omniauth_openid_federation 1.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (70) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +44 -0
  3. data/LICENSE.md +22 -0
  4. data/README.md +922 -0
  5. data/SECURITY.md +28 -0
  6. data/app/controllers/omniauth_openid_federation/federation_controller.rb +160 -0
  7. data/config/routes.rb +17 -0
  8. data/examples/README_INTEGRATION_TESTING.md +399 -0
  9. data/examples/README_MOCK_OP.md +243 -0
  10. data/examples/app/controllers/users/omniauth_callbacks_controller.rb.example +37 -0
  11. data/examples/app/jobs/jwks_rotation_job.rb.example +60 -0
  12. data/examples/app/models/user.rb.example +39 -0
  13. data/examples/config/initializers/devise.rb.example +131 -0
  14. data/examples/config/initializers/federation_endpoint.rb.example +206 -0
  15. data/examples/config/mock_op.yml.example +83 -0
  16. data/examples/config/open_id_connect_config.rb.example +210 -0
  17. data/examples/config/routes.rb.example +12 -0
  18. data/examples/db/migrate/add_omniauth_to_users.rb.example +16 -0
  19. data/examples/integration_test_flow.rb +1334 -0
  20. data/examples/jobs/README.md +194 -0
  21. data/examples/jobs/federation_cache_refresh_job.rb.example +78 -0
  22. data/examples/jobs/federation_files_generation_job.rb.example +87 -0
  23. data/examples/mock_op_server.rb +775 -0
  24. data/examples/mock_rp_server.rb +435 -0
  25. data/lib/omniauth_openid_federation/access_token.rb +504 -0
  26. data/lib/omniauth_openid_federation/cache.rb +39 -0
  27. data/lib/omniauth_openid_federation/cache_adapter.rb +173 -0
  28. data/lib/omniauth_openid_federation/configuration.rb +135 -0
  29. data/lib/omniauth_openid_federation/constants.rb +13 -0
  30. data/lib/omniauth_openid_federation/endpoint_resolver.rb +168 -0
  31. data/lib/omniauth_openid_federation/engine.rb +17 -0
  32. data/lib/omniauth_openid_federation/entity_statement_reader.rb +129 -0
  33. data/lib/omniauth_openid_federation/errors.rb +52 -0
  34. data/lib/omniauth_openid_federation/federation/entity_statement.rb +331 -0
  35. data/lib/omniauth_openid_federation/federation/entity_statement_builder.rb +188 -0
  36. data/lib/omniauth_openid_federation/federation/entity_statement_fetcher.rb +142 -0
  37. data/lib/omniauth_openid_federation/federation/entity_statement_helper.rb +87 -0
  38. data/lib/omniauth_openid_federation/federation/entity_statement_parser.rb +198 -0
  39. data/lib/omniauth_openid_federation/federation/entity_statement_validator.rb +502 -0
  40. data/lib/omniauth_openid_federation/federation/metadata_policy_merger.rb +276 -0
  41. data/lib/omniauth_openid_federation/federation/signed_jwks.rb +210 -0
  42. data/lib/omniauth_openid_federation/federation/trust_chain_resolver.rb +225 -0
  43. data/lib/omniauth_openid_federation/federation_endpoint.rb +949 -0
  44. data/lib/omniauth_openid_federation/http_client.rb +70 -0
  45. data/lib/omniauth_openid_federation/instrumentation.rb +399 -0
  46. data/lib/omniauth_openid_federation/jwks/cache.rb +76 -0
  47. data/lib/omniauth_openid_federation/jwks/decode.rb +175 -0
  48. data/lib/omniauth_openid_federation/jwks/fetch.rb +153 -0
  49. data/lib/omniauth_openid_federation/jwks/normalizer.rb +49 -0
  50. data/lib/omniauth_openid_federation/jwks/rotate.rb +97 -0
  51. data/lib/omniauth_openid_federation/jwks/selector.rb +101 -0
  52. data/lib/omniauth_openid_federation/jws.rb +410 -0
  53. data/lib/omniauth_openid_federation/key_extractor.rb +173 -0
  54. data/lib/omniauth_openid_federation/logger.rb +99 -0
  55. data/lib/omniauth_openid_federation/rack_endpoint.rb +187 -0
  56. data/lib/omniauth_openid_federation/railtie.rb +15 -0
  57. data/lib/omniauth_openid_federation/rate_limiter.rb +55 -0
  58. data/lib/omniauth_openid_federation/strategy.rb +2114 -0
  59. data/lib/omniauth_openid_federation/string_helpers.rb +30 -0
  60. data/lib/omniauth_openid_federation/tasks_helper.rb +428 -0
  61. data/lib/omniauth_openid_federation/utils.rb +168 -0
  62. data/lib/omniauth_openid_federation/validators.rb +126 -0
  63. data/lib/omniauth_openid_federation/version.rb +3 -0
  64. data/lib/omniauth_openid_federation.rb +99 -0
  65. data/lib/tasks/omniauth_openid_federation.rake +376 -0
  66. data/sig/federation.rbs +218 -0
  67. data/sig/jwks.rbs +63 -0
  68. data/sig/omniauth_openid_federation.rbs +254 -0
  69. data/sig/strategy.rbs +60 -0
  70. metadata +361 -0
metadata ADDED
@@ -0,0 +1,361 @@
1
+ --- !ruby/object:Gem::Specification
2
+ name: omniauth_openid_federation
3
+ version: !ruby/object:Gem::Version
4
+ version: 1.2.2
5
+ platform: ruby
6
+ authors:
7
+ - Andrei Makarov
8
+ bindir: bin
9
+ cert_chain: []
10
+ date: 1980-01-02 00:00:00.000000000 Z
11
+ dependencies:
12
+ - !ruby/object:Gem::Dependency
13
+ name: omniauth-oauth2
14
+ requirement: !ruby/object:Gem::Requirement
15
+ requirements:
16
+ - - "~>"
17
+ - !ruby/object:Gem::Version
18
+ version: '1.8'
19
+ type: :runtime
20
+ prerelease: false
21
+ version_requirements: !ruby/object:Gem::Requirement
22
+ requirements:
23
+ - - "~>"
24
+ - !ruby/object:Gem::Version
25
+ version: '1.8'
26
+ - !ruby/object:Gem::Dependency
27
+ name: openid_connect
28
+ requirement: !ruby/object:Gem::Requirement
29
+ requirements:
30
+ - - "~>"
31
+ - !ruby/object:Gem::Version
32
+ version: '2.3'
33
+ type: :runtime
34
+ prerelease: false
35
+ version_requirements: !ruby/object:Gem::Requirement
36
+ requirements:
37
+ - - "~>"
38
+ - !ruby/object:Gem::Version
39
+ version: '2.3'
40
+ - !ruby/object:Gem::Dependency
41
+ name: jwt
42
+ requirement: !ruby/object:Gem::Requirement
43
+ requirements:
44
+ - - "~>"
45
+ - !ruby/object:Gem::Version
46
+ version: '3.1'
47
+ type: :runtime
48
+ prerelease: false
49
+ version_requirements: !ruby/object:Gem::Requirement
50
+ requirements:
51
+ - - "~>"
52
+ - !ruby/object:Gem::Version
53
+ version: '3.1'
54
+ - !ruby/object:Gem::Dependency
55
+ name: jwe
56
+ requirement: !ruby/object:Gem::Requirement
57
+ requirements:
58
+ - - "~>"
59
+ - !ruby/object:Gem::Version
60
+ version: '1.1'
61
+ type: :runtime
62
+ prerelease: false
63
+ version_requirements: !ruby/object:Gem::Requirement
64
+ requirements:
65
+ - - "~>"
66
+ - !ruby/object:Gem::Version
67
+ version: '1.1'
68
+ - !ruby/object:Gem::Dependency
69
+ name: http
70
+ requirement: !ruby/object:Gem::Requirement
71
+ requirements:
72
+ - - "~>"
73
+ - !ruby/object:Gem::Version
74
+ version: '5.3'
75
+ type: :runtime
76
+ prerelease: false
77
+ version_requirements: !ruby/object:Gem::Requirement
78
+ requirements:
79
+ - - "~>"
80
+ - !ruby/object:Gem::Version
81
+ version: '5.3'
82
+ - !ruby/object:Gem::Dependency
83
+ name: rack
84
+ requirement: !ruby/object:Gem::Requirement
85
+ requirements:
86
+ - - ">="
87
+ - !ruby/object:Gem::Version
88
+ version: '2.0'
89
+ - - "<"
90
+ - !ruby/object:Gem::Version
91
+ version: '4'
92
+ type: :runtime
93
+ prerelease: false
94
+ version_requirements: !ruby/object:Gem::Requirement
95
+ requirements:
96
+ - - ">="
97
+ - !ruby/object:Gem::Version
98
+ version: '2.0'
99
+ - - "<"
100
+ - !ruby/object:Gem::Version
101
+ version: '4'
102
+ - !ruby/object:Gem::Dependency
103
+ name: rspec
104
+ requirement: !ruby/object:Gem::Requirement
105
+ requirements:
106
+ - - "~>"
107
+ - !ruby/object:Gem::Version
108
+ version: '3.13'
109
+ type: :development
110
+ prerelease: false
111
+ version_requirements: !ruby/object:Gem::Requirement
112
+ requirements:
113
+ - - "~>"
114
+ - !ruby/object:Gem::Version
115
+ version: '3.13'
116
+ - !ruby/object:Gem::Dependency
117
+ name: webmock
118
+ requirement: !ruby/object:Gem::Requirement
119
+ requirements:
120
+ - - "~>"
121
+ - !ruby/object:Gem::Version
122
+ version: '3.26'
123
+ type: :development
124
+ prerelease: false
125
+ version_requirements: !ruby/object:Gem::Requirement
126
+ requirements:
127
+ - - "~>"
128
+ - !ruby/object:Gem::Version
129
+ version: '3.26'
130
+ - !ruby/object:Gem::Dependency
131
+ name: rake
132
+ requirement: !ruby/object:Gem::Requirement
133
+ requirements:
134
+ - - "~>"
135
+ - !ruby/object:Gem::Version
136
+ version: '13.3'
137
+ type: :development
138
+ prerelease: false
139
+ version_requirements: !ruby/object:Gem::Requirement
140
+ requirements:
141
+ - - "~>"
142
+ - !ruby/object:Gem::Version
143
+ version: '13.3'
144
+ - !ruby/object:Gem::Dependency
145
+ name: simplecov
146
+ requirement: !ruby/object:Gem::Requirement
147
+ requirements:
148
+ - - "~>"
149
+ - !ruby/object:Gem::Version
150
+ version: '0.22'
151
+ type: :development
152
+ prerelease: false
153
+ version_requirements: !ruby/object:Gem::Requirement
154
+ requirements:
155
+ - - "~>"
156
+ - !ruby/object:Gem::Version
157
+ version: '0.22'
158
+ - !ruby/object:Gem::Dependency
159
+ name: rspec_junit_formatter
160
+ requirement: !ruby/object:Gem::Requirement
161
+ requirements:
162
+ - - "~>"
163
+ - !ruby/object:Gem::Version
164
+ version: '0.6'
165
+ type: :development
166
+ prerelease: false
167
+ version_requirements: !ruby/object:Gem::Requirement
168
+ requirements:
169
+ - - "~>"
170
+ - !ruby/object:Gem::Version
171
+ version: '0.6'
172
+ - !ruby/object:Gem::Dependency
173
+ name: simplecov-cobertura
174
+ requirement: !ruby/object:Gem::Requirement
175
+ requirements:
176
+ - - "~>"
177
+ - !ruby/object:Gem::Version
178
+ version: '3.1'
179
+ type: :development
180
+ prerelease: false
181
+ version_requirements: !ruby/object:Gem::Requirement
182
+ requirements:
183
+ - - "~>"
184
+ - !ruby/object:Gem::Version
185
+ version: '3.1'
186
+ - !ruby/object:Gem::Dependency
187
+ name: standard
188
+ requirement: !ruby/object:Gem::Requirement
189
+ requirements:
190
+ - - "~>"
191
+ - !ruby/object:Gem::Version
192
+ version: '1.52'
193
+ type: :development
194
+ prerelease: false
195
+ version_requirements: !ruby/object:Gem::Requirement
196
+ requirements:
197
+ - - "~>"
198
+ - !ruby/object:Gem::Version
199
+ version: '1.52'
200
+ - !ruby/object:Gem::Dependency
201
+ name: appraisal
202
+ requirement: !ruby/object:Gem::Requirement
203
+ requirements:
204
+ - - "~>"
205
+ - !ruby/object:Gem::Version
206
+ version: '2.5'
207
+ type: :development
208
+ prerelease: false
209
+ version_requirements: !ruby/object:Gem::Requirement
210
+ requirements:
211
+ - - "~>"
212
+ - !ruby/object:Gem::Version
213
+ version: '2.5'
214
+ - !ruby/object:Gem::Dependency
215
+ name: memory_profiler
216
+ requirement: !ruby/object:Gem::Requirement
217
+ requirements:
218
+ - - "~>"
219
+ - !ruby/object:Gem::Version
220
+ version: '1.1'
221
+ type: :development
222
+ prerelease: false
223
+ version_requirements: !ruby/object:Gem::Requirement
224
+ requirements:
225
+ - - "~>"
226
+ - !ruby/object:Gem::Version
227
+ version: '1.1'
228
+ - !ruby/object:Gem::Dependency
229
+ name: rbs
230
+ requirement: !ruby/object:Gem::Requirement
231
+ requirements:
232
+ - - "~>"
233
+ - !ruby/object:Gem::Version
234
+ version: '3.9'
235
+ type: :development
236
+ prerelease: false
237
+ version_requirements: !ruby/object:Gem::Requirement
238
+ requirements:
239
+ - - "~>"
240
+ - !ruby/object:Gem::Version
241
+ version: '3.9'
242
+ - !ruby/object:Gem::Dependency
243
+ name: webrick
244
+ requirement: !ruby/object:Gem::Requirement
245
+ requirements:
246
+ - - "~>"
247
+ - !ruby/object:Gem::Version
248
+ version: '1.9'
249
+ type: :development
250
+ prerelease: false
251
+ version_requirements: !ruby/object:Gem::Requirement
252
+ requirements:
253
+ - - "~>"
254
+ - !ruby/object:Gem::Version
255
+ version: '1.9'
256
+ description: Custom OmniAuth strategy for OpenID Federation providers using openid_connect
257
+ gem, supporting signed request objects (RFC 9101), ID token encryption/decryption,
258
+ client assertion (private_key_jwt), and OpenID Federation entity statements. Framework-agnostic
259
+ and works with Rails, Sinatra, Rack, and other Rack-compatible frameworks.
260
+ email:
261
+ - contact@kiskolabs.com
262
+ executables: []
263
+ extensions: []
264
+ extra_rdoc_files: []
265
+ files:
266
+ - CHANGELOG.md
267
+ - LICENSE.md
268
+ - README.md
269
+ - SECURITY.md
270
+ - app/controllers/omniauth_openid_federation/federation_controller.rb
271
+ - config/routes.rb
272
+ - examples/README_INTEGRATION_TESTING.md
273
+ - examples/README_MOCK_OP.md
274
+ - examples/app/controllers/users/omniauth_callbacks_controller.rb.example
275
+ - examples/app/jobs/jwks_rotation_job.rb.example
276
+ - examples/app/models/user.rb.example
277
+ - examples/config/initializers/devise.rb.example
278
+ - examples/config/initializers/federation_endpoint.rb.example
279
+ - examples/config/mock_op.yml.example
280
+ - examples/config/open_id_connect_config.rb.example
281
+ - examples/config/routes.rb.example
282
+ - examples/db/migrate/add_omniauth_to_users.rb.example
283
+ - examples/integration_test_flow.rb
284
+ - examples/jobs/README.md
285
+ - examples/jobs/federation_cache_refresh_job.rb.example
286
+ - examples/jobs/federation_files_generation_job.rb.example
287
+ - examples/mock_op_server.rb
288
+ - examples/mock_rp_server.rb
289
+ - lib/omniauth_openid_federation.rb
290
+ - lib/omniauth_openid_federation/access_token.rb
291
+ - lib/omniauth_openid_federation/cache.rb
292
+ - lib/omniauth_openid_federation/cache_adapter.rb
293
+ - lib/omniauth_openid_federation/configuration.rb
294
+ - lib/omniauth_openid_federation/constants.rb
295
+ - lib/omniauth_openid_federation/endpoint_resolver.rb
296
+ - lib/omniauth_openid_federation/engine.rb
297
+ - lib/omniauth_openid_federation/entity_statement_reader.rb
298
+ - lib/omniauth_openid_federation/errors.rb
299
+ - lib/omniauth_openid_federation/federation/entity_statement.rb
300
+ - lib/omniauth_openid_federation/federation/entity_statement_builder.rb
301
+ - lib/omniauth_openid_federation/federation/entity_statement_fetcher.rb
302
+ - lib/omniauth_openid_federation/federation/entity_statement_helper.rb
303
+ - lib/omniauth_openid_federation/federation/entity_statement_parser.rb
304
+ - lib/omniauth_openid_federation/federation/entity_statement_validator.rb
305
+ - lib/omniauth_openid_federation/federation/metadata_policy_merger.rb
306
+ - lib/omniauth_openid_federation/federation/signed_jwks.rb
307
+ - lib/omniauth_openid_federation/federation/trust_chain_resolver.rb
308
+ - lib/omniauth_openid_federation/federation_endpoint.rb
309
+ - lib/omniauth_openid_federation/http_client.rb
310
+ - lib/omniauth_openid_federation/instrumentation.rb
311
+ - lib/omniauth_openid_federation/jwks/cache.rb
312
+ - lib/omniauth_openid_federation/jwks/decode.rb
313
+ - lib/omniauth_openid_federation/jwks/fetch.rb
314
+ - lib/omniauth_openid_federation/jwks/normalizer.rb
315
+ - lib/omniauth_openid_federation/jwks/rotate.rb
316
+ - lib/omniauth_openid_federation/jwks/selector.rb
317
+ - lib/omniauth_openid_federation/jws.rb
318
+ - lib/omniauth_openid_federation/key_extractor.rb
319
+ - lib/omniauth_openid_federation/logger.rb
320
+ - lib/omniauth_openid_federation/rack_endpoint.rb
321
+ - lib/omniauth_openid_federation/railtie.rb
322
+ - lib/omniauth_openid_federation/rate_limiter.rb
323
+ - lib/omniauth_openid_federation/strategy.rb
324
+ - lib/omniauth_openid_federation/string_helpers.rb
325
+ - lib/omniauth_openid_federation/tasks_helper.rb
326
+ - lib/omniauth_openid_federation/utils.rb
327
+ - lib/omniauth_openid_federation/validators.rb
328
+ - lib/omniauth_openid_federation/version.rb
329
+ - lib/tasks/omniauth_openid_federation.rake
330
+ - sig/federation.rbs
331
+ - sig/jwks.rbs
332
+ - sig/omniauth_openid_federation.rbs
333
+ - sig/strategy.rbs
334
+ homepage: https://github.com/amkisko/omniauth_openid_federation.rb
335
+ licenses:
336
+ - MIT
337
+ metadata:
338
+ source_code_uri: https://github.com/amkisko/omniauth_openid_federation.rb
339
+ changelog_uri: https://github.com/amkisko/omniauth_openid_federation.rb/blob/main/CHANGELOG.md
340
+ bug_tracker_uri: https://github.com/amkisko/omniauth_openid_federation.rb/issues
341
+ rubygems_mfa_required: 'true'
342
+ documentation_uri: https://rubydoc.info/gems/omniauth_openid_federation
343
+ rdoc_options: []
344
+ require_paths:
345
+ - lib
346
+ required_ruby_version: !ruby/object:Gem::Requirement
347
+ requirements:
348
+ - - ">="
349
+ - !ruby/object:Gem::Version
350
+ version: '3.0'
351
+ required_rubygems_version: !ruby/object:Gem::Requirement
352
+ requirements:
353
+ - - ">="
354
+ - !ruby/object:Gem::Version
355
+ version: 3.3.0
356
+ requirements: []
357
+ rubygems_version: 3.6.9
358
+ specification_version: 4
359
+ summary: OmniAuth strategy for OpenID Federation providers with signed request objects
360
+ and ID token encryption.
361
+ test_files: []