omniauth_openid_federation 1.3.0 → 2.0.0

data/lib/omniauth_openid_federation/entity_statement_reader.rb

@@ -5,6 +5,7 @@ require_relative "key_extractor"
 require_relative "utils"
 require_relative "configuration"
 require_relative "logger"
+require_relative "string_helpers"
 
 # Entity Statement Reader for OpenID Federation 1.0
 # @see https://openid.net/specs/openid-federation-1_0.html OpenID Federation 1.0 Specification
@@ -30,7 +31,7 @@ module OmniauthOpenidFederation
       # @return [Array<Hash>] Array of JWK hash objects
       def fetch_keys(entity_statement_path: nil)
         entity_statement = load_entity_statement(entity_statement_path)
-        return [] if entity_statement.nil? || entity_statement.empty?
+        return [] if StringHelpers.blank?(entity_statement)
 
         # Decode self-signed entity statement
         # Entity statements are self-signed, so we validate using their own JWKS
@@ -53,7 +54,7 @@ module OmniauthOpenidFederation
       # @return [Hash, nil] Hash with provider metadata or nil if not found
       def parse_metadata(entity_statement_path: nil)
         entity_statement = load_entity_statement(entity_statement_path)
-        return nil if entity_statement.nil? || entity_statement.empty?
+        return nil if StringHelpers.blank?(entity_statement)
 
         # Decode JWT payload
         jwt_parts = entity_statement.split(".")
@@ -93,21 +94,45 @@ module OmniauthOpenidFederation
       def load_entity_statement(entity_statement_path)
         return nil if entity_statement_path.nil? || entity_statement_path.to_s.empty?
 
-        # Determine allowed directories for file path validation
-        config = OmniauthOpenidFederation::Configuration.config
-        allowed_dirs = if defined?(Rails) && Rails.root
-          [Rails.root.join("config").to_s]
-        elsif config.root_path
-          [File.join(config.root_path, "config")]
+        # If path is absolute and exists, allow it (for temp files in tests)
+        # For absolute paths that don't exist, validate path traversal but allow outside allowed_dirs
+        # For relative paths, validate against allowed directories
+        path_str = entity_statement_path.to_s
+        is_absolute = path_str.start_with?("/", "~")
+
+        if is_absolute && File.exist?(entity_statement_path)
+          validated_path = entity_statement_path
+        elsif is_absolute
+          # Absolute path - validate path traversal but allow outside allowed_dirs
+          begin
+            validated_path = Utils.validate_file_path!(
+              entity_statement_path,
+              allowed_dirs: nil  # Allow absolute paths outside config directory
+            )
+          rescue SecurityError
+            return nil
+          end
+        else
+          # Relative path - must be in allowed directories
+          config = OmniauthOpenidFederation::Configuration.config
+          allowed_dirs = if defined?(Rails) && Rails.root
+            [Rails.root.join("config").to_s]
+          elsif config.root_path
+            [File.join(config.root_path, "config")]
+          end
+
+          begin
+            # Validate file path to prevent path traversal attacks
+            validated_path = Utils.validate_file_path!(
+              entity_statement_path,
+              allowed_dirs: allowed_dirs
+            )
+          rescue SecurityError
+            return nil
+          end
         end
 
         begin
-          # Validate file path to prevent path traversal attacks
-          validated_path = Utils.validate_file_path!(
-            entity_statement_path,
-            allowed_dirs: allowed_dirs
-          )
-
           return nil unless File.exist?(validated_path)
 
           File.read(validated_path)

data/lib/omniauth_openid_federation/federation/entity_statement.rb

@@ -1,4 +1,3 @@
-require "net/http"
 require "digest"
 require "jwt"
 require "base64"
@@ -94,9 +93,6 @@ module OmniauthOpenidFederation
       # @raise [FetchError] If fetching fails
       # @raise [ValidationError] If validation fails
       def self.fetch!(url, fingerprint: nil, previous_statement: nil, timeout: 10)
-        # Use HttpClient for retry logic and configurable SSL verification
-        # Note: HttpClient uses HTTP gem, but entity statements might need Net::HTTP
-        # For now, we'll use a simple HTTP.get approach with HttpClient's retry logic
         begin
           # Convert URL to URI for HttpClient
           response = HttpClient.get(url, timeout: timeout)

data/lib/omniauth_openid_federation/federation/entity_statement_builder.rb

@@ -4,6 +4,7 @@ require "openssl"
 require "time"
 require_relative "../logger"
 require_relative "../errors"
+require_relative "../string_helpers"
 
