omniauth-activedirectory 1.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 9e5054c1ce0e8771f7955b5cab69b08b4ecb1287c6add06c6c3557b557df161b
+  data.tar.gz: b46b578255169b89254233a5351092d767c7a18e2d923d831f3f9d0c146c45ca
+SHA512:
+  metadata.gz: c3c9954a04ee129aa7f5f4a7cb6a32cc487b75e44bd50abde7e3864a56fe9cba9479b3aca3708505f7a73711e23c7392cd7b87ef02bffbd588f92afbe0b53ca0
+  data.tar.gz: 3b40be7f0410ff9f79a303aa2614e12314973d5efe2fb90ce116905b1d03a3003b6eddb0cb8a24670cf579e3d9f6823919c577de8a4cb6c4991d0397d3ec098e

data/.gitignore

@@ -0,0 +1,9 @@
+*.gem
+*.log
+.bundle
+coverage
+.powenv
+.rspec
+Gemfile.lock
+pkg/*
+tmp

data/.rubocop.yml

@@ -0,0 +1,8 @@
+inherit_from: .rubocop_todo.yml
+
+AllCops:
+  Exclude:
+    - 'spec/fixtures/**/*'
+
+Style/Encoding:
+  Enabled: false

data/.rubocop_todo.yml

@@ -0,0 +1,20 @@
+# This configuration was generated by `rubocop --auto-gen-config`
+# on 2015-08-06 14:09:24 -0700 using RuboCop version 0.32.1.
+# The point is for the user to remove these configuration records
+# one by one as the offenses are removed from the code base.
+# Note that changes in the inspected code, or installation of new
+# versions of RuboCop, may require this file to be generated again.
+
+# Offense count: 2
+Metrics/AbcSize:
+  Max: 19
+
+# Offense count: 1
+# Configuration parameters: CountComments.
+Metrics/ClassLength:
+  Max: 118
+
+# Offense count: 1
+# Configuration parameters: Exclude.
+Style/FileName:
+  Enabled: false

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gemspec

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2021 Dave Van Fleet
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,94 @@
+# OmniAuth Azure Active Directory
+
+This is a fork of Microsoft's official ruby gem for Azure Active Directory as an omniauth provider.  Most of this README is taken from Microsoft's original gem, [found here](https://github.com/AzureAD/omniauth-azure-activedirectory), with additions to make it compatible with other providers.
+
+OmniAuth strategy to authenticate to Azure Active Directory via OpenId Connect.
+
+Before starting, set up a tenant and register a Web Application at [https://manage.windowsazure.com](https://manage.windowsazure.com). Note your client id and tenant for later.
+
+# Why this Gem?
+
+While Microsoft's original gem still works, when Azure AD is being used as the only provider for omniauth, it hasn't been updated in a significant amount of time.  When trying to implement this gem in my own projects, I faced the issue of having many runtime dependency conflicts, meaning I either needed to use older versions of other provider gems (not always possible), or update this gem for myself.  This repo is the result of deciding on the latter.
+
+## Samples and Documentation
+
+[Find Microsoft's examples here](https://github.com/AzureADSamples) to help you get started with learning the Azure Identity system. This includes tutorials for native clients such as Windows, Windows Phone, iOS, OSX, Android, and Linux. There you can also find full walkthroughs for authentication flows such as OAuth2, OpenID Connect, Graph API, and other features provided by Microsoft. 
+
+## How to use this SDK
+
+#### Installation
+
+Add to your Gemfile:
+
+```ruby
+gem 'omniauth-activedirectory'
+```
+
+### Usage
+
+If you are already using OmniAuth, adding AzureAD is as simple as adding a new provider to your `OmniAuth::Builder`. The provider requires your AzureAD client id and your AzureAD tenant.
+
+For example, in Rails you would add this in `config/initializers/omniauth.rb`:
+
+```ruby
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :activedirectory, ENV['AAD_CLIENT_ID'], ENV['AAD_TENANT']
+  # other providers here
+end
+```
+
+When you want to authenticate the user, simply redirect them to `/auth/activedirectory`. From there, OmniAuth will takeover. Once the user authenticates (or fails to authenticate), they will be redirected to `/auth/activedirectory/callback`. The authentication result is available in `request.env['omniauth.auth']`.
+
+#### CSRF Concerns
+
+Rails' built-in CSRF protection can cause some hassles with omniauth, since a `POST` request is being made to your application by the provider, without an anti forgery token from you application.  We need to tells Rails not to perform this check on the specific action being used for authentication with omniauth.  Typically, your callback will be routed to the `#create` action in the `Sessions` controller.  If this is the case for your app, app the following line in the beggining of the sessions controller:  
+```ruby
+skip_before_action :verify_authenticity_token, only: :create
+```  
+Make sure that nothing sensitive is happening in this action that could expose your app to CSRF attacks.  It should pretty much just get the data in the `POST` request and use it to create a new session.
+
+
+### Auth Hash
+
+OmniAuth AzureAD tries to be consistent with the auth hash schema recommended by OmniAuth. [https://github.com/intridea/omniauth/wiki/Auth-Hash-Schema](https://github.com/intridea/omniauth/wiki/Auth-Hash-Schema).
+
+Here's an example of an authentication hash available in the callback. You can access this hash as `request.env['omniauth.auth']`.
+
+```
+  :provider => "azureactivedirectory",
+  :uid => "123456abcdef",
+  :info => {
+    :name => "John Smith",
+    :email => "jsmith@contoso.net",
+    :first_name => "John",
+    :last_name => "Smith"
+  },
+  :credentials => {
+    :code => "ffdsjap9fdjw893-rt2wj8r9r32jnkdsflaofdsa9"
+  },
+  :extra => {
+    :session_state => '532fgdsgtfera32',
+    :raw_info => {
+      :id_token => "fjeri9wqrfe98r23.fdsaf121435rt.f42qfdsaf",
+      :id_token_claims => {
+        "aud" => "fdsafdsa-fdsafd-fdsa-sfdasfds",
+        "iss" => "https://sts.windows.net/fdsafdsa-fdsafdsa/",
+        "iat" => 53315113,
+        "nbf" => 53143215,
+        "exp" => 53425123,
+        "ver" => "1.0",
+        "tid" => "5ffdsa2f-dsafds-sda-sds",
+        "oid" => "fdsafdsaafdsa",
+        "upn" => "jsmith@contoso.com",
+        "sub" => "123456abcdef",
+        "nonce" => "fdsaf342rfdsafdsafsads"
+      },
+      :id_token_header => {
+        "typ" => "JWT",
+        "alg" => "RS256",
+        "x5t" => "fdsafdsafdsafdsa4t4er32",
+        "kid" => "tjiofpjd8ap9fgdsa44"
+      }
+    }
+  }
+```

