omniauth_oidc 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 801521d0f3ce8e7cdfa427b09c09689db790784bbacb90f9c1d46e8194db1bb6
-  data.tar.gz: 5a5ddd24e583e982304fca72de602dc8b405b11c98c2d019fbc88fe7058ad48f
+  metadata.gz: 74463844a516326572c11a06efb05d658c8f62a14046ef8348f0940296c16433
+  data.tar.gz: 4756f11d552dc0d39085125210631161eaa6fa5ecf27b2388a0a90becec96abc
 SHA512:
-  metadata.gz: 8480664bb2f337914f7eefc8aa012d58bc9b67fa66fb0e206d2aef09c0352f9228a4d9212e5a1a36a5689676b01dacc00d888dd5a186fbd6af5a69f69f519174
-  data.tar.gz: 45645700fc002901880944adc41cf1d97ee9d108132c5416718198955b7620203e293938646e225d798e7fd86f028c9bd4f5108aa41f2e3ba822fe6489eef936
+  metadata.gz: 11a227e37b5878b9ac0e61ee4956acc36e905a17271d06bc33992d37aad3e5a6e33f777e6f9118f3b60ada81570b9a2b884876d6db08febfa917de59dd721b4b
+  data.tar.gz: 786fbde9d9929102212c954bee84769f5a8a4d92f36347ec3dfb299d785f94a9a26ffd0057395e96d385a12a6e720aacf42b3b6476cbe3622b5ed394563ff19a

data/CHANGELOG.md

@@ -1,6 +1,9 @@
 ## [Released]
 
-## [0.2.0] - 2024-07-21
+## [0.2.2] - 2024-08-04
+- Update dependencies, update documentation, fix end_session_uri, update other_phase
+
+## [0.2.1] - 2024-07-21
 - Update dependencies
 
 ## [0.2.0] - 2024-07-06

data/README.md

@@ -91,6 +91,7 @@ end
 ```
 
 Ensure to replace identifier, secret, configuration endpoint url and others with credentials received from your OIDC provider.
+Please note that the gem does not accept `redirect_uri` as a configurable option. For details please see section Routes.
 
 ### Redirecting for Authentication
 
@@ -125,15 +126,20 @@ end
 
 ### Routes
 
-The gem uses dynamic routes when making requests to the OIDC provider endpoints. These routes follow the naming pattern
-of `https://your_app.com/auth/<simple_provider>/callback`, where `<simple_provider>` is the provider name defined
-within the configuration of the `omniauth.rb` initializer.
+The gem uses dynamic routes when making requests to the OIDC provider endpoints, so called `redirect_uri` which is a
+non-configurable value that follows the naming pattern of `https://your_app.com/auth/<simple_provider>/callback`, 
+where `<simple_provider>` is the provider name defined within the configuration of the `omniauth.rb` initializer.
+This represents the `redirect_uri` that will be passed with the authorization request to your OIDC provider and that
+has to be registered with your OIDC provider as permitted `redirect_uri`.
 
 Dynamic routes are used to process responses and perform intermediary steps by the middleware, e.g. request phase,
-token verification. While you can define and use same routes within your Rails app, you can modify your `routes.rb`
-to perform a dynamic redirect to a another controller method. In an example below, all OIDC responses are ultimately
-redirected to the `omniauth` method of the `callbacks_controller`, which is a universal method to handle authentication
-with various omniauth providers:
+token verification. While you can define and use same routes within your Rails app, it is highly recommended to modify 
+your `routes.rb` to perform a dynamic redirect to a another controller method so this does not cause any conflicts with
+the middleware or the authorization flow.
+
+In an example below, `auth/:provider/callback` is generalized `redirect_uri` value that is passed in the authorization
+flow, while all OIDC provider responses are ultimately redirected to the `omniauth` method of the `callbacks_controller`,
+which could be a "Swiss army knife" method to handle authentication or user data from various omniauth providers:
 
