omniauth_openid_federation 1.3.2 → 2.0.0

data/lib/omniauth_openid_federation/time_helpers.rb

@@ -56,5 +56,12 @@ module OmniauthOpenidFederation
         false
       end
     end
+
+    # Seconds to add to {TimeHelpers.now} for JWT request object expiration.
+    #
+    # @return [Integer]
+    def self.request_object_expiration_offset
+      Constants::REQUEST_OBJECT_EXPIRATION_SECONDS
+    end
   end
 end

data/lib/omniauth_openid_federation/user_info.rb

@@ -0,0 +1,15 @@
+module OmniauthOpenidFederation
+  class UserInfo
+    attr_reader :raw_attributes
+
+    def initialize(raw_attributes)
+      @raw_attributes = raw_attributes.each_with_object({}) do |(key, value), claims|
+        claims[key.to_sym] = value
+      end
+    end
+
+    def as_json(_options = {})
+      raw_attributes.transform_keys(&:to_s)
+    end
+  end
+end

data/lib/omniauth_openid_federation/utils.rb

@@ -7,11 +7,19 @@ module OmniauthOpenidFederation
     #
     # @param hash [Hash, Object] The hash to convert
     # @return [Hash, HashWithIndifferentAccess] Converted hash
-    def self.to_indifferent_hash(hash)
+    def self.to_indifferent_hash(value)
+      hash = if value.is_a?(Hash)
+        value
+      elsif value.respond_to?(:to_h)
+        value.to_h
+      else
+        {}
+      end
+
       if defined?(ActiveSupport::HashWithIndifferentAccess)
         ActiveSupport::HashWithIndifferentAccess.new(hash)
       else
-        hash.is_a?(Hash) ? hash : hash.to_h
+        hash
       end
     end
 

data/lib/omniauth_openid_federation/validators.rb

@@ -9,19 +9,54 @@ module OmniauthOpenidFederation
     #
     # @param private_key [OpenSSL::PKey::RSA, String, nil] The private key to validate
     # @raise [ConfigurationError] If private key is missing or invalid
-    def self.validate_private_key!(private_key)
+    def self.validate_private_key!(private_key, min_bits: Constants::MIN_RSA_KEY_BITS)
       if private_key.nil?
         raise ConfigurationError, "Private key is required for signed request objects"
       end
 
-      if private_key.is_a?(String)
-        begin
-          OpenSSL::PKey::RSA.new(private_key)
-        rescue => e
-          raise ConfigurationError, "Invalid private key format: #{e.message}"
+      normalized_key =
+        if private_key.is_a?(String)
+          begin
+            OpenSSL::PKey::RSA.new(private_key)
+          rescue => error
+            raise ConfigurationError, "Invalid private key format: #{error.message}"
+          end
+        elsif private_key.is_a?(OpenSSL::PKey::RSA)
+          private_key
+        else
+          raise ConfigurationError, "Private key must be an OpenSSL::PKey::RSA instance or PEM string"
         end
-      elsif !private_key.is_a?(OpenSSL::PKey::RSA)
-        raise ConfigurationError, "Private key must be an OpenSSL::PKey::RSA instance or PEM string"
+
+      if min_bits.to_i.positive? && normalized_key.n.num_bits < min_bits.to_i
+        raise ConfigurationError,
+          "RSA private key must be at least #{min_bits} bits (got #{normalized_key.n.num_bits} bits)"
+      end
+
+      true
+    end
+
+    def self.validate_required_request_object_claims!(claims, required_names)
+      required = Array(required_names).map(&:to_s).uniq
+      return true if required.empty?
+
+      normalized_claims = (claims || {}).each_with_object({}) do |(key, value), hash|
+        hash[key.to_s] = value
+      end
+
+      missing = required.reject { |name| StringHelpers.present?(normalized_claims[name]) }
+      return true if missing.empty?
+
+      raise ConfigurationError, "Missing required request object claims: #{missing.join(", ")}"
+    end
+
+    def self.validate_allowed_acr_value!(acr_value, allowed_acr_values)
+      allowed = Array(allowed_acr_values).map(&:to_s).map(&:strip).reject { |value| StringHelpers.blank?(value) }
+      return true if allowed.empty?
+
+      token_acr = acr_value.to_s.strip
+      if StringHelpers.blank?(token_acr) || !allowed.include?(token_acr)
+        raise ValidationError,
+          "ID token acr mismatch: expected one of [#{allowed.join(", ")}], got '#{acr_value}'"
       end
 
