omniauth_openid_connect 0.3.0 → 0.3.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/config/rubocop_linter_action.yml +59 -0
- data/.github/stale.yml +17 -0
- data/.github/workflows/rubocop.yml +22 -0
- data/.rubocop.yml +58 -0
- data/.travis.yml +4 -0
- data/CHANGELOG.md +34 -0
- data/Gemfile +2 -0
- data/Guardfile +5 -3
- data/README.md +52 -8
- data/lib/omniauth/openid_connect.rb +2 -0
- data/lib/omniauth/openid_connect/errors.rb +3 -0
- data/lib/omniauth/openid_connect/version.rb +3 -1
- data/lib/omniauth/strategies/openid_connect.rb +127 -70
- data/lib/omniauth_openid_connect.rb +2 -0
- data/omniauth_openid_connect.gemspec +14 -13
- data/test/lib/omniauth/strategies/openid_connect_test.rb +163 -8
- metadata +44 -40
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 9c030571ea9bcbd861ebe4d8455282c0b1b34c17af77294660b1c0123ed976ab
|
|
4
|
+
data.tar.gz: 2f4b2a8cd026797260f36e358ac7678a6827486889f23aab325d08e0d390b649
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: afdf6363a18b019939a88abc612be51b20780fdeae2f1f300ef5e9df5a1002a97812b17360939e1ba9bb0b3bf4e54471e3da0ec6de858ac2afa40df15fdfb23d
|
|
7
|
+
data.tar.gz: e449bd59e5e75cfcce12ae27e5072fb8e3fe821e969a510856bbad0ed2553252345826ed16e97ecdbe1405a8c4be275195f759e71aed99fd699bf9509bffa0f3
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
# Description: The name of the check that will be created.
|
|
2
|
+
# Valid Options: A reasonably sized string.
|
|
3
|
+
# Default: 'Rubocop Action'
|
|
4
|
+
check_name: 'Rubocop Results'
|
|
5
|
+
|
|
6
|
+
# Description: Versions required to run your RuboCop checks.
|
|
7
|
+
# Valid options: RuboCop and any RuboCop extension, by default the latest gem version will be used. You can explicitly state that
|
|
8
|
+
# (not required) or use a version number, like '1.5.1'.
|
|
9
|
+
# Default:
|
|
10
|
+
# versions:
|
|
11
|
+
# - rubocop: 'latest'
|
|
12
|
+
versions:
|
|
13
|
+
- rubocop
|
|
14
|
+
- rubocop-minitest
|
|
15
|
+
- rubocop-performance: '1.5.1'
|
|
16
|
+
|
|
17
|
+
# Description: Rubocop configuration file path relative to the workspace.
|
|
18
|
+
# Valid options: A valid file path inside of the workspace.
|
|
19
|
+
# Default: nil
|
|
20
|
+
# Note: This does not need to be filled out for Rubocop to still find your config.
|
|
21
|
+
# Resource: https://rubocop.readthedocs.io/en/stable/configuration/
|
|
22
|
+
rubocop_config_path: '.rubocop.yml'
|
|
23
|
+
|
|
24
|
+
# Run all cops enabled by configuration except this list.
|
|
25
|
+
# Valid options: list of valid cop(s) and/or departments.
|
|
26
|
+
# Default: nil
|
|
27
|
+
# Resource: https://rubocop.readthedocs.io/en/stable/cops/
|
|
28
|
+
# rubocop_excluded_cops:
|
|
29
|
+
# - 'Style/FrozenStringLiteralComment'
|
|
30
|
+
|
|
31
|
+
# Minimum severity for exit with error code
|
|
32
|
+
# Valid options: 'refactor', 'convention', 'warning', 'error', or 'fatal'.
|
|
33
|
+
# Default: 'warning'
|
|
34
|
+
# Resource: https://rubocop.readthedocs.io/en/stable/configuration/#severity
|
|
35
|
+
# rubocop_fail_level: 'warning'
|
|
36
|
+
|
|
37
|
+
# Whether or not to use --force-exclusion when building the rubocop command. Use this if you are only linting modified
|
|
38
|
+
# files and typically excluded files have been changed. For example, if you exclude db/schema.rb in your rubocop.yml
|
|
39
|
+
# but a change gets made, then with the check_scope config set to 'modified' rubocop will lint db/schema.rb. If you set
|
|
40
|
+
# this to true, rubocop will ignore it.
|
|
41
|
+
# Valid options: true || false
|
|
42
|
+
# Default: false
|
|
43
|
+
|
|
44
|
+
# Instead of installing gems from rubygems, we can run `bundle install` on your project,
|
|
45
|
+
# you would need to do this if you are using something like 'rubocop-github' or if you don't
|
|
46
|
+
# want to list out dependencies with the `versions` key.
|
|
47
|
+
# Valid options: true || false
|
|
48
|
+
# Default: false
|
|
49
|
+
# bundle: false
|
|
50
|
+
|
|
51
|
+
# The scope of code that Rubocop should lint. Use this if you only want to lint changed files. If this is not set
|
|
52
|
+
# or not equal to 'modified', Rubocop is run against the entire codebase. Note that this will not work on the master branch.
