omniauth-google-oauth2 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 65ffc15faaed3d23a1c4a7ca2d5fa07f8ffda0f5
-  data.tar.gz: 6c70bafaec2478b78b8293bca662a898d4d4e019
+  metadata.gz: e8856da55d4dd3541aa24210676726e43c9f7afb
+  data.tar.gz: 8d34f80f64977b8eef82858f8521c31d4cb4b000
 SHA512:
-  metadata.gz: 55b5b27e600710e73ddd27d4ec9886faed3d76a2909f05090e46da59bde030d5e2cc567ac3a92d213fc9737a3938be4c1507d7f9631d8cfbd1b1962a87ca56b9
-  data.tar.gz: f4091407c27f7fb9d05751a927cd2963f2f9447e7ad8ce9af32f2769bc5759f0a0dc488a273ea79b32bd56e44fd5a9f2e4ffc177e96fac096a9bc93400368b71
+  metadata.gz: 30137b2edafdad7c71b22f9a0f6b4f7f2897719348326facad7ad2e8a6c5ab3f22f9040cfd2a06cba42995496fcc2f644946ea467b1e0e9d76139a42b39113b6
+  data.tar.gz: 153076648f4c1eac3971a2bf67c67c75b43ddff1bca0e6c9ca1c86885fb31cdc01cdf306507f2b527931051c6b1cb8029bf93b0b928c4723d84e8de91c7b554e

data/CHANGELOG.md

@@ -1,6 +1,21 @@
 # Changelog
 All notable changes to this project will be documented in this file.
 
+## 0.5.1 - 2017-07-19
+
+### Added
+- JWT iss verification can be enabled/disabled with the `verify_iss` flag.
+- Authorize options now includes `device_id` and `device_name` for private ip ranges.
+
+### Deprecated
+- Nothing.
+
+### Removed
+- Nothing.
+
+### Fixed
+- Updated `authorize_url` and `token_url` to new endpoints.
+
 ## 0.5.0 - 2017-05-29
 
 ### Added

data/README.md

@@ -87,6 +87,8 @@ You can configure several options, which you pass in to the `provider` method vi
 
 * `openid_realm`: Set the OpenID realm value, to allow upgrading from OpenID based authentication to OAuth 2 based authentication. When this is set correctly an `openid_id` value will be set in `[:extra][:id_info]` in the authentication hash with the value of the user's OpenID ID URL.
 
