omniauth_openid_federation 1.3.0 → 2.0.0

data/lib/omniauth_openid_federation/jwt_response_decoder.rb

@@ -0,0 +1,290 @@
+require "base64"
+require "json"
+require "jwt"
+require "uri"
+
+require_relative "string_helpers"
+require_relative "logger"
+require_relative "validators"
+require_relative "utils"
+require_relative "key_extractor"
+require_relative "jwe"
+require_relative "jwks/decode"
+require_relative "federation/entity_statement"
+require_relative "federation/entity_statement_helper"
+require_relative "federation/signed_jwks"
+
+module OmniauthOpenidFederation
+  # Decrypts and verifies compact JWE/JWS response bodies (nested JWTs).
+  class JwtResponseDecoder
+    COMPACT_TOKEN_PATTERN = /\A[\w\-.]+\z/
+
+    def initialize(strategy_options:, client: nil)
+      @strategy_options = strategy_options
+      @client = client
+    end
+
+    def decode(body)
+      body_text = body.to_s.strip
+      return {} if OmniauthOpenidFederation::StringHelpers.blank?(body_text)
+
+      unless compact_token?(body_text)
+        return OmniauthOpenidFederation::Utils.to_indifferent_hash(JSON.parse(body_text))
+      end
+
+      signed_jwt = resolve_signed_jwt(body_text)
+      return OmniauthOpenidFederation::Utils.to_indifferent_hash(signed_jwt) if signed_jwt.is_a?(Hash)
+
+      payload = verify_signed_jwt(signed_jwt)
+      OmniauthOpenidFederation::Utils.to_indifferent_hash(payload)
+    end
+
+    private
+
+    def compact_token?(body_text)
+      COMPACT_TOKEN_PATTERN.match?(body_text) && body_text.count(".") >= 2
+    end
+
+    def resolve_signed_jwt(body_text)
+      if OmniauthOpenidFederation::Jwe.encrypted?(body_text)
+        plain_text = OmniauthOpenidFederation::Jwe.decrypt(body_text, encryption_key)
+        return plain_text if plain_text.to_s.split(".").length == 3
+
+        begin
+          parsed = JSON.parse(plain_text)
+          return parsed if parsed.is_a?(Hash)
+        rescue JSON::ParserError
+          # fall through to JWT verification path
+        end
+
+        plain_text
+      else
+        body_text
+      end
+    end
+
+    def verify_signed_jwt(signed_jwt)
+      parts = signed_jwt.to_s.split(".")
+      raise ValidationError, "Signed response is not a valid JWT" if parts.empty?
+
+      header = JSON.parse(Base64.urlsafe_decode64(parts.first))
+      algorithm = header["alg"] || header[:alg]
+
+      if algorithm.nil? || algorithm.to_s.downcase == "none"
+        raise ValidationError, "JWT algorithm '#{algorithm}' is not permitted for signed responses"
+      end
+
+      unless parts.length == 3
+        raise ValidationError, "Signed response is not a valid JWT"
+      end
+
+      normalized_strategy_options = OmniauthOpenidFederation::Validators.normalize_hash(@strategy_options)
+      signed_jwks = fetch_signed_jwks(normalized_strategy_options)
+
+      if signed_jwks
+        payload, = ::JWT.decode(
+          signed_jwt,
+          nil,
+          true,
+          {algorithms: [algorithm], jwks: signed_jwks}
+        )
+        return payload
+      end
+
+      jwks_uri = resolve_jwks_uri(normalized_strategy_options)
+      unless jwks_uri
+        raise ConfigurationError,
+          "JWKS URI not available. Cannot verify JWT signature. Provide jwks_uri in client_options or entity statement."
+      end
+
+      entity_statement_keys = load_entity_statement_keys_for_jwks_validation(normalized_strategy_options)
+      payload, = OmniauthOpenidFederation::Jwks::Decode.jwt(
+        signed_jwt,
+        jwks_uri.to_s,
+        entity_statement_keys: entity_statement_keys
+      )
+      payload
+    rescue ConfigurationError, ValidationError, SignatureError
+      raise
+    rescue => error
+      raise ValidationError, "Failed to verify JWT response: #{error.class} - #{error.message}", error.backtrace
