omniauth-auth0 2.4.0 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.circleci/config.yml +27 -5
- data/.github/CODEOWNERS +1 -1
- data/.github/ISSUE_TEMPLATE/config.yml +8 -0
- data/.github/ISSUE_TEMPLATE/feature_request.md +39 -0
- data/.github/ISSUE_TEMPLATE/report_a_bug.md +55 -0
- data/.gitignore +2 -0
- data/CHANGELOG.md +70 -0
- data/Gemfile +1 -1
- data/README.md +99 -2
- data/lib/omniauth-auth0/version.rb +1 -1
- data/lib/omniauth/auth0/jwt_validator.rb +63 -13
- data/lib/omniauth/strategies/auth0.rb +17 -7
- data/omniauth-auth0.gemspec +3 -2
- data/spec/omniauth/auth0/jwt_validator_spec.rb +261 -33
- data/spec/omniauth/strategies/auth0_spec.rb +74 -17
- metadata +26 -11
- data/.github/ISSUE_TEMPLATE.md +0 -39
- data/Gemfile.lock +0 -167
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 0520b864e8bb97a9d82fed1babc9caa7097e101a1189b1c42cf15b1180ceb4df
|
|
4
|
+
data.tar.gz: 87e8bd695538c9b3b1121a3a3fd1e308d5ea8426e5a9e16085958b0c494f7dc2
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: ae02867645d43d7cd0002adeeba78a9a2af3022553766e4c93f64f612bcae587a1cb04c7552734b76fdf9bbc8802c1ad8821f79b28c11b24d66e20514e6bd937
|
|
7
|
+
data.tar.gz: 1d507d8fada206d902fbfd4f527728fc36918b2fa169f3c0e806b233afd10bf8ea0739afc3f57068c70e704d8ac6060b4d11929057840f7380f03e113a7b9171
|
data/.circleci/config.yml
CHANGED
|
@@ -1,17 +1,38 @@
|
|
|
1
1
|
version: 2.1
|
|
2
|
+
matrix_rubyversions: &matrix_rubyversions
|
|
3
|
+
matrix:
|
|
4
|
+
parameters:
|
|
5
|
+
rubyversion: ["2.5", "2.6", "2.7", "3.0"]
|
|
6
|
+
# Default version of ruby to use for lint and publishing
|
|
7
|
+
default_rubyversion: &default_rubyversion "2.7"
|
|
8
|
+
|
|
9
|
+
executors:
|
|
10
|
+
ruby:
|
|
11
|
+
parameters:
|
|
12
|
+
rubyversion:
|
|
13
|
+
type: string
|
|
14
|
+
default: *default_rubyversion
|
|
15
|
+
docker:
|
|
16
|
+
- image: circleci/ruby:<< parameters.rubyversion >>
|
|
17
|
+
|
|
2
18
|
jobs:
|
|
3
19
|
run-tests:
|
|
4
|
-
|
|
5
|
-
|
|
20
|
+
parameters:
|
|
21
|
+
rubyversion:
|
|
22
|
+
type: string
|
|
23
|
+
default: *default_rubyversion
|
|
24
|
+
executor:
|
|
25
|
+
name: ruby
|
|
26
|
+
rubyversion: "<< parameters.rubyversion >>"
|
|
6
27
|
steps:
|
|
7
28
|
- checkout
|
|
8
29
|
- restore_cache:
|
|
9
30
|
keys:
|
|
10
|
-
- gems-v2-{{ checksum "Gemfile
|
|
31
|
+
- gems-v2-{{ checksum "Gemfile" }}
|
|
11
32
|
- gems-v2-
|
|
12
33
|
- run: bundle check || bundle install
|
|
13
34
|
- save_cache:
|
|
14
|
-
key: gems-v2--{{ checksum "Gemfile
|
|
35
|
+
key: gems-v2--{{ checksum "Gemfile" }}
|
|
15
36
|
paths:
|
|
16
37
|
- vendor/bundle
|
|
17
38
|
- run: bundle exec rake spec
|
|
@@ -19,4 +40,5 @@ jobs:
|
|
|
19
40
|
workflows:
|
|
20
41
|
tests:
|
|
21
42
|
jobs:
|
|
22
|
-
- run-tests
|
|
43
|
+
- run-tests:
|
|
44
|
+
<<: *matrix_rubyversions
|
data/.github/CODEOWNERS
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
* @auth0/dx-sdks-
|
|
1
|
+
* @auth0/dx-sdks-engineer
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
blank_issues_enabled: false
|
|
2
|
+
contact_links:
|
|
3
|
+
- name: Auth0 Community
|
|
4
|
+
url: https://community.auth0.com/c/sdks/5
|
|
5
|
+
