omniauth-azure-activedirectory-v2 2.0.1 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c7b7178785e2c99c41ee6151625a0fe7015b6d739b6acec990869170ccc9279b
-  data.tar.gz: 212532541fef751fb142fc03c6bcc52edf120300732f0b475c05ee0ac22ee7e1
+  metadata.gz: 82d3c5122483452eb3e9b37dba4ae4faab9ccad50e343e8f91834ee87771bcb2
+  data.tar.gz: 75cb855f9c40ea1d0d3186dc3282ad89e6054c1da576e8b9d5e5983a5b617a85
 SHA512:
-  metadata.gz: 27831a75a2ced722e99022c230d1c2fa9beaeaafc692ccb4248ad58532321895e1b95764a9f25ee031d6c58e8a5dbae6ec4aa1b937988f65a7d43928b32611b2
-  data.tar.gz: decf7f79d5998bce54df815bf286f681101a8bcdbac134e6c9856c53c619bcd5e218fe9643724f5caaca415911c24f576da25eafe6f76422998d284fc426819a
+  metadata.gz: d26b6339a494b85458791b95b52302456f34930d1ea9dd445fdb24b3eda589602ffb5088bfa2ec8c37a71238317c82759dd07b30f0ae4975c2b295bc3ca6e5eb
+  data.tar.gz: 6d1ca0c3c8e6946c2a40cbf3939ab6da98e6f6004a600f09b5096d8a2dc0e65643d0b2028d80c5ce91ca5d7f29998c1cec34d4989b6d01d9c070008dfea1e1d0

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Change Log
 
+## v2.1.0 (2023-09-16)
+
+[Implements](https://github.com/RIPAGlobal/omniauth-azure-activedirectory-v2/pull/19) support for custom policies when using Microsoft Azure AD - thanks @stevenchanin!
+
+## v2.0.2 (2023-03-31)
+
+[Fixes](https://github.com/RIPAGlobal/omniauth-azure-activedirectory-v2/pull/16) inability to override prompt in authorisation parameters - thanks @lamroger!
+
 ## v2.0.1 (2023-01-11)
 
 Renames:

data/README.md

@@ -99,12 +99,25 @@ All of the items listed below are optional, unless noted otherwise. They can be
 | `client_secret`    | **Mandatory.** Client secret for the 'application' (integration) configured on the Azure side. Found via the Azure UI. |
 | `base_azure_url`   | Location of Azure login page, for specialised requirements; default is `OmniAuth::Strategies::AzureActivedirectoryV2::BASE_AZURE_URL` (at the time of writing, this is `https://login.microsoftonline.com`). |
 | `tenant_id`        | _Azure_ tenant ID for multi-tenanted use. Default is `common`. Forms part of the Azure OAuth URL - `{base}/{tenant_id}/oauth2/v2.0/...` |
+| `custom_policy`    | _Azure_ custom policy. Default is nil. Forms part of the Azure Token URL - `{base}/{tenant_id}/{custom_policy}/oauth2/v2.0/...` |
 | `authorize_params` | Additional parameters passed as URL query data in the initial OAuth redirection to Microsoft. See below for more. Empty Hash default. |
 | `domain_hint`      | If defined, sets (overwriting, if already present) `domain_hint` inside `authorize_params`. Default `nil` / none. |
 | `scope`            | If defined, sets (overwriting, if already present) `scope` inside `authorize_params`. Default is `OmniAuth::Strategies::AzureActivedirectoryV2::DEFAULT_SCOPE` (at the time of writing, this is `'openid profile email'`). |
 
 In addition, as a special case, if the request URL contains a query parameter `prompt`, then this will be written into `authorize_params` under that key, overwriting if present any other value there. Note that this comes from the current request URL at the time OAuth flow is commencing, _not_ via static options Hash data or via a custom provider class - but you _could_ just as easily set `scope` inside a custom `authorize_params` returned from a provider class, as shown in an example later; the request URL query mechanism is just another way of doing the same thing.
 
+#### Explaining `custom_policy`
+
+In the documentation for [requesting a token](https://learn.microsoft.com/en-us/azure/active-directory-b2c/access-tokens#request-a-token), Microsoft indicate that they want the name of custom policies to be given in the URL rather than in the body of the request:
+
+```
+POST <tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/oauth2/v2.0/token
+```
+
+When the underlying `oath2` gem creates the request for getting a token via POST, it places all `params` (which would include anything you've provided in the normal configuration to name your custom policy) in the `body` of the request. Unfortunately, Microsoft ignores custom policies in the body and only looks for them in the URL.
+
+If you set a `custom_policy` in your configuration, it will be included in the URL between the `tenant_id` and the remaining parts of the path (`/oauth2/v2.0/token`).
+
 #### Explaining `authorize_params`
 
 The `authorize_params` hash-like object contains key-value pairs which are transformed into URL query string data and added to existing standard OAuth query data in the URL used for the initial redirection from your web site, to the Microsoft Azure AD login page, at the start of OAuth flow. You can find these listed some way down the table just below an OAuth URL example at:
@@ -151,12 +164,23 @@ In method `#authorize_params` above, the request object is used to look for a `l
 
 
 
-
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/RIPAGlobal/omniauth-azure-activedirectory-v2. This project is intended to be a safe, welcoming space for collaboration so contributors must adhere to the [code of conduct](https://github.com/RIPAGlobal/omniauth-azure-activedirectory-v2/blob/master/CODE_OF_CONDUCT.md).
 
