omniauth-azure-devops 1.0.8 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b49d7b12fbd7a19f157141da1e8b5bcb79a5e99eb4f315add5b4089e36edc579
-  data.tar.gz: 7b148fc02e6b8313e2ba3d29b6d6ff773b161ddd077684933d825347d436c6ae
+  metadata.gz: 1371aaeba34d0fdb8a1254358ab1a72cfd2e204cd042a3b7fd0395d8299e04f7
+  data.tar.gz: 38225a347250640a66ca6c1ccecddbf0c1bbae6e24f3bd9a8b363685ef22dced
 SHA512:
-  metadata.gz: 0006ead27889ce6ea0b472d4c0f2b632ca994a6b078664afb9bfa59262faa6d3c1109e5ca50f606be2619962520a9456f828c25c04156d6f1bc1f4f09b6ef60a
-  data.tar.gz: cbfe15cc8df7aa199ce1562ad2441de69e55ae22535cf2480f1894fe1e3043ee33bd1c552793bdabc815c487bb3d8cd2a4d4295404e98c7985823151f95429a9
+  metadata.gz: 10db990de46c448121adbc0873ae5fe8cae0b4d8920015a4c516f134bc6027c41c613ad1f17650a46eef8b77550d73cb0d827d7cf5ae6b91dda3153042496d6a
+  data.tar.gz: 8f8c865fc1e4d56970eb21c77232a019492bf40b358963565bdef7ac99b1cd30cfe3a3f3af92339c1093aea67e275f4eb1e3f9a525ba709c44f22d154380ddca

data/.rubocop.yml

@@ -46,6 +46,9 @@ Metrics/PerceivedComplexity:
   Enabled: false
 
 # Naming cop configuration
+Naming/FileName:
+  Exclude:
+    - lib/omniauth-azure-devops.rb
 Naming/MethodParameterName:
   Enabled: true
   Exclude:

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [1.2.0]
+
+- Add `extra.tenant_name` to the `azure_devops_entra` strategy: the Microsoft Entra tenant's display name, read from Microsoft Graph `/organization` with a `User.Read` token redeemed from the sign-in's refresh token. It is `nil` when Graph can't be reached or `User.Read` isn't consented, and never fails the sign-in.
+
+## [1.1.0]
+
+- Add the `azure_devops_entra` strategy: Microsoft Entra ID authorization code + PKCE with a certificate-signed client assertion, alongside the unchanged legacy `azure_devops` strategy
+- Require `omniauth-oauth2` `~> 1.7` (PKCE) and `oauth2` `~> 2.0` (`private_key_jwt` client auth and snake_cased responses), and declare the `jwt` dependency
+
 ## [1.0.8]
 
 - Address Dependabot security advisories in transitive dependencies by updating `Gemfile.lock`:

data/Gemfile.lock

@@ -1,9 +1,11 @@
 PATH
   remote: .
   specs:
-    omniauth-azure-devops (1.0.8)
+    omniauth-azure-devops (1.2.0)
+      jwt (>= 2.10, < 4)
+      oauth2 (~> 2.0)
       omniauth (>= 1, < 3)
-      omniauth-oauth2 (~> 1.1)
+      omniauth-oauth2 (~> 1.7)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -34,6 +34,22 @@ bundle install
 
 5. Access user information and tokens as needed in your application by utilizing the OmniAuth authentication data.
 
+### Microsoft Entra ID
+
+The `azure_devops_entra` strategy signs users in through a multi-tenant Microsoft Entra ID application (authorization code + PKCE) and authenticates the code exchange with a certificate-signed client assertion, so no client secret is used.
+
+```ruby
+provider :azure_devops_entra, ENV['ENTRA_APP_ID'], nil,
+         client_private_key: ENV['ENTRA_CLIENT_PRIVATE_KEY'],
+         certificate_thumbprint: ENV['ENTRA_CERTIFICATE_THUMBPRINT'],
+         scope: '499b84ac-1321-427f-aa17-267ca6975798/.default offline_access',
+         callback_path: '/link/azure_devops_entra/oauth_callback'
+```
+
+- `client_private_key` is the PEM private key of the certificate registered on the Entra application, and `certificate_thumbprint` is its base64url-encoded SHA-1 thumbprint (the JWT `x5t` header).
+- `scope` is sent exactly as given. Include `offline_access`, or Entra issues no refresh token.
+- The auth hash `uid` is the Azure DevOps profile id, the same value the `azure_devops` strategy returns. `extra.tenant_id` is the user's Entra tenant id, which is needed to refresh the token later at `https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token`.
+
 ## Running Tests
 