 # Entity Statement Builder for OpenID Federation 1.0
 # @see https://openid.net/specs/openid-federation-1_0.html OpenID Federation 1.0 Specification
@@ -82,7 +83,6 @@ module OmniauthOpenidFederation
 
         payload = build_payload
 
-        # Build JWT header
         # Per OpenID Federation 1.0 Section 3.1: typ MUST be "entity-statement+jwt"
         header = {
           alg: "RS256",
@@ -102,13 +102,13 @@ module OmniauthOpenidFederation
       private
 
       def validate_parameters
-        raise ConfigurationError, "Issuer is required" if @issuer.nil? || @issuer.empty?
-        raise ConfigurationError, "Subject is required" if @subject.nil? || @subject.empty?
+        raise ConfigurationError, "Issuer is required" if StringHelpers.blank?(@issuer)
+        raise ConfigurationError, "Subject is required" if StringHelpers.blank?(@subject)
         raise ConfigurationError, "Private key is required" if @private_key.nil?
-        raise ConfigurationError, "JWKS is required" if @jwks.nil? || @jwks.empty?
-        raise ConfigurationError, "Metadata is required" if @metadata.nil? || @metadata.empty?
-        raise ConfigurationError, "JWKS must contain at least one key" if @jwks["keys"].nil? || @jwks["keys"].empty?
-        raise ConfigurationError, "Key ID (kid) is required" if @kid.nil? || @kid.empty?
+        raise ConfigurationError, "JWKS is required" if StringHelpers.blank?(@jwks)
+        raise ConfigurationError, "Metadata is required" if StringHelpers.blank?(@metadata)
+        raise ConfigurationError, "JWKS must contain at least one key" if StringHelpers.blank?(@jwks["keys"])
+        raise ConfigurationError, "Key ID (kid) is required" if StringHelpers.blank?(@kid)
       end
 
       def build_payload
@@ -125,7 +125,6 @@ module OmniauthOpenidFederation
           metadata: @metadata
         }
 
-        # Entity Configuration specific claims
         if is_entity_configuration
           payload[:authority_hints] = @authority_hints if @authority_hints
           payload[:trust_marks] = @trust_marks if @trust_marks
@@ -133,7 +132,6 @@ module OmniauthOpenidFederation
           payload[:trust_mark_owners] = @trust_mark_owners if @trust_mark_owners
         end
 
-        # Subordinate Statement specific claims
         if is_subordinate_statement
           payload[:metadata_policy] = @metadata_policy if @metadata_policy
           payload[:metadata_policy_crit] = @metadata_policy_crit if @metadata_policy_crit
@@ -141,21 +139,17 @@ module OmniauthOpenidFederation
           payload[:source_endpoint] = @source_endpoint if @source_endpoint
         end
 
-        # Common optional claims
         payload[:crit] = @crit if @crit
 
         payload
       end
 
       def normalize_jwks(jwks)
-        # Ensure JWKS is a hash with "keys" array
         if jwks.is_a?(Hash)
-          # If it has :keys or "keys", use as-is
           if jwks.key?(:keys) || jwks.key?("keys")
             keys = jwks[:keys] || jwks["keys"]
             {"keys" => normalize_keys(keys)}
           else
-            # If it's just a hash, wrap it
             {"keys" => [jwks]}
           end
         elsif jwks.is_a?(Array)
@@ -168,7 +162,6 @@ module OmniauthOpenidFederation
       def normalize_keys(keys)
         keys.map do |key|
           if key.is_a?(Hash)
-            # Convert symbol keys to string keys
             key.transform_keys(&:to_s)
           else
             key

data/lib/omniauth_openid_federation/federation/entity_statement_helper.rb

@@ -17,18 +17,47 @@ module OmniauthOpenidFederation
       # @raise [ValidationError] If parsing fails
       def self.parse_for_signed_jwks(entity_statement_path)
         # Determine allowed directories for file path validation
-        config = Configuration.config
-        allowed_dirs = if defined?(Rails) && Rails.root
-          [Rails.root.join("config").to_s]
-        elsif config.root_path
-          [File.join(config.root_path, "config")]
-        end
+        # If path is absolute and exists, allow it (for temp files in tests)
+        # For absolute paths that don't exist, validate path traversal but allow outside allowed_dirs
+        # For relative paths, validate against allowed directories
+        path_str = entity_statement_path.to_s
+        is_absolute = path_str.start_with?("/", "~")
+
+        if is_absolute && File.exist?(entity_statement_path)
+          validated_path = entity_statement_path
+        elsif is_absolute
+          # Absolute path - validate path traversal but allow outside allowed_dirs
+          begin
+            validated_path = Utils.validate_file_path!(
+              entity_statement_path,
+              allowed_dirs: nil  # Allow absolute paths outside config directory
+            )
+          rescue SecurityError => e
+            OmniauthOpenidFederation::Logger.warn("[EntityStatementHelper] Security error: #{e.message}")
+            return nil
+          end
+        else
+          # Relative path - must be in allowed directories
+          config = Configuration.config
+          allowed_dirs = if defined?(Rails) && Rails.root
+            [Rails.root.join("config").to_s]
+          elsif config.root_path
+            [File.join(config.root_path, "config")]
+          end
 
-        # Validate file path to prevent path traversal
-        validated_path = Utils.validate_file_path!(
-          entity_statement_path,
-          allowed_dirs: allowed_dirs
-        )
+          begin
+            # Validate file path to prevent path traversal
+            validated_path = Utils.validate_file_path!(
+              entity_statement_path,
+              allowed_dirs: allowed_dirs
+            )
+          rescue SecurityError => e
+            # For relative paths with path traversal, raise SecurityError instead of returning nil
+            # This is a security violation that should be explicitly handled
+            OmniauthOpenidFederation::Logger.warn("[EntityStatementHelper] Security error: #{e.message}")
+            raise SecurityError, e.message
+          end
+        end
 
         unless File.exist?(validated_path)
           sanitized_path = Utils.sanitize_path(validated_path)

data/lib/omniauth_openid_federation/federation/entity_statement_validator.rb

@@ -4,6 +4,7 @@ require "json"
 require_relative "../logger"
 require_relative "../errors"
 require_relative "../configuration"
+require_relative "../string_helpers"
 
 # Entity Statement Validator for OpenID Federation 1.0
 # @see https://openid.net/specs/openid-federation-1_0.html#section-3.2.1 Section 3.2.1: Entity Statement Validation
@@ -53,70 +54,27 @@ module OmniauthOpenidFederation
       # @return [Hash] Validated entity statement with header and claims
       # @raise [ValidationError] If validation fails at any step
       def validate!
-        # Step 1: Entity Statement MUST be a signed JWT
         validate_jwt_format
-
-        # Step 2: Validate typ header (MUST be "entity-statement+jwt")
         validate_typ_header
-
-        # Step 3: Validate alg header (MUST be present and not "none")
         validate_alg_header
-
-        # Step 4: Validate sub claim matches Entity Identifier
         validate_sub_claim
-
-        # Step 5: Validate iss claim is valid Entity Identifier
         validate_iss_claim
-
-        # Step 6: Determine Entity Configuration vs Subordinate Statement
         determine_statement_type
-
-        # Step 7: Validate authority_hints for Subordinate Statements
         validate_authority_hints if @is_subordinate_statement
-
-        # Step 8: Validate iat claim (issued at time)
         validate_iat_claim
-
-        # Step 9: Validate exp claim (expiration time)
         validate_exp_claim
-
-        # Step 10: Validate jwks claim (MUST be present and valid)
         validate_jwks_claim
-
-        # Step 11: Validate kid header (MUST be non-zero length string)
         validate_kid_header
-
-        # Step 12: Validate kid matches key in issuer's JWKS
         validate_kid_matching
-
-        # Step 13: Validate signature (if issuer configuration provided)
         validate_signature if @issuer_entity_configuration || @is_entity_configuration
-
-        # Step 14: Validate crit claim (if present)
         validate_crit_claim
-
-        # Step 15: Validate authority_hints syntax (if present)
         validate_authority_hints_syntax if @header && @payload && @is_entity_configuration
-
-        # Step 16: Validate metadata syntax (if present)
         validate_metadata_syntax
-
-        # Step 17: Validate metadata_policy (if present, MUST be Subordinate Statement)
         validate_metadata_policy_presence
-
-        # Step 18: Validate metadata_policy_crit (if present, MUST be Subordinate Statement)
         validate_metadata_policy_crit_presence
-
-        # Step 19: Validate constraints (if present, MUST be Subordinate Statement)
         validate_constraints_presence
-
-        # Step 20: Validate trust_marks (if present, MUST be Entity Configuration)
         validate_trust_marks_presence
-
-        # Step 21: Validate trust_mark_issuers (if present, MUST be Entity Configuration)
         validate_trust_mark_issuers_presence
-
-        # Step 22: Validate trust_mark_owners (if present, MUST be Entity Configuration)
         validate_trust_mark_owners_presence
 
         {
@@ -129,14 +87,12 @@ module OmniauthOpenidFederation
 
       private
 
-      # Step 1: Entity Statement MUST be a signed JWT
       def validate_jwt_format
         jwt_parts = @jwt_string.split(".")
         if jwt_parts.length != JWT_PARTS_COUNT
           raise ValidationError, "Invalid JWT format: expected #{JWT_PARTS_COUNT} parts (header.payload.signature), got #{jwt_parts.length}"
         end
 
-        # Decode header and payload
         begin
           @header = JSON.parse(Base64.urlsafe_decode64(jwt_parts[0]))
           @payload = JSON.parse(Base64.urlsafe_decode64(jwt_parts[1]))
@@ -147,7 +103,6 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 2: Entity Statement MUST have typ header with value "entity-statement+jwt"
       def validate_typ_header
         typ = @header["typ"] || @header[:typ]
         unless typ == REQUIRED_TYP
@@ -155,10 +110,9 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 3: Entity Statement MUST have alg header that is present and not "none"
       def validate_alg_header
         alg = @header["alg"] || @header[:alg]
-        if alg.nil? || alg.empty?
+        if StringHelpers.blank?(alg)
           raise ValidationError, "Entity statement MUST have an alg (algorithm) header parameter"
         end
         if alg == "none"
@@ -170,33 +124,28 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 4: Entity Identifier MUST match sub claim
       # Note: This is a structural check. The actual Entity Identifier validation
       # would require knowing the expected Entity Identifier, which is context-dependent.
       def validate_sub_claim
         sub = @payload["sub"]
-        if sub.nil? || sub.empty?
+        if StringHelpers.blank?(sub)
           raise ValidationError, "Entity statement MUST have a sub (subject) claim with a valid Entity Identifier"
         end
-        # Basic Entity Identifier format validation (should be a URI)
         unless sub.is_a?(String) && sub.start_with?("http://", "https://")
           raise ValidationError, "Entity statement sub claim MUST be a valid Entity Identifier (URI)"
         end
       end
 
-      # Step 5: Entity Statement MUST have iss claim with valid Entity Identifier
       def validate_iss_claim
         iss = @payload["iss"]
-        if iss.nil? || iss.empty?
+        if StringHelpers.blank?(iss)
           raise ValidationError, "Entity statement MUST have an iss (issuer) claim with a valid Entity Identifier"
         end
-        # Basic Entity Identifier format validation (should be a URI)
         unless iss.is_a?(String) && iss.start_with?("http://", "https://")
           raise ValidationError, "Entity statement iss claim MUST be a valid Entity Identifier (URI)"
         end
       end
 