data/Rakefile

@@ -0,0 +1,22 @@
+#!/usr/bin/env rake
+
+require 'rake'
+require 'rspec/core/rake_task'
+require 'rubocop/rake_task'
+
+# This can be run with `bundle exec rake spec`.
+RSpec::Core::RakeTask.new(:spec) do |t|
+  t.pattern = `git ls-files`.split("\n").select { |f| f.end_with? 'spec.rb' }
+  t.rspec_opts = '--format documentation'
+end
+
+# This can be run with `bundle exec rake rubocop`.
+RuboCop::RakeTask.new(:rubocop) do |t|
+  t.patterns = `git ls-files`.split("\n").select do |f|
+    f.end_with?('.rb') && !f.start_with?('examples')
+
+  end
+  t.fail_on_error = false
+end
+
+task default: :spec

data/lib/omniauth/activedirectory/version.rb

@@ -0,0 +1,6 @@
+module OmniAuth
+  # The release version.
+  module ActiveDirectory
+    VERSION = '1.0.1'
+  end
+end

data/lib/omniauth/activedirectory.rb

@@ -0,0 +1,2 @@
+require 'omniauth/activedirectory/version'
+require 'omniauth/strategies/activedirectory'

data/lib/omniauth/strategies/activedirectory.rb

@@ -0,0 +1,307 @@
+require 'jwt'
+require 'omniauth'
+require 'openssl'
+require 'securerandom'
+
+module OmniAuth
+  module Strategies
+    # A strategy for authentication against Azure Active Directory.
+    class ActiveDirectory
+      include OmniAuth::ActiveDirectory
+      include OmniAuth::Strategy
+
+      class OAuthError < StandardError; end
+
+      ##
+      # The client id (key) and tenant must be configured when the OmniAuth
+      # middleware is installed. Example:
+      #
+      #    require 'omniauth'
+      #    require 'omniauth-activedirectory'
+      #
+      #    use OmniAuth::Builder do
+      #      provider :activedirectory, ENV['AAD_KEY'], ENV['AAD_TENANT']
+      #    end
+      #
+      args [:client_id, :tenant]
+      option :client_id, nil
+      option :tenant, nil
+
+      # Field renaming is an attempt to fit the OmniAuth recommended schema as
+      # best as possible.
+      #
+      # @see https://github.com/intridea/omniauth/wiki/Auth-Hash-Schema
+      uid { @claims['sub'] }
+      info do
+        { name: @claims['name'],
+          email: @claims['email'] || @claims['upn'],
+          first_name: @claims['given_name'],
+          last_name: @claims['family_name'] }
+      end
+      credentials { { code: @code } }
+      extra do
+        { session_state: @session_state,
+          raw_info:
+            { id_token: @id_token,
+              id_token_claims: @claims,
+              id_token_header: @header } }
+      end
+
+      DEFAULT_RESPONSE_TYPE = 'code id_token'
+      DEFAULT_RESPONSE_MODE = 'form_post'
+
+      ##
+      # Overridden method from OmniAuth::Strategy. This is the first step in the
+      # authentication process.
+      def request_phase
+        redirect authorize_endpoint_url
+      end
+
+      ##
+      # Overridden method from OmniAuth::Strategy. This is the second step in
+      # the authentication process. It is called after the user enters
+      # credentials at the authorization endpoint.
+      def callback_phase
+        error = request.params['error_reason'] || request.params['error']
+        fail(OAuthError, error) if error
+        @session_state = request.params['session_state']
+        @id_token = request.params['id_token']
+        @code = request.params['code']
+        @claims, @header = validate_and_parse_id_token(@id_token)
+        # validate_chash(@code, @claims, @header)
+        super
+      end
+
+      private
+
+      ##
+      # Constructs a one-time-use authorize_endpoint. This method will use
+      # a new nonce on each invocation.
+      #
+      # @return String
+      def authorize_endpoint_url
+        uri = URI(openid_config['authorization_endpoint'])
+        uri.query = URI.encode_www_form(client_id: client_id,
+                                        redirect_uri: callback_url,
+                                        response_mode: response_mode,
+                                        response_type: response_type,
+                                        nonce: new_nonce)
+        uri.to_s
+      end
+
+      ##
+      # The client id of the calling application. This must be configured where
+      # AD is installed as an OmniAuth strategy.
+      #
+      # @return String
+      def client_id
+        return options.client_id if options.client_id
+        fail StandardError, 'No client_id specified in AzureAD configuration.'
+      end
+
+      ##
+      # The expected id token issuer taken from the discovery endpoint.
+      #
+      # @return String
+      def issuer
+        openid_config['issuer']
+      end
+
+      ##
+      # Fetches the current signing keys for Azure AD. Note that there should
+      # always two available, and that they have a 6 week rollover.
+      #
+      # Each key is a hash with the following fields:
+      #   kty, use, kid, x5t, n, e, x5c
+      #
+      # @return Array[Hash]
+      def fetch_signing_keys
+        response = JSON.parse(Net::HTTP.get(URI(signing_keys_url)))
+        response['keys']
+      rescue JSON::ParserError
+        raise StandardError, 'Unable to fetch AzureAD signing keys.'
+      end
+
+      ##
+      # Fetches the OpenId Connect configuration for the AzureAD tenant. This
+      # contains several import values, including:
+      #
+      #   authorization_endpoint
+      #   token_endpoint
+      #   token_endpoint_auth_methods_supported
+      #   jwks_uri
+      #   response_types_supported
+      #   response_modes_supported
+      #   subject_types_supported
+      #   id_token_signing_alg_values_supported
+      #   scopes_supported
+      #   issuer
+      #   claims_supported
+      #   microsoft_multi_refresh_token
+      #   check_session_iframe
+      #   end_session_endpoint
+      #   userinfo_endpoint
