omniauth-proconnect 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +7 -0
- data/lib/omniauth/proconnect/version.rb +1 -1
- data/lib/omniauth/proconnect.rb +116 -115
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3798432d91f891378bd3a61ac701ed300d262613b961c9d2e7c6ef9e7f72d8bd
|
|
4
|
+
data.tar.gz: a13a4a55b57569fbb93907b35966aa6855beb6002f73a66088d19dcd0f4a00b9
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 6bc5467a0edef737742ed477ec0ddb175e45e58298ffde705bb3162a214cc802cf52f98568e5c20ffc98d4a6a2812fab98840a185d0d0ddc9b1e9b37cb464bfe
|
|
7
|
+
data.tar.gz: d68e03e9eb2e796da1f68d270eb322f52b2e429c1ab0554e78f040bfa768a20c70e09dc89a62d701fd9053cb1f99060e3e16f9c04aa9a15c71e97e7b2bb8c471
|
data/README.md
CHANGED
|
@@ -17,6 +17,13 @@ qui malgré son degré de maturité supérieure semble à l'abandon aussi.
|
|
|
17
17
|
|
|
18
18
|
## Utilisation
|
|
19
19
|
|
|
20
|
+
Une fois que vous avez créé votre application sur [l'espace
|
|
21
|
+
partenaires de
|
|
22
|
+
ProConnect](https://partenaires.proconnect.gouv.fr/apps) et identifié
|
|
23
|
+
vos endpoints grâce à leur [documentation
|
|
24
|
+
technique](https://partenaires.proconnect.gouv.fr/docs/fournisseur-service/implementation_technique))
|
|
25
|
+
:
|
|
26
|
+
|
|
20
27
|
1. installer la gem `bundle add omniauth-proconnect` ;
|
|
21
28
|
2. configurer une nouvelle stratégie pour OmniAuth :
|
|
22
29
|
|
data/lib/omniauth/proconnect.rb
CHANGED
|
@@ -6,149 +6,150 @@ require "json/jwt"
|
|
|
6
6
|
|
|
7
7
|
require_relative "proconnect/version"
|
|
8
8
|
|
|
9
|
-
module
|
|
10
|
-
|
|
11
|
-
class
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
9
|
+
module OmniAuth
|
|
10
|
+
module Strategies
|
|
11
|
+
class Proconnect
|
|
12
|
+
class Error < StandardError; end
|
|
13
|
+
|
|
14
|
+
include OmniAuth::Strategy
|
|
15
|
+
|
|
16
|
+
option :name, "proconnect"
|
|
17
|
+
option :client_id
|
|
18
|
+
option :client_secret
|
|
19
|
+
option :proconnect_domain
|
|
20
|
+
option :redirect_uri
|
|
21
|
+
option :post_logout_redirect_uri
|
|
22
|
+
option :scope, "openid email given_name usual_name"
|
|
23
|
+
|
|
24
|
+
def setup_phase
|
|
25
|
+
discover_endpoint!
|
|
26
|
+
end
|
|
26
27
|
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
28
|
+
def request_phase
|
|
29
|
+
redirect(authorization_uri)
|
|
30
|
+
end
|
|
30
31
|
|
|
31
|
-
|
|
32
|
-
|
|
32
|
+
def callback_phase
|
|
33
|
+
verify_state!(request.params["state"])
|
|
33
34
|
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
35
|
+
exchange_authorization_code!(request.params["code"])
|
|
36
|
+
.then { |response| store_tokens!(response) }
|
|
37
|
+
.then { get_userinfo! }
|
|
38
|
+
.then { |response| @userinfo = JSON::JWT.decode(response.body, :skip_verification) }
|
|
39
|
+
.then { super }
|
|
40
|
+
end
|
|
40
41
|
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
42
|
+
def other_phase
|
|
43
|
+
if on_logout_path?
|
|
44
|
+
engage_logout!
|
|
45
|
+
else
|
|
46
|
+
call_app!
|
|
47
|
+
end
|
|
46
48
|
end
|
|
47
|
-
end
|
|
48
49
|
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
50
|
+
def uid
|
|
51
|
+
session["omniauth.pc.id_token"]["sub"]
|
|
52
|
+
end
|
|
52
53
|
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
54
|
+
def info
|
|
55
|
+
{
|
|
56
|
+
email: @userinfo["email"]
|
|
57
|
+
}
|
|
58
|
+
end
|
|
58
59
|
|
|
59
|
-
|
|
60
|
+
private
|
|
60
61
|
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
62
|
+
def connection
|
|
63
|
+
@connection ||= Faraday.new(url: options[:proconnect_domain]) do |c|
|
|
64
|
+
c.response :json
|
|
65
|
+
c.response :raise_error
|
|
66
|
+
end
|
|
65
67
|
end
|
|
66
|
-
end
|
|
67
68
|
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
69
|
+
def discovered_configuration
|
|
70
|
+
@discovered_configuration ||= discover_endpoint!
|
|
71
|
+
end
|
|
71
72
|
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
73
|
+
def discover_endpoint!
|
|
74
|
+
connection
|
|
75
|
+
.get(".well-known/openid-configuration")
|
|
76
|
+
.body
|
|
77
|
+
end
|
|
77
78
|
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
79
|
+
def authorization_uri
|
|
80
|
+
URI(discovered_configuration["authorization_endpoint"]).tap do |endpoint|
|
|
81
|
+
endpoint.query = URI.encode_www_form(
|
|
82
|
+
response_type: "code",
|
|
83
|
+
client_id: options[:client_id],
|
|
84
|
+
redirect_uri: options[:redirect_uri],
|
|
85
|
+
scope: options[:scope],
|
|
86
|
+
state: store_new_state!,
|
|
87
|
+
nonce: store_new_nonce!
|
|
88
|
+
)
|
|
89
|
+
end
|
|
88
90
|
end
|
|
89
|
-
end
|
|
90
91
|
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
92
|
+
def end_session_uri
|
|
93
|
+
URI(discovered_configuration["end_session_endpoint"]).tap do |endpoint|
|
|
94
|
+
endpoint.query = URI.encode_www_form(
|
|
95
|
+
id_token_hint: session["omniauth.pc.id_token"],
|
|
96
|
+
state: current_state,
|
|
97
|
+
post_logout_redirect_uri: options[:post_logout_redirect_uri]
|
|
98
|
+
)
|
|
99
|
+
end
|
|
98
100
|
end
|
|
99
|
-
end
|
|
100
101
|
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
end
|
|
102
|
+
def exchange_authorization_code!(code)
|
|
103
|
+
connection.post(URI(discovered_configuration["token_endpoint"]),
|
|
104
|
+
URI.encode_www_form(
|
|
105
|
+
grant_type: "authorization_code",
|
|
106
|
+
client_id: options[:client_id],
|
|
107
|
+
client_secret: options[:client_secret],
|
|
108
|
+
redirect_uri: options[:redirect_uri],
|
|
109
|
+
code: code
|
|
110
|
+
))
|
|
111
|
+
end
|
|
112
112
|
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
113
|
+
def store_tokens!(response)
|
|
114
|
+
response.tap do |res|
|
|
115
|
+
%w[access id refresh].each do |name|
|
|
116
|
+
session["omniauth.pc.#{name}_token"] = res.body["#{name}_token"]
|
|
117
|
+
end
|
|
117
118
|
end
|
|
118
119
|
end
|
|
119
|
-
end
|
|
120
120
|
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
121
|
+
def get_userinfo!
|
|
122
|
+
endpoint = URI(discovered_configuration["userinfo_endpoint"])
|
|
123
|
+
token = session["omniauth.pc.access_token"]
|
|
124
124
|
|
|
125
|
-
|
|
126
|
-
|
|
125
|
+
connection.get(endpoint, {}, "Authorization" => "Bearer #{token}")
|
|
126
|
+
end
|
|
127
127
|
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
128
|
+
def engage_logout!
|
|
129
|
+
redirect end_session_uri
|
|
130
|
+
end
|
|
131
131
|
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
132
|
+
def on_logout_path?
|
|
133
|
+
# FIXME: maybe don't hardcode this
|
|
134
|
+
request.path.end_with?("#{request_path}/logout")
|
|
135
|
+
end
|
|
136
136
|
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
137
|
+
def store_new_state!
|
|
138
|
+
session["omniauth.state"] = SecureRandom.hex(16)
|
|
139
|
+
end
|
|
140
140
|
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
141
|
+
def current_state
|
|
142
|
+
session["omniauth.state"]
|
|
143
|
+
end
|
|
144
144
|
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
145
|
+
def store_new_nonce!
|
|
146
|
+
session["omniauth.nonce"] = SecureRandom.hex(16)
|
|
147
|
+
end
|
|
148
148
|
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
149
|
+
def verify_state!(other_state)
|
|
150
|
+
if other_state != current_state
|
|
151
|
+
raise "a request came back with a different 'state' parameter than what we had last stored."
|
|
152
|
+
end
|
|
152
153
|
end
|
|
153
154
|
end
|
|
154
155
|
end
|
metadata
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: omniauth-proconnect
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.3.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Stéphane Maniaci
|
|
8
8
|
bindir: exe
|
|
9
9
|
cert_chain: []
|
|
10
|
-
date: 2025-
|
|
10
|
+
date: 2025-05-22 00:00:00.000000000 Z
|
|
11
11
|
dependencies:
|
|
12
12
|
- !ruby/object:Gem::Dependency
|
|
13
13
|
name: faraday
|