-      # Step 6: Determine Entity Configuration vs Subordinate Statement
       def determine_statement_type
         iss = @payload["iss"]
         sub = @payload["sub"]
@@ -213,7 +162,6 @@ module OmniauthOpenidFederation
           return
         end
 
-        # Extract authority_hints from issuer's Entity Configuration
         issuer_config = if @issuer_entity_configuration.is_a?(Hash)
           @issuer_entity_configuration
         elsif @issuer_entity_configuration.respond_to?(:parse)
@@ -231,7 +179,6 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 8: Validate iat claim (issued at time)
       def validate_iat_claim
         iat = @payload["iat"]
         if iat.nil?
@@ -243,13 +190,11 @@ module OmniauthOpenidFederation
         end
 
         current_time = Time.now.to_i
-        # Allow clock skew: iat can be slightly in the future
         if iat > (current_time + @clock_skew_tolerance)
           raise ValidationError, "Entity statement iat (issued at) claim is too far in the future. Current time: #{current_time}, iat: #{iat}, tolerance: #{@clock_skew_tolerance}s"
         end
       end
 
-      # Step 9: Validate exp claim (expiration time)
       def validate_exp_claim
         exp = @payload["exp"]
         if exp.nil?
@@ -261,19 +206,16 @@ module OmniauthOpenidFederation
         end
 
         current_time = Time.now.to_i
-        # Allow clock skew: exp can be slightly in the past
         if exp < (current_time - @clock_skew_tolerance)
           raise ValidationError, "Entity statement has expired. Current time: #{current_time}, exp: #{exp}, tolerance: #{@clock_skew_tolerance}s"
         end
       end
 
-      # Step 10: Validate jwks claim (MUST be present and valid)
       def validate_jwks_claim
         jwks = @payload["jwks"]
         if jwks.nil?
           # jwks is OPTIONAL only for Entity Statement returned from OP during Explicit Registration
           # For all other cases, it is REQUIRED
-          # We'll be strict and require it unless we have context that this is an Explicit Registration response
           raise ValidationError, "Entity statement MUST have a jwks (JWK Set) claim"
         end
 
@@ -286,14 +228,12 @@ module OmniauthOpenidFederation
           raise ValidationError, "Entity statement jwks claim MUST contain a 'keys' array"
         end
 
-        # Validate that each key has a unique kid
         kids = keys.map { |key| key["kid"] || key[:kid] }.compact
         if kids.length != kids.uniq.length
           raise ValidationError, "Entity statement jwks keys MUST have unique kid (Key ID) values"
         end
       end
 
-      # Step 11: Validate kid header (MUST be non-zero length string)
       def validate_kid_header
         kid = @header["kid"] || @header[:kid]
         if kid.nil?
@@ -307,17 +247,13 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 12: Validate kid matches key in issuer's JWKS
       def validate_kid_matching
         kid = @header["kid"] || @header[:kid]
         jwks = @payload["jwks"] || {}
 
-        # Get issuer's JWKS
         issuer_jwks = if @is_entity_configuration
-          # For Entity Configuration, use its own JWKS
           jwks
         elsif @issuer_entity_configuration
-          # For Subordinate Statement, use issuer's Entity Configuration JWKS
           issuer_config = if @issuer_entity_configuration.is_a?(Hash)
             @issuer_entity_configuration
           elsif @issuer_entity_configuration.respond_to?(:parse)
@@ -328,7 +264,6 @@ module OmniauthOpenidFederation
 
           issuer_config[:jwks] || issuer_config["jwks"] || issuer_config[:claims]&.fetch("jwks", {}) || issuer_config["claims"]&.fetch("jwks", {})
         else
-          # Cannot validate kid matching without issuer configuration
           OmniauthOpenidFederation::Logger.warn("[EntityStatementValidator] Cannot validate kid matching: issuer entity configuration not provided")
           return
         end
@@ -341,12 +276,9 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 13: Validate signature
+      # Signature validation is typically done separately using JWT.decode
+      # This step validates that we have the necessary information to validate the signature
       def validate_signature
-        # Signature validation is typically done separately using JWT.decode
-        # This step is a placeholder - actual signature validation should be done
-        # by the caller using the issuer's public key
-        # We validate that we have the necessary information to validate the signature
         kid = @header["kid"] || @header[:kid]
         jwks = @payload["jwks"] || {}
 