+      #
+      # @return Hash
+      def fetch_openid_config
+        JSON.parse(Net::HTTP.get(URI(openid_config_url)))
+      rescue JSON::ParserError
+        raise StandardError, 'Unable to fetch OpenId configuration for ' \
+                             'AzureAD tenant.'
+      end
+
+      ##
+      # Generates a new nonce for one time use. Stores it in the session so
+      # multiple users don't share nonces. All nonces should be generated by
+      # this method.
+      #
+      # @return String
+      def new_nonce
+        session['omniauth-azure-activedirectory.nonce'] = SecureRandom.uuid
+      end
+
+      ##
+      # A memoized version of #fetch_openid_config.
+      #
+      # @return Hash
+      def openid_config
+        @openid_config ||= fetch_openid_config
+      end
+
+      ##
+      # The location of the OpenID configuration for the tenant.
+      #
+      # @return String
+      def openid_config_url
+        "https://login.windows.net/#{tenant}/.well-known/openid-configuration"
+      end
+
+      ##
+      # Returns the most recent nonce for the session and deletes it from the
+      # session.
+      #
+      # @return String
+      def read_nonce
+        session.delete('omniauth-azure-activedirectory.nonce')
+      end
+
+      ##
+      # The response_type that will be set in the authorization request query
+      # parameters. Can be overridden by the client, but it shouldn't need to
+      # be.
+      #
+      # @return String
+      def response_type
+        options[:response_type] || DEFAULT_RESPONSE_TYPE
+      end
+
+      ##
+      # The response_mode that will be set in the authorization request query
+      # parameters. Can be overridden by the client, but it shouldn't need to
+      # be.
+      #
+      # @return String
+      def response_mode
+        options[:response_mode] || DEFAULT_RESPONSE_MODE
+      end
+
+      ##
+      # The keys used to sign the id token JWTs. This is just a memoized version
+      # of #fetch_signing_keys.
+      #
+      # @return Array[Hash]
+      def signing_keys
+        @signing_keys ||= fetch_signing_keys
+      end
+
+      ##
+      # The location of the public keys of the token signer. This is parsed from
+      # the OpenId config response.
+      #
+      # @return String
+      def signing_keys_url
+        return openid_config['jwks_uri'] if openid_config.include? 'jwks_uri'
+        fail StandardError, 'No jwks_uri in OpenId config response.'
+      end
+
+      ##
+      # The tenant of the calling application. Note that this must be
+      # explicitly configured when installing the AzureAD OmniAuth strategy.
+      #
+      # @return String
+      def tenant
+        return options.tenant if options.tenant
+        fail StandardError, 'No tenant specified in AzureAD configuration.'
+      end
+
+      ##
+      # Verifies the signature of the id token as well as the exp, nbf, iat,
+      # iss, and aud fields.
+      #
+      # See OpenId Connect Core 3.1.3.7 and 3.2.2.11.
+      #
+      # @return Claims, Header
+      def validate_and_parse_id_token(id_token)
+        # The second parameter is the public key to verify the signature.
+        # However, that key is overridden by the value of the executed block
+        # if one is present.
+        #
+        # If you're thinking that this looks ugly with the raw nil and boolean,
+        # see https://github.com/jwt/ruby-jwt/issues/59.
+        jwt_claims, jwt_header =
+          JWT.decode(id_token, nil, false, verify_options) do |header|
+            # There should always be one key from the discovery endpoint that
+            # matches the id in the JWT header.
+            x5c = (signing_keys.find do |key|
+              key['kid'] == header['kid']
+            end || {})['x5c']
+            if x5c.nil? || x5c.empty?
+              fail JWT::VerificationError,
+                   'No keys from key endpoint match the id token'
+            end
+            # The key also contains other fields, such as n and e, that are
+            # redundant. x5c is sufficient to verify the id token.
+            OpenSSL::X509::Certificate.new(JWT.base64url_decode(x5c.first)).public_key
+          end
+        return jwt_claims, jwt_header if jwt_claims['nonce'] == read_nonce
+        fail JWT::DecodeError, 'Returned nonce did not match.'
+      end
+
+      ##
+      # Verifies that the c_hash the id token claims matches the authorization
+      # code. See OpenId Connect Core 3.3.2.11.
+      #
+      # @param String code
+      # @param Hash claims
+      # @param Hash header
+      # def validate_chash(code, claims, header)
+      #   # This maps RS256 -> sha256, ES384 -> sha384, etc.
+      #   algorithm = (header['alg'] || 'RS256').sub(/RS|ES|HS/, 'sha')
+      #   full_hash = OpenSSL::Digest.new(algorithm).digest code
+      #   c_hash = JWT.base64url_encode full_hash[0..full_hash.length / 2 - 1]
+      #   return if c_hash == claims['c_hash']
+      #   fail JWT::VerificationError,
+      #        'c_hash in id token does not match auth code.'
+      # end
+
+      ##
+      # The options passed to the Ruby JWT library to verify the id token.
+      # Note that these are not all the checks we perform. Some (like nonce)
+      # are not handled by the JWT API and are checked manually in
+      # #validate_and_parse_id_token.
+      #
+      # @return Hash
+      def verify_options
+        { verify_expiration: true,
+          verify_not_before: true,
+          verify_iat: true,
+          verify_iss: true,
+          'iss' => issuer,
+          verify_aud: true,
+          'aud' => client_id }
+      end
+    end
+  end
+end
+
+OmniAuth.config.add_camelization 'activedirectory', 'ActiveDirectory'

data/lib/omniauth-activedirectory.rb

@@ -0,0 +1 @@
+require 'omniauth/activedirectory'

data/omniauth-activedirectory.gemspec

@@ -0,0 +1,29 @@
+$LOAD_PATH.push File.expand_path('../lib', __FILE__)
+require 'omniauth/activedirectory/version'
+
+Gem::Specification.new do |s|
+  s.name            = 'omniauth-activedirectory'
+  s.version         = OmniAuth::ActiveDirectory::VERSION
+  s.authors         = ['Microsoft Corporation', 'Dave Van Fleet']
+  s.email           = 'vanfleet@arsome.com'
+  s.summary         = 'Azure Active Directory strategy for OmniAuth'
+  s.description     = 'Allows developers to authenticate to Azure AD'
+  s.homepage        = 'https://github.com/davevanfleet/omniauth-activedirectory'
+  s.license         = 'MIT'
+
+  s.files           = `git ls-files`.split("\n")
+  s.require_paths   = ['lib']
+
+  s.required_ruby_version = '>= 2.2'
+
+  s.add_runtime_dependency 'jwt', '>= 2.0'
+  s.add_runtime_dependency 'oauth2', '~> 1.1'
+  s.add_runtime_dependency 'omniauth', '~> 2.0'
+  s.add_runtime_dependency 'omniauth-oauth2', '~> 1.7.1'
+
+  s.add_development_dependency 'rake', '~> 12.0'
+  s.add_development_dependency 'rspec', '~> 3.6'
+  s.add_development_dependency 'rubocop', '~> 0.49'
+  s.add_development_dependency 'simplecov', '~> 0.10'
+  s.add_development_dependency 'webmock', '~> 1.21'
+end

data/spec/fixtures/id_token.txt

@@ -0,0 +1 @@
+eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMyJ9.eyJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9idW5jaC1vZi1yYW5kb20tY2hhcnMiLCJuYW1lIjoiSm9obiBTbWl0aCIsImF1ZCI6InRoZSBjbGllbnQgaWQiLCJub25jZSI6Im15IG5vbmNlIiwiZ2l2ZW5fbmFtZSI6IkpvaG4iLCJmYW1pbHlfbmFtZSI6InNtaXRoIiwiZW1haWwiOiJqc21pdGhAY29udG9zby5jb20iLCJjX2hhc2giOiJWcFRRaWk1VF84cmd3eEEtV3RiMkJ3In0.Xz9SL1dm9xeJ3YtBIwSpL7SHEMr5lsL32mkJIugoAt7rNhj2ZauN77_N3skU9FIRTVb_XBFHrLo1AXion7RWoOGAMk8xnuQRlhamGoWsjttWE9oO6J6kuQPSDBvLTA88UqLoGNezDwFNfgUFQq-66m33ZWdkiNOFoFZ_In6DtAwxHZZUys-KoYD3iCbviUoBzU57aV-SBsWyComq39pDGpw03qZoa_xgRfujdVHG1DKlO5VG79kUE3ySYWJyBYVKUdAzjH1iotjpPA1svtqytn4CUldAMi4nnf7iq5SCJMb4ucu0mN6AhJH9ktY--fGY6_OidyiDe4F57ZzLw-3jOQ