+    end
+
+    def encryption_key
+      raw_client_options = @strategy_options[:client_options] || @strategy_options["client_options"] || {}
+      client_options = OmniauthOpenidFederation::Validators.normalize_hash(raw_client_options)
+
+      private_key = client_options[:private_key] ||
+        ((@client.respond_to?(:private_key) ? @client.private_key : nil))
+      jwks = client_options[:jwks] || client_options["jwks"]
+
+      metadata = nil
+      entity_statement_path = @strategy_options[:entity_statement_path] || @strategy_options["entity_statement_path"]
+      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_path)
+        begin
+          validated_path = OmniauthOpenidFederation::Utils.validate_file_path!(
+            entity_statement_path,
+            allowed_dirs: defined?(Rails) ? [Rails.root.join("config").to_s] : nil
+          )
+          metadata = JSON.parse(File.read(validated_path)) if File.exist?(validated_path)
+        rescue => error
+          OmniauthOpenidFederation::Logger.debug("[JwtResponseDecoder] Could not load metadata for key extraction: #{error.message}")
+        end
+      end
+
+      key = OmniauthOpenidFederation::KeyExtractor.extract_encryption_key(
+        jwks: jwks,
+        metadata: metadata,
+        private_key: private_key
+      ) || private_key
+
+      OmniauthOpenidFederation::Validators.validate_private_key!(key)
+      key
+    end
+
+    def resolve_jwks_uri(strategy_options)
+      raw_client_options = strategy_options[:client_options] || strategy_options["client_options"] || {}
+      client_options = OmniauthOpenidFederation::Validators.normalize_hash(raw_client_options)
+      jwks_uri_value = client_options[:jwks_uri] ||
+        ((@client.respond_to?(:jwks_uri) ? @client.jwks_uri : nil))
+
+      if jwks_uri_value && %r{https?://.+}.match?(jwks_uri_value.to_s)
+        return URI.parse(jwks_uri_value.to_s)
+      end
+
+      if jwks_uri_value
+        return URI::HTTPS.build(
+          host: client_options[:host] || ((@client.respond_to?(:host) ? @client.host : nil)),
+          path: jwks_uri_value.to_s
+        )
+      end
+
+      remote_uri = resolve_jwks_uri_from_entity_statement(strategy_options)
+      remote_uri ? URI.parse(remote_uri.to_s) : nil
+    end
+
+    def fetch_signed_jwks(strategy_options)
+      entity_statement_content = load_entity_statement_content(strategy_options)
+      return nil if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_content)
+
+      parsed = OmniauthOpenidFederation::Federation::EntityStatementHelper.parse_for_signed_jwks_from_content(
+        entity_statement_content
+      )
+      return nil if parsed.nil?
+
+      signed_jwks_uri = parsed[:signed_jwks_uri]
+      return nil if OmniauthOpenidFederation::StringHelpers.blank?(signed_jwks_uri)
+
+      OmniauthOpenidFederation::Federation::SignedJWKS.fetch!(signed_jwks_uri, parsed[:entity_jwks])
+    rescue OmniauthOpenidFederation::SecurityError => error
+      OmniauthOpenidFederation::Logger.error("[JwtResponseDecoder] Security error: #{error.message}")
+      nil
+    rescue
+      OmniauthOpenidFederation::Logger.warn("[JwtResponseDecoder] Failed to fetch signed JWKS, falling back to standard JWKS")
+      nil
+    end
+
+    def load_entity_statement_keys_for_jwks_validation(strategy_options)
+      entity_statement_content = load_entity_statement_content(strategy_options)
+      return nil if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_content)
+
+      entity_statement = OmniauthOpenidFederation::Federation::EntityStatement.new(entity_statement_content)
+      parsed = entity_statement.parse
+      entity_jwks = parsed[:jwks] if parsed
+
+      keys = if entity_jwks.is_a?(Hash) && entity_jwks.key?("keys")
+        entity_jwks["keys"]
+      elsif entity_jwks.is_a?(Hash) && entity_jwks.key?(:keys)
+        entity_jwks[:keys]
+      elsif entity_jwks.is_a?(Array)
+        entity_jwks
+      else
+        []
+      end
+      if keys.empty?
+        OmniauthOpenidFederation::Logger.warn("[JwtResponseDecoder] No keys found in entity statement")
+        return nil
+      end
+
+      OmniauthOpenidFederation::Utils.to_indifferent_hash(
+        keys: keys.map { |jwk| jwk.is_a?(Hash) ? jwk : JSON.parse(jwk.to_json) }
+      )
+    rescue => error
+      OmniauthOpenidFederation::Logger.error(
+        "[JwtResponseDecoder] Failed to load entity statement keys for JWKS validation: #{error.message}"
+      )
+      nil
+    end
+
+    def resolve_jwks_uri_from_entity_statement(strategy_options)
+      entity_statement_content = load_entity_statement_content(strategy_options, log_fetch_errors: :debug)
+      return nil if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_content)
+
+      entity_statement = OmniauthOpenidFederation::Federation::EntityStatement.new(entity_statement_content)
+      parsed = entity_statement.parse
+      return nil unless parsed
+
+      jwks_uri = parsed.dig(:metadata, :openid_provider, :jwks_uri) ||
+        parsed.dig("metadata", "openid_provider", "jwks_uri")
+      OmniauthOpenidFederation::StringHelpers.present?(jwks_uri) ? jwks_uri : nil
+    rescue => error
+      OmniauthOpenidFederation::Logger.debug(
+        "[JwtResponseDecoder] Could not extract JWKS URI from entity statement: #{error.message}"
+      )
+      nil
+    end
+
+    def load_entity_statement_content(strategy_options, log_fetch_errors: :warn)
+      normalized_options = OmniauthOpenidFederation::Validators.normalize_hash(strategy_options)
+      entity_statement_path = normalized_options[:entity_statement_path]
+      entity_statement_url = normalized_options[:entity_statement_url]
+      issuer = normalized_options[:issuer]
+      entity_statement_fingerprint = normalized_options[:entity_statement_fingerprint]
+
+      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_path)
+        begin
+          validated_path = OmniauthOpenidFederation::Utils.validate_file_path!(
+            entity_statement_path,
+            allowed_dirs: defined?(Rails) ? [Rails.root.join("config").to_s] : nil
+          )
+          return File.read(validated_path) if File.exist?(validated_path)
+        rescue OmniauthOpenidFederation::SecurityError => error
+          OmniauthOpenidFederation::Logger.error("[JwtResponseDecoder] #{error.message}")
+        end
+      end
+
+      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_url)
+        begin
+          return OmniauthOpenidFederation::Federation::EntityStatement.fetch!(
+            entity_statement_url,
+            fingerprint: entity_statement_fingerprint
+          ).entity_statement
+        rescue => error
+          log_entity_statement_fetch_failure(log_fetch_errors, "URL", error)
+        end
+      end
+
+      if OmniauthOpenidFederation::StringHelpers.present?(issuer)
+        begin
+          return OmniauthOpenidFederation::Federation::EntityStatement.fetch_from_issuer!(
+            issuer,
+            fingerprint: entity_statement_fingerprint
+          ).entity_statement
+        rescue => error
+          log_entity_statement_fetch_failure(log_fetch_errors, "issuer", error)
+        end
+      end
+
+      nil
+    end
+
+    def log_entity_statement_fetch_failure(level, source, error)
+      message = "[JwtResponseDecoder] Failed to fetch entity statement from #{source}: #{error.message}"
+      if level == :debug
+        OmniauthOpenidFederation::Logger.debug(message)
+      else
+        OmniauthOpenidFederation::Logger.warn(message)
+      end
+    end
+  end
+end

