omniauth-auth0 2.0.0 → 3.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (37) hide show
  1. checksums.yaml +5 -5
  2. data/.circleci/config.yml +63 -0
  3. data/.devcontainer/devcontainer.json +18 -0
  4. data/.github/CODEOWNERS +1 -0
  5. data/.github/ISSUE_TEMPLATE/config.yml +8 -0
  6. data/.github/ISSUE_TEMPLATE/feature_request.md +39 -0
  7. data/.github/ISSUE_TEMPLATE/report_a_bug.md +55 -0
  8. data/.github/PULL_REQUEST_TEMPLATE.md +32 -0
  9. data/.github/stale.yml +20 -0
  10. data/.github/workflows/semgrep.yml +24 -0
  11. data/.gitignore +5 -2
  12. data/.semgrepignore +4 -0
  13. data/.shiprc +7 -0
  14. data/.snyk +9 -0
  15. data/CHANGELOG.md +212 -4
  16. data/CONTRIBUTING.md +71 -0
  17. data/EXAMPLES.md +167 -0
  18. data/Gemfile +17 -17
  19. data/Gemfile.lock +180 -0
  20. data/README.md +117 -92
  21. data/Rakefile +2 -2
  22. data/codecov.yml +22 -0
  23. data/lib/omniauth/auth0/errors.rb +11 -0
  24. data/lib/omniauth/auth0/jwt_validator.rb +278 -0
  25. data/lib/omniauth/auth0/telemetry.rb +36 -0
  26. data/lib/omniauth/strategies/auth0.rb +89 -21
  27. data/lib/omniauth-auth0/version.rb +1 -1
  28. data/lib/omniauth-auth0.rb +1 -1
  29. data/omniauth-auth0.gemspec +6 -7
  30. data/opslevel.yml +6 -0
  31. data/spec/omniauth/auth0/jwt_validator_spec.rb +729 -0
  32. data/spec/omniauth/auth0/telemetry_spec.rb +28 -0
  33. data/spec/omniauth/strategies/auth0_spec.rb +160 -18
  34. data/spec/resources/jwks.json +28 -0
  35. data/spec/spec_helper.rb +12 -7
  36. metadata +54 -16
  37. data/.travis.yml +0 -6
data/EXAMPLES.md ADDED
@@ -0,0 +1,167 @@
1
+ * [Example of the resulting authentication hash](#example-of-the-resulting-authentication-hash)
2
+ * [Send additional authentication parameters](#send-additional-authentication-parameters)
3
+ * [Query Parameter Options](#query-parameter-options)
4
+ * [Auth0 Organizations](#auth0-organizations)
5
+ - [Logging in with an Organization](#logging-in-with-an-organization)
6
+ - [Validating Organizations when using Organization Login Prompt](#validating-organizations-when-using-organization-login-prompt)
7
+ - [Accepting user invitations](#accepting-user-invitations)
8
+
9
+ ### Example of the resulting authentication hash
10
+
11
+ The Auth0 strategy will provide the standard OmniAuth hash attributes:
12
+
13
+ - `:provider` - the name of the strategy, in this case `auth0`
14
+ - `:uid` - the user identifier
15
+ - `:info` - the result of the call to `/userinfo` using OmniAuth standard attributes
16
+ - `:credentials` - tokens requested and data
17
+ - `:extra` - Additional info obtained from calling `/userinfo` in the `:raw_info` property
18
+
19
+ ```ruby
20
+ {
21
+ :provider => 'auth0',
22
+ :uid => 'auth0|USER_ID',
23
+ :info => {
24
+ :name => 'John Foo',
25
+ :email => 'johnfoo@example.org',
26
+ :nickname => 'john',
27
+ :image => 'https://example.org/john.jpg'
28
+ },
29
+ :credentials => {
30
+ :token => 'ACCESS_TOKEN',
31
+ :expires_at => 1485373937,
32
+ :expires => true,
33
+ :refresh_token => 'REFRESH_TOKEN',
34
+ :id_token => 'JWT_ID_TOKEN',
35
+ :token_type => 'bearer',
36
+ },
37
+ :extra => {
38
+ :raw_info => {
39
+ :email => 'johnfoo@example.org',
40
+ :email_verified => 'true',
41
+ :name => 'John Foo',
42
+ :picture => 'https://example.org/john.jpg',
43
+ :user_id => 'auth0|USER_ID',
44
+ :nickname => 'john',
45
+ :created_at => '2014-07-15T17:19:50.387Z'
46
+ }
47
+ }
48
+ }
49
+ ```
50
+
51
+ ## Send additional authentication parameters
52
+
53
+ To send additional parameters during login, you can specify them when you register the provider:
54
+
55
+ ```ruby
56
+ provider
57
+ :auth0,
58
+ ENV['AUTH0_CLIENT_ID'],
59
+ ENV['AUTH0_CLIENT_SECRET'],
60
+ ENV['AUTH0_DOMAIN'],
61
+ {
62
+ authorize_params: {
63
+ scope: 'openid read:users write:order',
64
+ audience: 'https://mydomain/api',
65
+ max_age: 3600 # time in seconds authentication is valid
66
+ }
67
+ }
68
+ ```
69
+
70
+ This will tell the strategy to send those parameters on every authentication request.
71
+
72
+ ## Query Parameter Options
73
+
74
+ In some scenarios, you may need to pass specific query parameters to `/authorize`. The following parameters are available to enable this:
75
+
76
+ - `connection`
77
+ - `connection_scope`
78
+ - `prompt`
79
+ - `screen_hint` (only relevant to New Universal Login Experience)
80
+ - `organization`
81
+ - `invitation`
82
+
83
+ Simply pass these query parameters to your OmniAuth redirect endpoint to enable their behavior.
84
+
85
+ ## Auth0 Organizations
86
+
87
+ [Organizations](https://auth0.com/docs/organizations) is a set of features that provide better support for developers who build and maintain SaaS and Business-to-Business (B2B) applications.
88
+
89
+ Note that Organizations is currently only available to customers on our Enterprise and Startup subscription plans.
90
+
91
+ ### Logging in with an Organization
92
+
93
+ Logging in with an Organization is as easy as passing the parameters to the authorize endpoint. You can do this with
94
+
95
+ ```ruby
96
+ <%=
97
+ button_to 'Login', 'auth/auth0',
98
+ method: :post,
99
+ params: {
100
+ # Found in your Auth0 dashboard, under Organization settings:
101
+ organization: '{AUTH0_ORGANIZATION}'
102
+ }
103
+ %>
104
+ ```
105
+
106
+ Alternatively you can configure the organization when you register the provider:
107
+
108
+ ```ruby
109
+ provider
110
+ :auth0,
111
+ ENV['AUTH0_CLIENT_ID'],
112
+ ENV['AUTH0_CLIENT_SECRET'],
113
+ ENV['AUTH0_DOMAIN']
114
+ {
115
+ authorize_params: {
116
+ scope: 'openid read:users',
117
+ audience: 'https://{AUTH0_DOMAIN}/api',
118
+ organization: '{AUTH0_ORGANIZATION}'
119
+ }
120
+ }
121
+ ```
122
+
123
+ When passing `openid` to the scope and `organization` to the authorize params, you will receive an ID token on callback with the `org_id` claim. This claim is validated for you by the SDK.
124
+
125
+ ### Validating Organizations when using Organization Login Prompt
126
+
127
+ When Organization login prompt is enabled on your application, but you haven't specified an Organization for the application's authorization endpoint, the `org_id` claim will be present on the ID token, and should be validated to ensure that the value received is expected or known.
128
+
129
+ Normally, validating the issuer would be enough to ensure that the token was issued by Auth0, and this check is performed by the SDK. However, in the case of organizations, additional checks should be made so that the organization within an Auth0 tenant is expected.
130
+
131
+ In particular, the `org_id` claim should be checked to ensure it is a value that is already known to the application. This could be validated against a known list of organization IDs, or perhaps checked in conjunction with the current request URL. e.g. the sub-domain may hint at what organization should be used to validate the ID Token.
132
+
133
+ Here is an example using it in your `callback` method
134
+
135
+ ```ruby
136
+ def callback
137
+ claims = request.env['omniauth.auth']['extra']['raw_info']
138
+
139
+ if claims["org"] && claims["org"] !== expected_org
140
+ redirect_to '/unauthorized', status: 401
141
+ else
142
+ session[:userinfo] = claims
143
+ redirect_to '/dashboard'
144
+ end
145
+ end
146
+ ```
147
+
148
+ For more information, please read [Work with Tokens and Organizations](https://auth0.com/docs/organizations/using-tokens) on Auth0 Docs.
149
+
150
+ ### Accepting user invitations
151
+
152
+ Auth0 Organizations allow users to be invited using emailed links, which will direct a user back to your application. The URL the user will arrive at is based on your configured `Application Login URI`, which you can change from your Application's settings inside the Auth0 dashboard.
153
+
154
+ When the user arrives at your application using an invite link, you can expect three query parameters to be provided: `invitation`, `organization`, and `organization_name`. These will always be delivered using a GET request.
155
+
156
+ You can then supply those parametrs to a `button_to` or `link_to` helper
157
+
158
+ ```ruby
159
+ <%=
160
+ button_to 'Login', 'auth/auth0',
161
+ method: :post,
162
+ params: {
163
+ organization: '{YOUR_ORGANIZATION_ID}',
164
+ invitation: '{INVITE_CODE}'
165
+ }
166
+ %>
167
+ ```
data/Gemfile CHANGED
@@ -1,26 +1,26 @@
1
- source 'http://rubygems.org'
1
+ source 'https://rubygems.org'
2
2
 