+* `verify_iss`: Allows you to disable iss validation when decoding the JWT. This was added since Google now returns either `accounts.google.com` or `https://accounts.google.com`, and there is no way to predict what they will return, causing JWT validation failures.
+
 Here's an example of a possible configuration where the strategy name is changed, the user is asked for extra permissions, the user is always prompted to select his account when logging in and the user's profile picture is returned as a thumbnail:
 
 ```ruby
@@ -191,7 +193,7 @@ class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
         flash[:notice] = I18n.t 'devise.omniauth_callbacks.success', kind: 'Google'
         sign_in_and_redirect @user, event: :authentication
       else
-        session['devise.google_data'] = request.env['omniauth.auth'].except(:extra) #Removing extra as it can overflow some session stores
+        session['devise.google_data'] = request.env['omniauth.auth'].except(:extra) # Removing extra as it can overflow some session stores
         redirect_to new_user_registration_url, alert: @user.errors.full_messages.join("\n")
       end
   end

data/examples/config.ru

@@ -114,7 +114,8 @@ use Rack::Session::Cookie, secret: ENV['RACK_COOKIE_SECRET']
 use OmniAuth::Builder do
   # For additional provider examples please look at 'omni_auth.rb'
   # The key provider_ignores_state is only for AJAX flows. It is not recommended for normal logins.
-  provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], access_type: 'offline', prompt: 'consent', provider_ignores_state: true, scope: 'email,profile,calendar'
+  # Also, verify_iss is disabled because google now returns an unpredictable value for iss.
+  provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], verify_iss: false, access_type: 'offline', prompt: 'consent', provider_ignores_state: true, scope: 'email,profile,calendar'
 end
 
 run App.new

data/lib/omniauth/google_oauth2/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module GoogleOauth2
-    VERSION = '0.5.0'
+    VERSION = '0.5.1'
   end
 end

data/lib/omniauth/strategies/google_oauth2.rb

@@ -18,13 +18,13 @@ module OmniAuth
       option :skip_image_info, true
       option :skip_jwt, false
       option :jwt_leeway, 60
-      option :authorize_options, %i[access_type hd login_hint prompt request_visible_actions scope state redirect_uri include_granted_scopes openid_realm]
+      option :authorize_options, %i[access_type hd login_hint prompt request_visible_actions scope state redirect_uri include_granted_scopes openid_realm device_id device_name]
       option :authorized_client_ids, []
+      option :verify_iss, true
 
       option :client_options,
-             site: 'https://accounts.google.com',
-             authorize_url: '/o/oauth2/auth',
-             token_url: '/o/oauth2/token'
+             authorize_url: 'https://accounts.google.com/o/oauth2/v2/auth',
+             token_url: 'https://www.googleapis.com/oauth2/v4/token'
 
       def authorize_params
         super.tap do |params|
@@ -60,7 +60,7 @@ module OmniAuth
         hash[:id_token] = access_token['id_token']
         if !options[:skip_jwt] && !access_token['id_token'].nil?
           hash[:id_info] = JWT.decode(
-            access_token['id_token'], nil, false, verify_iss: true,
+            access_token['id_token'], nil, false, verify_iss: options.verify_iss,
                                                   iss: 'accounts.google.com',
                                                   verify_aud: true,
                                                   aud: options.client_id,

data/spec/omniauth/strategies/google_oauth2_spec.rb

@@ -28,16 +28,16 @@ describe OmniAuth::Strategies::GoogleOauth2 do
   end
 
   describe '#client_options' do
-    it 'has correct site' do
-      expect(subject.client.site).to eq('https://accounts.google.com')
+    it 'does not have site' do
+      expect(subject.client.site).to eq(nil)
     end
 
     it 'has correct authorize_url' do
-      expect(subject.client.options[:authorize_url]).to eq('/o/oauth2/auth')
+      expect(subject.client.options[:authorize_url]).to eq('https://accounts.google.com/o/oauth2/v2/auth')
     end
 
     it 'has correct token_url' do
-      expect(subject.client.options[:token_url]).to eq('/o/oauth2/token')
+      expect(subject.client.options[:token_url]).to eq('https://www.googleapis.com/oauth2/v4/token')
     end
 
     describe 'overrides' do
@@ -78,7 +78,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
   end
 
   describe '#authorize_options' do
-    %i[access_type hd login_hint prompt scope state].each do |k|
+    %i[access_type hd login_hint prompt scope state device_id device_name].each do |k|
       it "should support #{k}" do
         @options = { k => 'http://someval' }
         expect(subject.authorize_params[k.to_s]).to eq('http://someval')
@@ -593,6 +593,37 @@ describe OmniAuth::Strategies::GoogleOauth2 do
     end
   end
 
+  describe 'verify_iss option' do
+    before(:each) do
+      subject.options.client_options[:connection_build] = proc do |builder|
+        builder.request :url_encoded
+        builder.adapter :test do |stub|
+          stub.get('/oauth2/v3/tokeninfo?access_token=invalid_iss_token') do
+            [200, { 'Content-Type' => 'application/json; charset=UTF-8' },
+             MultiJson.encode(
+               aud: '000000000000.apps.googleusercontent.com',
+               sub: '123456789',
+               email_verified: 'true',
+               email: 'example@example.com',
+               access_type: 'offline',
+               scope: 'profile email',
+               expires_in: 436,
+               iss: 'foobar.com'
+             )]
+          end
+        end
+      end
+      subject.options.authorized_client_ids = ['000000000000.apps.googleusercontent.com']
+      subject.options.client_id = '000000000000.apps.googleusercontent.com'
+      subject.options[:verify_iss] = false
+    end
+
+    it 'should verify token if the iss does not match options.expected_iss' do
+      result = subject.send(:verify_token, 'invalid_iss_token')
+      expect(result).to eq(true)
+    end
+  end
+
   describe 'verify_token' do
     before(:each) do
       subject.options.client_options[:connection_build] = proc do |builder|

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-google-oauth2
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Josh Ellithorpe
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-05-30 00:00:00.000000000 Z
+date: 2017-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth