omniauth_openid_federation 1.3.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bdb5dbe8832e2837c2970556b8498492c8e32489e8efad28eff176be94af1a1d
-  data.tar.gz: 7addf88091e26b0c603a5bd50fe8c701d8d8cb2c5a5854549a59795b7782a792
+  metadata.gz: ed139d6baa665a3a7dce282bed397079492844cef7b45de0b5787edf3de9284e
+  data.tar.gz: c4d1f5e957c5aa2340d8cd223bfe1c591ed8b85f79417f775468868a54e4d465
 SHA512:
-  metadata.gz: 31a2b0f6042da80bcb445c0d92e137b06da8d017e58e05835fb0983e35df4215797ccabef024378cc5faa78006037f0f338cb074bc8784c72eea02b349fbc248
-  data.tar.gz: cd47a106c42a20a80caa3db3212dbe4c1748af65a17f88b4a57273f35a01cbc79e814b998f793691b50b368592f5d31ac31ff87c1831880497047b02178569d1
+  metadata.gz: bb56e08a749c63510e1d1456766ed2375827cb41f4171e25fbc260a5e06563fd59559fed10c7cf95ccdf7893a70d1567a8372fbda13c454fa7be765ae775db0d
+  data.tar.gz: 576b586169d64ba1b4989db48badd0cb1da1f145336e0786dabd8b41770344b9a19b0c43b4a28859738f0d72c63fb985069372868d41fcb64665ab6821cfcf4b

data/CHANGELOG.md

@@ -1,5 +1,49 @@
 # CHANGELOG
 
+## 2.0.0 (2026-07-06)
+
+- BREAKING: Replace `openid_connect` and `json-jwt` with `OmniauthOpenidFederation::OidcClient`, `AccessToken`, and `IdToken` built on `oauth2` and `jwt`
+- BREAKING: Drop explicit `rack` runtime dependency; load Rack federation endpoints via `require "omniauth_openid_federation/rack"`
+- BREAKING: Validate ID token `iss`, `aud`, and session `nonce` in `callback_phase`
+- BREAKING: Fail closed on trust chain resolution errors instead of returning empty metadata
+- BREAKING: Reject `alg: none` in access token JWT handling
+- BREAKING: Remove broad JWKS decode retry on non-signature errors
+- BREAKING: Reject unknown `crit` claims in entity statement validation
+- BREAKING: Enforce minimum RSA key size (2048 bits) in `Validators.validate_private_key!`
+- Use `jwe` gem for JWE encrypt/decrypt instead of `json-jwt`
+- Refactor `OmniAuth::Strategies::OpenIDFederation` into concern modules under `lib/omniauth_openid_federation/strategy/`
+- Add `OmniauthOpenidFederation::SecureCompare` for constant-time string comparison in the strategy
+- Add `OmniauthOpenidFederation::JwtResponseDecoder` for encrypted/signed JWT userinfo and resource responses
+- Add behavioral contract specs for token exchange, userinfo, and JWE parity with former `openid_connect` flow
+- Add Telia Tunnistus PP entity statement fixture and contract spec (A128GCM and A128CBC-HS256)
+- Add provider-agnostic strategy options: `default_request_object_claims`, `required_request_object_claims`, `allowed_acr_values`, `require_entity_statement_fingerprint`
+- Use `Jwe.encrypted?` for JWE detection in `AccessToken#resource_request` and `TasksHelper`
+- Deduplicate entity statement loading in `access_token.rb` via `load_entity_statement_content`
+- Verify subordinate entity statement signatures in trust chain resolution
+- Wire `verify_ssl` into `HttpClient` SSL options
+- Use `CacheAdapter` in `RateLimiter` instead of `Rails.cache` directly
+- Use issuer-scoped cache keys for federation JWKS and signed JWKS endpoints
+- Fix OAuth callback failures in `callback_phase` to return the Rack response from `fail!` instead of `nil`; avoids `Rack::ETag` `NoMethodError` and HTTP 500 on auth failure
+- Fix flaky `test_local_endpoint` spec when `SSL_CERT_FILE` is set in the environment
+- Replace internal `decode_id_token` stubs in strategy specs with JWKS-backed setup
+- Add `HttpClient.post` with form data, headers, and connect/read timeouts
+- Retry GET requests on HTTP 429, 502, and 503; POST requests default to no retry
+- Auto-configure SSL CA file when peer verification is enabled
+- Route rake task HTTP through `HttpClient` instead of ad hoc `Net::HTTP`
+
+## 1.3.2 (2025-12-09)
+
+- Added `TimeHelpers` module for compatibility with non-Rails environments
+- Replaced `Time.zone` usage with `TimeHelpers` to work with or without ActiveSupport
+
+## 1.3.1 (2025-12-09)
+
+- Enhanced SSL configuration for HTTPS requests in tasks_helper.rb
+- Updated federation controller to use ApplicationController
+- Updated routes to have semaphore if it is already loaded
+- Updated gemfiles and workflows for Rails 8 compatibility
+- Improved time handling in integration and mock server classes using Time.zone.now
+
 ## 1.3.0 (2025-11-28)
 
 - Added `prepare_request_object_params` proc option to customize request parameters before signing
@@ -25,7 +69,7 @@
 ## 1.1.0 (2025-11-26)
 
 - Enhanced instrumentation: All blocking exceptions automatically reported through instrumentation system, including OmniAuth middleware errors (like AuthenticityTokenProtection)
-- CSRF protection instrumentation: New authenticity_error event type for reporting OmniAuth CSRF protection failures
+- CSRF protection instrumentation: New authenticity_error event type for reporting OmniAuth CSRF failures
 - Comprehensive error reporting: Override fail! method in strategy to catch and instrument all authentication failures
 - CSRF protection documentation: Added comprehensive Step 7 in README explaining CSRF protection configuration for both request and callback phases
 - CSRF configuration examples: Added complete examples in examples/config/initializers/devise.rb.example and examples/app/controllers/users/omniauth_callbacks_controller.rb.example

data/README.md

@@ -1,15 +1,9 @@
 # omniauth_openid_federation
 
-[![Gem Version](https://badge.fury.io/rb/omniauth_openid_federation.svg?v=1.1.0)](https://badge.fury.io/rb/omniauth_openid_federation) [![Test Status](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb/graph/badge.svg?token=CX3O9M1GIT)](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb/graph/badge.svg)
+[![Gem Version](https://badge.fury.io/rb/omniauth_openid_federation.svg?v=1.1.0)](https://badge.fury.io/rb/omniauth_openid_federation) [![Test Status](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb/graph/badge.svg?token=CX3O9M1GIT)](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_omniauth_openid_federation.rb&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=amkisko_omniauth_openid_federation.rb)
 
 OmniAuth strategy for OpenID Federation providers with comprehensive security features, supporting signed request objects, ID token encryption, and full OpenID Federation 1.0 compliance.
 
-Sponsored by [Kisko Labs](https://www.kiskolabs.com).
-
-<a href="https://www.kiskolabs.com">
-  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
-</a>
-
 ## Installation
 
 ```ruby
@@ -279,7 +273,14 @@ Use `prepare_request_object_params` proc to modify parameters before they're add
 
 ```ruby
 config.omniauth :openid_federation,
-  request_object_params: [:ftn_spname], # Allow-list for custom params
+  request_object_params: [:ftn_spname], # Allow-list for provider-specific params (example: Finnish FTN)
+  default_request_object_claims: {
+    ui_locales: "fi",
+    acr_values: ENV["OPENID_ACR_VALUES"]
+  },
+  required_request_object_claims: %w[ftn_spname acr_values ui_locales],
+  allowed_acr_values: [ENV["OPENID_ACR_VALUES"]].compact,
+  require_entity_statement_fingerprint: true,
   prepare_request_object_params: proc do |params|
     # Combine config acr_values with form acr_values
     form_acr_values = params["acr_values"]&.to_s&.strip
@@ -310,6 +311,96 @@ config.omniauth :openid_federation,
 
 The proc will combine this with config values before adding to the signed JWT.
 
+## Rodauth Integration
+
+This strategy can be used with the Rodauth authentication framework via the
+[`rodauth-omniauth` feature](https://github.com/janko/rodauth-omniauth).
+
+### Minimal Roda/Rodauth setup
+
+```ruby
+require "roda"
+require "rodauth"
+require "rodauth/omniauth"
+require "omniauth_openid_federation"
+
+DB = Sequel.sqlite # or your production database
+
+DB.create_table? :accounts do
+  primary_key :id
+  String :email, null: false
+end
+
+DB.create_table? :account_identities do
+  primary_key :id
+  foreign_key :account_id, :accounts, null: false
+  String :provider, null: false
+  String :uid, null: false
+  index [:provider, :uid], unique: true
+end
+
+class App < Roda
+  plugin :sessions, secret: ENV.fetch("SESSION_SECRET") { SecureRandom.hex(32) }
+  plugin :json
+
+  plugin :rodauth, json: true do
+    db DB
+    enable :omniauth
+
+    # Mount OmniAuth under /auth, as recommended by rodauth-omniauth
+    omniauth_prefix "/auth"
+
+    omniauth_provider :openid_federation,
+      nil,
+      nil,
+      strategy_class: OmniAuth::Strategies::OpenIDFederation,
+      name: :openid_federation,
+      issuer: ENV.fetch("OPENID_ISSUER", "https://provider.example.com"),
+      audience: ENV.fetch("OPENID_AUDIENCE", "https://provider.example.com"),
+      client_options: {
+        identifier: ENV["OPENID_CLIENT_ID"],
+        redirect_uri: ENV["OPENID_REDIRECT_URI"] || "https://your-app.example.com/auth/openid_federation/callback",
+        host: URI.parse(ENV.fetch("OPENID_ISSUER", "https://provider.example.com")).host,
+        scheme: URI.parse(ENV.fetch("OPENID_ISSUER", "https://provider.example.com")).scheme,
+        authorization_endpoint: "/oauth2/authorize",
+        token_endpoint: "/oauth2/token",
+        userinfo_endpoint: "/oauth2/userinfo",
+        jwks_uri: "/.well-known/jwks.json",
+        private_key: OpenSSL::PKey::RSA.new(
+          Base64.decode64(ENV.fetch("OPENID_CLIENT_PRIVATE_KEY_BASE64"))
+        )
+      },
+      entity_statement_url: ENV["OPENID_ENTITY_STATEMENT_URL"],
+      entity_statement_fingerprint: ENV["OPENID_ENTITY_STATEMENT_FINGERPRINT"]
+  end
+
+  route do |r|
+    # Rodauth authentication + OmniAuth endpoints
+    # r.rodauth automatically handles omniauth routes based on omniauth_prefix setting
+    r.rodauth
+
+    r.root do
+      if rodauth.logged_in?
+        {logged_in: true, account_id: rodauth.session_value}
+      else
+        {logged_in: false}
+      end
+    end
+  end
+end
+```
+
+With this configuration, the Rodauth `:omniauth` feature:
+
+- uses `OmniAuth::Strategies::OpenIDFederation` as the strategy implementation,
+- calls the strategy's request and callback phases under `/auth/openid_federation`,
+- persists external identities into the `account_identities` table following the
+  [`rodauth-omniauth` schema](https://github.com/janko/rodauth-omniauth),
+- and exposes helper methods like `rodauth.omniauth_auth`, `rodauth.omniauth_email`,
+  and `rodauth.omniauth_name` as documented in the
+  [Rodauth documentation](https://rodauth.jeremyevans.net/documentation.html)
+  and [`rodauth-omniauth` README](https://github.com/janko/rodauth-omniauth).
+
 ## Rake Tasks
 
 ### Prepare Client Keys
@@ -356,6 +447,10 @@ rake openid_federation:test_authentication_flow[
 - `always_encrypt_request_object` - Force encryption of request objects (default: false)
 - `request_object_params` - Array of parameter names to include in request object (allow-list)
 - `prepare_request_object_params` - Proc to modify params before adding to signed request object: `proc { |params| modified_params }`
+- `default_request_object_claims` - Hash of default claims merged before `prepare_request_object_params` (request params override defaults)
+- `required_request_object_claims` - Array of claim names that must be present in the signed request object (raises before redirect)
+- `allowed_acr_values` - When set, ID token `acr` must match one of the configured values
+- `require_entity_statement_fingerprint` - When true, fetching provider entity statements from URL or issuer requires `entity_statement_fingerprint`
 - `discovery` - Enable automatic endpoint discovery (default: true)
 
 ## Security
@@ -383,9 +478,10 @@ rake openid_federation:test_authentication_flow[
 ## Example Files
 
 See `examples/` directory for complete configuration examples:
-- `examples/config/initializers/devise.rb.example`
-- `examples/config/initializers/omniauth_openid_federation.rb.example`
-- `examples/config/open_id_connect_config.rb.example`
+- `examples/standalone_multiple_endpoints_example.rb` - Standalone Sinatra app with multiple auth endpoints and entrance point-based redirects
+- `examples/config/initializers/devise.rb.example` - Devise integration example (Rails)
+- `examples/config/initializers/omniauth_openid_federation.rb.example` - Federation endpoint configuration
+- `examples/config/open_id_connect_config.rb.example` - Configuration class example
 
 ## Development
 
@@ -393,9 +489,11 @@ See `examples/` directory for complete configuration examples:
 git clone https://github.com/amkisko/omniauth_openid_federation.rb.git
 cd omniauth_openid_federation.rb
 bundle install
-bin/rspec
+bundle exec polyrun parallel-rspec --workers 5 -c polyrun.yml
 ```
 
+Same flow as CI; optional wrappers [`bin/rspec_parallel`](bin/rspec_parallel) and [`bin/appraisals`](bin/appraisals) (runs **`polyrun parallel-rspec`** per Appraisal gemfile). Details: **[POLYRUN.md](POLYRUN.md)**.
+
 ## Contributing
 
 Contributions welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
@@ -413,8 +511,8 @@ Contributions welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for guidel
 - [omniauth](https://github.com/omniauth/omniauth) - Authentication framework
 - [devise](https://github.com/heartcombo/devise) - Rails authentication solution
 - [jwt](https://github.com/jwt/ruby-jwt) - JSON Web Token implementation
-- [jwe](https://github.com/nov/jwe) - JSON Web Encryption
-- [openid_connect](https://github.com/nov/openid_connect) - OpenID Connect client
+- [jwe](https://rubygems.org/gems/jwe) - JSON Web Encryption (via `OmniauthOpenidFederation::Jwe`)
+- [oauth2](https://github.com/oauth-xx/oauth2) - OAuth 2.0 client (via `OmniauthOpenidFederation::OidcClient`)
 - [http](https://github.com/httprb/http) - HTTP client
 - [anyway_config](https://github.com/palkan/anyway_config) - Configuration management
 - [action_reporter](https://github.com/basecamp/action_reporter) - Error reporting
@@ -422,3 +520,11 @@ Contributions welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for guidel
 ## License
 
 MIT License. See [LICENSE.md](LICENSE.md) for details.
+
+## Sponsors
+
+Sponsored by [Kisko Labs](https://www.kiskolabs.com).
+
+<a href="https://www.kiskolabs.com">
+  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
+</a>

data/app/controllers/omniauth_openid_federation/federation_controller.rb

@@ -12,7 +12,7 @@
 require "omniauth_openid_federation/cache_adapter"
 
 module OmniauthOpenidFederation
-  class FederationController < ActionController::Base
+  class FederationController < ::ApplicationController
     # Serve the entity statement
     #
     # GET /.well-known/openid-federation
@@ -105,7 +105,7 @@ module OmniauthOpenidFederation
       jwks_to_serve = OmniauthOpenidFederation::FederationEndpoint.current_jwks
 
       # Apply server-side caching if available
-      cache_key = "federation:jwks:#{Digest::SHA256.hexdigest(jwks_to_serve.to_json)}"
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_jwks(config.issuer)
       cache_ttl = config.jwks_cache_ttl || 3600
 
       jwks_json = if OmniauthOpenidFederation::CacheAdapter.available?
@@ -144,7 +144,7 @@ module OmniauthOpenidFederation
       signed_jwks_jwt = OmniauthOpenidFederation::FederationEndpoint.generate_signed_jwks
 
       # Apply server-side caching if available
-      cache_key = "federation:signed_jwks:#{Digest::SHA256.hexdigest(signed_jwks_jwt)}"
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(config.issuer)
       cache_ttl = config.jwks_cache_ttl || 3600
 
       cached_jwt = if OmniauthOpenidFederation::CacheAdapter.available?

data/config/polyrun_coverage.yml

@@ -0,0 +1,15 @@
+# Polyrun::Coverage::Rails — loaded from spec/spec_helper via Polyrun::Coverage::Rails.start!
+# (must run before application code; keep coverage config here, not in initializers)
+#
+# Do not set track_files here: with track_files, Polyrun merges the full Coverage.result blob
+# (every loaded gem / dependency) before filtering, which dilutes the line % and breaks the gate.
+# Default track_under: ["lib"] keeps only this gem under the project root.
+
+track_under:
+  - lib
+reject_patterns:
+  - "/lib/tasks/"
+  - "/lib/omniauth_openid_federation/version.rb"
+  - "/spec/"
+minimum_line_percent: 80
+strict: true

data/config/polyrun_spec_quality.yml

@@ -0,0 +1,29 @@
+# Per-example spec quality (coverage deltas, resource use). See polyrun report-spec-quality.
+track_under:
+  - lib
+  - app
+ignore_paths:
+  - /lib/omniauth_openid_federation/version.rb
+  - /lib/tasks/
+min_line_churn: 40
+min_query_count: 15
+hot_line_example_overlap: 8
+strict: false
+sample: 1.0
+ignore_examples:
+  - version_spec.rb
+  - omniauth_openid_federation_spec.rb:2
+  - /handles missing URL/
+  - /handles configuration errors/
+  - /handles validation errors/
+  - /handles unexpected errors/
+  - /handles fetch errors/
+ignore_query_patterns: []
+profile:
+  - cpu
+  - mem
+sql_counter: true
+# CI gates (POLYRUN_SPEC_QUALITY_STRICT=1 or strict: true):
+# minimum_unique_lines_per_example: 1
+# max_zero_hit_examples: 0
+# max_hot_line_overlap: 100

data/config/routes.rb

@@ -1,17 +1,27 @@
 # Routes for OpenID Federation well-known endpoints
 # These routes are mounted at the root level (not namespaced) because
 # OpenID Federation spec requires specific well-known paths
-OmniauthOpenidFederation::Engine.routes.draw do
-  # OpenID Federation 1.0 Section 9: Entity Configuration endpoint
-  # MUST be at /.well-known/openid-federation
-  get "/.well-known/openid-federation", to: "omniauth_openid_federation/federation#show", as: :openid_federation
+# Guard to prevent double-loading routes (important for test isolation)
+# Use a file-level instance variable that doesn't trigger class loading
+@_omniauth_openid_federation_routes_loaded ||= false
+unless @_omniauth_openid_federation_routes_loaded
+  @_omniauth_openid_federation_routes_loaded = true
+  begin
+    OmniauthOpenidFederation::Engine.routes.draw do
+      # OpenID Federation 1.0 Section 9: Entity Configuration endpoint
+      # MUST be at /.well-known/openid-federation
+      get "/.well-known/openid-federation", to: "omniauth_openid_federation/federation#show", as: :openid_federation
 
-  # Fetch endpoint for Subordinate Statements (Section 6.1)
-  get "/.well-known/openid-federation/fetch", to: "omniauth_openid_federation/federation#fetch", as: :openid_federation_fetch
+      # Fetch endpoint for Subordinate Statements (Section 6.1)
+      get "/.well-known/openid-federation/fetch", to: "omniauth_openid_federation/federation#fetch", as: :openid_federation_fetch
 
-  # Standard JWKS endpoint
-  get "/.well-known/jwks.json", to: "omniauth_openid_federation/federation#jwks", as: :openid_federation_jwks
+      # Standard JWKS endpoint
+      get "/.well-known/jwks.json", to: "omniauth_openid_federation/federation#jwks", as: :openid_federation_jwks
 
-  # Signed JWKS endpoint (OpenID Federation requirement)
-  get "/.well-known/signed-jwks.json", to: "omniauth_openid_federation/federation#signed_jwks", as: :openid_federation_signed_jwks
+      # Signed JWKS endpoint (OpenID Federation requirement)
+      get "/.well-known/signed-jwks.json", to: "omniauth_openid_federation/federation#signed_jwks", as: :openid_federation_signed_jwks
+    end
+  rescue NameError, LoadError
+    # Rails not available or not fully initialized - routes will be loaded when Engine initializes
+  end
 end

data/examples/README_INTEGRATION_TESTING.md

@@ -145,6 +145,9 @@ This will:
 5. Run all integration tests
 6. Clean up (kill servers, remove tmp dirs) on exit
 
+CI runs the same flow on every push to `main` (see `.github/workflows/test.yml`, job `integration`).
+Locally: `make integration-test` or `bundle exec ruby examples/integration_test_flow.rb` (exits non-zero on failure).
+
 ### Manual Start (For Debugging)
 
 If you want to start servers manually for debugging:

data/examples/integration_test_flow.rb

@@ -42,7 +42,7 @@ require "securerandom"
 require "fileutils"
 require "timeout"
 require "open3"
-require "jwe"
+require_relative "../lib/omniauth_openid_federation"
 require "jwt"
 
 $LOAD_PATH.unshift(File.expand_path("../lib", __dir__))
@@ -272,7 +272,7 @@ class IntegrationTestFlow
     script_path = File.expand_path(script, __dir__)
     project_root = File.expand_path("..", __dir__)
 
-    # Use bundle exec to ensure all dependencies (jwt, jwe, etc.) are available
+    # Use bundle exec to ensure all dependencies (jwt, jwe, oauth2, etc.) are available
     pid = Process.spawn(
       {
         "RUBYOPT" => "-W0", # Suppress warnings
@@ -319,7 +319,7 @@ class IntegrationTestFlow
       attempt = 0
       ready = false
       server_name = url.include?("9292") ? "OP" : "RP"
-      start_time = Time.now
+      start_time = OmniauthOpenidFederation::TimeHelpers.now
 
       while attempt < max_attempts && !ready
         begin
@@ -330,7 +330,7 @@ class IntegrationTestFlow
           response = http.get(uri.path)
 
           if response.code == "200"
-            elapsed = (Time.now - start_time).round(1)
+            elapsed = (OmniauthOpenidFederation::TimeHelpers.now - start_time).round(1)
             puts "  ✓ #{url} is ready (#{elapsed}s)"
             ready = true
           end
@@ -342,7 +342,7 @@ class IntegrationTestFlow
           attempt += 1
           # Show progress every 5 attempts (1 second)
           if attempt % 5 == 0
-            elapsed = (Time.now - start_time).round(1)
+            elapsed = (OmniauthOpenidFederation::TimeHelpers.now - start_time).round(1)
             print "."
           end
           sleep check_interval
@@ -350,7 +350,7 @@ class IntegrationTestFlow
       end
 
       unless ready
-        elapsed = (Time.now - start_time).round(1)
+        elapsed = (OmniauthOpenidFederation::TimeHelpers.now - start_time).round(1)
         puts "\n  ✗ #{server_name} server at #{url} did not become ready in time (#{elapsed}s)"
         err_log = File.join(@tmp_dir, "#{server_name.downcase}_server_error.log")
         log_file = File.join(@tmp_dir, "#{server_name.downcase}_server.log")
@@ -679,7 +679,7 @@ class IntegrationTestFlow
 
       # Encrypt with wrong key (provider won't be able to decrypt with its key)
       signed_jwt = jws.sign
-      encrypted_request = JWE.encrypt(signed_jwt, wrong_key)
+      encrypted_request = OmniauthOpenidFederation::Jwe.encrypt(signed_jwt, wrong_key, alg: "RSA-OAEP", enc: "A128CBC-HS256")
 
       # Verify it's encrypted (JWE has 5 parts)
       parts = encrypted_request.split(".")
@@ -1261,6 +1261,8 @@ class IntegrationTestFlow
 
     puts ""
     puts (passed == @test_results.length) ? "✅ All tests passed!" : "❌ Some tests failed."
+
+    passed == @test_results.length
   end
 
   def cleanup
@@ -1330,5 +1332,5 @@ if __FILE__ == $0
   puts ""
 
   test_flow = IntegrationTestFlow.new
-  test_flow.run
+  exit(test_flow.run ? 0 : 1)
 end

data/examples/jobs/federation_cache_refresh_job.rb.example

@@ -32,14 +32,17 @@ class FederationCacheRefreshJob < ApplicationJob
 
     Rails.logger.info "[FederationCacheRefreshJob] Starting cache refresh..."
 
+    config = OmniauthOpenidFederation::FederationEndpoint.configuration
+
     # Clear all federation caches
     if Rails.cache.respond_to?(:delete_matched)
       Rails.cache.delete_matched("federation:*")
       Rails.logger.info "[FederationCacheRefreshJob] Cleared federation caches"
     else
       # Fallback: clear known cache keys
-      Rails.cache.delete("federation:jwks")
-      Rails.cache.delete("federation:signed_jwks")
+      issuer = config.issuer
+      Rails.cache.delete(OmniauthOpenidFederation::Cache.key_for_served_jwks(issuer))
+      Rails.cache.delete(OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(issuer))
       Rails.cache.delete("federation:entity_statement")
       Rails.logger.info "[FederationCacheRefreshJob] Cleared federation caches (fallback)"
     end
@@ -47,20 +50,17 @@ class FederationCacheRefreshJob < ApplicationJob
     # Optionally: Pre-warm caches by generating data
     # This ensures data is ready immediately after cache clear
     begin
-      config = OmniauthOpenidFederation::FederationEndpoint.configuration
-      
       # Pre-warm JWKS cache
       if config.current_jwks || config.current_jwks_proc
         jwks = OmniauthOpenidFederation::FederationEndpoint.current_jwks
-        cache_key = "federation:jwks:#{Digest::SHA256.hexdigest(jwks.to_json)}"
+        cache_key = OmniauthOpenidFederation::Cache.key_for_served_jwks(config.issuer)
         Rails.cache.write(cache_key, jwks.to_json, expires_in: config.jwks_cache_ttl || 3600)
         Rails.logger.info "[FederationCacheRefreshJob] Pre-warmed JWKS cache"
       end
 
       # Pre-warm signed JWKS cache
       signed_jwks = OmniauthOpenidFederation::FederationEndpoint.generate_signed_jwks
-      cache_key = "federation:signed_jwks:#{Digest::SHA256.hexdigest(signed_jwks)}"
-      config = OmniauthOpenidFederation::FederationEndpoint.configuration
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(config.issuer)
       Rails.cache.write(cache_key, signed_jwks, expires_in: config.jwks_cache_ttl || 3600)
       Rails.logger.info "[FederationCacheRefreshJob] Pre-warmed signed JWKS cache"
     rescue => e

data/examples/jobs/federation_files_generation_job.rb.example

@@ -72,8 +72,9 @@ class FederationFilesGenerationJob < ApplicationJob
       Rails.logger.info "[FederationFilesGenerationJob] Cleared federation caches"
     else
       # Fallback: clear known cache keys
-      Rails.cache.delete("federation:jwks")
-      Rails.cache.delete("federation:signed_jwks")
+      issuer = OmniauthOpenidFederation::FederationEndpoint.configuration.issuer
+      Rails.cache.delete(OmniauthOpenidFederation::Cache.key_for_served_jwks(issuer))
+      Rails.cache.delete(OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(issuer))
       Rails.logger.info "[FederationFilesGenerationJob] Cleared federation caches (fallback)"
     end
 

data/examples/mock_op_server.rb

@@ -37,7 +37,6 @@ require "webrick"
 require "yaml"
 require "json"
 require "jwt"
-require "jwe"
 require "openssl"
 require "base64"
 require "uri"
@@ -111,7 +110,7 @@ class MockOPServer
   end
 
   def self.load_signing_key(key_data)
-    if key_data.nil? || key_data.empty?
+    if OmniauthOpenidFederation::StringHelpers.blank?(key_data)
       # Generate a new key for testing
       OpenSSL::PKey::RSA.new(2048)
     elsif key_data.is_a?(String)
@@ -126,7 +125,7 @@ class MockOPServer
   end
 
   def self.load_encryption_key(key_data)
-    return nil if key_data.nil? || key_data.empty?
+    return nil if OmniauthOpenidFederation::StringHelpers.blank?(key_data)
     load_signing_key(key_data)
   end
 
@@ -478,7 +477,7 @@ class MockOPServer
         redirect_uri: redirect_uri,
         state: state,
         nonce: nonce,
-        created_at: Time.now
+        created_at: OmniauthOpenidFederation::TimeHelpers.now
       }
 
       # Redirect back to RP with authorization code
@@ -566,7 +565,7 @@ class MockOPServer
 
         # Try to decrypt - will fail if wrong key was used
         begin
-          request_jwt = JWE.decrypt(request_jwt, MockOPServer::ENCRYPTION_KEY)
+          request_jwt = OmniauthOpenidFederation::Jwe.decrypt(request_jwt, MockOPServer::ENCRYPTION_KEY)
         rescue => e
           raise OmniauthOpenidFederation::DecryptionError, "Failed to decrypt request object: #{e.message}"
         end

data/examples/mock_rp_server.rb

@@ -66,7 +66,7 @@ class MockRPServer
   end
 
   def self.load_signing_key(key_data)
-    if key_data.nil? || key_data.empty?
+    if OmniauthOpenidFederation::StringHelpers.blank?(key_data)
       OpenSSL::PKey::RSA.new(2048)
     elsif key_data.is_a?(String)
       if key_data.include?("BEGIN")
@@ -80,7 +80,7 @@ class MockRPServer
   end
 
   def self.load_encryption_key(key_data)
-    return nil if key_data.nil? || key_data.empty?
+    return nil if OmniauthOpenidFederation::StringHelpers.blank?(key_data)
     load_signing_key(key_data)
   end
 
@@ -297,7 +297,7 @@ class MockRPServer
         provider_entity_id: provider_entity_id,
         redirect_uri: redirect_uri,
         nonce: nonce,
-        created_at: Time.now
+        created_at: OmniauthOpenidFederation::TimeHelpers.now
       }
 
       # Step 5: Redirect to provider