about: Discuss this SDK in the Auth0 Community forums
|
|
6
|
+
- name: Library Documentation
|
|
7
|
+
url: https://github.com/auth0/omniauth-auth0#documentation
|
|
8
|
+
about: Read the library docs on Auth0.com
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: Feature request
|
|
3
|
+
about: Suggest an idea or a feature for this project
|
|
4
|
+
title: ''
|
|
5
|
+
labels: feature request
|
|
6
|
+
assignees: ''
|
|
7
|
+
---
|
|
8
|
+
|
|
9
|
+
<!--
|
|
10
|
+
**Please do not report security vulnerabilities here**. The Responsible Disclosure Program (https://auth0.com/whitehat) details the procedure for disclosing security issues.
|
|
11
|
+
|
|
12
|
+
Thank you in advance for helping us to improve this library! Your attention to detail here is greatly appreciated and will help us respond as quickly as possible. For general support or usage questions, use the Auth0 Community (https://community.auth0.com/) or Auth0 Support (https://support.auth0.com/). Finally, to avoid duplicates, please search existing Issues before submitting one here.
|
|
13
|
+
|
|
14
|
+
By submitting an Issue to this repository, you agree to the terms within the Auth0 Code of Conduct (https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md).
|
|
15
|
+
-->
|
|
16
|
+
|
|
17
|
+
### Describe the problem you'd like to have solved
|
|
18
|
+
|
|
19
|
+
<!--
|
|
20
|
+
> A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
|
21
|
+
-->
|
|
22
|
+
|
|
23
|
+
### Describe the ideal solution
|
|
24
|
+
|
|
25
|
+
<!--
|
|
26
|
+
> A clear and concise description of what you want to happen.
|
|
27
|
+
-->
|
|
28
|
+
|
|
29
|
+
## Alternatives and current work-arounds
|
|
30
|
+
|
|
31
|
+
<!--
|
|
32
|
+
> A clear and concise description of any alternatives you've considered or any work-arounds that are currently in place.
|
|
33
|
+
-->
|
|
34
|
+
|
|
35
|
+
### Additional information, if any
|
|
36
|
+
|
|
37
|
+
<!--
|
|
38
|
+
> Add any other context or screenshots about the feature request here.
|
|
39
|
+
-->
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: Report a bug
|
|
3
|
+
about: Have you found a bug or issue? Create a bug report for this SDK
|
|
4
|
+
title: ''
|
|
5
|
+
labels: bug report
|
|
6
|
+
assignees: ''
|
|
7
|
+
---
|
|
8
|
+
|
|
9
|
+
<!--
|
|
10
|
+
**Please do not report security vulnerabilities here**. The Responsible Disclosure Program (https://auth0.com/whitehat) details the procedure for disclosing security issues.
|
|
11
|
+
|
|
12
|
+
Thank you in advance for helping us to improve this library! Please read through the template below and answer all relevant questions. Your additional work here is greatly appreciated and will help us respond as quickly as possible. For general support or usage questions, use the Auth0 Community (https://community.auth0.com/) or Auth0 Support (https://support.auth0.com/). Finally, to avoid duplicates, please search existing Issues before submitting one here.
|
|
13
|
+
|
|
14
|
+
By submitting an Issue to this repository, you agree to the terms within the Auth0 Code of Conduct (https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md).
