omniauth-azure-devops 1.1.0 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +4 -0
- data/Gemfile.lock +1 -1
- data/lib/omni_auth/azure_devops/version.rb +1 -1
- data/lib/omni_auth/strategies/azure_devops_entra.rb +26 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 1371aaeba34d0fdb8a1254358ab1a72cfd2e204cd042a3b7fd0395d8299e04f7
|
|
4
|
+
data.tar.gz: 38225a347250640a66ca6c1ccecddbf0c1bbae6e24f3bd9a8b363685ef22dced
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 10db990de46c448121adbc0873ae5fe8cae0b4d8920015a4c516f134bc6027c41c613ad1f17650a46eef8b77550d73cb0d827d7cf5ae6b91dda3153042496d6a
|
|
7
|
+
data.tar.gz: 8f8c865fc1e4d56970eb21c77232a019492bf40b358963565bdef7ac99b1cd30cfe3a3f3af92339c1093aea67e275f4eb1e3f9a525ba709c44f22d154380ddca
|
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [1.2.0]
|
|
4
|
+
|
|
5
|
+
- Add `extra.tenant_name` to the `azure_devops_entra` strategy: the Microsoft Entra tenant's display name, read from Microsoft Graph `/organization` with a `User.Read` token redeemed from the sign-in's refresh token. It is `nil` when Graph can't be reached or `User.Read` isn't consented, and never fails the sign-in.
|
|
6
|
+
|
|
3
7
|
## [1.1.0]
|
|
4
8
|
|
|
5
9
|
- Add the `azure_devops_entra` strategy: Microsoft Entra ID authorization code + PKCE with a certificate-signed client assertion, alongside the unchanged legacy `azure_devops` strategy
|
data/Gemfile.lock
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
+
require 'json'
|
|
3
4
|
require 'jwt'
|
|
4
5
|
require 'openssl'
|
|
5
6
|
require 'securerandom'
|
|
@@ -11,6 +12,8 @@ module OmniAuth
|
|
|
11
12
|
TOKEN_URL = 'https://login.microsoftonline.com/organizations/oauth2/v2.0/token'
|
|
12
13
|
CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
|
|
13
14
|
CLIENT_ASSERTION_LIFETIME_SECONDS = 120
|
|
15
|
+
GRAPH_SCOPE = 'https://graph.microsoft.com/User.Read'
|
|
16
|
+
GRAPH_ORGANIZATION_URL = 'https://graph.microsoft.com/v1.0/organization'
|
|
14
17
|
|
|
15
18
|
option :name, :azure_devops_entra
|
|
16
19
|
option :pkce, true
|
|
@@ -42,7 +45,8 @@ module OmniAuth
|
|
|
42
45
|
extra do
|
|
43
46
|
{
|
|
44
47
|
raw_info: raw_info,
|
|
45
|
-
tenant_id: tenant_id
|
|
48
|
+
tenant_id: tenant_id,
|
|
49
|
+
tenant_name: tenant_name
|
|
46
50
|
}
|
|
47
51
|
end
|
|
48
52
|
|
|
@@ -54,6 +58,16 @@ module OmniAuth
|
|
|
54
58
|
@tenant_id ||= JWT.decode(access_token.token, nil, false).first['tid']
|
|
55
59
|
end
|
|
56
60
|
|
|
61
|
+
def tenant_name
|
|
62
|
+
return @tenant_name if defined?(@tenant_name)
|
|
63
|
+
|
|
64
|
+
@tenant_name = JSON.parse(graph_access_token.get(GRAPH_ORGANIZATION_URL).body).dig('value', 0, 'displayName')
|
|
65
|
+
rescue StandardError => e
|
|
66
|
+
status = e.response&.status if e.is_a?(::OAuth2::Error)
|
|
67
|
+
log :warn, "Could not read the Entra tenant name for tenant #{tenant_id}: #{e.class} (status #{status.inspect}): #{e.message}"
|
|
68
|
+
@tenant_name = nil
|
|
69
|
+
end
|
|
70
|
+
|
|
57
71
|
def token_params
|
|
58
72
|
super.tap do |params|
|
|
59
73
|
params[:client_id] = client.id
|
|
@@ -68,6 +82,17 @@ module OmniAuth
|
|
|
68
82
|
|
|
69
83
|
private
|
|
70
84
|
|
|
85
|
+
def graph_access_token
|
|
86
|
+
client.get_token(
|
|
87
|
+
grant_type: 'refresh_token',
|
|
88
|
+
refresh_token: access_token.refresh_token,
|
|
89
|
+
scope: GRAPH_SCOPE,
|
|
90
|
+
client_id: client.id,
|
|
91
|
+
client_assertion_type: CLIENT_ASSERTION_TYPE,
|
|
92
|
+
client_assertion: client_assertion
|
|
93
|
+
)
|
|
94
|
+
end
|
|
95
|
+
|
|
71
96
|
def client_assertion
|
|
72
97
|
now = Time.now.to_i
|
|
73
98
|
claims = {
|