data/lib/omniauth_openid_federation/oidc_client.rb

@@ -0,0 +1,101 @@
+require "oauth2"
+require "jwt"
+require "securerandom"
+require "uri"
+
+require_relative "errors"
+require_relative "access_token"
+
+module OmniauthOpenidFederation
+  class OidcClient < OAuth2::Client
+    CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+    CLIENT_ASSERTION_EXPIRATION_SECONDS = 180
+
+    attr_accessor :private_key, :authorization_code, :jwks_uri
+    attr_reader :authorization_endpoint, :token_endpoint, :userinfo_endpoint
+
+    def initialize(identifier:, redirect_uri:, authorization_endpoint:, token_endpoint:, secret: nil,
+      userinfo_endpoint: nil, jwks_uri: nil)
+      token_uri = URI.parse(token_endpoint.to_s)
+      site = build_site(token_uri)
+
+      super(
+        identifier,
+        secret,
+        site: site,
+        authorize_url: authorization_endpoint,
+        token_url: token_endpoint,
+        redirect_uri: redirect_uri,
+        auth_scheme: :private_key_jwt
+      )
+
+      @authorization_endpoint = authorization_endpoint
+      @token_endpoint = token_endpoint
+      @userinfo_endpoint = userinfo_endpoint
+      @jwks_uri = jwks_uri
+      @authorization_code = nil
+    end
+
+    def identifier
+      id
+    end
+
+    def identifier=(value)
+      @id = value
+    end
+
+    def redirect_uri
+      options[:redirect_uri]
+    end
+
+    def redirect_uri=(value)
+      options[:redirect_uri] = value
+    end
+
+    def host
+      URI.parse(site.to_s).host
+    end
+
+    def access_token!(client_auth_method = :jwt_bearer)
+      unless client_auth_method == :jwt_bearer
+        raise ConfigurationError, "Unsupported client_auth_method: #{client_auth_method}"
+      end
+
+      OmniauthOpenidFederation::Validators.validate_private_key!(private_key)
+
+      oauth_token = auth_code.get_token(
+        authorization_code,
+        redirect_uri: redirect_uri,
+        client_assertion_type: CLIENT_ASSERTION_TYPE,
+        client_assertion: build_client_assertion
+      )
+
+      OmniauthOpenidFederation::AccessToken.from_oauth2_token(
+        oauth_token,
+        strategy_options: instance_variable_get(:@strategy_options)
+      )
+    end
+
+    private
+
+    def build_site(token_uri)
+      site = "#{token_uri.scheme}://#{token_uri.host}"
+      site += ":#{token_uri.port}" if token_uri.port && !token_uri.default_port
+      site
+    end
+
+    def build_client_assertion
+      now = Time.now.to_i
+      payload = {
+        iss: identifier,
+        sub: identifier,
+        aud: token_endpoint.to_s,
+        jti: SecureRandom.hex(16),
+        iat: now,
+        exp: now + CLIENT_ASSERTION_EXPIRATION_SECONDS
+      }
+
+      JWT.encode(payload, private_key, "RS256")
+    end
+  end
+end

data/lib/omniauth_openid_federation/rack.rb

@@ -0,0 +1,2 @@
+require "rack"
+require_relative "rack_endpoint"

data/lib/omniauth_openid_federation/rack_endpoint.rb

@@ -88,7 +88,7 @@ module OmniauthOpenidFederation
       jwks_to_serve = OmniauthOpenidFederation::FederationEndpoint.current_jwks
 
       # Apply server-side caching if available
-      cache_key = "federation:jwks:#{Digest::SHA256.hexdigest(jwks_to_serve.to_json)}"
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_jwks(config.issuer)
       cache_ttl = config.jwks_cache_ttl || 3600
 
       jwks_json = if CacheAdapter.available?
@@ -116,7 +116,7 @@ module OmniauthOpenidFederation
       subject_entity_id = request.params["sub"]
 
       unless subject_entity_id
-        return error_response(400, {error: "invalid_request", error_description: "Missing required parameter: sub"}.to_json)
+        return error_response(400, {error: "invalid_request", error_description: "Missing required parameter: sub"})
       end
 
       # Security: Validate entity identifier per OpenID Federation 1.0 spec
@@ -125,22 +125,22 @@ module OmniauthOpenidFederation
         # Validate and get trimmed value
         subject_entity_id = OmniauthOpenidFederation::Validators.validate_entity_identifier!(subject_entity_id)
       rescue SecurityError => e
-        return error_response(400, {error: "invalid_request", error_description: "Invalid subject entity ID: #{e.message}"}.to_json)
+        return error_response(400, {error: "invalid_request", error_description: "Invalid subject entity ID: #{e.message}"})
       rescue => e
-        return error_response(400, {error: "invalid_request", error_description: "Subject entity ID validation failed: #{e.message}"}.to_json)
+        return error_response(400, {error: "invalid_request", error_description: "Subject entity ID validation failed: #{e.message}"})
       end
 
       # Validate that subject is not the issuer (invalid request per spec)
       config = OmniauthOpenidFederation::FederationEndpoint.configuration
       if subject_entity_id == config.issuer
-        return error_response(400, {error: "invalid_request", error_description: "Subject cannot be the issuer"}.to_json)
+        return error_response(400, {error: "invalid_request", error_description: "Subject cannot be the issuer"})
       end
 
       # Get Subordinate Statement
       subordinate_statement = OmniauthOpenidFederation::FederationEndpoint.get_subordinate_statement(subject_entity_id)
 
       unless subordinate_statement
-        return error_response(404, {error: "not_found", error_description: "Subordinate Statement not found for subject: #{subject_entity_id}"}.to_json)
+        return error_response(404, {error: "not_found", error_description: "Subordinate Statement not found for subject: #{subject_entity_id}"})
       end
 
       headers = {
@@ -159,7 +159,7 @@ module OmniauthOpenidFederation
       signed_jwks_jwt = OmniauthOpenidFederation::FederationEndpoint.generate_signed_jwks
 