       true

data/lib/omniauth_openid_federation/version.rb

@@ -1,3 +1,3 @@
 module OmniauthOpenidFederation
-  VERSION = "1.3.2".freeze
+  VERSION = "2.0.0".freeze
 end

data/lib/omniauth_openid_federation.rb

@@ -1,7 +1,7 @@
 # OmniAuth OpenID Federation
 #
-# Custom OmniAuth strategy for OpenID Federation providers using openid_connect gem
-# supporting signed request objects, ID token encryption, and OpenID Federation.
+# Custom OmniAuth strategy for OpenID Federation providers supporting signed request objects,
+# ID token encryption, and OpenID Federation.
 #
 # @see https://openid.net/specs/openid-federation-1_0.html
 module OmniauthOpenidFederation
@@ -39,7 +39,13 @@ require_relative "omniauth_openid_federation/constants"
 require_relative "omniauth_openid_federation/cache"
 require_relative "omniauth_openid_federation/cache_adapter"
 require_relative "omniauth_openid_federation/utils"
+require_relative "omniauth_openid_federation/jwe"
 require_relative "omniauth_openid_federation/jws"
+require_relative "omniauth_openid_federation/http_errors"
+require_relative "omniauth_openid_federation/id_token"
+require_relative "omniauth_openid_federation/user_info"
+require_relative "omniauth_openid_federation/secure_compare"
+require_relative "omniauth_openid_federation/oidc_client"
 require_relative "omniauth_openid_federation/jwks/normalizer"
 require_relative "omniauth_openid_federation/jwks/fetch"
 require_relative "omniauth_openid_federation/jwks/decode"
@@ -56,12 +62,12 @@ require_relative "omniauth_openid_federation/federation/trust_chain_resolver"
 require_relative "omniauth_openid_federation/federation/metadata_policy_merger"
 require_relative "omniauth_openid_federation/federation/signed_jwks"
 require_relative "omniauth_openid_federation/federation_endpoint"
-require_relative "omniauth_openid_federation/rack_endpoint"
 require_relative "omniauth_openid_federation/entity_statement_reader"
 require_relative "omniauth_openid_federation/tasks_helper"
 require_relative "omniauth_openid_federation/endpoint_resolver"
 require_relative "omniauth_openid_federation/strategy"
 require_relative "omniauth_openid_federation/access_token"
+require_relative "omniauth_openid_federation/jwt_response_decoder"
 
 module OmniauthOpenidFederation
   # Rotate JWKS cache for a provider

data/lib/tasks/omniauth_openid_federation.rake

@@ -457,8 +457,7 @@ namespace :openid_federation do
       begin
         well_known_url = "#{base_url}/.well-known/openid-federation"
         puts "📥 Attempting to fetch entity statement from: #{well_known_url}"
-        require "http"
-        response = HTTP.timeout(connect: 5, read: 5).get(well_known_url)
+        response = OmniauthOpenidFederation::HttpClient.get(well_known_url, timeout: 5, max_retries: 0)
         if response.status.success?
           entity_statement_path = "/tmp/entity_statement_#{Time.now.to_i}.json"
           File.write(entity_statement_path, response.body.to_s)

data/sig/omniauth_openid_federation.rbs

@@ -71,7 +71,8 @@ module OmniauthOpenidFederation
   end
 
   class HttpClient
-    def self.get: (String uri, ?timeout: Integer, ?max_retries: Integer, ?retry_delay: Integer) -> untyped
+    def self.get: (String uri, ?Hash[Symbol, untyped] options) -> untyped
+    def self.post: (String uri, ?Hash[Symbol, untyped] options) -> untyped
   end
 