data/spec/fixtures/id_token_bad_audience.txt

@@ -0,0 +1 @@
+eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMyJ9.eyJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9idW5jaC1vZi1yYW5kb20tY2hhcnMiLCJuYW1lIjoiSm9obiBTbWl0aCIsImF1ZCI6Im5vdCB0aGUgY2xpZW50IGlkIiwibm9uY2UiOiJteSBub25jZSIsImdpdmVuX25hbWUiOiJKb2huIiwiZmFtaWx5X25hbWUiOiJzbWl0aCIsImVtYWlsIjoianNtaXRoQGNvbnRvc28uY29tIn0.gGCFTcGDBb2P5tPRj2ojUUiwOJoSslQlxEVTElZY6FCzCZzcypsnrYOB9Adkztp2AWF4wW9fT58lqXwaahKquXtK4wyK4KoNBxXBhS4sDMeNpVkK4914tT_6gecvyUsI_tlJaS0epd5c0mN9-1QjgvNEirY1L-XYaT290LmLYVYIFTEJXoSlnwvv081k0txdJZKr14JXd_bSLUbhGSd-NcGZkJuVmg2F_C65zd1wUsQOkV2iVdJ-ycaDJklv8-DFfDFIHQio8S9yqyieHwArRmTW9HzcoHhWBh2MIItszoTSbmQEF062NtNBPW8gyk1OSot5X9klJUhgPAAFqJ0TJQ

data/spec/fixtures/id_token_bad_chash.txt

@@ -0,0 +1 @@
+eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMyJ9.eyJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9idW5jaC1vZi1yYW5kb20tY2hhcnMiLCJuYW1lIjoiSm9obiBTbWl0aCIsImF1ZCI6InRoZSBjbGllbnQgaWQiLCJub25jZSI6Im15IG5vbmNlIiwiZ2l2ZW5fbmFtZSI6IkpvaG4iLCJmYW1pbHlfbmFtZSI6InNtaXRoIiwiZW1haWwiOiJqc21pdGhAY29udG9zby5jb20iLCJjX2hhc2giOiI1WEhDdk9qcUgtbnJBXzNXNUJYaWJnIn0.EHPFrxMbr2EH1IZ15F3oP1yvrukadY4ggZSOxm625qPoMxfhv-QzFm0YMhkAG0cLM_LSHi_RgedDwTGuzOtIWqmheYzydnhtbIBeKmx0RSgdob6WeiTZwJ93VRiV4q82Qda41JaaIl_wdWd4lVyVstd9o9jPYMtKEVLgaNDrtHt6pPxEGCVraiaM6tVyKc5XIHu3wNaqle5UZZREU6oirwTCUhXDZkz1g5qY2-aWUdfFVsElSarJuMcxGDPD20hvx7T3D7SCHAF8WhKw3AwQyrodKWCo3cqDOz6vHymb_-ELkJc14GMbtJiyrf6XYySZZoseoI_WBDmLfKcK637xCw

data/spec/fixtures/id_token_bad_issuer.txt

@@ -0,0 +1 @@
+eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMyJ9.eyJpc3MiOiJodHRwczovL3N0cy5pbXBvc3Rlci5uZXQvYnVuY2gtb2YtcmFuZG9tLWNoYXJzIiwibmFtZSI6IkpvaG4gU21pdGgiLCJhdWQiOiJ0aGUgY2xpZW50IGlkIiwibm9uY2UiOiJteSBub25jZSIsImdpdmVuX25hbWUiOiJKb2huIiwiZmFtaWx5X25hbWUiOiJzbWl0aCIsImVtYWlsIjoianNtaXRoQGNvbnRvc28uY29tIn0.fwnJuRsif_Td3MfXoyADHidYJyPFdWSBBoLbVAu4Lz3-pmSln9Vgxl5KowqEKq2LX5n0aqyWVGLcoT-_G_PNXuizuNmssv5vreKLvDMpsFXt2irdwGYDCRki7KQPBk3bn12YjBzE2EqiRy7dTEG_0vWoh1RqoNP72BBL8xYQUlIOFleZhT5KGNYbh7rvcmDq7aA-xdaXT3QJfHCHpitW_zVzZ5Gok_awcdx_v3r3eFbG2IT0PfmT40Ljia0aP2i60KgsOLLHarYO51KFNDEfr1pUDf4IweaEzstbVLwk-_5ulJ5QgByhNJrmWDfrGeCQRk0SO2XX-EUsVn5ySVJ5CQ

data/spec/fixtures/id_token_bad_kid.txt

@@ -0,0 +1 @@
+eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMzQifQ.eyJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9idW5jaC1vZi1yYW5kb20tY2hhcnMiLCJuYW1lIjoiSm9obiBTbWl0aCIsImF1ZCI6InRoZSBjbGllbnQgaWQiLCJub25jZSI6Im15IG5vbmNlIiwiZ2l2ZW5fbmFtZSI6IkpvaG4iLCJmYW1pbHlfbmFtZSI6InNtaXRoIiwiZW1haWwiOiJqc21pdGhAY29udG9zby5jb20iLCJjX2hhc2giOiI1WEhDdk9qcUgtbnJBXzNXNUJYaWJnIn0.gWGBc9rH30SN17Ikm1CjqIYAyzFHX0yeRQu85sVYLE3r5k26bjS3R6rTJcCQlYqHPRdoPcnkUgT1QVbdThw34ICrODoavs7I5QYEn_jKP9zM4UJEKQaCLBAtitzrk1KDEf0GLcNKif-MYu7MiQfoOzwCGWfIs-vgqk4lv0JUs9OlSLp5LHru7G3jKy6Qswbrpxpjzm9I8BnKEdhUfhz4P6wIf9KLMmhgeGQdQ6wBuxPmOf9r6EKIij2AENhFp1qP90m8kXq9tIt5FZFjwIs_G6spLl0gQXyx0qC8rP5JTkqwrBUieWU-BRqVdax8YxA0iDKzZyfsMV92yVcZT6S_NQ

data/spec/fixtures/id_token_bad_nonce.txt

@@ -0,0 +1 @@
+eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMyJ9.eyJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9idW5jaC1vZi1yYW5kb20tY2hhcnMiLCJuYW1lIjoiSm9obiBTbWl0aCIsImF1ZCI6InRoZSBjbGllbnQgaWQiLCJub25jZSI6Im5vdCBteSBub25jZSIsImdpdmVuX25hbWUiOiJKb2huIiwiZmFtaWx5X25hbWUiOiJzbWl0aCIsImVtYWlsIjoianNtaXRoQGNvbnRvc28uY29tIn0.KBSOCiy0sUF33akept9nPNFgmMWxiPWDBVA0dZqQaF6gQkhQu82irAQzB2Ygkh9KDeIEf0MSZWLDq0X3W3Fke4wzjrbzL-2QM4l-KgPFbJixqtJYHSPOidHSCQ8vA0v8kES3H_zqU6QisygwwXLh2ozqKXMnsrBPIAtiZz_a0vPbHtrYbb-WIrtTruMemcTt5OkbfDIttzi5EarakQg93vraIb0jK0szuAqLkXFOzcIIGPgyAvVpHZveqm99GR04tbKyTRIyJP1vZwtIpu89PKFM3soWcWd_kjAWcS81ZTzEn5_P-1QL7YTInK53acNXZHh08Fba3Um4J_KlV2KRjw

data/spec/fixtures/id_token_no_alg.txt

@@ -0,0 +1 @@
+eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMyJ9.eyJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9idW5jaC1vZi1yYW5kb20tY2hhcnMiLCJuYW1lIjoiSm9obiBTbWl0aCIsImF1ZCI6InRoZSBjbGllbnQgaWQiLCJub25jZSI6Im15IG5vbmNlIiwiZ2l2ZW5fbmFtZSI6IkpvaG4iLCJmYW1pbHlfbmFtZSI6InNtaXRoIiwiZW1haWwiOiJqc21pdGhAY29udG9zby5jb20iLCJjX2hhc2giOiJWcFRRaWk1VF84cmd3eEEtV3RiMkJ3In0.Xz9SL1dm9xeJ3YtBIwSpL7SHEMr5lsL32mkJIugoAt7rNhj2ZauN77_N3skU9FIRTVb_XBFHrLo1AXion7RWoOGAMk8xnuQRlhamGoWsjttWE9oO6J6kuQPSDBvLTA88UqLoGNezDwFNfgUFQq-66m33ZWdkiNOFoFZ_In6DtAwxHZZUys-KoYD3iCbviUoBzU57aV-SBsWyComq39pDGpw03qZoa_xgRfujdVHG1DKlO5VG79kUE3ySYWJyBYVKUdAzjH1iotjpPA1svtqytn4CUldAMi4nnf7iq5SCJMb4ucu0mN6AhJH9ktY--fGY6_OidyiDe4F57ZzLw-3jOQ

data/spec/fixtures/x5c.txt

@@ -0,0 +1 @@
+MIIBwzCCAbegAwIBAgIBATADBgEAMDAxEzARBgoJkiaJk_IsZAEZFgNvcmcxGTAXBgoJkiaJk_IsZAEZFglydWJ5LWxhbmcwHhcNMTUwODA2MjMyOTE4WhcNMjUwODAzMjMyOTE4WjAwMRMwEQYKCZImiZPyLGQBGRYDb3JnMRkwFwYKCZImiZPyLGQBGRYJcnVieS1sYW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxyunSConbK4z1T47vukPa0OaNcY_R6l8Z0TILR1w5O_YkMbJGRXpZORFPVs83xLoxs7RcPWnibQhQ4G6m6fwEA4rutvOm-3xWyey-OOZdVqpNmxqd2VcCCI6AoUtl8m4w0UFuu-oiELj7BF8cGS5wvHYATEBEY72n_84uu-LF423Ffe8HeMEY00nO3ZVcV9MjFBVps8RAwL62ooXPZyly6fQt4728wlZPs3EMijS-Bj4auokx6ssBooaF9XiZJKKCAe16epbBB9S4XVlNXo6EhZ-PBpMFRJknDwWFFYPVOX3NlBp8chi8VaXmDXqsFJiwkkeIqg4I6WFAM4BsnDInwIDAQABMAMGAQADAQA

data/spec/fixtures/x5c_different.txt

@@ -0,0 +1 @@
+MIIBjTCCAYGgAwIBAgIBATADBgEAMBUxEzARBgoJkiaJk_IsZAEZFgNvcmcwHhcNMTUwODA3MjAyMDU1WhcNMjUwODA0MjAyMDU1WjAVMRMwEQYKCZImiZPyLGQBGRYDb3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy8VyE4KHx0GDV6RMYqscBR56lal9uQNYXm_Du8O6-F8Da9Xc0h7O8JWomqFLUEE-0ogMcjzOAiQzTc8X6VhkIBbMCKYA6OQ-hiC3aaYFLNAnxaVThnUJWXxA7spbnKFG1xZK01G8bAx7s7DbbWMHlchebjWprCMkYEjnECXVuDyfkZW-8aHDCtq62JAd-WQL1LN-UkOBCgodTNW2x7e-_KBvPzPSSzYygAh7kCl727QeHwplgA83mQrdecNvYoiEBYOjSKz8bdiKRYjmogGoDv3_W4cY76a9XBZpSoNjBWdWo_w7ce4KbOsi3V0g8EZm9ccKjBPKe9pZYF4aCNQJ6QIDAQABMAMGAQADAQA

data/spec/omniauth/strategies/activedirectory_spec.rb

@@ -0,0 +1,200 @@
+require 'spec_helper'
+require 'omniauth-activedirectory'
+
+# This was fairly awkward to test. I've stubbed every endpoint and am simulating
+# the state of the request. Especially large strings are stored in fixtures.
+describe OmniAuth::Strategies::ActiveDirectory do
+  let(:app) { -> _ { [200, {}, ['Hello world.']] } }
+  let(:x5c) { File.read(File.expand_path('../../../fixtures/x5c.txt', __FILE__)) }
+
+  # These values were used to create the "successful" id_token JWT.
+  let(:client_id) { 'the client id' }
+  let(:code) { 'code' }
+  let(:email) { 'jsmith@contoso.com' }
+  let(:family_name) { 'smith' }
+  let(:given_name) { 'John' }
+  let(:issuer) { 'https://sts.windows.net/bunch-of-random-chars' }
+  let(:kid) { 'abc123' }
+  let(:name) { 'John Smith' }
+  let(:nonce) { 'my nonce' }
+  let(:session_state) { 'session state' }
+  let(:auth_endpoint_host) { 'authorize.com' }
+
+  let(:hybrid_flow_params) do
+    { 'id_token' => id_token,
+      'session_state' => session_state,
+      'code' => code }
+  end
+
+  let(:tenant) { 'tenant' }
+  let(:openid_config_response) { "{\"issuer\":\"#{issuer}\",\"authorization_endpoint\":\"http://#{auth_endpoint_host}\",\"jwks_uri\":\"https://login.windows.net/common/discovery/keys\"}" }
+  let(:keys_response) { "{\"keys\":[{\"kid\":\"#{kid}\",\"x5c\":[\"#{x5c}\"]}]}" }
+
+  let(:env) { { 'rack.session' => { 'omniauth-azure-activedirectory.nonce' => nonce } } }
+
+  before(:each) do
+    stub_request(:get, "https://login.windows.net/#{tenant}/.well-known/openid-configuration")
+      .to_return(status: 200, body: openid_config_response)
+    stub_request(:get, 'https://login.windows.net/common/discovery/keys')
+      .to_return(status: 200, body: keys_response)
+  end
+
+  describe '#callback_phase' do
+    let(:request) { double('Request', params: hybrid_flow_params, path_info: 'path') }
+    let(:strategy) do
+      described_class.new(app, client_id, tenant).tap do |s|
+        allow(s).to receive(:request) { request }
+      end
+    end
+
+    subject { -> { strategy.callback_phase } }
+    before(:each) { strategy.call!(env) }
+
+    context 'with a successful response' do
+      # payload:
+      #   { 'iss' => 'https://sts.windows.net/bunch-of-random-chars',
+      #     'name' => 'John Smith',
+      #     'aud' => 'the client id',
+      #     'nonce' => 'my nonce',
+      #     'email' => 'jsmith@contoso.com',
+      #     'given_name' => 'John',
+      #     'family_name' => 'Smith' }
+      # headers:
+      #   { 'typ' => 'JWT',
+      #     'alg' => 'RS256',
+      #     'kid' => 'abc123' }
+      #
+      let(:id_token) { File.read(File.expand_path('../../../fixtures/id_token.txt', __FILE__)) }
+
+      # If it passes this test, then the id was successfully validated.
+      it { is_expected.to_not raise_error }
+
+      describe 'the auth hash' do
+        before(:each) { strategy.callback_phase }
+
+        subject { env['omniauth.auth'] }
+
+        it 'should contain the name' do
+          expect(subject.info['name']).to eq name
+        end
+
+        it 'should contain the first name' do
+          expect(subject.info['first_name']).to eq given_name
+        end
+
+        it 'should contain the last name' do
+          expect(subject.info['last_name']).to eq family_name
+        end
+
+        it 'should contain the email' do
+          expect(subject.info['email']).to eq email
+        end
+
+        it 'should contain the auth code' do
+          expect(subject.credentials['code']).to eq code
+        end
+
+        it 'should contain the session state' do
+          expect(subject.extra['session_state']).to eq session_state
+        end
+      end
+    end
+
+    context 'with an invalid issuer' do
+      # payload:
+      #   { 'iss' => 'https://sts.imposter.net/bunch-of-random-chars', ... }
+      #
+      let(:id_token) { File.read(File.expand_path('../../../fixtures/id_token_bad_issuer.txt', __FILE__)) }
+      it { is_expected.to raise_error JWT::InvalidIssuerError }
+    end
+
+    context 'with an invalid audience' do
+      # payload:
+      #   { 'aud' => 'not the client id', ... }
+      #
+      let(:id_token) { File.read(File.expand_path('../../../fixtures/id_token_bad_audience.txt', __FILE__)) }
+      it { is_expected.to raise_error JWT::InvalidAudError }
+    end
+
+    context 'with a non-matching nonce' do
+      # payload:
+      #   { 'nonce' => 'not my nonce', ... }
+      #
+      let(:id_token) { File.read(File.expand_path('../../../fixtures/id_token_bad_nonce.txt', __FILE__)) }
+      it { is_expected.to raise_error JWT::DecodeError }
+    end
+
+    context 'with the wrong x5c' do
+      let(:x5c) { File.read(File.expand_path('../../../fixtures/x5c_different.txt', __FILE__)) }
+      let(:id_token) { File.read(File.expand_path('../../../fixtures/id_token.txt', __FILE__)) }
+      it { is_expected.to raise_error JWT::VerificationError }
+    end
+
+    context 'with a non-matching c_hash' do
+      let(:id_token) { File.read(File.expand_path('../../../fixtures/id_token_bad_chash.txt', __FILE__)) }
+      it { is_expected.to raise_error JWT::VerificationError }
+    end
+
+    context 'with a non-matching kid' do
+      let(:id_token) { File.read(File.expand_path('../../../fixtures/id_token_bad_kid.txt', __FILE__)) }
+      it { is_expected.to raise_error JWT::VerificationError }
+    end
+
+    context 'with no alg header' do
+      let(:id_token) { File.read(File.expand_path('../../../fixtures/id_token_no_alg.txt', __FILE__)) }
+
+      it 'should correctly parse using default RS256' do
+        expect(subject).to_not raise_error
+      end
+
+      describe 'the auth hash' do
+        subject { env['omniauth.auth'] }
+        before(:each) { strategy.callback_phase }
+
+        it 'should default to RS256' do
+          expect(subject.info['name']).to eq name
+        end
+      end
+    end
+  end
+
+  describe '#request_phase' do
+    let(:strategy) { described_class.new(app, client_id, tenant) }
+    subject { strategy.request_phase }
+    before(:each) { strategy.call!(env) }
+
+    it 'should make a redirect' do
+      expect(subject.first).to eq 302
+    end
+
+    it 'should redirect to the correct endpoint' do
+      expect(URI(subject[1]['Location']).host).to eq auth_endpoint_host
+    end
+  end
+
+  describe '#read_nonce' do
+    let(:strategy) { described_class.new(app, client_id, tenant) }
+    let(:env) { { 'rack.session' => {} } }
+    before(:each) { strategy.call!(env) }
+    subject { strategy.send(:read_nonce) }
+
+    context 'before a nonce is set' do
+      it { is_expected.to be nil }
+    end
+
+    context 'after a nonce is set' do
+      before(:each) { @nonce = strategy.send(:new_nonce) }
+      it 'should match' do
+        expect(subject).to eq @nonce
+      end
+    end
+
+    context 'twice in a row' do
+      before(:each) do
+        strategy.send(:new_nonce)
+        strategy.send(:read_nonce)
+      end
+      it { is_expected.to be nil }
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,44 @@
+#-------------------------------------------------------------------------------
+# Copyright (c) 2015 Micorosft Corporation
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+#-------------------------------------------------------------------------------
+
+require 'webmock/rspec'
+require 'simplecov'
+
+SimpleCov.start do
+  # Don't measure coverage on test files.
+  add_filter 'spec'
+end
+
+WebMock.disable_net_connect!(allow_localhost: true)
+
+RSpec.configure do |config|
+  config.expect_with :rspec do |expectations|
+    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
+  end
+
+  config.mock_with :rspec do |mocks|
+    mocks.verify_partial_doubles = true
+  end
+
+  config.warnings = true
+  config.order = :random
+end

