omniauth-azure-devops 1.0.7 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1239bde8d9de8035c9533f3cdd3e3ff955b5774287b3ce27329adb0336bc91f6
-  data.tar.gz: d5bf7c6f7d8230f2808eed96e6edd78af9e53b2967ceca471a35d9e5eea74555
+  metadata.gz: 544262ba6729895bcbcb165b305e95674278a1cc32589fa6402fffe5fc542cec
+  data.tar.gz: f503a152f1220753813fbb49a8d61a164b4ed81b791f001a429ebf4bcf73d651
 SHA512:
-  metadata.gz: 901b0ab85db481ea49fe4ea1c09a6e3a40d3561e5538eb9839ebde2073df6298c4f976faf0d062febce13e9122f4dbedbc7346acc01d6f6da052b75da942ac96
-  data.tar.gz: 1515b59c4747491bd1ed3f85a21943fca468f63c602e250556fa49303233c58137aa85ee80c5ce389f395e41f72770a42a935a1e8a2821a115b3e3cd106bc143
+  metadata.gz: b0f6aa4de3c127933424bc9f72fe0b99ccc5ba13ac01158739dbece602ef0a22e12e1f6a684d746a8146461034a9d5f2787cc6470096106f637415f054b41477
+  data.tar.gz: 7e74f1e5c66372654886c8a631e8d294ad5d3dce614203f354b0c2ac9563de29936da7e8640ccd8792087c41b394deae5ac5002da381cc5f7bc6557ff17d3eaf

data/.rubocop.yml

@@ -46,6 +46,9 @@ Metrics/PerceivedComplexity:
   Enabled: false
 
 # Naming cop configuration
+Naming/FileName:
+  Exclude:
+    - lib/omniauth-azure-devops.rb
 Naming/MethodParameterName:
   Enabled: true
   Exclude:

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.1.0]
+
+- Add the `azure_devops_entra` strategy: Microsoft Entra ID authorization code + PKCE with a certificate-signed client assertion, alongside the unchanged legacy `azure_devops` strategy
+- Require `omniauth-oauth2` `~> 1.7` (PKCE) and `oauth2` `~> 2.0` (`private_key_jwt` client auth and snake_cased responses), and declare the `jwt` dependency
+
+## [1.0.8]
+
+- Address Dependabot security advisories in transitive dependencies by updating `Gemfile.lock`:
+  - `rack` 3.1.16 → 3.1.22 (GHSA-6xw4-3v39-52mm, GHSA-r657-rxjc-j557, GHSA-wpv5-97wm-hp9c, GHSA-w9pc-fmgc-vxvw, GHSA-p543-xpfm-54cp, GHSA-mxw3-3hh2-x2mh, GHSA-whrj-4476-wvmp, GHSA-g2pf-xv49-m2h5, GHSA-q2ww-5357-x388, GHSA-qv7j-4883-hwh7, GHSA-8vqr-qjwx-82mw, GHSA-7mqq-6cf9-v2qp, GHSA-v569-hp3g-36wr, GHSA-qfgr-crr9-7r49, GHSA-vgpv-f759-9wx3, GHSA-v6x5-cg8r-vv6x, GHSA-x8cg-fq8g-mxfx, GHSA-q4qf-9j86-f5mh, GHSA-h2jq-g4cq-5ppq)
+  - `faraday` 2.13.1 → 2.14.4 (GHSA-98m9-hrrm-r99r, GHSA-5rv5-xj5j-3484, GHSA-33mh-2634-fwr2)
+  - `jwt` 2.10.1 → 2.10.3 (GHSA-c32j-vqhx-rx3x)
+  - `json` 2.12.2 → 2.21.2 (GHSA-x2f5-4prf-w687)
+  - `uri` 1.0.3 → 1.1.1 (GHSA-j4pr-3wm6-xx2r)
+
 ## [1.0.7]
 