|
|
53
|
+
# Valid options: 'modified'
|
|
54
|
+
# Default: nil
|
|
55
|
+
|
|
56
|
+
# The base branch against which changes will be compared, if check_scope config is set to 'modified'.
|
|
57
|
+
# This setting is not used if check_scope != 'modified'.
|
|
58
|
+
# Valid options: 'origin/another_branch'
|
|
59
|
+
# Default: 'origin/master'
|
data/.github/stale.yml
ADDED
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
# Number of days of inactivity before an issue becomes stale
|
|
2
|
+
daysUntilStale: 60
|
|
3
|
+
# Number of days of inactivity before a stale issue is closed
|
|
4
|
+
daysUntilClose: 7
|
|
5
|
+
# Issues with these labels will never be considered stale
|
|
6
|
+
exemptLabels:
|
|
7
|
+
- pinned
|
|
8
|
+
- security
|
|
9
|
+
# Label to use when marking an issue as stale
|
|
10
|
+
staleLabel: wontfix
|
|
11
|
+
# Comment to post when marking an issue as stale. Set to `false` to disable
|
|
12
|
+
markComment: >
|
|
13
|
+
This issue has been automatically marked as stale because it has not had
|
|
14
|
+
recent activity. It will be closed if no further activity occurs. Thank you
|
|
15
|
+
for your contributions.
|
|
16
|
+
# Comment to post when closing a stale issue. Set to `false` to disable
|
|
17
|
+
closeComment: false
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
name: Rubocop check
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
pull_request:
|
|
5
|
+
branches:
|
|
6
|
+
- "*"
|
|
7
|
+
push:
|
|
8
|
+
branches:
|
|
9
|
+
- master
|
|
10
|
+
jobs:
|
|
11
|
+
build:
|
|
12
|
+
name: RuboCop Action
|
|
13
|
+
runs-on: ubuntu-latest
|
|
14
|
+
steps:
|
|
15
|
+
- name: Checkout Action
|
|
16
|
+
uses: actions/checkout@v1
|
|
17
|
+
- name: Rubocop Linter Action
|
|
18
|
+
uses: andrewmcodes/rubocop-linter-action@v3.2.0
|
|
19
|
+
with:
|
|
20
|
+
action_config_path: '.github/config/rubocop_linter_action.yml'
|
|
21
|
+
env:
|
|
22
|
+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
data/.rubocop.yml
ADDED
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
LineLength:
|
|
2
|
+
Description: 'Limit lines to 130 characters.'
|
|
3
|
+
Max: 130
|
|
4
|
+
|
|
5
|
+
Layout/SpaceInsideStringInterpolation:
|
|
6
|
+
Enabled: false
|
|
7
|
+
|
|
8
|
+
Layout/MultilineOperationIndentation:
|
|
9
|
+
EnforcedStyle: indented
|
|
10
|
+
|
|
11
|
+
StringLiterals:
|
|
12
|
+
EnforcedStyle: single_quotes
|
|
13
|
+
|
|
14
|
+
Style/TrailingCommaInArrayLiteral:
|
|
15
|
+
EnforcedStyleForMultiline: comma
|
|
16
|
+
Style/TrailingCommaInHashLiteral:
|
|
17
|
+
EnforcedStyleForMultiline: comma
|
|
18
|
+
|
|
19
|
+
Style/SafeNavigation:
|
|
20
|
+
Enabled: false
|
|
21
|
+
|
|
22
|
+
Style/EmptyMethod:
|
|
23
|
+
Description: 'Checks the formatting of empty method definitions.'
|
|
24
|
+
StyleGuide: '#no-single-line-methods'
|
|
25
|
+
Enabled: false
|
|
26
|
+
|
|
27
|
+
HashSyntax:
|
|
28
|
+
Description: "Prefer Ruby 1.9 hash syntax { a: 1, b: 2 } over 1.8 syntax\n{ :a => 1, :b => 2 }"
|
|
29
|
+
EnforcedStyle: ruby19
|
|
30
|
+
Enabled: true
|
|
31
|
+
|
|
32
|
+
RedundantBegin:
|
|
33
|
+
Enabled: true
|
|
34
|
+
|
|
35
|
+
Documentation:
|
|
36
|
+
Enabled: false
|
|
37
|
+
|
|
38
|
+
Metrics/AbcSize:
|
|
39
|
+
Max: 50
|
|
40
|
+
|
|
41
|
+
Metrics/CyclomaticComplexity:
|
|
42
|
+
Max: 50
|
|
43
|
+
|
|
44
|
+
Metrics/PerceivedComplexity:
|
|
45
|
+
Max: 15
|
|
46
|
+
|
|
47
|
+
Metrics/BlockLength:
|
|
48
|
+
Max: 40
|
|
49
|
+
|
|
50
|
+
Metrics/MethodLength:
|
|
51
|
+
Max: 45
|
|
52
|
+
|
|
53
|
+
AllCops:
|
|
54
|
+
Exclude:
|
|
55
|
+
- bin/**/*
|
|
56
|
+
- Rakefile
|
|
57
|
+
- config/**/*
|
|
58
|
+
- test/**/*
|
data/.travis.yml
CHANGED
data/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,37 @@
|
|
|
1
|
+
# v0.3.5 (07.06.2020)
|
|
2
|
+
|
|
3
|
+
- bugfix: Info from decoded id_token is not exposed into `request.env['omniauth.auth']` [#61](https://github.com/m0n9oose/omniauth_openid_connect/pull/61)
|
|
4
|
+
- bugfix: NoMethodError (`undefined method 'count' for #<OpenIDConnect::ResponseObject::IdToken>`) [#60](https://github.com/m0n9oose/omniauth_openid_connect/pull/60)
|
|
5
|
+
|
|
6
|
+
# v0.3.4 (21.05.2020)
|
|
7
|
+
|
|
8
|
+
- Try to verify id_token when response_type is code [#44](https://github.com/m0n9oose/omniauth_openid_connect/pull/44)
|
|
9
|
+
- Provide more information on error [#49](https://github.com/m0n9oose/omniauth_openid_connect/pull/49)
|
|
10
|
+
- Update configuration documentation [#53](https://github.com/m0n9oose/omniauth_openid_connect/pull/53)
|
|
11
|
+
- Add documentation about the send_scope_to_token_endpoint config property [#52](https://github.com/m0n9oose/omniauth_openid_connect/pull/52)
|
|
12
|
+
- refactor: take uid_field from raw_attributes [#54](https://github.com/m0n9oose/omniauth_openid_connect/pull/54)
|
|
13
|
+
- chore(ci): add 2.7, ruby-head and jruby-head [#55](https://github.com/m0n9oose/omniauth_openid_connect/pull/55)
|
|
14
|
+
|
|
15
|
+
# v0.3.3 (09.11.2019)
|
|
16
|
+
|
|
17
|
+
- Pass `acr_values` to authorize url [#43](https://github.com/m0n9oose/omniauth_openid_connect/pull/43)
|
|
18
|
+
- Add raw info for id token [#42](https://github.com/m0n9oose/omniauth_openid_connect/pull/42)
|
|
19
|
+
- Fixed `id_token` verification when `id_token` is not used [#41](https://github.com/m0n9oose/omniauth_openid_connect/pull/41)
|
|
20
|
+
- Cast `response_type` to string when checking if it is set in params [#36](https://github.com/m0n9oose/omniauth_openid_connect/pull/36)
|
|
21
|
+
- Support both symbol and string version of `response_type` option [#35](https://github.com/m0n9oose/omniauth_openid_connect/pull/35)
|
|
22
|
+
- Fix gemspec homepage [#33](https://github.com/m0n9oose/omniauth_openid_connect/pull/33)
|
|
23
|
+
- Add support for `response_type` `id_token` [#32](https://github.com/m0n9oose/omniauth_openid_connect/pull/32)
|
|
24
|
+
|
|
25
|
+
# v0.3.2 (03.08.2019)
|
|
26
|
+
|
|
27
|
+
- Use response_mode in `authorize_uri` if the option is defined [#30](https://github.com/m0n9oose/omniauth_openid_connect/pull/30)
|
|
28
|
+
- Move verification of `id_token` to before accessing tokens [#28](https://github.com/m0n9oose/omniauth_openid_connect/pull/28)
|
|
29
|
+
- Update omniauth dependency [#26](https://github.com/m0n9oose/omniauth_openid_connect/pull/26)
|
|
30
|
+
|
|
31
|
+
# v0.3.1 (08.06.2019)
|
|
32
|
+
|
|
33
|
+
- Set default OmniAuth name to openid_connect [#23](https://github.com/m0n9oose/omniauth_openid_connect/pull/23)
|
|
34
|
+
|
|
1
35
|
# v0.3.0 (27.04.2019)
|
|
2
36
|
|
|
3
37
|
- RP-Initiated Logout phase [#5](https://github.com/m0n9oose/omniauth_openid_connect/pull/5)
|
data/Gemfile
CHANGED
data/Guardfile
CHANGED
|
@@ -1,11 +1,13 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
1
3
|
# A sample Guardfile
|
|
2
4
|
# More info at https://github.com/guard/guard#readme
|
|
3
5
|
|
|
4
6
|
guard 'minitest' do
|
|
5
7
|
# with Minitest::Unit
|
|
6
|
-
watch(%r
|
|
7
|
-
watch(%r
|
|
8
|
-
watch(%r
|
|
8
|
+
watch(%r{^test/(.*)\/(.*)_test\.rb})
|
|
9
|
+
watch(%r{^lib/(.*)\.rb}) { |m| "test/lib/#{m[1]}_test.rb" }
|
|
10
|
+
watch(%r{^test/test_helper\.rb}) { 'test' }
|
|
9
11
|
end
|
|
10
12
|
|
|
11
13
|
guard :bundler do
|
data/README.md
CHANGED
|
@@ -19,6 +19,10 @@ And then execute:
|
|
|
19
19
|
Or install it yourself as:
|
|
20
20
|
|
|
21
21
|
$ gem install omniauth_openid_connect
|
|
22
|
+
|
|
23
|
+
## Supported Ruby Versions
|
|
24
|
+
|
|
25
|
+
OmniAuth::OpenIDConnect is tested under 2.4, 2.5, 2.6, 2.7
|
|
22
26
|
|
|
23
27
|
## Usage
|
|
24
28
|
|
|
@@ -40,7 +44,44 @@ config.omniauth :openid_connect, {
|
|
|
40
44
|
}
|
|
41
45
|
```
|
|
42
46
|
|
|
43
|
-
|
|
47
|
+
### Options Overview
|
|
48
|
+
|
|
49
|
+
| Field | Description | Required | Default | Example/Options |
|
|
50
|
+
|------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|----------------------------|-----------------------------------------------------|
|
|
51
|
+
| name | Arbitrary string to identify connection and identify it from other openid_connect providers | no | String: openid_connect | :my_idp |
|
|
52
|
+
| issuer | Root url for the authorization server | yes | | https://myprovider.com |
|
|
53
|
+
| discovery | Should OpenID discovery be used. This is recommended if the IDP provides a discovery endpoint. See client config for how to manually enter discovered values. | no | false | one of: true, false |
|
|
54
|
+
| client_auth_method | Which authentication method to use to authenticate your app with the authorization server | no | Sym: basic | "basic", "jwks" |
|
|
55
|
+
| scope | Which OpenID scopes to include (:openid is always required) | no | Array<sym> [:openid] | [:openid, :profile, :email] |
|
|
56
|
+
| response_type | Which OAuth2 response type to use with the authorization request | no | String: code | one of: 'code', 'id_token' |
|
|
57
|
+
| state | A value to be used for the OAuth2 state parameter on the authorization request. Can be a proc that generates a string. | no | Random 16 character string | Proc.new { SecureRandom.hex(32) } |
|
|
58
|
+
| response_mode | The response mode per [spec](https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html) | no | nil | one of: :query, :fragment, :form_post, :web_message |
|
|
59
|
+
| display | An optional parameter to the authorization request to determine how the authorization and consent page | no | nil | one of: :page, :popup, :touch, :wap |
|
|
60
|
+
| prompt | An optional parameter to the authrization request to determine what pages the user will be shown | no | nil | one of: :none, :login, :consent, :select_account |
|
|
61
|
+
| send_scope_to_token_endpoint | Should the scope parameter be sent to the authorization token endpoint? | no | true | one of: true, false |
|
|
62
|
+
| post_logout_redirect_uri | The logout redirect uri to use per the [session management draft](https://openid.net/specs/openid-connect-session-1_0.html) | no | empty | https://myapp.com/logout/callback |
|
|
63
|
+
| uid_field | The field of the user info response to be used as a unique id | no | 'sub' | "sub", "preferred_username" |
|
|
64
|
+
| client_options | A hash of client options detailed in its own section | yes | | |
|
|
65
|
+
|
|
66
|
+
### Client Config Options
|
|
67
|
+
|
|
68
|
+
These are the configuration options for the client_options hash of the configuration.
|
|
69
|
+
|
|
70
|
+
| Field | Description | Default | Replaced by discovery? |
|
|
71
|
+
|------------------------|-----------------------------------------------------------------|------------|------------------------|
|
|
72
|
+
| identifier | The OAuth2 client_id | | |
|
|
73
|
+
| secret | The OAuth2 client secret | | |
|
|
74
|
+
| redirect_uri | The OAuth2 authorization callback url in your app | | |
|
|
75
|
+
| scheme | The http scheme to use | https | |
|
|
76
|
+
| host | The host of the authorization server | nil | |
|
|
77
|
+
| port | The port for the authorization server | 443 | |
|
|
78
|
+
| authorization_endpoint | The authorize endpoint on the authorization server | /authorize | yes |
|
|
79
|
+
| token_endpoint | The token endpoint on the authorization server | /token | yes |
|
|
80
|
+
| userinfo_endpoint | The user info endpoint on the authorization server | /userinfo | yes |
|
|
81
|
+
| jwks_uri | The jwks_uri on the authorization server | /jwk | yes |
|
|
82
|
+
| end_session_endpoint | The url to call to log the user out at the authorization server | nil | yes |
|
|
83
|
+
|
|
84
|
+
### Additional Configuration Notes
|
|
44
85
|
* `name` is arbitrary, I recommend using the name of your provider. The name
|
|
45
86
|
configuration exists because you could be using multiple OpenID Connect
|
|
46
87
|
providers in a single app.
|
|
@@ -48,11 +89,9 @@ Configuration details:
|
|
|
48
89
|
**NOTE**: if you use this gem with Devise you should use `:openid_connect` name,
|
|
49
90
|
or Devise would route to 'users/auth/:provider' rather than 'users/auth/openid_connect'
|
|
50
91
|
|
|
51
|
-
*
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
server side web apps anyway and are designed more for native/mobile apps.
|
|
55
|
-
* If you want to pass `state` paramete by yourself. You can set Proc Object.
|
|
92
|
+
* `response_type` tells the authorization server which grant type the application wants to use,
|
|
93
|
+
currently, only `:code` (Authorization Code grant) and `:id_token` (Implicit grant) are valid.
|
|
94
|
+
* If you want to pass `state` paramete by yourself. You can set Proc Object.
|
|
56
95
|
e.g. `state: Proc.new { SecureRandom.hex(32) }`
|
|
57
96
|
* `nonce` is optional. If don't want to pass "nonce" parameter to provider, You should specify
|
|
58
97
|
`false` to `send_nonce` option. (default true)
|
|
@@ -60,14 +99,19 @@ Configuration details:
|
|
|
60
99
|
`:client_auth_method` option, automatically set `:basic`.
|
|
61
100
|
* Use "OpenID Connect Discovery", You should specify `true` to `discovery` option. (default false)
|
|
62
101
|
* In "OpenID Connect Discovery", generally provider should have Webfinger endpoint.
|
|
63
|
-
If provider does not have Webfinger endpoint, You can specify "Issuer" to option.
|
|
64
|
-
e.g. `issuer: "https://myprovider.com"`
|
|
102
|
+
If provider does not have Webfinger endpoint, You can specify "Issuer" to option.
|
|
103
|
+
e.g. `issuer: "https://myprovider.com"`
|
|
65
104
|
It means to get configuration from "https://myprovider.com/.well-known/openid-configuration".
|
|
66
105
|
* The uid is by default using the `sub` value from the `user_info` response,
|
|
67
106
|
which in some applications is not the expected value. To avoid such limitations, the uid label can be
|
|
68
107
|
configured by providing the omniauth `uid_field` option to a different label (i.e. `preferred_username`)
|
|
69
108
|
that appears in the `user_info` details.
|
|
70
109
|
* The `issuer` property should exactly match the provider's issuer link.
|
|
110
|
+
* The `response_mode` option is optional and specifies how the result of the authorization request is formatted.
|
|
111
|
+
* Some OpenID Connect providers require the `scope` attribute in requests to the token endpoint, even if
|
|
112
|
+
this is not in the protocol specifications. In those cases, the `send_scope_to_token_endpoint`
|
|
113
|
+
property can be used to add the attribute to the token request. Initial value is `true`, which means that the
|
|
114
|
+
scope attribute is included by default.
|
|
71
115
|
|
|
72
116
|
For the full low down on OpenID Connect, please check out
|
|
73
117
|
[the spec](http://openid.net/specs/openid-connect-core-1_0.html).
|
|
@@ -1,3 +1,5 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
1
3
|
require 'addressable/uri'
|
|
2
4
|
require 'timeout'
|
|
3
5
|
require 'net/http'
|
|
@@ -12,32 +14,37 @@ module OmniAuth
|
|
|
12
14
|
include OmniAuth::Strategy
|
|
13
15
|
extend Forwardable
|
|
14
16
|
|
|
17
|
+
RESPONSE_TYPE_EXCEPTIONS = {
|
|
18
|
+
'id_token' => { exception_class: OmniAuth::OpenIDConnect::MissingIdTokenError, key: :missing_id_token }.freeze,
|
|
19
|
+
'code' => { exception_class: OmniAuth::OpenIDConnect::MissingCodeError, key: :missing_code }.freeze,
|
|
20
|
+
}.freeze
|
|
21
|
+
|
|
15
22
|
def_delegator :request, :params
|
|
16
23
|
|
|
17
|
-
option :
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
24
|
+
option :name, 'openid_connect'
|
|
25
|
+
option(:client_options, identifier: nil,
|
|
26
|
+
secret: nil,
|
|
27
|
+
redirect_uri: nil,
|
|
28
|
+
scheme: 'https',
|
|
29
|
+
host: nil,
|
|
30
|
+
port: 443,
|
|
31
|
+
authorization_endpoint: '/authorize',
|
|
32
|
+
token_endpoint: '/token',
|
|
33
|
+
userinfo_endpoint: '/userinfo',
|
|
34
|
+
jwks_uri: '/jwk',
|
|
35
|
+
end_session_endpoint: nil)
|
|
36
|
+
|
|
30
37
|
option :issuer
|
|
31
38
|
option :discovery, false
|
|
32
39
|
option :client_signing_alg
|
|
33
40
|
option :client_jwk_signing_key
|
|
34
41
|
option :client_x509_signing_key
|
|
35
42
|
option :scope, [:openid]
|
|
36
|
-
option :response_type,
|
|
43
|
+
option :response_type, 'code' # ['code', 'id_token']
|
|
37
44
|
option :state
|
|
38
|
-
option :response_mode
|
|
39
|
-
option :display, nil
|
|
40
|
-
option :prompt, nil
|
|
45
|
+
option :response_mode # [:query, :fragment, :form_post, :web_message]
|
|
46
|
+
option :display, nil # [:page, :popup, :touch, :wap]
|
|
47
|
+
option :prompt, nil # [:none, :login, :consent, :select_account]
|
|
41
48
|
option :hd, nil
|
|
42
49
|
option :max_age
|
|
43
50
|
option :ui_locales
|
|
@@ -47,13 +54,11 @@ module OmniAuth
|
|
|
47
54
|
option :send_scope_to_token_endpoint, true
|
|
48
55
|
option :client_auth_method
|
|
49
56
|
option :post_logout_redirect_uri
|
|
57
|
+
option :extra_authorize_params, {}
|
|
50
58
|
option :uid_field, 'sub'
|
|
51
59
|
|
|
52
60
|
def uid
|
|
53
|
-
user_info.
|
|
54
|
-
rescue NoMethodError
|
|
55
|
-
log :warn, "User sub:#{user_info.sub} missing info field: #{options.uid_field}"
|
|
56
|
-
user_info.sub
|
|
61
|
+
user_info.raw_attributes[options.uid_field.to_sym] || user_info.sub
|
|
57
62
|
end
|
|
58
63
|
|
|
59
64
|
info do
|
|
@@ -66,7 +71,7 @@ module OmniAuth
|
|
|
66
71
|
gender: user_info.gender,
|
|
67
72
|
image: user_info.picture,
|
|
68
73
|
phone: user_info.phone_number,
|
|
69
|
-
urls: { website: user_info.website }
|
|
74
|
+
urls: { website: user_info.website },
|
|
70
75
|
}
|
|
71
76
|
end
|
|
72
77
|
|
|
@@ -80,7 +85,7 @@ module OmniAuth
|
|
|
80
85
|
token: access_token.access_token,
|
|
81
86
|
refresh_token: access_token.refresh_token,
|
|
82
87
|
expires_in: access_token.expires_in,
|
|
83
|
-
scope: access_token.scope
|
|
88
|
+
scope: access_token.scope,
|
|
84
89
|
}
|
|
85
90
|
end
|
|
86
91
|
|
|
@@ -93,29 +98,36 @@ module OmniAuth
|
|
|
93
98
|
end
|
|
94
99
|
|
|
95
100
|
def request_phase
|
|
96
|
-
options.issuer = issuer if options.issuer.
|
|
101
|
+
options.issuer = issuer if options.issuer.to_s.empty?
|
|
97
102
|
discover!
|
|
98
103
|
redirect authorize_uri
|
|
99
104
|
end
|
|
100
105
|
|
|
101
106
|
def callback_phase
|
|
102
107
|
error = params['error_reason'] || params['error']
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
108
|
+
error_description = params['error_description'] || params['error_reason']
|
|
109
|
+
invalid_state = params['state'].to_s.empty? || params['state'] != stored_state
|
|
110
|
+
|
|
111
|
+
raise CallbackError, error: params['error'], reason: error_description, uri: params['error_uri'] if error
|
|
112
|
+
raise CallbackError, error: :csrf_detected, reason: "Invalid 'state' parameter" if invalid_state
|
|
113
|
+
|
|
114
|
+
return unless valid_response_type?
|
|
115
|
+
|
|
116
|
+
options.issuer = issuer if options.issuer.nil? || options.issuer.empty?
|
|
117
|
+
|
|
118
|
+
verify_id_token!(params['id_token']) if configured_response_type == 'id_token'
|
|
119
|
+
discover!
|
|
120
|
+
client.redirect_uri = redirect_uri
|
|
121
|
+
|
|
122
|
+
return id_token_callback_phase if configured_response_type == 'id_token'
|
|
123
|
+
|
|
124
|
+
client.authorization_code = authorization_code
|
|
125
|
+
access_token
|
|
126
|
+
super
|
|
127
|
+
rescue CallbackError => e
|
|
128
|
+
fail!(e.error, e)
|
|
129
|
+
rescue ::Rack::OAuth2::Client::Error => e
|
|
130
|
+
fail!(e.response[:error], e)
|
|
119
131
|
rescue ::Timeout::Error, ::Errno::ETIMEDOUT => e
|
|
120
132
|
fail!(:timeout, e)
|
|
121
133
|
rescue ::SocketError => e
|
|
@@ -124,7 +136,7 @@ module OmniAuth
|
|
|
124
136
|
|
|
125
137
|
def other_phase
|
|
126
138
|
if logout_path_pattern.match?(current_path)
|
|
127
|
-
options.issuer = issuer if options.issuer.
|
|
139
|
+
options.issuer = issuer if options.issuer.to_s.empty?
|
|
128
140
|
discover!
|
|
129
141
|
return redirect(end_session_uri) if end_session_uri
|
|
130
142
|
end
|
|
@@ -137,6 +149,7 @@ module OmniAuth
|
|
|
137
149
|
|
|
138
150
|
def end_session_uri
|
|
139
151
|
return unless end_session_endpoint_is_valid?
|
|
152
|
+
|
|
140
153
|
end_session_uri = URI(client_options.end_session_endpoint)
|
|
141
154
|
end_session_uri.query = encoded_post_logout_redirect_uri
|
|
142
155
|
end_session_uri.to_s
|
|
@@ -146,6 +159,7 @@ module OmniAuth
|
|
|
146
159
|
client.redirect_uri = redirect_uri
|
|
147
160
|
opts = {
|
|
148
161
|
response_type: options.response_type,
|
|
162
|
+
response_mode: options.response_mode,
|
|
149
163
|
scope: options.scope,
|
|
150
164
|
state: new_state,
|
|
151
165
|
login_hint: params['login_hint'],
|
|
@@ -154,12 +168,17 @@ module OmniAuth
|
|
|
154
168
|
prompt: options.prompt,
|
|
155
169
|
nonce: (new_nonce if options.send_nonce),
|
|
156
170
|
hd: options.hd,
|
|
171
|
+
acr_values: options.acr_values,
|
|
157
172
|
}
|
|
158
|
-
|
|
173
|
+
|
|
174
|
+
opts.merge!(options.extra_authorize_params) unless options.extra_authorize_params.empty?
|
|
175
|
+
|
|
176
|
+
client.authorization_uri(opts.reject { |_k, v| v.nil? })
|
|
159
177
|
end
|
|
160
178
|
|
|
161
179
|
def public_key
|
|
162
180
|
return config.jwks if options.discovery
|
|
181
|
+
|
|
163
182
|
key_or_secret
|
|
164
183
|
end
|
|
165
184
|
|
|
@@ -173,6 +192,7 @@ module OmniAuth
|
|
|
173
192
|
|
|
174
193
|
def discover!
|
|
175
194
|
return unless options.discovery
|
|
195
|
+
|
|
176
196
|
client_options.authorization_endpoint = config.authorization_endpoint
|
|
177
197
|
client_options.token_endpoint = config.token_endpoint
|
|
178
198
|
client_options.userinfo_endpoint = config.userinfo_endpoint
|
|
@@ -181,23 +201,28 @@ module OmniAuth
|
|
|
181
201
|
end
|
|
182
202
|
|
|
183
203
|
def user_info
|
|
184
|
-
@user_info
|
|
204
|
+
return @user_info if @user_info
|
|
205
|
+
|
|
206
|
+
if access_token.id_token
|
|
207
|
+
decoded = decode_id_token(access_token.id_token).raw_attributes
|
|
208
|
+
|
|
209
|
+
@user_info = ::OpenIDConnect::ResponseObject::UserInfo.new access_token.userinfo!.raw_attributes.merge(decoded)
|
|
210
|
+
else
|
|
211
|
+
@user_info = access_token.userinfo!
|
|
212
|
+
end
|
|
185
213
|
end
|
|
186
214
|
|
|
187
215
|
def access_token
|
|
188
|
-
@access_token
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
)
|
|
199
|
-
_access_token
|
|
200
|
-
end
|
|
216
|
+
return @access_token if @access_token
|
|
217
|
+
|
|
218
|
+
@access_token = client.access_token!(
|
|
219
|
+
scope: (options.scope if options.send_scope_to_token_endpoint),
|
|
220
|
+
client_auth_method: options.client_auth_method
|
|
221
|
+
)
|
|
222
|
+
|
|
223
|
+
verify_id_token!(@access_token.id_token) if configured_response_type == 'code'
|
|
224
|
+
|
|
225
|
+
@access_token
|
|
201
226
|
end
|
|
202
227
|
|
|
203
228
|
def decode_id_token(id_token)
|
|
@@ -233,20 +258,20 @@ module OmniAuth
|
|
|
233
258
|
|
|
234
259
|
def session
|
|
235
260
|
return {} if @env.nil?
|
|
261
|
+
|
|
236
262
|
super
|
|
237
263
|
end
|
|
238
264
|
|
|
239
265
|
def key_or_secret
|
|
240
266
|
case options.client_signing_alg
|
|
241
267
|
when :HS256, :HS384, :HS512
|
|
242
|
-
|
|
268
|
+
client_options.secret
|
|
243
269
|
when :RS256, :RS384, :RS512
|
|
244
270
|
if options.client_jwk_signing_key
|
|
245
|
-
|
|
271
|
+
parse_jwk_key(options.client_jwk_signing_key)
|
|
246
272
|
elsif options.client_x509_signing_key
|
|
247
|
-
|
|
273
|
+
parse_x509_key(options.client_x509_signing_key)
|
|
248
274
|
end
|
|
249
|
-
else
|
|
250
275
|
end
|
|
251
276
|
end
|
|
252
277
|
|
|
@@ -256,24 +281,24 @@ module OmniAuth
|
|
|
256
281
|
|
|
257
282
|
def parse_jwk_key(key)
|
|
258
283
|
json = JSON.parse(key)
|
|
259
|
-
if json.
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
JSON::JWK.new json
|
|
263
|
-
end
|
|
284
|
+
return JSON::JWK::Set.new(json['keys']) if json.key?('keys')
|
|
285
|
+
|
|
286
|
+
JSON::JWK.new(json)
|
|
264
287
|
end
|
|
265
288
|
|
|
266
289
|
def decode(str)
|
|
267
|
-
UrlSafeBase64.decode64(str).
|
|
290
|
+
UrlSafeBase64.decode64(str).unpack1('B*').to_i(2).to_s
|
|
268
291
|
end
|
|
269
292
|
|
|
270
293
|
def redirect_uri
|
|
271
294
|
return client_options.redirect_uri unless params['redirect_uri']
|
|
295
|
+
|
|
272
296
|
"#{ client_options.redirect_uri }?redirect_uri=#{ CGI.escape(params['redirect_uri']) }"
|
|
273
297
|
end
|
|
274
298
|
|
|
275
299
|
def encoded_post_logout_redirect_uri
|
|
276
300
|
return unless options.post_logout_redirect_uri
|
|
301
|
+
|
|
277
302
|
URI.encode_www_form(
|
|
278
303
|
post_logout_redirect_uri: options.post_logout_redirect_uri
|
|
279
304
|
)
|
|
@@ -288,13 +313,45 @@ module OmniAuth
|
|
|
288
313
|
@logout_path_pattern ||= %r{\A#{Regexp.quote(request_path)}(/logout)}
|
|
289
314
|
end
|
|
290
315
|
|
|
316
|
+
def id_token_callback_phase
|
|
317
|
+
user_data = decode_id_token(params['id_token']).raw_attributes
|
|
318
|
+
env['omniauth.auth'] = AuthHash.new(
|
|
319
|
+
provider: name,
|
|
320
|
+
uid: user_data['sub'],
|
|
321
|
+
info: { name: user_data['name'], email: user_data['email'] },
|
|
322
|
+
extra: { raw_info: user_data }
|
|
323
|
+
)
|
|
324
|
+
call_app!
|
|
325
|
+
end
|
|
326
|
+
|
|
327
|
+
def valid_response_type?
|
|
328
|
+
return true if params.key?(configured_response_type)
|
|
329
|
+
|
|
330
|
+
error_attrs = RESPONSE_TYPE_EXCEPTIONS[configured_response_type]
|
|
331
|
+
fail!(error_attrs[:key], error_attrs[:exception_class].new(params['error']))
|
|
332
|
+
|
|
333
|
+
false
|
|
334
|
+
end
|
|
335
|
+
|
|
336
|
+
def configured_response_type
|
|
337
|
+
@configured_response_type ||= options.response_type.to_s
|
|
338
|
+
end
|
|
339
|
+
|
|
340
|
+
def verify_id_token!(id_token)
|
|
341
|
+
return unless id_token
|
|
342
|
+
|
|
343
|
+
decode_id_token(id_token).verify!(issuer: options.issuer,
|
|
344
|
+
client_id: client_options.identifier,
|
|
345
|
+
nonce: stored_nonce)
|
|
346
|
+
end
|
|
347
|
+
|
|
291
348
|
class CallbackError < StandardError
|
|
292
349
|
attr_accessor :error, :error_reason, :error_uri
|
|
293
350
|
|
|
294
|
-
def initialize(
|
|
295
|
-
self.error = error
|
|
296
|
-
self.error_reason =
|
|
297
|
-
self.error_uri =
|
|
351
|
+
def initialize(data)
|
|
352
|
+
self.error = data[:error]
|
|
353
|
+
self.error_reason = data[:reason]
|
|
354
|
+
self.error_uri = data[:uri]
|
|
298
355
|
end
|
|
299
356
|
|
|
300
357
|
def message
|