omniauth-okta 0.1.0 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. checksums.yaml +5 -5
  2. data/README.md +19 -13
  3. data/lib/omniauth/strategies/okta.rb +56 -31
  4. data/lib/omniauth-okta/version.rb +1 -1
  5. metadata +16 -23
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
- SHA1:
3
- metadata.gz: 38df3b55712de59cb23523883470194544d4bce3
4
- data.tar.gz: 216d413ed26f5d19e9cd30891a2d3594e17d8990
2
+ SHA256:
3
+ metadata.gz: 650d54dafaf437d369cb409d744f748555cdd1b7e3c55fc4f32bfba93ad7f5b6
4
+ data.tar.gz: 28dc60af8636a5b7c52fc06b4c5d4fad5d2ce552a087d916c266fb08d9d34324
5
5
  SHA512:
6
- metadata.gz: 0e7b53deafd73f07efee1f988cdee305542dbbefdbae4a1d7d0e63309a2bc0bac91502b816e9ac77ac5561302bc5c03f935a72307fc7ceb0849508624ce5fd6f
7
- data.tar.gz: 88199e697905e10481d5c5b7e3cb1af8f766b17a1f03f6059cbf4b86341840a163777c3b8837d94abd87796da70074dc0ac925d33c2a8a0681dded3baac31e45
6
+ metadata.gz: f3ea460bba7ec3750dc952689368e529fcc8b35886559952c9e0dff09b6979852cd0fc89b1cdf86e65f01a0d08ce9de02e89e93d7c2e95e4411a8a951ead4d27
7
+ data.tar.gz: fed4566b63e0c4835e08f79393923db0be979344d289a5330261746db6f589dd49f607e1fcf5169da4bdcb73824a5d06315bcee79b63a9c9ca299b08cc48ebcd
data/README.md CHANGED
@@ -22,22 +22,22 @@ Or install it yourself as:
22
22
  $ gem install omniauth-okta
23
23
  ```
24
24
 
25
- ### Environment Variables
26
-
27
- ```bash
28
- OKTA_CLIENT_ID # required
29
- OKTA_CLIENT_SECRET # required
30
- OKTA_ORG # required - defaults to 'your-org' if unset
31
- OKTA_DOMAIN # optional - defaults to 'okta.com' if unset
32
- ```
33
-
34
25
  ### OmniAuth
35
26
 
36
27
  Here's an example for adding the middleware to a Rails app in `config/initializers/omniauth.rb`:
37
28
 
38
29
  ```ruby
39
30
  Rails.application.config.middleware.use OmniAuth::Builder do
40
- provider :okta, ENV['OKTA_CLIENT_ID'], ENV['OKTA_CLIENT_SECRET']
31
+ provider :okta, ENV['OKTA_CLIENT_ID'], ENV['OKTA_CLIENT_SECRET'], {
32
+ client_options: {
33
+ site: 'https://your-org.okta.com',
34
+ authorization_server: '<authorization_server>',
35
+ authorize_url: 'https://your-org.okta.com/oauth2/<authorization_server>/v1/authorize',
36
+ token_url: 'https://your-org.okta.com/oauth2/<authorization_server>/v1/token',
37
+ user_info_url: 'https://your-org.okta.com/oauth2/<authorization_server>/v1/userinfo',
38
+ audience: 'api://your-audience'
39
+ }
40
+ }
41
41
  end
42
42
  ```
43
43
 
@@ -57,9 +57,15 @@ or add options like the following:
57
57
  config.omniauth(:okta,
58
58
  ENV['OKTA_CLIENT_ID'],
59
59
  ENV['OKTA_CLIENT_SECRET'],
60
- :scope => 'openid profile email',
61
- :fields => ['profile', 'email'],
62
- :strategy_class => OmniAuth::Strategies::Okta)
60
+ scope: 'openid profile email',
61
+ fields: ['profile', 'email'],
62
+ client_options: {
63
+ site: 'https://your-org.okta.com',
64
+ authorize_url: 'https://your-org.okta.com/oauth2/default/v1/authorize',
65
+ token_url: 'https://your-org.okta.com/oauth2/default/v1/token',
66
+ user_info_url: 'https://your-org.okta.com/oauth2/default/v1/userinfo',
67
+ },
68
+ strategy_class: OmniAuth::Strategies::Okta)
63
69
  ```
64
70
 
65
71
  Then add the following to 'config/routes.rb' so the callback routes are defined.
data/lib/omniauth/strategies/okta.rb CHANGED
@@ -5,24 +5,22 @@ require 'omniauth-oauth2'
5
5
  module OmniAuth
6
6
  module Strategies
7
7
  class Okta < OmniAuth::Strategies::OAuth2
8
-
9
- ORG = ENV['OKTA_ORG'] || 'your-org'
10
- DOMAIN = ENV['OKTA_DOMAIN'] || 'okta'
11
- BASE_URL = "https://#{ORG}.#{DOMAIN}.com"
12
- DEFAULT_SCOPE = %[openid profile email].freeze
8
+ DEFAULT_SCOPE = %{openid profile email}.freeze
13
9
 
14
10
  option :name, 'okta'
15
-
16
11
  option :skip_jwt, false
17
12
  option :jwt_leeway, 60
18
13
 
14
+ # These are defaults that need to be overriden on an implementation
19
15
  option :client_options, {
20
- site: BASE_URL,
21
- authorize_url: "#{BASE_URL}/oauth2/v1/authorize",
22
- token_url: "#{BASE_URL}/oauth2/v1/token",
23
- response_type: 'id_token'
16
+ site: 'https://your-org.okta.com',
17
+ authorize_url: 'https://your-org.okta.com/oauth2/default/v1/authorize',
18
+ token_url: 'https://your-org.okta.com/oauth2/default/v1/token',
19
+ user_info_url: 'https://your-org.okta.com/oauth2/default/v1/userinfo',
20
+ response_type: 'id_token',
21
+ authorization_server: 'default',
22
+ audience: 'api://default'
24
23
  }
25
-
26
24
  option :scope, DEFAULT_SCOPE
27
25
 
28
26
  uid { raw_info['sub'] }
@@ -38,40 +36,67 @@ module OmniAuth
38
36
  end
39
37
 
40
38
  extra do
41
- hash = {}
42
- hash[:raw_info] = raw_info unless skip_info?
43
- hash[:id_token] = access_token.token
44
- if !options[:skip_jwt] && !access_token.token.nil?
45
- hash[:id_info] = validated_token(access_token.token)
39
+ {}.tap do |h|
40
+ h[:raw_info] = raw_info unless skip_info?
41
+
42
+ if access_token
43
+ h[:id_token] = access_token.token
44
+
45
+ if !options[:skip_jwt] && !access_token.token.nil?
46
+ h[:id_info] = validated_token(access_token.token)
47
+ end
48
+ end
46
49
  end
47
- hash
50
+ end
51
+
52
+ def client_options
53
+ options.fetch(:client_options)
48
54
  end
49
55
 
50
56
  alias :oauth2_access_token :access_token
51
57
 
52
58
  def access_token
53
- ::OAuth2::AccessToken.new(client, oauth2_access_token.token, {
54
- :expires_in => oauth2_access_token.expires_in,
55
- :expires_at => oauth2_access_token.expires_at
56
- })
59
+ if oauth2_access_token
60
+ ::OAuth2::AccessToken.new(client, oauth2_access_token.token, {
61
+ refresh_token: oauth2_access_token.refresh_token,
62
+ expires_in: oauth2_access_token.expires_in,
63
+ expires_at: oauth2_access_token.expires_at
64
+ })
65
+ end
57
66
  end
58
67
 
59
68
  def raw_info
60
- @_raw_info ||= access_token.get('/oauth2/v1/userinfo').parsed || {}
69
+ @_raw_info ||= access_token.get(client_options.fetch(:user_info_url)).parsed || {}
61
70
  rescue ::Errno::ETIMEDOUT
62
71
  raise ::Timeout::Error
63
72
  end
64
73
 
65
- def request_phase
66
- super
74
+ def callback_url
75
+ options[:redirect_uri] || (full_host + callback_path)
67
76
  end
68
77
 
69
- def callback_phase
70
- super
78
+ # Returns the qualified URL for the authorization server
79
+ #
80
+ # This is necessary in the case where there is a custom authorization server.
81
+ #
82
+ # Okta provides a default, by default.
83
+ #
84
+ # @return [String]
85
+ def authorization_server_path
86
+ site = client_options.fetch(:site)
87
+ authorization_server = client_options.fetch(:authorization_server, 'default')
88
+
89
+ "#{site}/oauth2/#{authorization_server}"
71
90
  end
72
91
 
73
- def callback_url
74
- options[:redirect_uri] || (full_host + script_name + callback_path)
92
+ # Specifies the audience for the authorization server
93
+ #
94
+ # By default, this is +'default'+. If using a custom authorization
95
+ # server, this will need to be set
96
+ #
97
+ # @return [String]
98
+ def authorization_server_audience
99
+ client_options.fetch(:audience, 'default')
75
100
  end
76
101
 
77
102
  def validated_token(token)
@@ -79,16 +104,16 @@ module OmniAuth
79
104
  nil,
80
105
  false,
81
106
  verify_iss: true,
82
- iss: BASE_URL,
83
107
  verify_aud: true,
84
- aud: BASE_URL,
108
+ iss: authorization_server_path,
109
+ aud: authorization_server_audience,
85
110
  verify_sub: true,
86
111
  verify_expiration: true,
87
112
  verify_not_before: true,
88
113
  verify_iat: true,
89
114
  verify_jti: false,
90
115
  leeway: options[:jwt_leeway]
91
- ).first
116
+ ).first
92
117
  end
93
118
  end
94
119
  end
data/lib/omniauth-okta/version.rb CHANGED
@@ -2,6 +2,6 @@
2
2
 
3
3
  module OmniAuth
4
4
  module Okta
5
- VERSION = '0.1.0'
5
+ VERSION = '1.0.0'.freeze
6
6
  end
7
7
  end
metadata CHANGED
@@ -1,14 +1,15 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: omniauth-okta
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.0
4
+ version: 1.0.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Dan Andrews
8
+ - Hector Rios
8
9
  autorequire:
9
10
  bindir: bin
10
11
  cert_chain: []
11
- date: 2017-06-05 00:00:00.000000000 Z
12
+ date: 2021-04-06 00:00:00.000000000 Z
12
13
  dependencies:
13
14
  - !ruby/object:Gem::Dependency
14
15
  name: omniauth
@@ -16,42 +17,34 @@ dependencies:
16
17
  requirements:
17
18
  - - "~>"
18
19
  - !ruby/object:Gem::Version
19
- version: '1.0'
20
+ version: '2.0'
20
21
  type: :runtime
21
22
  prerelease: false
22
23
  version_requirements: !ruby/object:Gem::Requirement
23
24
  requirements:
24
25
  - - "~>"
25
26
  - !ruby/object:Gem::Version
26
- version: '1.0'
27
+ version: '2.0'
27
28
  - !ruby/object:Gem::Dependency
28
29
  name: omniauth-oauth2
29
30
  requirement: !ruby/object:Gem::Requirement
30
31
  requirements:
31
32
  - - "~>"
32
33
  - !ruby/object:Gem::Version
33
- version: '1.0'
34
+ version: '1.7'
35
+ - - ">="
36
+ - !ruby/object:Gem::Version
37
+ version: 1.7.1
34
38
  type: :runtime
35
39
  prerelease: false
36
40
  version_requirements: !ruby/object:Gem::Requirement
37
41
  requirements:
38
42
  - - "~>"
39
43
  - !ruby/object:Gem::Version
40
- version: '1.0'
41
- - !ruby/object:Gem::Dependency
42
- name: bundler
43
- requirement: !ruby/object:Gem::Requirement
44
- requirements:
45
- - - "~>"
46
- - !ruby/object:Gem::Version
47
- version: '1.5'
48
- type: :development
49
- prerelease: false
50
- version_requirements: !ruby/object:Gem::Requirement
51
- requirements:
52
- - - "~>"
44
+ version: '1.7'
45
+ - - ">="
53
46
  - !ruby/object:Gem::Version
54
- version: '1.5'
47
+ version: 1.7.1
55
48
  - !ruby/object:Gem::Dependency
56
49
  name: rake
57
50
  requirement: !ruby/object:Gem::Requirement
@@ -72,14 +65,14 @@ dependencies:
72
65
  requirements:
73
66
  - - "~>"
74
67
  - !ruby/object:Gem::Version
75
- version: '2.7'
68
+ version: '3'
76
69
  type: :development
77
70
  prerelease: false
78
71
  version_requirements: !ruby/object:Gem::Requirement
79
72
  requirements:
80
73
  - - "~>"
81
74
  - !ruby/object:Gem::Version
82
- version: '2.7'
75
+ version: '3'
83
76
  - !ruby/object:Gem::Dependency
84
77
  name: rack-test
85
78
  requirement: !ruby/object:Gem::Requirement
@@ -97,6 +90,7 @@ dependencies:
97
90
  description: Unofficial OmniAuth OAuth2 strategy for Okta
98
91
  email:
99
92
  - daniel.raymond.andrews@gmail.com
93
+ - that.hector@gmail.com
100
94
  executables: []
101
95
  extensions: []
102
96
  extra_rdoc_files: []
@@ -126,8 +120,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
126
120
  - !ruby/object:Gem::Version
127
121
  version: '0'
128
122
  requirements: []
129
- rubyforge_project:
130
- rubygems_version: 2.6.8
123
+ rubygems_version: 3.0.0
131
124
  signing_key:
132
125
  specification_version: 4
133
126
  summary: Unofficial OmniAuth OAuth2 strategy for Okta