3
3
  gemspec
4
4
 
5
- gem 'gem-release'
6
- gem 'rake'
5
+ gem 'gem-release', '~> 2'
6
+ gem 'jwt', '~> 2'
7
+ gem 'rake', '~> 13'
7
8
 
8
9
  group :development do
9
- gem 'dotenv'
10
- gem 'pry'
11
- gem 'shotgun'
12
- gem 'sinatra'
13
- gem 'thin'
10
+ gem 'dotenv', '~> 2'
11
+ gem 'pry', '~> 0'
12
+ gem 'rubocop', '~> 1', require: false
13
+ gem 'shotgun', '~> 0'
14
+ gem 'sinatra', '~> 2'
15
+ gem 'thin', '~> 1'
14
16
  end
15
17
 
16
18
  group :test do
17
- gem 'guard-rspec', require: false
18
- gem 'listen', '~> 3.1.5'
19
- gem 'rack-test'
20
- gem 'rspec', '~> 3.5'
21
- gem 'rubocop', '>= 0.30', platforms: [
22
- :ruby_19, :ruby_20, :ruby_21, :ruby_22
23
- ]
24
- gem 'simplecov'
25
- gem 'webmock'
19
+ gem 'guard-rspec', '~> 4', require: false
20
+ gem 'listen', '~> 3'
21
+ gem 'rack-test', '~> 2'
22
+ gem 'rspec', '~> 3'
23
+ gem 'simplecov-cobertura', '~> 2'
24
+ gem 'webmock', '~> 3'
25
+ gem 'multi_json', '~> 1'
26
26
  end
data/Gemfile.lock ADDED
@@ -0,0 +1,180 @@
1
+ PATH
2
+ remote: .
3
+ specs:
4
+ omniauth-auth0 (3.1.0)
5
+ omniauth (~> 2)
6
+ omniauth-oauth2 (~> 1)
7
+
8
+ GEM
9
+ remote: https://rubygems.org/
10
+ specs:
11
+ addressable (2.8.1)
12
+ public_suffix (>= 2.0.2, < 6.0)
13
+ ast (2.4.2)
14
+ coderay (1.1.3)
15
+ crack (0.4.5)
16
+ rexml
17
+ daemons (1.4.1)
18
+ diff-lcs (1.5.0)
19
+ docile (1.4.0)
20
+ dotenv (2.8.1)
21
+ eventmachine (1.2.7)
22
+ faraday (2.7.1)
23
+ faraday-net_http (>= 2.0, < 3.1)
24
+ ruby2_keywords (>= 0.0.4)
25
+ faraday-net_http (3.0.2)
26
+ ffi (1.15.5)
27
+ formatador (1.1.0)
28
+ gem-release (2.2.2)
29
+ guard (2.18.0)
30
+ formatador (>= 0.2.4)
31
+ listen (>= 2.7, < 4.0)
32
+ lumberjack (>= 1.0.12, < 2.0)
33
+ nenv (~> 0.1)
34
+ notiffany (~> 0.0)
35
+ pry (>= 0.13.0)
36
+ shellany (~> 0.0)
37
+ thor (>= 0.18.1)
38
+ guard-compat (1.2.1)
39
+ guard-rspec (4.7.3)
40
+ guard (~> 2.1)
41
+ guard-compat (~> 1.1)
42
+ rspec (>= 2.99.0, < 4.0)
43
+ hashdiff (1.0.1)
44
+ hashie (5.0.0)
45
+ json (2.6.3)
46
+ jwt (2.5.0)
47
+ listen (3.7.1)
48
+ rb-fsevent (~> 0.10, >= 0.10.3)
49
+ rb-inotify (~> 0.9, >= 0.9.10)
50
+ lumberjack (1.2.8)
51
+ method_source (1.0.0)
52
+ multi_json (1.15.0)
53
+ multi_xml (0.6.0)
54
+ mustermann (2.0.2)
55
+ ruby2_keywords (~> 0.0.1)
56
+ nenv (0.3.0)
57
+ notiffany (0.1.3)
58
+ nenv (~> 0.1)
59
+ shellany (~> 0.0)
60
+ oauth2 (2.0.9)
61
+ faraday (>= 0.17.3, < 3.0)
62
+ jwt (>= 1.0, < 3.0)
63
+ multi_xml (~> 0.5)
64
+ rack (>= 1.2, < 4)
65
+ snaky_hash (~> 2.0)
66
+ version_gem (~> 1.1)
67
+ omniauth (2.1.0)
68
+ hashie (>= 3.4.6)
69
+ rack (>= 2.2.3)
70
+ rack-protection
71
+ omniauth-oauth2 (1.8.0)
72
+ oauth2 (>= 1.4, < 3)
73
+ omniauth (~> 2.0)
74
+ parallel (1.22.1)
75
+ parser (3.1.3.0)
76
+ ast (~> 2.4.1)
77
+ pry (0.14.1)
78
+ coderay (~> 1.1)
79
+ method_source (~> 1.0)
80
+ public_suffix (5.0.0)
81
+ rack (2.2.4)
82
+ rack-protection (2.2.3)
83
+ rack
84
+ rack-test (2.0.2)
85
+ rack (>= 1.3)
86
+ rainbow (3.1.1)
87
+ rake (13.0.6)
88
+ rb-fsevent (0.11.2)
89
+ rb-inotify (0.10.1)
90
+ ffi (~> 1.0)
91
+ regexp_parser (2.6.1)
92
+ rexml (3.2.5)
93
+ rspec (3.12.0)
94
+ rspec-core (~> 3.12.0)
95
+ rspec-expectations (~> 3.12.0)
96
+ rspec-mocks (~> 3.12.0)
97
+ rspec-core (3.12.0)
98
+ rspec-support (~> 3.12.0)
99
+ rspec-expectations (3.12.0)
100
+ diff-lcs (>= 1.2.0, < 2.0)
101
+ rspec-support (~> 3.12.0)
102
+ rspec-mocks (3.12.0)
103
+ diff-lcs (>= 1.2.0, < 2.0)
104
+ rspec-support (~> 3.12.0)
105
+ rspec-support (3.12.0)
106
+ rubocop (1.39.0)
107
+ json (~> 2.3)
108
+ parallel (~> 1.10)
109
+ parser (>= 3.1.2.1)
110
+ rainbow (>= 2.2.2, < 4.0)
111
+ regexp_parser (>= 1.8, < 3.0)
112
+ rexml (>= 3.2.5, < 4.0)
113
+ rubocop-ast (>= 1.23.0, < 2.0)
114
+ ruby-progressbar (~> 1.7)
115
+ unicode-display_width (>= 1.4.0, < 3.0)
116
+ rubocop-ast (1.24.0)
117
+ parser (>= 3.1.1.0)
118
+ ruby-progressbar (1.11.0)
119
+ ruby2_keywords (0.0.5)
120
+ shellany (0.0.1)
121
+ shotgun (0.9.2)
122
+ rack (>= 1.0)
123
+ simplecov (0.21.2)
124
+ docile (~> 1.1)
125
+ simplecov-html (~> 0.11)
126
+ simplecov_json_formatter (~> 0.1)
127
+ simplecov-cobertura (2.1.0)
128
+ rexml
129
+ simplecov (~> 0.19)
130
+ simplecov-html (0.12.3)
131
+ simplecov_json_formatter (0.1.4)
132
+ sinatra (2.2.3)
133
+ mustermann (~> 2.0)
134
+ rack (~> 2.2)
135
+ rack-protection (= 2.2.3)
136
+ tilt (~> 2.0)
137
+ snaky_hash (2.0.1)
138
+ hashie
139
+ version_gem (~> 1.1, >= 1.1.1)
140
+ thin (1.8.1)
141
+ daemons (~> 1.0, >= 1.0.9)
142
+ eventmachine (~> 1.0, >= 1.0.4)
143
+ rack (>= 1, < 3)
144
+ thor (1.2.1)
145
+ tilt (2.0.11)
146
+ unicode-display_width (2.3.0)
147
+ version_gem (1.1.1)
148
+ webmock (3.18.1)
149
+ addressable (>= 2.8.0)
150
+ crack (>= 0.3.2)
151
+ hashdiff (>= 0.4.0, < 2.0.0)
152
+
153
+ PLATFORMS
154
+ arm64-darwin-21
155
+ x86_64-darwin-20
156
+ x86_64-darwin-21
157
+ x86_64-linux
158
+
159
+ DEPENDENCIES
160
+ bundler
161
+ dotenv (~> 2)
162
+ gem-release (~> 2)
163
+ guard-rspec (~> 4)
164
+ jwt (~> 2)
165
+ listen (~> 3)
166
+ multi_json (~> 1)
167
+ omniauth-auth0!
168
+ pry (~> 0)
169
+ rack-test (~> 2)
170
+ rake (~> 13)
171
+ rspec (~> 3)
172
+ rubocop (~> 1)
173
+ shotgun (~> 0)
174
+ simplecov-cobertura (~> 2)
175
+ sinatra (~> 2)
176
+ thin (~> 1)
177
+ webmock (~> 3)
178
+
179
+ BUNDLED WITH
180
+ 2.3.7
data/README.md CHANGED
@@ -1,143 +1,168 @@
1
- [![Build Status](https://travis-ci.org/auth0/omniauth-auth0.svg)](https://travis-ci.org/auth0/omniauth-auth0)
1
+ ![Omniauth-auth0](https://cdn.auth0.com/website/sdks/banners/omniauth-auth0-banner.png)
2
2
 
3
- # OmniAuth Auth0
4
3
 
5
- This is the official [OmniAuth](https://github.com/intridea/omniauth) strategy for authenticating to [Auth0](https://auth0.com).
4
+ [![CircleCI](https://img.shields.io/circleci/project/github/auth0/omniauth-auth0/master.svg)](https://circleci.com/gh/auth0/omniauth-auth0)
5
+ [![codecov](https://codecov.io/gh/auth0/omniauth-auth0/branch/master/graph/badge.svg)](https://codecov.io/gh/auth0/omniauth-auth0)
6
+ [![Gem Version](https://badge.fury.io/rb/omniauth-auth0.svg)](https://badge.fury.io/rb/omniauth-auth0)
7
+ [![MIT licensed](https://img.shields.io/dub/l/vibe-d.svg?style=flat)](https://github.com/auth0/omniauth-auth0/blob/master/LICENSE)
6
8
 
7
- ## Installing
9
+ <div>
10
+ 📚 <a href="#documentation">Documentation</a> - 🚀 <a href="#getting-started">Getting started</a> - 💻 <a href="https://www.rubydoc.info/gems/omniauth-auth0">API reference</a> - 💬 <a href="#feedback">Feedback</a>
11
+ </div>
8
12
 
9
- Add to your `Gemfile`:
13
+ ## Documentation
10
14
 
11
- ```ruby
12
- gem 'omniauth-auth0'
13
- ```
15
+ - [Ruby on Rails Quickstart](https://auth0.com/docs/quickstart/webapp/rails)
16
+ - [Sample projects](https://github.com/auth0-samples/auth0-rubyonrails-sample)
17
+ - [API Reference](https://www.rubydoc.info/gems/omniauth-auth0)
14
18
 
15
- Then `bundle install`.
19
+ ## Getting started
16
20
 
17
- ## Usage
21
+ ### Installation
18
22
 
19
- ### Rails
23
+ Add the following line to your `Gemfile`:
20
24
 
21
25
  ```ruby
22
- Rails.application.config.middleware.use OmniAuth::Builder do
23
- provider :auth0, ENV['AUTH0_CLIENT_ID'], ENV['AUTH0_CLIENT_SECRET'], ENV['AUTH0_DOMAIN']
24
- end
26
+ gem 'omniauth-auth0'
25
27
  ```
26
28
 
27
- Then to redirect to your tenant's hosted login page:
29
+ If you're using this strategy with Rails, also add the following for CSRF protection:
28
30
 
29
31
  ```ruby
30
- redirect_to '/auth/auth0'
32
+ gem 'omniauth-rails_csrf_protection'
31
33
  ```
32
34
 
33
- ### Sinatra
35
+ Then install:
34
36
 
35
- ```ruby
36
- use OmniAuth::Builder do
37
- provider :auth0, ENV['AUTH0_CLIENT_ID'], ENV['AUTH0_CLIENT_SECRET'], ENV['AUTH0_DOMAIN']
38
- end
37
+ ```bash
38
+ $ bundle install
39
39
  ```
40
40
 
41
- Then to redirect to your tenant's hosted login page:
41
+ See our [contributing guide](CONTRIBUTING.md) for information on local installation for development.
42
42
 
43
- ```ruby
44
- redirect to('/auth/auth0')
45
- ```
43
+ ## Configure the SDK
44
+
45
+ Adding the SDK to your Rails app requires a few steps:
46
46
 
47
- > You can customize your hosted login page in your [Auth0 Dashboard](https://manage.auth0.com/#/login_page)
47
+ - [Create the configuration file](#create-the-configuration-file)
48
+ - [Create the initializer](#create-the-initializer)
49
+ - [Create the callback controller](#create-the-callback-controller)
50
+ - [Add routes](#add-routes)
48
51
 
49
- ### Auth parameters
52
+ ### Create the configuration file
50
53
 
51
- To send additional parameters during login you can specify them when you register the provider
54
+ Create the file `./config/auth0.yml` within your application directory with the following content:
55
+
56
+ ```yml
57
+ development:
58
+ auth0_domain: <YOUR_DOMAIN>
59
+ auth0_client_id: <YOUR_CLIENT_ID>
60
+ auth0_client_secret: <YOUR AUTH0 CLIENT SECRET>
61
+ ```
62
+
63
+ ### Create the initializer
64
+
65
+ Create a new Ruby file in `./config/initializers/auth0.rb` to configure the OmniAuth middleware:
52
66
 
53
67
  ```ruby
54
- provider
55
- :auth0,
56
- ENV['AUTH0_CLIENT_ID'],
57
- ENV['AUTH0_CLIENT_SECRET'],
58
- ENV['AUTH0_DOMAIN'],
59
- {
68
+ AUTH0_CONFIG = Rails.application.config_for(:auth0)
69
+
70
+ Rails.application.config.middleware.use OmniAuth::Builder do
71
+ provider(
72
+ :auth0,
73
+ AUTH0_CONFIG['auth0_client_id'],
74
+ AUTH0_CONFIG['auth0_client_secret'],
75
+ AUTH0_CONFIG['auth0_domain'],
76
+ callback_path: '/auth/auth0/callback',
60
77
  authorize_params: {
61
- scope: 'openid read:users write:order',
62
- audience: 'https://mydomain/api'
78
+ scope: 'openid profile'
63
79
  }
64
- }
80
+ )
81
+ end
65
82
  ```
66
83
 
67
- that will tell it to send those parameters on every Auth request.
84
+ ### Create the callback controller
68
85
 
69
- Or you can do it for a specific Auth request by adding them in the query parameter of the redirect url:
86
+ Create a new controller `./app/controllers/auth0_controller.rb` to handle the callback from Auth0.
87
+
88
+ > You can also run `rails generate controller auth0 callback failure logout --skip-assets --skip-helper --skip-routes --skip-template-engine` to scaffold this controller for you.
70
89
 
71
90
  ```ruby
72
- redirect_to '/auth/auth0?connection=google-oauth2'
91
+ # ./app/controllers/auth0_controller.rb
92
+ class Auth0Controller < ApplicationController
93
+ def callback
94
+ # OmniAuth stores the information returned from Auth0 and the IdP in request.env['omniauth.auth'].
95