 - Fix the `tag-and-release` workflow to create the release tag with the `rewind-community-tagger` GitHub App token (`TAGGER_APP_ID`/`TAGGER_PRIVATE_KEY`) instead of the default `GITHUB_TOKEN`

data/Gemfile.lock

@@ -1,9 +1,11 @@
 PATH
   remote: .
   specs:
-    omniauth-azure-devops (1.0.7)
+    omniauth-azure-devops (1.1.0)
+      jwt (>= 2.10, < 4)
+      oauth2 (~> 2.0)
       omniauth (>= 1, < 3)
-      omniauth-oauth2 (~> 1.1)
+      omniauth-oauth2 (~> 1.7)
 
 GEM
   remote: https://rubygems.org/
@@ -19,15 +21,15 @@ GEM
     coderay (1.1.3)
     diff-lcs (1.6.2)
     docile (1.4.1)
-    faraday (2.13.1)
+    faraday (2.14.4)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-net_http (3.4.0)
-      net-http (>= 0.5.0)
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
     hashie (5.0.0)
-    json (2.12.2)
-    jwt (2.10.1)
+    json (2.21.2)
+    jwt (2.10.3)
       base64
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
@@ -35,8 +37,8 @@ GEM
     method_source (1.1.0)
     multi_xml (0.7.2)
       bigdecimal (~> 3.1)
-    net-http (0.6.0)
-      uri
+    net-http (0.9.1)
+      uri (>= 0.11.1)
     oauth2 (2.0.25)
       anonymous_loader (~> 0.1, >= 0.1.3)
       auth-sanitizer (~> 0.2, >= 0.2.3)
@@ -63,7 +65,7 @@ GEM
       coderay (~> 1.1)
       method_source (~> 1.0)
     racc (1.8.1)
-    rack (3.1.16)
+    rack (3.1.22)
     rack-protection (4.1.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
@@ -124,7 +126,7 @@ GEM
     unicode-display_width (3.1.4)
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.0.4)
-    uri (1.0.3)
+    uri (1.1.1)
     version_gem (1.1.15)
 
 PLATFORMS

data/README.md

@@ -34,6 +34,22 @@ bundle install
 
 5. Access user information and tokens as needed in your application by utilizing the OmniAuth authentication data.
 
+### Microsoft Entra ID
+
+The `azure_devops_entra` strategy signs users in through a multi-tenant Microsoft Entra ID application (authorization code + PKCE) and authenticates the code exchange with a certificate-signed client assertion, so no client secret is used.
+
+```ruby
+provider :azure_devops_entra, ENV['ENTRA_APP_ID'], nil,
+         client_private_key: ENV['ENTRA_CLIENT_PRIVATE_KEY'],
+         certificate_thumbprint: ENV['ENTRA_CERTIFICATE_THUMBPRINT'],
+         scope: '499b84ac-1321-427f-aa17-267ca6975798/.default offline_access',
+         callback_path: '/link/azure_devops_entra/oauth_callback'
+```
+
+- `client_private_key` is the PEM private key of the certificate registered on the Entra application, and `certificate_thumbprint` is its base64url-encoded SHA-1 thumbprint (the JWT `x5t` header).
+- `scope` is sent exactly as given. Include `offline_access`, or Entra issues no refresh token.
+- The auth hash `uid` is the Azure DevOps profile id, the same value the `azure_devops` strategy returns. `extra.tenant_id` is the user's Entra tenant id, which is needed to refresh the token later at `https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token`.
+
 ## Running Tests
 
 You can run the test suite using the following command:

data/lib/omni_auth/azure_devops/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module AzureDevops
-    VERSION = '1.0.7'
+    VERSION = '1.1.0'
   end
 end