|
|
15
|
+
-->
|
|
16
|
+
|
|
17
|
+
### Describe the problem
|
|
18
|
+
|
|
19
|
+
<!--
|
|
20
|
+
> Provide a clear and concise description of the issue
|
|
21
|
+
-->
|
|
22
|
+
|
|
23
|
+
### What was the expected behavior?
|
|
24
|
+
|
|
25
|
+
<!--
|
|
26
|
+
> Tell us about the behavior you expected to see
|
|
27
|
+
-->
|
|
28
|
+
|
|
29
|
+
### Reproduction
|
|
30
|
+
<!--
|
|
31
|
+
> Detail the steps taken to reproduce this error, and whether this issue can be reproduced consistently or if it is intermittent.
|
|
32
|
+
> **Note**: If clear, reproducable steps or the smallest sample app demonstrating misbehavior cannot be provided, we may not be able to follow up on this bug report.
|
|
33
|
+
|
|
34
|
+
> Where possible, please include:
|
|
35
|
+
>
|
|
36
|
+
> - The smallest possible sample app that reproduces the undesirable behavior
|
|
37
|
+
> - Log files (redact/remove sensitive information)
|
|
38
|
+
> - Application settings (redact/remove sensitive information)
|
|
39
|
+
> - Screenshots
|
|
40
|
+
-->
|
|
41
|
+
|
|
42
|
+
- Step 1..
|
|
43
|
+
- Step 2..
|
|
44
|
+
- ...
|
|
45
|
+
|
|
46
|
+
### Environment
|
|
47
|
+
|
|
48
|
+
<!--
|
|
49
|
+
> Please provide the following:
|
|
50
|
+
-->
|
|
51
|
+
|
|
52
|
+
- **Version of this library used:**
|
|
53
|
+
- **Which framework are you using, if applicable:**
|
|
54
|
+
- **Other modules/plugins/libraries that might be involved:**
|
|
55
|
+
- **Any other relevant information you think would be useful:**
|
data/.gitignore
CHANGED
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,75 @@
|
|
|
1
1
|
# Change Log
|
|
2
2
|
|
|
3
|
+
## [v3.0.0](https://github.com/auth0/omniauth-auth0/tree/v3.0.0) (2021-04-14)
|
|
4
|
+
Version 3.0 introduces [Omniauth v2.0](https://github.com/omniauth/omniauth/releases/tag/v2.0.0) which addresses [CVE-2015-9284](https://nvd.nist.gov/vuln/detail/CVE-2015-9284). Omniauth now defaults to only allow `POST` as the allowed request_phase method. This was previously handled through the recommended [mitigation](https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284) using the `omniauth-rails_csrf_protection v0.x.x` gem to provide CSRF protection.
|
|
5
|
+
|
|
6
|
+
### Upgrading to omniauth-rails_csrf_protection v1.0.0
|
|
7
|
+
If you are using `omniauth-rails_csrf_protection` to provide CSRF protection, you will need to be upgrade to `1.x.x`.
|
|
8
|
+
|
|
9
|
+
### BREAKING CHANGES
|
|
10
|
+
Now that OmniAuth now defaults to only `POST` as the allowed request_phase method, if you aren't already, you will need to convert any login links to use [form helpers](https://api.rubyonrails.org/classes/ActionView/Helpers/FormHelper.html#method-i-form_for) with the `POST` method.