 ```ruby
 # config/routes.rb
@@ -202,6 +208,41 @@ class CallbacksController < ApplicationController
 end
 ```
 
+### Ending Session
+
+The gem provides two configuration options to allow ending a session simultaneously with your client application and the
+OIDC provider.
+
+To use this feature, you need to provide a `logout_path` in the options and an `end_session_endpoint` in the client 
+options. Here’s a sample setup:
+
+``` ruby
+  provider :oidc, {
+    name: :simple_provider,
+    client_options: {
+      identifier: ENV['SIMPLE_PROVIDER_CLIENT_ID'],
+      secret: ENV['SIMPLE_PROVIDER_SECRET'],
+      config_endpoint: 'https://simpleprovider.com/1234567890/.well-known/openid-configuration',
+      end_session_endpoint: 'https://simpleprovider.com/signout' # URL to end session with OIDC provider
+    },
+    logout_path: '/logout' # path in your application to end user session
+  }
+```
+
+* `end_session_endpoint` is the URL to which your client app can redirect to log out the user from the OIDC provider's application. It can be dynamically fetched from the `config_endpoint` response if your OIDC provider specifies it there. Alternatively, you can explicitly provide it in the client options.
+
+* `logout_path` is the URL in your application that can be called to terminate the current user's session.
+
+Using these two configurations, you can ensure that when a user logs out from your application, they are also logged out
+from the OIDC provider, providing a seamless logout across multiple services.
+
+This works by calling `other_phase` on every request in your application, which checks if the requested URL matches the 
+defined `logout_path`. If it does, meaning that the current user has requested to log out from your application, 
+`other_phase` redirects to the `end_session_endpoin`t to terminate the user's session with the OIDC provider if such a 
+session exists. Then it returns back to your application and concludes the request to end the session.
+
+For additional details please refer to the [OIDC specification](https://openid.net/specs/openid-connect-session-1_0-17.html#:~:text=%C2%A0TOC-,5.%C2%A0%20RP%2DInitiated%20Logout,-An%20RP%20can).
+
 ### Advanced Configuration
 You can customize the OIDC strategy further by adding additional configuration options:
 

data/lib/omniauth/oidc/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OmniauthOidc
-  VERSION = "0.2.1"
+  VERSION = "0.2.2"
 end

data/lib/omniauth/strategies/oidc/verify.rb

@@ -62,7 +62,7 @@ module OmniAuth
             end
 
           decoded.verify!(keyset)
-          ::Oidc::ResponseObject::IdToken.new(decoded)
+          ::OpenIDConnect::ResponseObject::IdToken.new(decoded)
         rescue JSON::JWK::Set::KidNotFound
           # Workaround for https://github.com/nov/json-jwt/pull/92#issuecomment-824654949
           raise if decoded&.header&.key?("kid")
@@ -87,7 +87,7 @@ module OmniAuth
         end
 
         def decode!(id_token, key)
-          ::Oidc::ResponseObject::IdToken.decode(id_token, key)
+          ::OpenIDConnect::ResponseObject::IdToken.decode(id_token, key)
         end
 
         def decode_with_each_key!(id_token, keyset)
@@ -139,7 +139,7 @@ module OmniAuth
           if access_token.id_token
             decoded = decode_id_token(access_token.id_token).raw_attributes
 
-            @user_info = ::Oidc::ResponseObject::UserInfo.new(
+            @user_info = ::OpenIDConnect::ResponseObject::UserInfo.new(
               access_token.userinfo!.raw_attributes.merge(decoded)
             )
           else

data/lib/omniauth/strategies/oidc.rb

@@ -5,7 +5,7 @@ require "timeout"
 require "net/http"
 require "open-uri"
 require "omniauth"
-require "oidc"
+require "openid_connect"
 require "openid_config_parser"
 require "forwardable"
 require "httparty"
@@ -112,9 +112,9 @@ module OmniAuth
         }
       end
 
-      # Initialize Oidc Client with options
+      # Initialize OpenIDConnect Client with options
       def client
-        @client ||= ::Oidc::Client.new(client_options)
+        @client ||= ::OpenIDConnect::Client.new(client_options)
       end
 
       # Config is build from the json response from the OIDC config endpoint
@@ -127,8 +127,9 @@ module OmniAuth
         @config ||= OpenidConfigParser.fetch_openid_configuration(client_options.config_endpoint)
       end
 
+      # Detects if current request is for the logout url and makes a redirect to end session with OIDC provider
       def other_phase
-        if logout_path_pattern.match?(current_path)
+        if logout_path_pattern.match?(request.url)
           options.issuer = issuer if options.issuer.to_s.empty?
 
           return redirect(end_session_uri) if end_session_uri
@@ -136,6 +137,7 @@ module OmniAuth
         call_app!
       end
 
+      # URL to end authenticated user's session with OIDC provider
       def end_session_uri
         return unless end_session_endpoint_is_valid?
 
@@ -205,7 +207,7 @@ module OmniAuth
       end
 
       def logout_path_pattern
-        @logout_path_pattern ||= /\A#{Regexp.quote(request_path)}#{options.logout_path}/
+        @logout_path_pattern ||= /\A#{Regexp.quote(request.base_url)}#{options.logout_path}/
       end
 
       # Strips port and host from strings with OIDC endpoints

data/omniauth_oidc.gemspec

@@ -33,9 +33,9 @@ Gem::Specification.new do |spec|
 
   # Uncomment to register a new dependency of your gem
   spec.add_dependency "httparty"
-  spec.add_dependency "oidc"
   spec.add_dependency "omniauth"
   spec.add_dependency "openid_config_parser"
+  spec.add_dependency "openid_connect"
 
   # For more information and examples about making a new gem, check out our
   # guide at: https://bundler.io/guides/creating_gem.html

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth_oidc
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - Suleyman Musayev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-07-21 00:00:00.000000000 Z
+date: 2024-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httparty
@@ -25,7 +25,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: oidc
+  name: omniauth
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -39,7 +39,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: omniauth
+  name: openid_config_parser
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -53,7 +53,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: openid_config_parser
+  name: openid_connect
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="