@@ -372,12 +304,8 @@ module OmniauthOpenidFederation
         unless matching_key
           raise ValidationError, "Cannot validate signature: signing key with kid '#{kid}' not found in issuer's JWKS"
         end
-
-        # Note: Actual cryptographic signature verification should be done by the caller
-        # using JWT.decode with the matching key
       end
 
-      # Step 14: Validate crit claim (if present)
       def validate_crit_claim
         crit = @payload["crit"] || @payload[:crit]
         return unless crit
@@ -391,14 +319,11 @@ module OmniauthOpenidFederation
         unknown_claims = crit - standard_claims
 
         if unknown_claims.any?
-          # For now, we'll log a warning but not reject
-          # In a strict implementation, we should reject if we don't understand the claims
-          # Future enhancement: Add strict_mode option to reject unknown crit claims
-          OmniauthOpenidFederation::Logger.warn("[EntityStatementValidator] Entity statement contains crit claim with unknown claims: #{unknown_claims.join(", ")}. These claims MUST be understood and processed.")
+          raise ValidationError,
+            "Entity statement crit claim contains unknown claims that MUST be understood: #{unknown_claims.join(", ")}"
         end
       end
 
-      # Step 15: Validate authority_hints syntax (if present)
       def validate_authority_hints_syntax
         authority_hints = @payload["authority_hints"] || @payload[:authority_hints]
         return unless authority_hints
@@ -418,7 +343,6 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 16: Validate metadata syntax (if present)
       def validate_metadata_syntax
         metadata = @payload["metadata"] || @payload[:metadata]
         return unless metadata
@@ -427,7 +351,6 @@ module OmniauthOpenidFederation
           raise ValidationError, "Entity statement metadata claim MUST be a JSON object"
         end
 
-        # Validate that metadata values are not null
         metadata.each do |entity_type, entity_metadata|
           if entity_metadata.nil?
             raise ValidationError, "Entity statement metadata claim MUST NOT use null as metadata values"
@@ -438,7 +361,6 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 17: Validate metadata_policy presence (MUST be Subordinate Statement)
       def validate_metadata_policy_presence
         metadata_policy = @payload["metadata_policy"] || @payload[:metadata_policy]
         return unless metadata_policy
@@ -448,7 +370,6 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 18: Validate metadata_policy_crit presence (MUST be Subordinate Statement)
       def validate_metadata_policy_crit_presence
         metadata_policy_crit = @payload["metadata_policy_crit"] || @payload[:metadata_policy_crit]
         return unless metadata_policy_crit
@@ -458,7 +379,6 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 19: Validate constraints presence (MUST be Subordinate Statement)
       def validate_constraints_presence
         constraints = @payload["constraints"] || @payload[:constraints]
         return unless constraints
@@ -468,7 +388,6 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 20: Validate trust_marks presence (MUST be Entity Configuration)
       def validate_trust_marks_presence
         trust_marks = @payload["trust_marks"] || @payload[:trust_marks]
         return unless trust_marks
@@ -478,7 +397,6 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 21: Validate trust_mark_issuers presence (MUST be Entity Configuration)
       def validate_trust_mark_issuers_presence
         trust_mark_issuers = @payload["trust_mark_issuers"] || @payload[:trust_mark_issuers]
         return unless trust_mark_issuers
@@ -488,7 +406,6 @@ module OmniauthOpenidFederation
         end
       end
 
-      # Step 22: Validate trust_mark_owners presence (MUST be Entity Configuration)
       def validate_trust_mark_owners_presence
         trust_mark_owners = @payload["trust_mark_owners"] || @payload[:trust_mark_owners]
         return unless trust_mark_owners

data/lib/omniauth_openid_federation/federation/signed_jwks.rb

@@ -1,4 +1,3 @@
-require "http"
 require "jwt"
 require "base64"
 require "openssl"