|
|
11
|
+
|
|
12
|
+
```html+ruby
|
|
13
|
+
# OLD -- GET request
|
|
14
|
+
<a href='/auth/auth0'>Login</a>
|
|
15
|
+
|
|
16
|
+
# NEW Example #1 -- POST request
|
|
17
|
+
<%= link_to 'Login', 'auth/auth0', method: :post %>
|
|
18
|
+
|
|
19
|
+
# NEW Example #2 -- POST request
|
|
20
|
+
<%= button_to 'Login', 'auth/auth0', method: :post %>
|
|
21
|
+
|
|
22
|
+
# NEW Example #3 -- POST request
|
|
23
|
+
<%= form_tag('/auth/auth0', method: :post) do %>
|
|
24
|
+
<button type='submit'></button>
|
|
25
|
+
<% end %>
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
### Allowing GET Requests
|
|
29
|
+
In the scenario you absolutely must use GET requests as an allowed request method for authentication, you can override the protection provided with the following config override:
|
|
30
|
+
|
|
31
|
+
```ruby
|
|
32
|
+
# Allowing GET requests will expose you to CVE-2015-9284
|
|
33
|
+
OmniAuth.config.allowed_request_methods = [:get, :post]
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
## [v2.6.0](https://github.com/auth0/omniauth-auth0/tree/v2.6.0) (2021-04-01)
|
|
37
|
+
|
|
38
|
+
[Full Changelog](https://github.com/auth0/omniauth-auth0/compare/v2.5.0...v2.6.0)
|
|
39
|
+
|
|
40
|
+
**Added**
|
|
41
|
+
- Org Support [SDK-2395] [\#124](https://github.com/auth0/omniauth-auth0/pull/124) ([davidpatrick](https://github.com/davidpatrick))
|
|
42
|
+
- Add login_hint to permitted params [\#123](https://github.com/auth0/omniauth-auth0/pull/123) ([Roriz](https://github.com/Roriz))
|
|
43
|
+
|
|
44
|
+
## [v2.5.0](https://github.com/auth0/omniauth-auth0/tree/v2.5.0) (2021-01-21)
|
|
45
|
+
|
|
46
|
+
[Full Changelog](https://github.com/auth0/omniauth-auth0/compare/v2.4.2...v2.5.0)
|
|
47
|
+
|
|
48
|
+
**Added**
|
|
49
|
+
- Parsing claims from the id_token [\#120](https://github.com/auth0/omniauth-auth0/pull/120) ([davidpatrick](https://github.com/davidpatrick))
|
|
50
|
+
|
|
51
|
+
**Changed**
|
|
52
|
+
- Setup build matrix in CI [\#116](https://github.com/auth0/omniauth-auth0/pull/116) ([dmathieu](https://github.com/dmathieu))
|
|
53
|
+
|
|
54
|
+
**Fixed**
|
|
55
|
+
- Fixes params passed to authorize [\#119](https://github.com/auth0/omniauth-auth0/pull/119) ([davidpatrick](https://github.com/davidpatrick))
|
|
56
|
+
|
|
57
|
+
|
|
58
|
+
## [v2.4.2](https://github.com/auth0/omniauth-auth0/tree/v2.4.2) (2021-01-19)
|
|
59
|
+
|
|
60
|
+
[Full Changelog](https://github.com/auth0/omniauth-auth0/compare/v2.4.1...v2.4.2)
|
|
61
|
+
|
|
62
|
+
**Fixed**
|
|
63
|
+
- Lock Omniauth to 1.9 in gemspec
|
|
64
|
+
|
|
65
|
+
## [v2.4.1](https://github.com/auth0/omniauth-auth0/tree/v2.4.1) (2020-10-08)
|
|
66
|
+
|
|
67
|
+
[Full Changelog](https://github.com/auth0/omniauth-auth0/compare/v2.4.0...v2.4.1)
|
|
68
|
+
|
|
69
|
+
**Fixed**
|
|
70
|
+
- Verify the JWT Signature [\#109](https://github.com/auth0/omniauth-auth0/pull/109) ([jimmyjames](https://github.com/jimmyjames))
|
|
71
|
+
|
|
72
|
+
|
|
3
73
|
## [v2.4.0](https://github.com/auth0/omniauth-auth0/tree/v2.4.0) (2020-09-22)
|
|
4
74
|
|
|
5
75
|
[Full Changelog](https://github.com/auth0/omniauth-auth0/compare/v2.3.1...v2.4.0)
|
data/Gemfile
CHANGED
data/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
An [OmniAuth](https://github.com/intridea/omniauth) strategy for authenticating with [Auth0](https://auth0.com). This strategy is based on the [OmniAuth OAuth2](https://github.com/omniauth/omniauth-oauth2) strategy.
