omniauth_openid_federation 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (67) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +16 -0
  3. data/LICENSE.md +22 -0
  4. data/README.md +822 -0
  5. data/SECURITY.md +129 -0
  6. data/examples/README_INTEGRATION_TESTING.md +399 -0
  7. data/examples/README_MOCK_OP.md +243 -0
  8. data/examples/app/controllers/users/omniauth_callbacks_controller.rb.example +33 -0
  9. data/examples/app/jobs/jwks_rotation_job.rb.example +60 -0
  10. data/examples/app/models/user.rb.example +39 -0
  11. data/examples/config/initializers/devise.rb.example +97 -0
  12. data/examples/config/initializers/federation_endpoint.rb.example +206 -0
  13. data/examples/config/mock_op.yml.example +83 -0
  14. data/examples/config/open_id_connect_config.rb.example +210 -0
  15. data/examples/config/routes.rb.example +12 -0
  16. data/examples/db/migrate/add_omniauth_to_users.rb.example +16 -0
  17. data/examples/integration_test_flow.rb +1334 -0
  18. data/examples/jobs/README.md +194 -0
  19. data/examples/jobs/federation_cache_refresh_job.rb.example +78 -0
  20. data/examples/jobs/federation_files_generation_job.rb.example +87 -0
  21. data/examples/mock_op_server.rb +775 -0
  22. data/examples/mock_rp_server.rb +435 -0
  23. data/lib/omniauth_openid_federation/access_token.rb +504 -0
  24. data/lib/omniauth_openid_federation/cache.rb +39 -0
  25. data/lib/omniauth_openid_federation/cache_adapter.rb +173 -0
  26. data/lib/omniauth_openid_federation/configuration.rb +135 -0
  27. data/lib/omniauth_openid_federation/constants.rb +13 -0
  28. data/lib/omniauth_openid_federation/endpoint_resolver.rb +168 -0
  29. data/lib/omniauth_openid_federation/entity_statement_reader.rb +122 -0
  30. data/lib/omniauth_openid_federation/errors.rb +52 -0
  31. data/lib/omniauth_openid_federation/federation/entity_statement.rb +331 -0
  32. data/lib/omniauth_openid_federation/federation/entity_statement_builder.rb +188 -0
  33. data/lib/omniauth_openid_federation/federation/entity_statement_fetcher.rb +142 -0
  34. data/lib/omniauth_openid_federation/federation/entity_statement_helper.rb +87 -0
  35. data/lib/omniauth_openid_federation/federation/entity_statement_parser.rb +198 -0
  36. data/lib/omniauth_openid_federation/federation/entity_statement_validator.rb +502 -0
  37. data/lib/omniauth_openid_federation/federation/metadata_policy_merger.rb +276 -0
  38. data/lib/omniauth_openid_federation/federation/signed_jwks.rb +210 -0
  39. data/lib/omniauth_openid_federation/federation/trust_chain_resolver.rb +225 -0
  40. data/lib/omniauth_openid_federation/federation_endpoint.rb +949 -0
  41. data/lib/omniauth_openid_federation/http_client.rb +70 -0
  42. data/lib/omniauth_openid_federation/instrumentation.rb +383 -0
  43. data/lib/omniauth_openid_federation/jwks/cache.rb +76 -0
  44. data/lib/omniauth_openid_federation/jwks/decode.rb +174 -0
  45. data/lib/omniauth_openid_federation/jwks/fetch.rb +153 -0
  46. data/lib/omniauth_openid_federation/jwks/normalizer.rb +49 -0
  47. data/lib/omniauth_openid_federation/jwks/rotate.rb +97 -0
  48. data/lib/omniauth_openid_federation/jwks/selector.rb +101 -0
  49. data/lib/omniauth_openid_federation/jws.rb +416 -0
  50. data/lib/omniauth_openid_federation/key_extractor.rb +173 -0
  51. data/lib/omniauth_openid_federation/logger.rb +99 -0
  52. data/lib/omniauth_openid_federation/rack_endpoint.rb +187 -0
  53. data/lib/omniauth_openid_federation/railtie.rb +29 -0
  54. data/lib/omniauth_openid_federation/rate_limiter.rb +55 -0
  55. data/lib/omniauth_openid_federation/strategy.rb +2029 -0
  56. data/lib/omniauth_openid_federation/string_helpers.rb +30 -0
  57. data/lib/omniauth_openid_federation/tasks_helper.rb +428 -0
  58. data/lib/omniauth_openid_federation/utils.rb +166 -0
  59. data/lib/omniauth_openid_federation/validators.rb +126 -0
  60. data/lib/omniauth_openid_federation/version.rb +3 -0
  61. data/lib/omniauth_openid_federation.rb +98 -0
  62. data/lib/tasks/omniauth_openid_federation.rake +376 -0
  63. data/sig/federation.rbs +218 -0
  64. data/sig/jwks.rbs +63 -0
  65. data/sig/omniauth_openid_federation.rbs +254 -0
  66. data/sig/strategy.rbs +60 -0
  67. metadata +352 -0
metadata ADDED
@@ -0,0 +1,352 @@
1
+ --- !ruby/object:Gem::Specification
2
+ name: omniauth_openid_federation
3
+ version: !ruby/object:Gem::Version
4
+ version: 1.0.0
5
+ platform: ruby
6
+ authors:
7
+ - Andrei Makarov
8
+ bindir: bin
9
+ cert_chain: []
10
+ date: 1980-01-02 00:00:00.000000000 Z
11
+ dependencies:
12
+ - !ruby/object:Gem::Dependency
13
+ name: omniauth-oauth2
14
+ requirement: !ruby/object:Gem::Requirement
15
+ requirements:
16
+ - - "~>"
17
+ - !ruby/object:Gem::Version
18
+ version: '1.8'
19
+ type: :runtime
20
+ prerelease: false
21
+ version_requirements: !ruby/object:Gem::Requirement
22
+ requirements:
23
+ - - "~>"
24
+ - !ruby/object:Gem::Version
25
+ version: '1.8'
26
+ - !ruby/object:Gem::Dependency
27
+ name: openid_connect
28
+ requirement: !ruby/object:Gem::Requirement
29
+ requirements:
30
+ - - "~>"
31
+ - !ruby/object:Gem::Version
32
+ version: '2.3'
33
+ type: :runtime
34
+ prerelease: false
35
+ version_requirements: !ruby/object:Gem::Requirement
36
+ requirements:
37
+ - - "~>"
38
+ - !ruby/object:Gem::Version
39
+ version: '2.3'
40
+ - !ruby/object:Gem::Dependency
41
+ name: jwt
42
+ requirement: !ruby/object:Gem::Requirement
43
+ requirements:
44
+ - - "~>"
45
+ - !ruby/object:Gem::Version
46
+ version: '3.1'
47
+ type: :runtime
48
+ prerelease: false
49
+ version_requirements: !ruby/object:Gem::Requirement
50
+ requirements:
51
+ - - "~>"
52
+ - !ruby/object:Gem::Version
53
+ version: '3.1'
54
+ - !ruby/object:Gem::Dependency
55
+ name: jwe
56
+ requirement: !ruby/object:Gem::Requirement
57
+ requirements:
58
+ - - "~>"
59
+ - !ruby/object:Gem::Version
60
+ version: '1.1'
61
+ type: :runtime
62
+ prerelease: false
63
+ version_requirements: !ruby/object:Gem::Requirement
64
+ requirements:
65
+ - - "~>"
66
+ - !ruby/object:Gem::Version
67
+ version: '1.1'
68
+ - !ruby/object:Gem::Dependency
69
+ name: http
70
+ requirement: !ruby/object:Gem::Requirement
71
+ requirements:
72
+ - - "~>"
73
+ - !ruby/object:Gem::Version
74
+ version: '5.3'
75
+ type: :runtime
76
+ prerelease: false
77
+ version_requirements: !ruby/object:Gem::Requirement
78
+ requirements:
79
+ - - "~>"
80
+ - !ruby/object:Gem::Version
81
+ version: '5.3'
82
+ - !ruby/object:Gem::Dependency
83
+ name: rack
84
+ requirement: !ruby/object:Gem::Requirement
85
+ requirements:
86
+ - - "~>"
87
+ - !ruby/object:Gem::Version
88
+ version: '3.2'
89
+ type: :runtime
90
+ prerelease: false
91
+ version_requirements: !ruby/object:Gem::Requirement
92
+ requirements:
93
+ - - "~>"
94
+ - !ruby/object:Gem::Version
95
+ version: '3.2'
96
+ - !ruby/object:Gem::Dependency
97
+ name: rspec
98
+ requirement: !ruby/object:Gem::Requirement
99
+ requirements:
100
+ - - "~>"
101
+ - !ruby/object:Gem::Version
102
+ version: '3.13'
103
+ type: :development
104
+ prerelease: false
105
+ version_requirements: !ruby/object:Gem::Requirement
106
+ requirements:
107
+ - - "~>"
108
+ - !ruby/object:Gem::Version
109
+ version: '3.13'
110
+ - !ruby/object:Gem::Dependency
111
+ name: webmock
112
+ requirement: !ruby/object:Gem::Requirement
113
+ requirements:
114
+ - - "~>"
115
+ - !ruby/object:Gem::Version
116
+ version: '3.26'
117
+ type: :development
118
+ prerelease: false
119
+ version_requirements: !ruby/object:Gem::Requirement
120
+ requirements:
121
+ - - "~>"
122
+ - !ruby/object:Gem::Version
123
+ version: '3.26'
124
+ - !ruby/object:Gem::Dependency
125
+ name: rake
126
+ requirement: !ruby/object:Gem::Requirement
127
+ requirements:
128
+ - - "~>"
129
+ - !ruby/object:Gem::Version
130
+ version: '13.3'
131
+ type: :development
132
+ prerelease: false
133
+ version_requirements: !ruby/object:Gem::Requirement
134
+ requirements:
135
+ - - "~>"
136
+ - !ruby/object:Gem::Version
137
+ version: '13.3'
138
+ - !ruby/object:Gem::Dependency
139
+ name: simplecov
140
+ requirement: !ruby/object:Gem::Requirement
141
+ requirements:
142
+ - - "~>"
143
+ - !ruby/object:Gem::Version
144
+ version: '0.22'
145
+ type: :development
146
+ prerelease: false
147
+ version_requirements: !ruby/object:Gem::Requirement
148
+ requirements:
149
+ - - "~>"
150
+ - !ruby/object:Gem::Version
151
+ version: '0.22'
152
+ - !ruby/object:Gem::Dependency
153
+ name: rspec_junit_formatter
154
+ requirement: !ruby/object:Gem::Requirement
155
+ requirements:
156
+ - - "~>"
157
+ - !ruby/object:Gem::Version
158
+ version: '0.6'
159
+ type: :development
160
+ prerelease: false
161
+ version_requirements: !ruby/object:Gem::Requirement
162
+ requirements:
163
+ - - "~>"
164
+ - !ruby/object:Gem::Version
165
+ version: '0.6'
166
+ - !ruby/object:Gem::Dependency
167
+ name: simplecov-cobertura
168
+ requirement: !ruby/object:Gem::Requirement
169
+ requirements:
170
+ - - "~>"
171
+ - !ruby/object:Gem::Version
172
+ version: '3.1'
173
+ type: :development
174
+ prerelease: false
175
+ version_requirements: !ruby/object:Gem::Requirement
176
+ requirements:
177
+ - - "~>"
178
+ - !ruby/object:Gem::Version
179
+ version: '3.1'
180
+ - !ruby/object:Gem::Dependency
181
+ name: standard
182
+ requirement: !ruby/object:Gem::Requirement
183
+ requirements:
184
+ - - "~>"
185
+ - !ruby/object:Gem::Version
186
+ version: '1.52'
187
+ type: :development
188
+ prerelease: false
189
+ version_requirements: !ruby/object:Gem::Requirement
190
+ requirements:
191
+ - - "~>"
192
+ - !ruby/object:Gem::Version
193
+ version: '1.52'
194
+ - !ruby/object:Gem::Dependency
195
+ name: appraisal
196
+ requirement: !ruby/object:Gem::Requirement
197
+ requirements:
198
+ - - "~>"
199
+ - !ruby/object:Gem::Version
200
+ version: '2.5'
201
+ type: :development
202
+ prerelease: false
203
+ version_requirements: !ruby/object:Gem::Requirement
204
+ requirements:
205
+ - - "~>"
206
+ - !ruby/object:Gem::Version
207
+ version: '2.5'
208
+ - !ruby/object:Gem::Dependency
209
+ name: memory_profiler
210
+ requirement: !ruby/object:Gem::Requirement
211
+ requirements:
212
+ - - "~>"
213
+ - !ruby/object:Gem::Version
214
+ version: '1.1'
215
+ type: :development
216
+ prerelease: false
217
+ version_requirements: !ruby/object:Gem::Requirement
218
+ requirements:
219
+ - - "~>"
220
+ - !ruby/object:Gem::Version
221
+ version: '1.1'
222
+ - !ruby/object:Gem::Dependency
223
+ name: rbs
224
+ requirement: !ruby/object:Gem::Requirement
225
+ requirements:
226
+ - - "~>"
227
+ - !ruby/object:Gem::Version
228
+ version: '3.9'
229
+ type: :development
230
+ prerelease: false
231
+ version_requirements: !ruby/object:Gem::Requirement
232
+ requirements:
233
+ - - "~>"
234
+ - !ruby/object:Gem::Version
235
+ version: '3.9'
236
+ - !ruby/object:Gem::Dependency
237
+ name: webrick
238
+ requirement: !ruby/object:Gem::Requirement
239
+ requirements:
240
+ - - "~>"
241
+ - !ruby/object:Gem::Version
242
+ version: '1.9'
243
+ type: :development
244
+ prerelease: false
245
+ version_requirements: !ruby/object:Gem::Requirement
246
+ requirements:
247
+ - - "~>"
248
+ - !ruby/object:Gem::Version
249
+ version: '1.9'
250
+ description: Custom OmniAuth strategy for OpenID Federation providers using openid_connect
251
+ gem, supporting signed request objects (RFC 9101), ID token encryption/decryption,
252
+ client assertion (private_key_jwt), and OpenID Federation entity statements. Framework-agnostic
253
+ and works with Rails, Sinatra, Rack, and other Rack-compatible frameworks.
254
+ email:
255
+ - contact@kiskolabs.com
256
+ executables: []
257
+ extensions: []
258
+ extra_rdoc_files: []
259
+ files:
260
+ - CHANGELOG.md
261
+ - LICENSE.md
262
+ - README.md
263
+ - SECURITY.md
264
+ - examples/README_INTEGRATION_TESTING.md
265
+ - examples/README_MOCK_OP.md
266
+ - examples/app/controllers/users/omniauth_callbacks_controller.rb.example
267
+ - examples/app/jobs/jwks_rotation_job.rb.example
268
+ - examples/app/models/user.rb.example
269
+ - examples/config/initializers/devise.rb.example
270
+ - examples/config/initializers/federation_endpoint.rb.example
271
+ - examples/config/mock_op.yml.example
272
+ - examples/config/open_id_connect_config.rb.example
273
+ - examples/config/routes.rb.example
274
+ - examples/db/migrate/add_omniauth_to_users.rb.example
275
+ - examples/integration_test_flow.rb
276
+ - examples/jobs/README.md
277
+ - examples/jobs/federation_cache_refresh_job.rb.example
278
+ - examples/jobs/federation_files_generation_job.rb.example
279
+ - examples/mock_op_server.rb
280
+ - examples/mock_rp_server.rb
281
+ - lib/omniauth_openid_federation.rb
282
+ - lib/omniauth_openid_federation/access_token.rb
283
+ - lib/omniauth_openid_federation/cache.rb
284
+ - lib/omniauth_openid_federation/cache_adapter.rb
285
+ - lib/omniauth_openid_federation/configuration.rb
286
+ - lib/omniauth_openid_federation/constants.rb
287
+ - lib/omniauth_openid_federation/endpoint_resolver.rb
288
+ - lib/omniauth_openid_federation/entity_statement_reader.rb
289
+ - lib/omniauth_openid_federation/errors.rb
290
+ - lib/omniauth_openid_federation/federation/entity_statement.rb
291
+ - lib/omniauth_openid_federation/federation/entity_statement_builder.rb
292
+ - lib/omniauth_openid_federation/federation/entity_statement_fetcher.rb
293
+ - lib/omniauth_openid_federation/federation/entity_statement_helper.rb
294
+ - lib/omniauth_openid_federation/federation/entity_statement_parser.rb
295
+ - lib/omniauth_openid_federation/federation/entity_statement_validator.rb
296
+ - lib/omniauth_openid_federation/federation/metadata_policy_merger.rb
297
+ - lib/omniauth_openid_federation/federation/signed_jwks.rb
298
+ - lib/omniauth_openid_federation/federation/trust_chain_resolver.rb
299
+ - lib/omniauth_openid_federation/federation_endpoint.rb
300
+ - lib/omniauth_openid_federation/http_client.rb
301
+ - lib/omniauth_openid_federation/instrumentation.rb
302
+ - lib/omniauth_openid_federation/jwks/cache.rb
303
+ - lib/omniauth_openid_federation/jwks/decode.rb
304
+ - lib/omniauth_openid_federation/jwks/fetch.rb
305
+ - lib/omniauth_openid_federation/jwks/normalizer.rb
306
+ - lib/omniauth_openid_federation/jwks/rotate.rb
307
+ - lib/omniauth_openid_federation/jwks/selector.rb
308
+ - lib/omniauth_openid_federation/jws.rb
309
+ - lib/omniauth_openid_federation/key_extractor.rb
310
+ - lib/omniauth_openid_federation/logger.rb
311
+ - lib/omniauth_openid_federation/rack_endpoint.rb
312
+ - lib/omniauth_openid_federation/railtie.rb
313
+ - lib/omniauth_openid_federation/rate_limiter.rb
314
+ - lib/omniauth_openid_federation/strategy.rb
315
+ - lib/omniauth_openid_federation/string_helpers.rb
316
+ - lib/omniauth_openid_federation/tasks_helper.rb
317
+ - lib/omniauth_openid_federation/utils.rb
318
+ - lib/omniauth_openid_federation/validators.rb
319
+ - lib/omniauth_openid_federation/version.rb
320
+ - lib/tasks/omniauth_openid_federation.rake
321
+ - sig/federation.rbs
322
+ - sig/jwks.rbs
323
+ - sig/omniauth_openid_federation.rbs
324
+ - sig/strategy.rbs
325
+ homepage: https://github.com/amkisko/omniauth_openid_federation.rb
326
+ licenses:
327
+ - MIT
328
+ metadata:
329
+ source_code_uri: https://github.com/amkisko/omniauth_openid_federation.rb
330
+ changelog_uri: https://github.com/amkisko/omniauth_openid_federation.rb/blob/main/CHANGELOG.md
331
+ bug_tracker_uri: https://github.com/amkisko/omniauth_openid_federation.rb/issues
332
+ rubygems_mfa_required: 'true'
333
+ documentation_uri: https://rubydoc.info/gems/omniauth_openid_federation
334
+ rdoc_options: []
335
+ require_paths:
336
+ - lib
337
+ required_ruby_version: !ruby/object:Gem::Requirement
338
+ requirements:
339
+ - - ">="
340
+ - !ruby/object:Gem::Version
341
+ version: '3.0'
342
+ required_rubygems_version: !ruby/object:Gem::Requirement
343
+ requirements:
344
+ - - ">="
345
+ - !ruby/object:Gem::Version
346
+ version: 3.3.0
347
+ requirements: []
348
+ rubygems_version: 3.6.9
349
+ specification_version: 4
350
+ summary: OmniAuth strategy for OpenID Federation providers with signed request objects
351
+ and ID token encryption.
352
+ test_files: []