+ # In this code, you will pull the raw_info supplied from the id_token and assign it to the session.
96
+ # Refer to https://github.com/auth0/omniauth-auth0/blob/master/EXAMPLES.md#example-of-the-resulting-authentication-hash for complete information on 'omniauth.auth' contents.
97
+ auth_info = request.env['omniauth.auth']
98
+ session[:userinfo] = auth_info['extra']['raw_info']
99
+
100
+ # Redirect to the URL you want after successful auth
101
+ redirect_to '/dashboard'
102
+ end
103
+
104
+ def failure
105
+ # Handles failed authentication -- Show a failure page (you can also handle with a redirect)
106
+ @error_msg = request.params['message']
107
+ end
108
+
109
+ def logout
110
+ # you will finish this in a later step
111
+ end
112
+ end
73
113
  ```
74
114
 
75
- ### Auth Hash
76
-
77
- Auth0 strategy will have the standard OmniAuth hash attributes:
115
+ ### Add routes
78
116
 
79
- - provider: the name of the strategy, in this case `auth0`
80
- - uid: the user identifier
81
- - info: the result of the call to /userinfo using OmniAuth standard attributes
82
- - credentials: Auth0 tokens, at least will have an access_token but can eventually have refresh_token and/or id_token
83
- - extra: Additional info obtained from calling /userinfo in the attribute `raw_info`
117
+ Finally, add the following routes to your `./config/routes.rb` file:
84
118
 
85
119
  ```ruby
86
- {
87
- :provider => 'auth0',
88
- :uid => 'google-oauth2|this-is-the-google-id',
89
- :info => {
90
- :name => 'John Foo',
91
- :email => 'johnfoo@example.org',
92
- :nickname => 'john',
93
- :image => 'https://example.org/john.jpg'
94
- },
95
- :credentials => {
96
- :token => 'XdDadllcas2134rdfdsI',
97
- :expires_at => 1485373937,
98
- :expires => true,
99
- :refresh_token => 'aKNajdjfj123nBasd',
100
- :id_token => 'eyJhbGciOiJIUzI1NiIsImN0eSI6IkpXVCJ9.eyJuYW1lIjoiSm9obiBGb28ifQ.lxAiy1rqve8ZHQEQVehUlP1sommPHVJDhgPgFPnDosg',
101
- :token_type => 'bearer',
102
- },
103
- :extra => {
104
- :raw_info => {
105
- :email => 'johnfoo@example.org',
106
- :email_verified => 'true',
107
- :name => 'John Foo',
108
- :picture => 'https://example.org/john.jpg',
109
- :user_id => 'google-oauth2|this-is-the-google-id',
110
- :nickname => 'john',
111
- :created_at: '2014-07-15T17:19:50.387Z'
112
- }
113
- }
114
- }
120
+ Rails.application.routes.draw do
121
+ # ..
122
+ get '/auth/auth0/callback' => 'auth0#callback'
123
+ get '/auth/failure' => 'auth0#failure'
124
+ get '/auth/logout' => 'auth0#logout'
125
+ end
115
126
  ```
116
127
 
117
- ### ActionDispatch::Cookies::CookieOverflow issue
128
+ ## Logging in
118
129
 
119
- If you are getting this error it means that you are using Cookie sessions and since you are storing the whole profile it overflows the max-size of 4K.
130
+ To redirect your users to Auth0 for authentication, redirect your users to the `/auth/auth0` endpoint of your app. One way to do this is to use a link or button on a page:
120
131
 
121
- You can change to use In-Memory store for development as follows:
132
+ ```html
133
+ <%= button_to 'Login', '/auth/auth0', method: :post %>
134
+ ```
122
135
 
123
- # /config/initializers/session_store.rb
124
- CrazyApp::Application.config.session_store :cache_store
136
+ ## Feedback
125
137
 
126
- # /config/environments/development.rb
127
- config.cache_store = :memory_store
138
+ ### Contributing
128
139
 
129
- ## Documentation
140
+ We appreciate feedback and contribution to this repo! Before you get started, please see the following:
130
141
 
131
- For more information about [auth0](http://auth0.com) contact our [documentation page](http://docs.auth0.com/).
142
+ - [Auth0's general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
143
+ - [Auth0's code of conduct guidelines](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
144
+ - [This repo's contribution guide](https://github.com/auth0/omniauth-auth0/blob/master/CONTRIBUTING.md)
132
145
 
133
- ## Issue Reporting
146
+ ### Raise an issue
134
147
 
135
- If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The [Responsible Disclosure Program](https://auth0.com/whitehat) details the procedure for disclosing security issues.
148
+ To provide feedback or report a bug, please [raise an issue on our issue tracker](https://github.com/auth0/omniauth-auth0/issues).
136
149
 
137
- ## Author
150
+ ### Vulnerability Reporting
138
151
 
139
- [Auth0](https://auth0.com)
152
+ Please do not report security vulnerabilities on the public GitHub issue tracker. The [Responsible Disclosure Program](https://auth0.com/whitehat) details the procedure for disclosing security issues.
140
153
 
141
- ## License
154
+ ---
142
155
 
143
- This project is licensed under the MIT license. See the [LICENSE](LICENSE) file for more info.
156
+ <p align="center">
157
+ <picture>
158
+ <source media="(prefers-color-scheme: dark)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_dark_mode.png" width="150">
159
+ <source media="(prefers-color-scheme: light)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png" width="150">
160
+ <img alt="Auth0 Logo" src="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png" width="150">
161
+ </picture>
162
+ </p>
163
+ <p align="center">
164
+ Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout <a href="https://auth0.com/why-auth0">Why Auth0?</a>
165
+ </p>
166
+ <p align="center">
167
+ This project is licensed under the MIT license. See the <a href="https://github.com/auth0/omniauth-auth0/blob/master/LICENSE"> LICENSE</a> file for more info.
168
+ </p>
data/Rakefile CHANGED
@@ -10,7 +10,7 @@ begin
10
10
  RuboCop::RakeTask.new
11
11
  rescue LoadError
12
12
  task :rubocop do
13
- $stderr.puts 'Rubocop is disabled'
13
+ warn 'Rubocop is disabled'
14
14
  end
15
15
  end
16
16
 
@@ -23,7 +23,7 @@ namespace :sinatra do
23
23
  end
24
24
 
25
25
  desc 'Run specs'
26
- task default: [:spec, :rubocop]
26
+ task default: %i[spec rubocop]
27
27
  task test: :spec
28
28
  task :guard do
29
29
  system 'bundle exec guard'