|
|
4
4
|
|
|
5
|
-
> :warning: **Important security note:** This solution uses a 3rd party library
|
|
5
|
+
> :warning: **Important security note for v2:** This solution uses a 3rd party library that had a [security issue(s)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9284) in v2. Please review the details of the vulnerability, including [Auth0](https://github.com/auth0/omniauth-auth0/issues/82 ) and other recommended [mitigations](https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284), before implementing the solution in v2. **[Upgrading to v3](https://github.com/auth0/omniauth-auth0/pull/128) of this library resolves the issue.**
|
|
6
6
|
|
|
7
7
|
[](https://circleci.com/gh/auth0/omniauth-auth0)
|
|
8
8
|
[](https://codecov.io/gh/auth0/omniauth-auth0)
|
|
@@ -25,6 +25,7 @@ An [OmniAuth](https://github.com/intridea/omniauth) strategy for authenticating
|
|
|
25
25
|
|
|
26
26
|
- [Ruby on Rails Quickstart](https://auth0.com/docs/quickstart/webapp/rails)
|
|
27
27
|
- [Sample projects](https://github.com/auth0-samples/auth0-rubyonrails-sample)
|
|
28
|
+
- [API Reference](https://www.rubydoc.info/gems/omniauth-auth0)
|
|
28
29
|
|
|
29
30
|
## Installation
|
|
30
31
|
|
|
@@ -130,9 +131,105 @@ In some scenarios, you may need to pass specific query parameters to `/authorize
|
|
|
130
131
|
- `connection_scope`
|
|
131
132
|
- `prompt`
|
|
132
133
|
- `screen_hint` (only relevant to New Universal Login Experience)
|
|
134
|
+
- `organization`
|
|
135
|
+
- `invitation`
|
|
133
136
|
|
|
134
137
|
Simply pass these query parameters to your OmniAuth redirect endpoint to enable their behavior.
|
|
135
138
|
|
|
139
|
+
## Examples
|
|
140
|
+
|
|
141
|
+
### Auth0 Organizations
|
|
142
|
+
|
|
143
|
+
[Organizations](https://auth0.com/docs/organizations) is a set of features that provide better support for developers who build and maintain SaaS and Business-to-Business (B2B) applications.
|
|
144
|
+
|
|
145
|
+
Using Organizations, you can:
|
|
146
|
+
|
|
147
|
+
- Represent teams, business customers, partner companies, or any logical grouping of users that should have different ways of accessing your applications, as organizations.
|
|
148
|
+
- Manage their membership in a variety of ways, including user invitation.
|
|
149
|
+
- Configure branded, federated login flows for each organization.
|
|
150
|
+
- Implement role-based access control, such that users can have different roles when authenticating in the context of different organizations.
|
|
151
|
+
- Build administration capabilities into your products, using Organizations APIs, so that those businesses can manage their own organizations.
|
|
152
|
+
|
|
153
|
+
Note that Organizations is currently only available to customers on our Enterprise and Startup subscription plans.
|
|
154
|
+
|
|
155
|
+
#### Logging in with an Organization
|
|
156
|
+
|
|
157
|
+
Logging in with an Organization is as easy as passing the parameters to the authorize endpoint. You can do this with
|
|
158
|
+
|
|
159
|
+
```ruby
|
|
160
|
+
<%=
|
|
161
|
+
button_to 'Login', 'auth/auth0',
|
|
162
|
+
method: :post,
|
|
163
|
+
params: {
|
|
164
|
+
# Found in your Auth0 dashboard, under Organization settings:
|
|
165
|
+
organization: '{AUTH0_ORGANIZATION}'
|
|
166
|
+
}
|
|
167
|
+
%>
|
|
168
|
+
```
|
|
169
|
+
|
|
170
|
+
Alternatively you can configure the organization when you register the provider:
|
|
171
|
+
|
|
172
|
+
```ruby
|
|
173
|
+
provider
|
|
174
|
+
:auth0,
|
|
175
|
+
ENV['AUTH0_CLIENT_ID'],
|
|
176
|
+
ENV['AUTH0_CLIENT_SECRET'],
|
|
177
|
+
ENV['AUTH0_DOMAIN']
|
|
178
|
+
{
|
|
179
|
+
authorize_params: {
|
|
180
|
+
scope: 'openid read:users',
|
|
181
|
+
audience: 'https://{AUTH0_DOMAIN}/api',
|
|
182
|
+
organization: '{AUTH0_ORGANIZATION}'
|
|
183
|
+
}
|
|
184
|
+
}
|
|
185
|
+
```
|
|
186
|
+
|
|
187
|
+
When passing `openid` to the scope and `organization` to the authorize params, you will receive an ID token on callback with the `org_id` claim. This claim is validated for you by the SDK.