+### Getting running
+
+* Fork the repository
+* Check out your fork
+* `cd` into the repository
+* `bin/setup`
+* `bundle exec rspec` to make sure all the tests run
+
+### Making changes
 
+* Make your change
+* Add tests and check that `bundle exec rspec` still runs successfully
+* For new features (rather than bug fixes), update `README.md` with details
 
 ## License
 

data/lib/omniauth/azure_activedirectory_v2/version.rb

@@ -2,8 +2,8 @@ module OmniAuth
   module Azure
     module Activedirectory
       module V2
-        VERSION = "2.0.1"
-        DATE    = "2023-01-11"
+        VERSION = "2.1.0"
+        DATE    = "2023-09-16"
       end
     end
   end

data/lib/omniauth/strategies/azure_activedirectory_v2.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'omniauth-oauth2'
 
 module OmniAuth
@@ -14,41 +16,60 @@ module OmniAuth
       args [:tenant_provider]
 
       def client
-        if options.tenant_provider
-          provider = options.tenant_provider.new(self)
+        provider = if options.tenant_provider
+          options.tenant_provider.new(self)
         else
-          provider = options  # if pass has to config, get mapped right on to options
+          options
         end
 
         options.client_id = provider.client_id
         options.client_secret = provider.client_secret
         options.tenant_id =
-            provider.respond_to?(:tenant_id) ? provider.tenant_id : 'common'
+          provider.respond_to?(:tenant_id) ? provider.tenant_id : 'common'
         options.base_azure_url =
-            provider.respond_to?(:base_azure_url) ? provider.base_azure_url : BASE_AZURE_URL
+          provider.respond_to?(:base_azure_url) ? provider.base_azure_url : BASE_AZURE_URL
+
+        if provider.respond_to?(:authorize_params)
+          options.authorize_params = provider.authorize_params
+        end
 
-        options.authorize_params = provider.authorize_params if provider.respond_to?(:authorize_params)
-        options.authorize_params.domain_hint = provider.domain_hint if provider.respond_to?(:domain_hint) && provider.domain_hint
-        options.authorize_params.prompt = request.params['prompt'] if defined? request && request.params['prompt']
-        options.authorize_params.scope = (provider.scope if provider.respond_to?(:scope) && provider.scope) || DEFAULT_SCOPE
+        if provider.respond_to?(:domain_hint) && provider.domain_hint
+          options.authorize_params.domain_hint = provider.domain_hint
+        end
+
+        if defined?(request) && request.params['prompt']
+          options.authorize_params.prompt = request.params['prompt']
+        end
+
+        options.authorize_params.scope = if provider.respond_to?(:scope) && provider.scope
+          provider.scope
+        else
+          DEFAULT_SCOPE
+        end
+
+        options.custom_policy =
+          provider.respond_to?(:custom_policy) ? provider.custom_policy : nil
 
         options.client_options.authorize_url = "#{options.base_azure_url}/#{options.tenant_id}/oauth2/v2.0/authorize"
-        options.client_options.token_url = "#{options.base_azure_url}/#{options.tenant_id}/oauth2/v2.0/token"
+        options.client_options.token_url =
+          if options.custom_policy
+            "#{options.base_azure_url}/#{options.tenant_id}/#{options.custom_policy}/oauth2/v2.0/token"
+          else
+            "#{options.base_azure_url}/#{options.tenant_id}/oauth2/v2.0/token"
+          end
 
         super
       end
 
-      uid {
-        raw_info['oid']
-      }
+      uid { raw_info['oid'] }
 
       info do
         {
-            name: raw_info['name'],
-            email: raw_info['email'] || raw_info['upn'],
-            nickname: raw_info['unique_name'],
-            first_name: raw_info['given_name'],
-            last_name: raw_info['family_name']
+          name: raw_info['name'],
+          email: raw_info['email'] || raw_info['upn'],
+          nickname: raw_info['unique_name'],
+          first_name: raw_info['given_name'],
+          last_name: raw_info['family_name']
         }
       end
 
@@ -72,8 +93,16 @@ module OmniAuth
       #
       def raw_info
         if @raw_info.nil?
-          id_token_data   = ::JWT.decode(access_token.params['id_token'], nil, false).first rescue {}
-          auth_token_data = ::JWT.decode(access_token.token,              nil, false).first rescue {}
+          id_token_data = begin
+            ::JWT.decode(access_token.params['id_token'], nil, false).first
+          rescue StandardError
+            {}
+          end
+          auth_token_data = begin
+            ::JWT.decode(access_token.token, nil, false).first
+          rescue StandardError
+            {}
+          end
 
           id_token_data.merge!(auth_token_data)
           @raw_info = id_token_data
@@ -81,7 +110,6 @@ module OmniAuth
 
         @raw_info
       end
-
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-azure-activedirectory-v2
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.1.0
 platform: ruby
 authors:
 - RIPA Global
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-01-11 00:00:00.000000000 Z
+date: 2023-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
@@ -66,7 +66,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.4.4
 signing_key:
 specification_version: 4
 summary: OAuth 2 authentication with the Azure ActiveDirectory V2 API.