metadata

@@ -0,0 +1,192 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-activedirectory
+version: !ruby/object:Gem::Version
+  version: 1.0.1
+platform: ruby
+authors:
+- Microsoft Corporation
+- Dave Van Fleet
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2021-03-18 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: omniauth-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.7.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.7.1
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.6'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.49'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.49'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.10'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.10'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.21'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.21'
+description: Allows developers to authenticate to Azure AD
+email: vanfleet@arsome.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rubocop.yml"
+- ".rubocop_todo.yml"
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- lib/omniauth-activedirectory.rb
+- lib/omniauth/activedirectory.rb
+- lib/omniauth/activedirectory/version.rb
+- lib/omniauth/strategies/activedirectory.rb
+- omniauth-activedirectory.gemspec
+- spec/fixtures/id_token.txt
+- spec/fixtures/id_token_bad_audience.txt
+- spec/fixtures/id_token_bad_chash.txt
+- spec/fixtures/id_token_bad_issuer.txt
+- spec/fixtures/id_token_bad_kid.txt
+- spec/fixtures/id_token_bad_nonce.txt
+- spec/fixtures/id_token_no_alg.txt
+- spec/fixtures/x5c.txt
+- spec/fixtures/x5c_different.txt
+- spec/omniauth/strategies/activedirectory_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/davevanfleet/omniauth-activedirectory
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '2.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.2.3
+signing_key:
+specification_version: 4
+summary: Azure Active Directory strategy for OmniAuth
+test_files: []