|
|
188
|
+
|
|
189
|
+
#### Validating Organizations when using Organization Login Prompt
|
|
190
|
+
|
|
191
|
+
When Organization login prompt is enabled on your application, but you haven't specified an Organization for the application's authorization endpoint, the `org_id` claim will be present on the ID token, and should be validated to ensure that the value received is expected or known.
|
|
192
|
+
|
|
193
|
+
Normally, validating the issuer would be enough to ensure that the token was issued by Auth0, and this check is performed by the SDK. However, in the case of organizations, additional checks should be made so that the organization within an Auth0 tenant is expected.
|
|
194
|
+
|
|
195
|
+
In particular, the `org_id` claim should be checked to ensure it is a value that is already known to the application. This could be validated against a known list of organization IDs, or perhaps checked in conjunction with the current request URL. e.g. the sub-domain may hint at what organization should be used to validate the ID Token.
|
|
196
|
+
|
|
197
|
+
Here is an example using it in your `callback` method
|
|
198
|
+
|
|
199
|
+
```ruby
|
|
200
|
+
def callback
|
|
201
|
+
claims = request.env['omniauth.auth']['extra']['raw_info']
|
|
202
|
+
|
|
203
|
+
if claims["org"] && claims["org"] !== expected_org
|
|
204
|
+
redirect_to '/unauthorized', status: 401
|
|
205
|
+
else
|
|
206
|
+
session[:userinfo] = claims
|
|
207
|
+
redirect_to '/dashboard'
|
|
208
|
+
end
|
|
209
|
+
end
|
|
210
|
+
```
|
|
211
|
+
|
|
212
|
+
For more information, please read [Work with Tokens and Organizations](https://auth0.com/docs/organizations/using-tokens) on Auth0 Docs.
|
|
213
|
+
|
|
214
|
+
#### Accepting user invitations
|
|
215
|
+
|
|
216
|
+
Auth0 Organizations allow users to be invited using emailed links, which will direct a user back to your application. The URL the user will arrive at is based on your configured `Application Login URI`, which you can change from your Application's settings inside the Auth0 dashboard.
|
|
217
|
+
|
|
218
|
+
When the user arrives at your application using an invite link, you can expect three query parameters to be provided: `invitation`, `organization`, and `organization_name`. These will always be delivered using a GET request.