   class Logger

data/sig/strategy.rbs

@@ -1,8 +1,8 @@
 module OmniAuth
   module Strategies
     class OpenIDFederation < OmniAuth::Strategies::OAuth2
-      def client: () -> untyped
-      def oidc_client: () -> untyped
+      def client: () -> OmniauthOpenidFederation::OidcClient
+      def oidc_client: () -> OmniauthOpenidFederation::OidcClient
       def request_phase: () -> untyped
       def callback_phase: () -> untyped
       def auth_hash: () -> OmniAuth::AuthHash
@@ -10,7 +10,7 @@ module OmniAuth
       def raw_info: () -> Hash[String, untyped]
       def client_jwk_signing_key: () -> untyped
       def options: () -> untyped
-      def exchange_authorization_code: (String authorization_code) -> untyped
+      def exchange_authorization_code: (String authorization_code) -> OmniauthOpenidFederation::AccessToken
       def new_state: () -> String
       def new_nonce: () -> String
       def resolve_endpoints_from_metadata: (Hash[Symbol, untyped] client_options_hash) -> Hash[Symbol, String?]
@@ -21,7 +21,7 @@ module OmniAuth
       def resolve_jwks_uri: (Hash[Symbol, untyped] normalized_options) -> String?
       def build_base_url: (Hash[Symbol, untyped] client_options_hash) -> String
       def build_endpoint: (String base_url, String path) -> String
-      def decode_id_token: (String id_token) -> Hash[String, untyped]
+      def decode_id_token: (String id_token) -> OmniauthOpenidFederation::IdToken
       def encrypted_token?: (String token) -> bool
       def decode_userinfo: (untyped userinfo) -> Hash[String, untyped]
       def load_provider_entity_statement: () -> Hash[Symbol, untyped]?
@@ -45,9 +45,10 @@ module OmniAuth
   end
 end
 
-module OpenIDConnect
+module OmniauthOpenidFederation
   class AccessToken
     def resource_request: () { () -> untyped } -> untyped
+    def userinfo!: () -> untyped
     def get_strategy_options: () -> Hash[Symbol, untyped]
     def extract_encryption_key_for_decryption: () -> untyped
     def fetch_signed_jwks: (Hash[Symbol, untyped] strategy_options) -> Hash[String, untyped]?
@@ -55,4 +56,3 @@ module OpenIDConnect
     def resolve_jwks_uri_from_entity_statement: (Hash[Symbol, untyped] strategy_options) -> String?
   end
 end
-