data/lib/omni_auth/strategies/azure_devops_entra.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'jwt'
+require 'openssl'
+require 'securerandom'
+require 'omniauth/strategies/oauth2'
+
+module OmniAuth
+  module Strategies
+    class AzureDevopsEntra < OmniAuth::Strategies::OAuth2
+      TOKEN_URL = 'https://login.microsoftonline.com/organizations/oauth2/v2.0/token'
+      CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
+      CLIENT_ASSERTION_LIFETIME_SECONDS = 120
+
+      option :name, :azure_devops_entra
+      option :pkce, true
+      option :client_private_key, nil
+      option :certificate_thumbprint, nil
+
+      option :client_options, {
+        site: 'https://app.vssps.visualstudio.com',
+        authorize_url: 'https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize',
+        token_url: TOKEN_URL,
+        auth_scheme: :private_key_jwt
+      }
+
+      option :authorize_params, {
+        prompt: 'select_account'
+      }
+
+      # Must stay the ADO profile id, never the token's `oid` claim: they are different GUIDs, and rewind-app finds the
+      # existing service instance by `platform_id: uid`, so an `oid` here silently creates a second instance.
+      uid { raw_info['id'] }
+
+      info do
+        {
+          name: raw_info['display_name'],
+          email_address: raw_info['email_address']
+        }
+      end
+
+      extra do
+        {
+          raw_info: raw_info,
+          tenant_id: tenant_id
+        }
+      end
+
+      def raw_info
+        @raw_info ||= access_token.get('/_apis/profile/profiles/me', params: { 'api-version' => '7.1' }).parsed
+      end
+
+      def tenant_id
+        @tenant_id ||= JWT.decode(access_token.token, nil, false).first['tid']
+      end
+
+      def token_params
+        super.tap do |params|
+          params[:client_id] = client.id
+          params[:client_assertion_type] = CLIENT_ASSERTION_TYPE
+          params[:client_assertion] = client_assertion
+        end
+      end
+
+      def callback_url
+        full_host + callback_path
+      end
+
+      private
+
+      def client_assertion
+        now = Time.now.to_i
+        claims = {
+          iss: client.id,
+          sub: client.id,
+          aud: TOKEN_URL,
+          jti: SecureRandom.uuid,
+          exp: now + CLIENT_ASSERTION_LIFETIME_SECONDS,
+          nbf: now,
+          iat: now
+        }
+
+        JWT.encode(claims, OpenSSL::PKey::RSA.new(options.client_private_key), 'RS256',
+                   { alg: 'RS256', typ: 'JWT', x5t: options.certificate_thumbprint })
+      end
+    end
+  end
+end

data/lib/omniauth-azure-devops.rb

@@ -2,3 +2,4 @@
 
 require 'omni_auth/azure_devops/version'
 require 'omni_auth/strategies/azure_devops'
+require 'omni_auth/strategies/azure_devops_entra'

data/omniauth-azure-devops.gemspec

@@ -28,6 +28,8 @@ Gem::Specification.new do |gem|
 
   gem.required_ruby_version = '>= 3.4'
 
+  gem.add_dependency 'jwt', '>= 2.10', '< 4'
+  gem.add_dependency 'oauth2', '~> 2.0'
   gem.add_dependency 'omniauth', '>= 1', '< 3'
-  gem.add_dependency 'omniauth-oauth2', '~> 1.1'
+  gem.add_dependency 'omniauth-oauth2', '~> 1.7'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-azure-devops
 version: !ruby/object:Gem::Version
-  version: 1.0.7
+  version: 1.1.0
 platform: ruby
 authors:
 - Rewind Software Inc. | Parth Chandgadhiya
@@ -9,6 +9,40 @@ bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.10'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.10'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+- !ruby/object:Gem::Dependency
+  name: oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: omniauth
   requirement: !ruby/object:Gem::Requirement
@@ -35,14 +69,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '1.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '1.7'
 description: An Azure Devops OAuth strategy for OmniAuth 2.0
 email:
 - team@rewind.io
@@ -64,6 +98,7 @@ files:
 - bin/setup
 - lib/omni_auth/azure_devops/version.rb
 - lib/omni_auth/strategies/azure_devops.rb
+- lib/omni_auth/strategies/azure_devops_entra.rb
 - lib/omniauth-azure-devops.rb
 - omniauth-azure-devops.gemspec
 homepage: https://github.com/rewindio/omniauth-azure-devops