|
|
219
|
+
|
|
220
|
+
You can then supply those parametrs to a `button_to` or `link_to` helper
|
|
221
|
+
|
|
222
|
+
```ruby
|
|
223
|
+
<%=
|
|
224
|
+
button_to 'Login', 'auth/auth0',
|
|
225
|
+
method: :post,
|
|
226
|
+
params: {
|
|
227
|
+
organization: '{YOUR_ORGANIZATION_ID}',
|
|
228
|
+
invitation: '{INVITE_CODE}'
|
|
229
|
+
}
|
|
230
|
+
%>
|
|
231
|
+
```
|
|
232
|
+
|
|
136
233
|
## Contribution
|
|
137
234
|
|
|
138
235
|
We appreciate feedback and contribution to this repo! Before you get started, please see the following:
|
|
@@ -169,4 +266,4 @@ Auth0 helps you to easily:
|
|
|
169
266
|
The OmniAuth Auth0 strategy is licensed under MIT - [LICENSE](LICENSE)
|
|
170
267
|
|
|
171
268
|
|
|
172
|
-
[](https://app.fossa.com/projects/git%2Bgithub.com%2Fauth0%2Fomniauth-auth0?ref=badge_large)
|
|
269
|
+
[](https://app.fossa.com/projects/git%2Bgithub.com%2Fauth0%2Fomniauth-auth0?ref=badge_large)
|
|
@@ -28,23 +28,34 @@ module OmniAuth
|
|
|
28
28
|
@client_secret = options.client_secret
|
|
29
29
|
end
|
|
30
30
|
|
|
31
|
+
# Verify a token's signature. Only tokens signed with the RS256 or HS256 signatures are supported.
|
|
32
|
+
# Deprecated: Please use `decode` instead
|
|
33
|
+
# @return array - The token's key and signing algorithm
|
|
31
34
|
def verify_signature(jwt)
|
|
32
35
|
head = token_head(jwt)
|
|
36
|
+
key, alg = extract_key(head)
|
|
33
37
|
|
|
34
|
-
#
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
38
|
+
# Call decode to verify the signature
|
|
39
|
+
JWT.decode(jwt, key, true, decode_opts(alg))
|
|
40
|
+
return key, alg
|
|
41
|
+
end
|
|
42
|
+
|
|
43
|
+
# Decodes a JWT and verifies it's signature. Only tokens signed with the RS256 or HS256 signatures are supported.
|
|
44
|
+
# @param jwt string - JWT to verify.
|
|
45
|
+
# @return hash - The decoded token, if there were no exceptions.
|
|
46
|
+
# @see https://github.com/jwt/ruby-jwt
|
|
47
|
+
def decode(jwt)
|
|
48
|
+
head = token_head(jwt)
|
|
49
|
+
key, alg = extract_key(head)
|
|
50
|
+
|
|
51
|
+
# Call decode to verify the signature
|
|
52
|
+
JWT.decode(jwt, key, true, decode_opts(alg))
|
|
42
53
|
end
|
|
43
54
|
|
|
44
55
|
# Verify a JWT.
|
|
45
56
|
# @param jwt string - JWT to verify.
|
|
46
57
|
# @param authorize_params hash - Authorization params to verify on the JWT
|
|
47
|
-
# @return hash - The verified token, if there were no exceptions.
|
|
58
|
+
# @return hash - The verified token payload, if there were no exceptions.
|
|
48
59
|
def verify(jwt, authorize_params = {})
|
|
49
60
|
if !jwt
|
|
50
61
|
raise OmniAuth::Auth0::TokenValidationError.new('ID token is required but missing')
|
|
@@ -55,8 +66,7 @@ module OmniAuth
|
|
|
55
66
|
raise OmniAuth::Auth0::TokenValidationError.new('ID token could not be decoded')
|
|
56
67
|
end
|
|
57
68
|
|
|
58
|
-
|
|
59
|
-
id_token, header = JWT.decode(jwt, key, false)
|
|
69
|
+
id_token, header = decode(jwt)
|
|
60
70
|
verify_claims(id_token, authorize_params)
|
|
61
71
|
|
|
62
72
|
return id_token
|
|
@@ -93,11 +103,37 @@ module OmniAuth
|
|
|
93
103
|
end
|
|
94
104
|
|
|
95
105
|
private
|
|
106
|
+
# Get the JWT decode options. We disable the claim checks since we perform our claim validation logic
|
|
107
|
+
# Docs: https://github.com/jwt/ruby-jwt
|
|
108
|
+
# @return hash
|
|
109
|
+
def decode_opts(alg)
|
|
110
|
+
{
|
|
111
|
+
algorithm: alg,
|
|
112
|
+
verify_expiration: false,
|
|
113
|
+
verify_iat: false,
|
|
114
|
+
verify_iss: false,
|
|
115
|
+
verify_aud: false,
|
|
116
|
+
verify_jti: false,
|
|
117
|
+
verify_subj: false,
|
|
118
|
+
verify_not_before: false
|
|
119
|
+
}
|
|
120
|
+
end
|
|
121
|
+
|
|
122
|
+
def extract_key(head)
|
|
123
|
+
if head[:alg] == 'RS256'
|
|
124
|
+
key, alg = [rs256_decode_key(head[:kid]), head[:alg]]
|
|
125
|
+
elsif head[:alg] == 'HS256'
|
|
126
|
+
key, alg = [@client_secret, head[:alg]]
|
|
127
|
+
else
|
|
128
|
+
raise OmniAuth::Auth0::TokenValidationError.new("Signature algorithm of #{head[:alg]} is not supported. Expected the ID token to be signed with RS256 or HS256")
|
|
129
|
+
end
|
|
130
|
+
end
|
|
131
|
+
|
|
96
132
|
def rs256_decode_key(kid)
|
|
97
133
|
jwks_x5c = jwks_key(:x5c, kid)
|
|
98
134
|
|
|
99
135
|
if jwks_x5c.nil?