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth_openid_federation
 version: !ruby/object:Gem::Version
-  version: 1.3.2
+  version: 2.0.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -24,33 +24,33 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.8'
 - !ruby/object:Gem::Dependency
-  name: openid_connect
+  name: oauth2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '3.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '3.2'
 - !ruby/object:Gem::Dependency
   name: jwe
   requirement: !ruby/object:Gem::Requirement
@@ -71,34 +71,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.3'
+        version: '6.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.3'
-- !ruby/object:Gem::Dependency
-  name: rack
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -114,75 +94,53 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '3.13'
 - !ruby/object:Gem::Dependency
-  name: webmock
+  name: polyrun
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.26'
+        version: 2.1.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.26'
+        version: 2.1.2
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13.3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.3'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+        version: '3.26'
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: 3.26.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
-- !ruby/object:Gem::Dependency
-  name: rspec_junit_formatter
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+        version: '3.26'
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: 3.26.2
 - !ruby/object:Gem::Dependency
-  name: simplecov-cobertura
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '13.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '13.3'
 - !ruby/object:Gem::Dependency
   name: standard
   requirement: !ruby/object:Gem::Requirement
@@ -323,6 +281,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.1'
+- !ruby/object:Gem::Dependency
+  name: mutex_m
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rbs
   requirement: !ruby/object:Gem::Requirement
@@ -351,10 +323,122 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.9'
-description: Custom OmniAuth strategy for OpenID Federation providers using openid_connect
-  gem, supporting signed request objects (RFC 9101), ID token encryption/decryption,
-  client assertion (private_key_jwt), and OpenID Federation entity statements. Framework-agnostic
-  and works with Rails, Sinatra, Rack, and other Rack-compatible frameworks.
+- !ruby/object:Gem::Dependency
+  name: rodauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: rodauth-omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+- !ruby/object:Gem::Dependency
+  name: sequel
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: rack-test
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: tilt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: bcrypt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.1'
+- !ruby/object:Gem::Dependency
+  name: bundler-audit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+description: Custom OmniAuth strategy for OpenID Federation providers supporting signed
+  request objects (RFC 9101), ID token encryption/decryption, client assertion (private_key_jwt),
+  and OpenID Federation entity statements. Framework-agnostic and works with Rails,
+  Sinatra, Rack, and other Rack-compatible frameworks.
 email:
 - contact@kiskolabs.com
 executables: []
@@ -366,6 +450,8 @@ files:
 - README.md
 - SECURITY.md
 - app/controllers/omniauth_openid_federation/federation_controller.rb
+- config/polyrun_coverage.yml
+- config/polyrun_spec_quality.yml
 - config/routes.rb
 - examples/README_INTEGRATION_TESTING.md
 - examples/README_MOCK_OP.md
@@ -384,6 +470,7 @@ files:
 - examples/jobs/federation_files_generation_job.rb.example
 - examples/mock_op_server.rb
 - examples/mock_rp_server.rb
+- examples/standalone_multiple_endpoints_example.rb
 - lib/omniauth_openid_federation.rb
 - lib/omniauth_openid_federation/access_token.rb
 - lib/omniauth_openid_federation/cache.rb
@@ -405,7 +492,10 @@ files:
 - lib/omniauth_openid_federation/federation/trust_chain_resolver.rb
 - lib/omniauth_openid_federation/federation_endpoint.rb
 - lib/omniauth_openid_federation/http_client.rb
+- lib/omniauth_openid_federation/http_errors.rb
+- lib/omniauth_openid_federation/id_token.rb
 - lib/omniauth_openid_federation/instrumentation.rb
+- lib/omniauth_openid_federation/jwe.rb
 - lib/omniauth_openid_federation/jwks/cache.rb
 - lib/omniauth_openid_federation/jwks/decode.rb
 - lib/omniauth_openid_federation/jwks/fetch.rb
@@ -413,15 +503,35 @@ files:
 - lib/omniauth_openid_federation/jwks/rotate.rb
 - lib/omniauth_openid_federation/jwks/selector.rb
 - lib/omniauth_openid_federation/jws.rb
+- lib/omniauth_openid_federation/jwt_response_decoder.rb
 - lib/omniauth_openid_federation/key_extractor.rb
 - lib/omniauth_openid_federation/logger.rb
+- lib/omniauth_openid_federation/oidc_client.rb
+- lib/omniauth_openid_federation/rack.rb
 - lib/omniauth_openid_federation/rack_endpoint.rb
 - lib/omniauth_openid_federation/railtie.rb
 - lib/omniauth_openid_federation/rate_limiter.rb
+- lib/omniauth_openid_federation/secure_compare.rb
 - lib/omniauth_openid_federation/strategy.rb
+- lib/omniauth_openid_federation/strategy/authorization_request.rb
+- lib/omniauth_openid_federation/strategy/callback_handling.rb
+- lib/omniauth_openid_federation/strategy/client_construction.rb
+- lib/omniauth_openid_federation/strategy/client_entity_statement.rb
+- lib/omniauth_openid_federation/strategy/endpoint_resolution.rb
+- lib/omniauth_openid_federation/strategy/failure_handling.rb
+- lib/omniauth_openid_federation/strategy/id_token_decoding.rb
+- lib/omniauth_openid_federation/strategy/jwks_resolution.rb
+- lib/omniauth_openid_federation/strategy/provider_entity_statement.rb
+- lib/omniauth_openid_federation/strategy/userinfo_decoding.rb
 - lib/omniauth_openid_federation/string_helpers.rb
+- lib/omniauth_openid_federation/tasks/authentication_flow_tester.rb
+- lib/omniauth_openid_federation/tasks/callback_processor.rb
+- lib/omniauth_openid_federation/tasks/client_keys_preparer.rb
+- lib/omniauth_openid_federation/tasks/local_endpoint_tester.rb
+- lib/omniauth_openid_federation/tasks/path_resolver.rb
 - lib/omniauth_openid_federation/tasks_helper.rb
 - lib/omniauth_openid_federation/time_helpers.rb
+- lib/omniauth_openid_federation/user_info.rb
 - lib/omniauth_openid_federation/utils.rb
 - lib/omniauth_openid_federation/validators.rb
 - lib/omniauth_openid_federation/version.rb
@@ -446,14 +556,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: OmniAuth strategy for OpenID Federation providers with signed request objects
   and ID token encryption.