omniauth-azure-devops 1.1.0 → 1.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +8 -0
- data/Gemfile.lock +1 -1
- data/lib/omni_auth/azure_devops/version.rb +1 -1
- data/lib/omni_auth/strategies/azure_devops_entra.rb +39 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 9aab1424ede35a6caa2ef3736b0dc39e9784d7bd89971e86a687233664ecae16
|
|
4
|
+
data.tar.gz: 20773abee955e922d92047b7ba0425cfff02d12a3233681cf3ed7a2f04a297aa
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: e23d4ca268794faddfd3048dcc2ee491873f4587f11ec9d3c21b7768e852d230be69fbc14cf8f759f18a66bb0dc25adcb78963139615ecc745276dc46dba25c6
|
|
7
|
+
data.tar.gz: cd70bcd1e3b8a34e1d71bb52243f59b35991dd6b714530996b5027a698f170d9c98e16ee1c1166eed3497cdbca66a83e99e7304e542930af41657c3dd6cc5a43
|
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [1.2.1]
|
|
4
|
+
|
|
5
|
+
- Retry the `azure_devops_entra` tenant name lookup up to three times, waiting 1, 2 and 4 seconds. Consent granted during the sign-in can take a few seconds to reach the Graph token exchange, which Entra refuses meanwhile with `AADSTS65001` `consent_required`, so `extra.tenant_name` came back `nil` for a user who had just consented. Each failed attempt is logged with its attempt number.
|
|
6
|
+
|
|
7
|
+
## [1.2.0]
|
|
8
|
+
|
|
9
|
+
- Add `extra.tenant_name` to the `azure_devops_entra` strategy: the Microsoft Entra tenant's display name, read from Microsoft Graph `/organization` with a `User.Read` token redeemed from the sign-in's refresh token. It is `nil` when Graph can't be reached or `User.Read` isn't consented, and never fails the sign-in.
|
|
10
|
+
|
|
3
11
|
## [1.1.0]
|
|
4
12
|
|
|
5
13
|
- Add the `azure_devops_entra` strategy: Microsoft Entra ID authorization code + PKCE with a certificate-signed client assertion, alongside the unchanged legacy `azure_devops` strategy
|
data/Gemfile.lock
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
+
require 'json'
|
|
3
4
|
require 'jwt'
|
|
4
5
|
require 'openssl'
|
|
5
6
|
require 'securerandom'
|
|
@@ -11,6 +12,9 @@ module OmniAuth
|
|
|
11
12
|
TOKEN_URL = 'https://login.microsoftonline.com/organizations/oauth2/v2.0/token'
|
|
12
13
|
CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
|
|
13
14
|
CLIENT_ASSERTION_LIFETIME_SECONDS = 120
|
|
15
|
+
GRAPH_SCOPE = 'https://graph.microsoft.com/User.Read'
|
|
16
|
+
GRAPH_ORGANIZATION_URL = 'https://graph.microsoft.com/v1.0/organization'
|
|
17
|
+
TENANT_NAME_RETRY_DELAYS = [1, 2, 4].freeze
|
|
14
18
|
|
|
15
19
|
option :name, :azure_devops_entra
|
|
16
20
|
option :pkce, true
|
|
@@ -42,7 +46,8 @@ module OmniAuth
|
|
|
42
46
|
extra do
|
|
43
47
|
{
|
|
44
48
|
raw_info: raw_info,
|
|
45
|
-
tenant_id: tenant_id
|
|
49
|
+
tenant_id: tenant_id,
|
|
50
|
+
tenant_name: tenant_name
|
|
46
51
|
}
|
|
47
52
|
end
|
|
48
53
|
|
|
@@ -54,6 +59,28 @@ module OmniAuth
|
|
|
54
59
|
@tenant_id ||= JWT.decode(access_token.token, nil, false).first['tid']
|
|
55
60
|
end
|
|
56
61
|
|
|
62
|
+
# Consent granted during this sign-in can take a few seconds to reach the Graph token exchange, which Entra refuses
|
|
63
|
+
# meanwhile with AADSTS65001 consent_required, so failed lookups are retried after a short wait.
|
|
64
|
+
def tenant_name
|
|
65
|
+
return @tenant_name if defined?(@tenant_name)
|
|
66
|
+
|
|
67
|
+
attempts = TENANT_NAME_RETRY_DELAYS.size + 1
|
|
68
|
+
attempt = 0
|
|
69
|
+
begin
|
|
70
|
+
attempt += 1
|
|
71
|
+
@tenant_name = JSON.parse(graph_access_token.get(GRAPH_ORGANIZATION_URL).body).dig('value', 0, 'displayName')
|
|
72
|
+
rescue StandardError => e
|
|
73
|
+
status = e.response&.status if e.is_a?(::OAuth2::Error)
|
|
74
|
+
log :warn, "Could not read the Entra tenant name for tenant #{tenant_id} (attempt #{attempt} of #{attempts}): " \
|
|
75
|
+
"#{e.class} (status #{status.inspect}): #{e.message}"
|
|
76
|
+
if attempt < attempts
|
|
77
|
+
sleep TENANT_NAME_RETRY_DELAYS[attempt - 1]
|
|
78
|
+
retry
|
|
79
|
+
end
|
|
80
|
+
@tenant_name = nil
|
|
81
|
+
end
|
|
82
|
+
end
|
|
83
|
+
|
|
57
84
|
def token_params
|
|
58
85
|
super.tap do |params|
|
|
59
86
|
params[:client_id] = client.id
|
|
@@ -68,6 +95,17 @@ module OmniAuth
|
|
|
68
95
|
|
|
69
96
|
private
|
|
70
97
|
|
|
98
|
+
def graph_access_token
|
|
99
|
+
client.get_token(
|
|
100
|
+
grant_type: 'refresh_token',
|
|
101
|
+
refresh_token: access_token.refresh_token,
|
|
102
|
+
scope: GRAPH_SCOPE,
|
|
103
|
+
client_id: client.id,
|
|
104
|
+
client_assertion_type: CLIENT_ASSERTION_TYPE,
|
|
105
|
+
client_assertion: client_assertion
|
|
106
|
+
)
|
|
107
|
+
end
|
|
108
|
+
|
|
71
109
|
def client_assertion
|
|
72
110
|
now = Time.now.to_i
|
|
73
111
|
claims = {
|