       # Apply server-side caching if available
-      cache_key = "federation:signed_jwks:#{Digest::SHA256.hexdigest(signed_jwks_jwt)}"
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(config.issuer)
       cache_ttl = config.jwks_cache_ttl || 3600
 
       cached_jwt = if CacheAdapter.available?
@@ -188,11 +188,23 @@ module OmniauthOpenidFederation
     # Return error response
     #
     # @param status [Integer] HTTP status code
-    # @param message [String] Error message
+    # @param message [String, Hash] Error message (string) or error hash (will be converted to JSON)
     # @return [Array] Rack response
     def error_response(status, message)
       content_type = (status == 503) ? "text/plain" : "application/json"
-      body = (status == 503) ? message : {error: message}.to_json
+      body = if status == 503
+        message
+      elsif message.is_a?(Hash)
+        message.to_json
+      else
+        # If message is already JSON string, parse and re-encode to ensure proper format
+        begin
+          parsed = JSON.parse(message)
+          parsed.to_json
+        rescue JSON::ParserError
+          {error: message}.to_json
+        end
+      end
 
       [status, {"Content-Type" => content_type}, [body]]
     end

data/lib/omniauth_openid_federation/rate_limiter.rb

@@ -1,4 +1,5 @@
 require "digest"
+require_relative "cache_adapter"
 require_relative "utils"
 require_relative "logger"
 
@@ -11,34 +12,30 @@ module OmniauthOpenidFederation
 
     # Check if request should be throttled
     #
+    # Best-effort only: read-modify-write on the cache adapter is not atomic, so parallel
+    # workers can briefly exceed the limit. Treat this as a DoS soft guard, not a hard quota.
+    #
     # @param key [String] Unique identifier for the rate limit (e.g., jwks_uri)
     # @param max_requests [Integer] Maximum requests allowed in window (default: 10)
     # @param window [Integer] Time window in seconds (default: 60)
     # @return [Boolean] true if request should be allowed, false if throttled
     def self.allow?(key, max_requests: DEFAULT_MAX_REQUESTS, window: DEFAULT_WINDOW_SECONDS)
-      return true unless defined?(Rails) && Rails.cache
+      return true unless CacheAdapter.available?
 
       cache_key = "omniauth_openid_federation:rate_limit:#{Digest::SHA256.hexdigest(key)}"
       current_time = Time.now.to_i
       window_start = current_time - window
 
-      # Get existing request timestamps
-      timestamps = Rails.cache.read(cache_key) || []
-
-      # Filter out timestamps outside the current window
+      timestamps = CacheAdapter.read(cache_key) || []
       timestamps = timestamps.select { |ts| ts > window_start }
 
-      # Check if we've exceeded the limit
       if timestamps.length >= max_requests
         OmniauthOpenidFederation::Logger.warn("[RateLimiter] Rate limit exceeded for #{Utils.sanitize_uri(key)}: #{timestamps.length}/#{max_requests} requests in #{window}s")
         return false
       end
 
-      # Add current request timestamp
       timestamps << current_time
-
-      # Store updated timestamps (expires after window)
-      Rails.cache.write(cache_key, timestamps, expires_in: window)
+      CacheAdapter.write(cache_key, timestamps, expires_in: window)
 
       true
     end
@@ -47,9 +44,10 @@ module OmniauthOpenidFederation
     #
     # @param key [String] Unique identifier for the rate limit
     def self.reset!(key)
-      return unless defined?(Rails) && Rails.cache
+      return unless CacheAdapter.available?
+
       cache_key = "omniauth_openid_federation:rate_limit:#{Digest::SHA256.hexdigest(key)}"
-      Rails.cache.delete(cache_key)
+      CacheAdapter.delete(cache_key)
     end
   end
 end

data/lib/omniauth_openid_federation/secure_compare.rb

@@ -0,0 +1,15 @@
+require "openssl"
+
+module OmniauthOpenidFederation
+  module SecureCompare
+    module_function
+
+    def secure_compare(left, right)
+      left = left.to_s
+      right = right.to_s
+      return false unless left.bytesize == right.bytesize
+
+      OpenSSL.fixed_length_secure_compare(left, right)
+    end
+  end
+end