|
|
100
|
-
raise OmniAuth::Auth0::TokenValidationError.new("Could not find a public key for Key ID (kid) '#{kid}'
|
|
136
|
+
raise OmniAuth::Auth0::TokenValidationError.new("Could not find a public key for Key ID (kid) '#{kid}'")
|
|
101
137
|
end
|
|
102
138
|
|
|
103
139
|
jwks_public_cert(jwks_x5c.first)
|
|
@@ -130,13 +166,15 @@ module OmniAuth
|
|
|
130
166
|
def uri_string(uri)
|
|
131
167
|
temp_domain = URI(uri)
|
|
132
168
|
temp_domain = URI("https://#{uri}") unless temp_domain.scheme
|
|
133
|
-
|
|
169
|
+
temp_domain = temp_domain.to_s
|
|
170
|
+
temp_domain.end_with?('/') ? temp_domain : "#{temp_domain}/"
|
|
134
171
|
end
|
|
135
172
|
|
|
136
173
|
def verify_claims(id_token, authorize_params)
|
|
137
174
|
leeway = authorize_params[:leeway] || 60
|
|
138
175
|
max_age = authorize_params[:max_age]
|
|
139
176
|
nonce = authorize_params[:nonce]
|
|
177
|
+
organization = authorize_params[:organization]
|
|
140
178
|
|
|
141
179
|
verify_iss(id_token)
|
|
142
180
|
verify_sub(id_token)
|
|
@@ -146,6 +184,7 @@ module OmniAuth
|
|
|
146
184
|
verify_nonce(id_token, nonce)
|
|
147
185
|
verify_azp(id_token)
|
|
148
186
|
verify_auth_time(id_token, leeway, max_age)
|
|
187
|
+
verify_org(id_token, organization)
|
|
149
188
|
end
|
|
150
189
|
|
|
151
190
|
def verify_iss(id_token)
|
|
@@ -223,6 +262,17 @@ module OmniAuth
|
|
|
223
262
|
end
|
|
224
263
|
end
|
|
225
264
|
end
|
|
265
|
+
|
|
266
|
+
def verify_org(id_token, organization)
|
|
267
|
+
if organization
|
|
268
|
+
org_id = id_token['org_id']
|
|
269
|
+
if !org_id || !org_id.is_a?(String)
|
|
270
|
+
raise OmniAuth::Auth0::TokenValidationError.new("Organization Id (org_id) claim must be a string present in the ID token")
|
|
271
|
+
elsif org_id != organization
|
|
272
|
+
raise OmniAuth::Auth0::TokenValidationError.new("Organization Id (org_id) claim value mismatch in the ID token; expected '#{organization}', found '#{org_id}'")
|
|
273
|
+
end
|
|
274
|
+
end
|
|
275
|
+
end
|
|
226
276
|
end
|
|
227
277
|
end
|
|
228
278
|
end
|