 You can run the test suite using the following command:

data/lib/omni_auth/azure_devops/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module AzureDevops
-    VERSION = '1.0.8'
+    VERSION = '1.2.0'
   end
 end

data/lib/omni_auth/strategies/azure_devops_entra.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'jwt'
+require 'openssl'
+require 'securerandom'
+require 'omniauth/strategies/oauth2'
+
+module OmniAuth
+  module Strategies
+    class AzureDevopsEntra < OmniAuth::Strategies::OAuth2
+      TOKEN_URL = 'https://login.microsoftonline.com/organizations/oauth2/v2.0/token'
+      CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
+      CLIENT_ASSERTION_LIFETIME_SECONDS = 120
+      GRAPH_SCOPE = 'https://graph.microsoft.com/User.Read'
+      GRAPH_ORGANIZATION_URL = 'https://graph.microsoft.com/v1.0/organization'
+
+      option :name, :azure_devops_entra
+      option :pkce, true
+      option :client_private_key, nil
+      option :certificate_thumbprint, nil
+
+      option :client_options, {
+        site: 'https://app.vssps.visualstudio.com',
+        authorize_url: 'https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize',
+        token_url: TOKEN_URL,
+        auth_scheme: :private_key_jwt
+      }
+
+      option :authorize_params, {
+        prompt: 'select_account'
+      }
+
+      # Must stay the ADO profile id, never the token's `oid` claim: they are different GUIDs, and rewind-app finds the
+      # existing service instance by `platform_id: uid`, so an `oid` here silently creates a second instance.
+      uid { raw_info['id'] }
+
+      info do
+        {
+          name: raw_info['display_name'],
+          email_address: raw_info['email_address']
+        }
+      end
+
+      extra do
+        {
+          raw_info: raw_info,
+          tenant_id: tenant_id,
+          tenant_name: tenant_name
+        }
+      end
+
+      def raw_info
+        @raw_info ||= access_token.get('/_apis/profile/profiles/me', params: { 'api-version' => '7.1' }).parsed
+      end
+
+      def tenant_id
+        @tenant_id ||= JWT.decode(access_token.token, nil, false).first['tid']
+      end
+
+      def tenant_name
+        return @tenant_name if defined?(@tenant_name)
+
+        @tenant_name = JSON.parse(graph_access_token.get(GRAPH_ORGANIZATION_URL).body).dig('value', 0, 'displayName')
+      rescue StandardError => e
+        status = e.response&.status if e.is_a?(::OAuth2::Error)
+        log :warn, "Could not read the Entra tenant name for tenant #{tenant_id}: #{e.class} (status #{status.inspect}): #{e.message}"
+        @tenant_name = nil
+      end
+
+      def token_params
+        super.tap do |params|
+          params[:client_id] = client.id
+          params[:client_assertion_type] = CLIENT_ASSERTION_TYPE
+          params[:client_assertion] = client_assertion
+        end
+      end
+
+      def callback_url
+        full_host + callback_path
+      end
+
+      private
+
+      def graph_access_token
+        client.get_token(
+          grant_type: 'refresh_token',
+          refresh_token: access_token.refresh_token,
+          scope: GRAPH_SCOPE,
+          client_id: client.id,
+          client_assertion_type: CLIENT_ASSERTION_TYPE,
+          client_assertion: client_assertion
+        )
+      end
+
+      def client_assertion
+        now = Time.now.to_i
+        claims = {
+          iss: client.id,
+          sub: client.id,
+          aud: TOKEN_URL,
+          jti: SecureRandom.uuid,
+          exp: now + CLIENT_ASSERTION_LIFETIME_SECONDS,
+          nbf: now,
+          iat: now
+        }
+
+        JWT.encode(claims, OpenSSL::PKey::RSA.new(options.client_private_key), 'RS256',
+                   { alg: 'RS256', typ: 'JWT', x5t: options.certificate_thumbprint })
+      end
+    end
+  end
+end

data/lib/omniauth-azure-devops.rb

@@ -2,3 +2,4 @@
 
 require 'omni_auth/azure_devops/version'
 require 'omni_auth/strategies/azure_devops'
+require 'omni_auth/strategies/azure_devops_entra'

data/omniauth-azure-devops.gemspec

@@ -28,6 +28,8 @@ Gem::Specification.new do |gem|
 
   gem.required_ruby_version = '>= 3.4'
 
+  gem.add_dependency 'jwt', '>= 2.10', '< 4'
+  gem.add_dependency 'oauth2', '~> 2.0'
   gem.add_dependency 'omniauth', '>= 1', '< 3'
-  gem.add_dependency 'omniauth-oauth2', '~> 1.1'
+  gem.add_dependency 'omniauth-oauth2', '~> 1.7'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-azure-devops
 version: !ruby/object:Gem::Version
-  version: 1.0.8
+  version: 1.2.0
 platform: ruby
 authors:
 - Rewind Software Inc. | Parth Chandgadhiya
@@ -9,6 +9,40 @@ bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.10'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.10'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+- !ruby/object:Gem::Dependency
+  name: oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: omniauth
   requirement: !ruby/object:Gem::Requirement
@@ -35,14 +69,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '1.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '1.7'
 description: An Azure Devops OAuth strategy for OmniAuth 2.0
 email:
 - team@rewind.io
@@ -64,6 +98,7 @@ files:
 - bin/setup
 - lib/omni_auth/azure_devops/version.rb
 - lib/omni_auth/strategies/azure_devops.rb
+- lib/omni_auth/strategies/azure_devops_entra.rb
 - lib/omniauth-azure-devops.rb
 - omniauth-azure-devops.gemspec
 homepage: https://github.com/rewindio/omniauth-azure-devops