwt (0.5.0)
       faraday
       json-jwt
 
@@ -19,7 +19,7 @@ GEM
     diff-lcs (1.3)
     faraday (0.15.4)
       multipart-post (>= 1.2, < 3)
-    i18n (1.1.1)
+    i18n (1.2.0)
       concurrent-ruby (~> 1.0)
     json-jwt (1.9.4)
       activesupport

data/README.md

@@ -25,11 +25,9 @@ Configure the client to sign in user (optional):
 ```ruby
 # client for resource owner password flow
 Okta::Jwt.configure_client!(
-  issuer: 'https://<org>.oktapreview.com/oauth2<auth_server_id>,
-  client_id: 'client_id,
-  client_secret: 'client_secret,
-  logger: Logger.new(STDOUT) # optional
-)
+  issuer: 'https://<org>.oktapreview.com/oauth2<auth_server_id>',
+  client_id: 'client_id',
+  client_secret: 'client_secret')
 ```
 
 Sign in user to get access token (default scope is openid):
@@ -41,18 +39,20 @@ auth_response = Okta::Jwt.sign_in(
   scope: 'openid my_scope'
 )
 parsed_auth_response = JSON.parse(auth_response.body)
-access_token = parsed_auth_response['id_token']
+access_token = parsed_auth_response['access_token']
 ```
 
-Verify access token:
+Verify access token (signature + claims):
 
 ```ruby
+Okta::Jwt.logger = Logger.new(STDOUT) # set optional logger
 verified_access_token = Okta::Jwt.verify_token(access_token,
-  issuer: 'https://<org>.oktapreview.com/oauth2<auth_server_id>,
-  audience: 'http://localhost:3000,
+  issuer: 'https://<org>.oktapreview.com/oauth2<auth_server_id>',
+  audience: 'development',
   client_id: 'client_id'
 )
 ```
+NOTE: You can pass multiple client ids as an array if needed.
 
 ## Development
 

data/lib/okta/jwt.rb

@@ -14,26 +14,20 @@ module Okta
     JWKS_CACHE  = {}
   
     class << self
-      attr_accessor :issuer, :auth_server_id, :client_id, :client_secret, :public_key_ttl, :client, :logger
+      attr_accessor :issuer, :auth_server_id, :client_id, :client_secret, :logger
     end
   
     # configure the client for signing in
-    def configure_client!(issuer:, client_id:, client_secret:, logger: Logger.new(IO::NULL))
+    def configure_client!(issuer:, client_id:, client_secret:)
       @issuer         = issuer
       @client_id      = client_id
       @client_secret  = client_secret
-      @logger         = logger
       @auth_server_id = issuer.split('/').last
-
-      @client = Faraday.new(url: issuer) do |f|
-        f.use Faraday::Adapter::NetHttp
-        f.headers['Accept'] = 'application/json'
-      end
     end
   
     # sign in user to get tokens
     def sign_in(username:, password:, scope: 'openid')
-      client.post do |req|
+      client(issuer).post do |req|
         req.url "/oauth2/#{auth_server_id}/v1/token"
         req.headers['Content-Type']   = 'application/x-www-form-urlencoded'
         req.headers['Authorization']  = 'Basic: ' + Base64.strict_encode64("#{client_id}:#{client_secret}")
@@ -48,7 +42,7 @@ module Okta
       # validate claims
       raise InvalidToken.new('Invalid issuer')    if payload['iss'] != issuer
       raise InvalidToken.new('Invalid audience')  if payload['aud'] != audience
-      raise InvalidToken.new('Invalid client')    if payload['cid'] != client_id
+      raise InvalidToken.new('Invalid client')    if !Array(client_id).include?(payload['cid'])
       raise InvalidToken.new('Token is expired')  if payload['exp'].to_i <= Time.now.to_i
 
       # validate signature
@@ -58,12 +52,14 @@ module Okta
   
     # extract public key from metadata's jwks_uri using kid
     def get_jwk(header, payload)
-
       kid = header['kid']
-      return JWKS_CACHE[kid] if JWKS_CACHE[kid] # cache hit
+
+      # cache hit
+      return JWKS_CACHE[kid] if JWKS_CACHE[kid]
   
-      logger.info("[Okta::Jwt] Fetching public key: kid => #{kid} ...")
-      jwks_response = client.get do |req|
+      # fetch jwk
+      logger.info("[Okta::Jwt] Fetching public key: kid => #{kid} ...") if logger
+      jwks_response = client(payload['iss']).get do |req|
         req.url get_metadata(payload)['jwks_uri']
       end
       jwk = JSON.parse(jwks_response.body)['keys'].find do |key|
@@ -76,18 +72,20 @@ module Okta
   
     # fetch client metadata using cid/aud
     def get_metadata(payload)
-      auth_server_id  = payload['iss'].split('/').last    # iss: "https://<org>.oktapreview.com/oauth2/<auth_server_id>"
-      client_id       = payload['cid']
+      auth_server_id    = payload['iss'].split('/').last # iss: "https://<org>.oktapreview.com/oauth2/<auth_server_id>"
+      client_id         = payload['cid']
+      metadata_response = client(payload['iss']).get do |req|
+        req.url "/oauth2/#{auth_server_id}/.well-known/oauth-authorization-server?client_id=#{client_id}"
+      end
+      JSON.parse(metadata_response.body)
+    end
 
-      client = Faraday.new(url: payload['iss']) do |f|
+    # init client
+    def client(issuer)
+      Faraday.new(url: issuer) do |f|
         f.use Faraday::Adapter::NetHttp
         f.headers['Accept'] = 'application/json'
       end
-
-      metadata_response = client.get do |req|
-        req.url "/oauth2/#{auth_server_id}/.well-known/oauth-authorization-server?client_id=#{client_id}"
-      end
-      JSON.parse(metadata_response.body)
     end
   end
 end

data/lib/okta/jwt/version.rb

@@ -1,5 +1,5 @@
 module Okta
   module Jwt
-    VERSION = "0.4.0"
+    VERSION = "0.5.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: okta-jwt
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Damir Roso
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-12-10 00:00:00.000000000 Z
+date: 2018-12-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler