omniauth_openid_federation 1.3.2 → 2.0.0

data/lib/omniauth_openid_federation/federation/trust_chain_resolver.rb

@@ -1,3 +1,7 @@
+require "cgi"
+require "json"
+require "base64"
+require "jwt"
 require_relative "entity_statement"
 require_relative "entity_statement_validator"
 require_relative "../http_client"
@@ -5,7 +9,7 @@ require_relative "../logger"
 require_relative "../errors"
 require_relative "../utils"
 require_relative "../string_helpers"
-require "cgi"
+require_relative "../key_extractor"
 
 # Trust Chain Resolver for OpenID Federation 1.0
 # @see https://openid.net/specs/openid-federation-1_0.html#section-10 Section 10: Trust Chain Resolution
@@ -49,6 +53,7 @@ module OmniauthOpenidFederation
         @timeout = timeout
         @resolved_statements = []
         @visited_entities = Set.new
+        @entity_configurations = {}
       end
 
       # Resolve the trust chain
@@ -83,12 +88,13 @@ module OmniauthOpenidFederation
             end
 
             begin
+              issuer_config = fetch_entity_configuration(authority_id)
               subordinate_statement = fetch_subordinate_statement(
                 issuer: authority_id,
-                subject: current_entity_id
+                subject: current_entity_id,
+                issuer_config: issuer_config
               )
 
-              issuer_config = fetch_entity_configuration(authority_id)
               validate_entity_statement(subordinate_statement, issuer_config)
 
               @resolved_statements << subordinate_statement
@@ -143,18 +149,20 @@ module OmniauthOpenidFederation
       end
 
       def fetch_entity_configuration(entity_id)
+        return @entity_configurations[entity_id] if @entity_configurations.key?(entity_id)
+
         entity_statement_url = OmniauthOpenidFederation::Utils.build_entity_statement_url(entity_id)
         OmniauthOpenidFederation::Logger.debug("[TrustChainResolver] Fetching Entity Configuration from: #{entity_statement_url}")
 
         begin
-          EntityStatement.fetch!(entity_statement_url, timeout: @timeout)
+          config = EntityStatement.fetch!(entity_statement_url, timeout: @timeout)
+          @entity_configurations[entity_id] = config
         rescue OmniauthOpenidFederation::NetworkError => e
           raise FetchError, "Failed to fetch entity configuration from #{entity_statement_url}: #{e.message}"
         end
       end
 
-      def fetch_subordinate_statement(issuer:, subject:)
-        issuer_config = fetch_entity_configuration(issuer)
+      def fetch_subordinate_statement(issuer:, subject:, issuer_config:)
         fetch_endpoint = extract_fetch_endpoint(issuer_config)
 
         unless fetch_endpoint
@@ -198,6 +206,43 @@ module OmniauthOpenidFederation
           issuer_entity_configuration: issuer_config
         )
         validator.validate!
+        verify_entity_statement_signature!(statement, issuer_config)
+      end
+
+      def verify_entity_statement_signature!(statement, issuer_config)
+        jwt_string = statement.entity_statement
+        parts = jwt_string.split(".")
+        if parts.length != EntityStatementValidator::JWT_PARTS_COUNT
+          raise ValidationError, "Invalid JWT format: expected #{EntityStatementValidator::JWT_PARTS_COUNT} parts, got #{parts.length}"
+        end
+
+        header = JSON.parse(Base64.urlsafe_decode64(parts[0]))
+        kid = header["kid"] || header[:kid]
+
+        signing_keys = issuer_signing_keys(statement, issuer_config)
+        keys = signing_keys["keys"] || signing_keys[:keys] || []
+        signing_key_data = keys.find { |key| (key["kid"] || key[:kid]) == kid }
+
+        unless signing_key_data
+          raise ValidationError, "Signing key with kid '#{kid}' not found in issuer JWKS for signature verification"
+        end
+
+        public_key = OmniauthOpenidFederation::KeyExtractor.jwk_to_openssl_key(signing_key_data)
+        ::JWT.decode(jwt_string, public_key, true, {algorithm: "RS256"})
+      rescue ::JWT::DecodeError, ::JWT::VerificationError => e
+        error_msg = "Entity statement signature validation failed: #{e.class} - #{e.message}"
+        OmniauthOpenidFederation::Logger.error("[TrustChainResolver] #{error_msg}")
+        raise SignatureError, error_msg, e.backtrace
+      end
+
+      def issuer_signing_keys(statement, issuer_config)
+        if issuer_config.nil?
+          parsed = statement.parse
+          parsed[:jwks] || parsed["jwks"] || {}
+        else
+          issuer_parsed = issuer_config.parse
+          issuer_parsed[:jwks] || issuer_parsed["jwks"] || {}
+        end
       end
 
       def is_trust_anchor?(entity_config)

data/lib/omniauth_openid_federation/federation_endpoint.rb

@@ -462,7 +462,7 @@ module OmniauthOpenidFederation
       #     end
       #   end
       def rack_app
-        require_relative "rack_endpoint"
+        require_relative "rack"
         RackEndpoint.new
       end
 

data/lib/omniauth_openid_federation/http_client.rb

@@ -1,8 +1,19 @@
+require "http"
+require "openssl"
 require_relative "constants"
 
 # HTTP client with retry logic and SSL configuration
 module OmniauthOpenidFederation
   class HttpClient
+    RETRYABLE_ERRORS = [
+      HTTP::Error,
+      Timeout::Error,
+      Errno::ECONNREFUSED,
+      Errno::ETIMEDOUT
+    ].freeze
+
+    RETRYABLE_HTTP_STATUS_CODES = [429, 502, 503].freeze
+
     # Execute an HTTP GET request with retry logic
     #
     # @param uri [String, URI] The URI to fetch
@@ -10,61 +21,163 @@ module OmniauthOpenidFederation
     # @option options [Integer] :max_retries Maximum number of retries (default: from config)
     # @option options [Integer] :retry_delay Base retry delay in seconds (default: from config)
     # @option options [Integer] :timeout Request timeout in seconds (default: from config)
+    # @option options [Integer] :connect_timeout Connect timeout in seconds
+    # @option options [Integer] :read_timeout Read timeout in seconds
+    # @option options [Hash] :headers Request headers
     # @return [HTTP::Response] The HTTP response
     # @raise [NetworkError] If the request fails after all retries
     def self.get(uri, options = {})
-      max_retries = options[:max_retries] || Configuration.config.max_retries
-      retry_delay = options[:retry_delay] || Configuration.config.retry_delay
-      timeout = options[:timeout] || Configuration.config.http_timeout
+      request(:get, uri, options)
+    end
+
+    # Execute an HTTP POST request with retry logic
+    #
+    # POST defaults to max_retries: 0 because retries are not safe for non-idempotent requests.
+    # Pass max_retries explicitly when duplicate POST attempts are acceptable.
+    #
+    # @param uri [String, URI] The URI to post to
+    # @param options [Hash] Request options (same as get, plus :form)
+    # @option options [Hash] :form Form parameters
+    # @return [HTTP::Response] The HTTP response
+    # @raise [NetworkError] If the request fails after all retries
+    def self.post(uri, options = {})
+      request(:post, uri, options)
+    end
 
-      http_client = build_http_client(timeout)
+    def self.request(method, uri, options = {})
+      max_retries = max_retries_for(options, method)
+      retry_delay = options[:retry_delay] || Configuration.config.retry_delay
+      http_client = build_http_client(resolve_timeout(options))
+      headers = options[:headers] || {}
+      form = options[:form]
+      max_attempts = max_retries + 1
 
       retries = 0
-      begin
-        http_client.get(uri)
-      rescue HTTP::Error, Timeout::Error, Errno::ECONNREFUSED, Errno::ETIMEDOUT => e
-        retries += 1
-        if retries > max_retries
-          error_msg = "Failed to fetch #{uri} after #{max_retries} retries: #{e.class} - #{e.message}"
-          OmniauthOpenidFederation::Logger.error("[HttpClient] #{error_msg}")
-          raise OmniauthOpenidFederation::NetworkError, error_msg, e.backtrace
+
+      loop do
+        response = perform_request(http_client, headers, method, uri, form)
+
+        if should_retry_for_status?(method, response, retries, max_retries)
+          retries = retry_after_status(response, retries, max_attempts, retry_delay)
+          next
         end
 
-        delay = [retry_delay * retries, Constants::MAX_RETRY_DELAY_SECONDS].min
-        OmniauthOpenidFederation::Logger.warn("[HttpClient] Request failed (attempt #{retries}/#{max_retries}), retrying in #{delay}s: #{e.message}")
-        sleep(delay)
-        retry
+        return response
+      rescue *RETRYABLE_ERRORS => error
+        retries = handle_network_error(method, uri, error, retries, max_retries, max_attempts, retry_delay)
       end
     end
 
-    # Build HTTP client with SSL configuration
-    #
-    # @param timeout [Integer] Request timeout in seconds
-    # @return [HTTP::Client] Configured HTTP client
-    def self.build_http_client(timeout)
-      http_options_hash = build_http_options_hash || {}
-      http_options = HTTP::Options.new(http_options_hash)
-      HTTP::Client.new(http_options).timeout(timeout)
+    def self.perform_request(http_client, headers, method, uri, form)
+      client = http_client
+      client = client.headers(headers) unless headers.empty?
+
+      case method
+      when :get
+        client.get(uri)
+      when :post
+        client.post(uri, form: form || {})
+      else
+        raise ArgumentError, "Unsupported HTTP method: #{method}"
+      end
+    end
+
+    def self.should_retry_for_status?(method, response, retries, max_retries)
+      method == :get && retryable_http_status?(response.status.code) && retries < max_retries
+    end
+
+    def self.retry_after_status(response, retries, max_attempts, retry_delay)
+      retries += 1
+      delay = retry_delay_for(retries, retry_delay)
+      OmniauthOpenidFederation::Logger.warn(
+        "[HttpClient] HTTP #{response.status.code} on attempt #{retries}/#{max_attempts}, retrying in #{delay}s"
+      )
+      sleep(delay)
+      retries
+    end
+
+    def self.handle_network_error(method, uri, error, retries, max_retries, max_attempts, retry_delay)
+      retries += 1
+      if retries > max_retries
+        error_message = "Failed to #{method.to_s.upcase} #{uri} after #{max_attempts} attempts: #{error.class} - #{error.message}"
+        OmniauthOpenidFederation::Logger.error("[HttpClient] #{error_message}")
+        raise OmniauthOpenidFederation::NetworkError, error_message, error.backtrace
+      end
+
+      delay = retry_delay_for(retries, retry_delay)
+      OmniauthOpenidFederation::Logger.warn(
+        "[HttpClient] Request failed on attempt #{retries}/#{max_attempts}, retrying in #{delay}s: #{error.message}"
+      )
+      sleep(delay)
+      retries
+    end
+
+    def self.build_http_client(timeout_config)
+      http_options = HTTP::Options.new(build_http_options_hash)
+      HTTP::Client.new(http_options).timeout(timeout_config)
     end
 
-    # Build HTTP options hash from configuration
-    #
-    # @return [Hash, nil] HTTP options hash or nil
     def self.build_http_options_hash
       config = Configuration.config
-
-      # If http_options is configured, use it (can be Hash or Proc)
-      if config.http_options
+      user_options = if config.http_options
         if config.http_options.is_a?(Proc)
           config.http_options.call
         else
           config.http_options
         end
       end
+
+      options = (user_options || {}).dup
+      options[:ssl] = (options[:ssl] || {}).dup
+      options[:ssl][:verify_mode] ||= ssl_verify_mode(config.verify_ssl)
+      if options[:ssl][:verify_mode] == OpenSSL::SSL::VERIFY_PEER && !options[:ssl][:ca_file]
+        ca_file = ssl_ca_file
+        options[:ssl][:ca_file] = ca_file if ca_file
+      end
+      options
+    end
+
+    def self.ssl_verify_mode(verify_ssl)
+      verify_ssl ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
+    end
+
+    def self.ssl_ca_file
+      if ENV["SSL_CERT_FILE"] && File.file?(ENV["SSL_CERT_FILE"])
+        ENV["SSL_CERT_FILE"]
+      elsif File.exist?(OpenSSL::X509::DEFAULT_CERT_FILE)
+        OpenSSL::X509::DEFAULT_CERT_FILE
+      end
+    end
+
+    def self.max_retries_for(options, method)
+      return options[:max_retries] if options.key?(:max_retries)
+
+      (method == :post) ? 0 : Configuration.config.max_retries
     end
 
-    private_class_method :build_http_options_hash
+    def self.resolve_timeout(options)
+      default_timeout = Configuration.config.http_timeout
+
+      if options[:connect_timeout] || options[:read_timeout]
+        {
+          connect: options[:connect_timeout] || default_timeout,
+          read: options[:read_timeout] || default_timeout
+        }
+      else
+        options[:timeout] || default_timeout
+      end
+    end
+
+    def self.retryable_http_status?(status_code)
+      RETRYABLE_HTTP_STATUS_CODES.include?(status_code)
+    end
+
+    def self.retry_delay_for(retry_count, base_delay)
+      [base_delay * retry_count, Constants::MAX_RETRY_DELAY_SECONDS].min
+    end
 
-    private_class_method :build_http_client
+    private_class_method :request, :perform_request, :should_retry_for_status?, :retry_after_status,
+      :handle_network_error, :build_http_client, :build_http_options_hash, :ssl_verify_mode, :ssl_ca_file,
+      :max_retries_for, :resolve_timeout, :retryable_http_status?, :retry_delay_for
   end
 end

data/lib/omniauth_openid_federation/http_errors.rb

@@ -0,0 +1,14 @@
+module OmniauthOpenidFederation
+  class HttpError < Error
+    attr_reader :response
+
+    def initialize(status, message = nil, response = nil)
+      @response = response
+      super(message || "HTTP error #{status}")
+    end
+  end
+
+  class BadRequest < HttpError; end
+  class Unauthorized < HttpError; end
+  class Forbidden < HttpError; end
+end

data/lib/omniauth_openid_federation/id_token.rb

@@ -0,0 +1,19 @@
+module OmniauthOpenidFederation
+  class IdToken
+    CLAIM_READERS = %i[iss sub aud exp iat nonce acr auth_time amr].freeze
+
+    attr_reader :raw_attributes
+
+    def initialize(raw_attributes)
+      @raw_attributes = raw_attributes.each_with_object({}) do |(key, value), claims|
+        claims[key.to_sym] = value
+      end
+    end
+
+    CLAIM_READERS.each do |claim_name|
+      define_method(claim_name) do
+        raw_attributes[claim_name]
+      end
+    end
+  end
+end

data/lib/omniauth_openid_federation/jwe.rb

@@ -0,0 +1,26 @@
+require "jwe"
+
+require_relative "errors"
+
+module OmniauthOpenidFederation
+  # Compact-serialization JWE helpers for nested JWTs (sign then encrypt).
+  module Jwe
+    PARTS_COUNT = 5
+
+    def self.encrypted?(token)
+      token.to_s.count(".") + 1 == PARTS_COUNT
+    end
+
+    def self.encrypt(plaintext, public_key, alg:, enc:)
+      ::JWE.encrypt(plaintext.to_s, public_key, alg: alg.to_s, enc: enc.to_s)
+    end
+
+    def self.decrypt(ciphertext, private_key)
+      ::JWE.decrypt(ciphertext.to_s, private_key)
+    rescue ::JWE::DecodeError, ::JWE::InvalidData, ::JWE::BadCEK, ::JWE::NotImplementedError, ArgumentError => error
+      raise OmniauthOpenidFederation::DecryptionError,
+        "Failed to decrypt JWE: #{error.message}",
+        error.backtrace
+    end
+  end
+end

data/lib/omniauth_openid_federation/jwks/decode.rb

@@ -113,19 +113,6 @@ module OmniauthOpenidFederation
           else
             raise e
           end
-        rescue => e
-          # Other errors might be due to key rotation
-          if retried
-            # If already re-tried to fetch, raise error
-            error_msg = "JWT decode failed after cache refresh: #{e.class} - #{e.message}"
-            OmniauthOpenidFederation::Logger.error("[Jwks::Decode] #{error_msg}")
-            raise ValidationError, error_msg, e.backtrace
-          else
-            OmniauthOpenidFederation::Logger.warn("[Jwks::Decode] JWT decode error (clearing cache and retrying - possible key rotation): #{e.class} - #{e.message}")
-            # Reset cache to force re-fetching of keys
-            OmniauthOpenidFederation::Cache.delete_jwks(jwks_uri)
-            run(encoded_jwt, jwks_uri, retried: true, entity_statement_keys: entity_statement_keys, &block)
-          end
         end
       end
 

data/lib/omniauth_openid_federation/jwks/fetch.rb

@@ -1,4 +1,3 @@
-require "http"
 require "jwt"
 require "openssl"
 require_relative "../logger"
@@ -44,52 +43,30 @@ module OmniauthOpenidFederation
         cache_ttl ||= config.cache_ttl
         rotate_on_errors = config.rotate_on_errors
 
-        # Use cache adapter if available, otherwise fetch directly
         if CacheAdapter.available?
-          if force_refresh
-            # Force refresh: clear cache and fetch fresh
-            CacheAdapter.delete(cache_key)
-          end
+          CacheAdapter.delete(cache_key) if force_refresh
 
-          if cache_ttl.nil?
-            # Manual rotation: cache forever, only rotate on errors if rotate_on_errors is enabled
-            begin
-              CacheAdapter.fetch(cache_key, expires_in: nil) do
-                fetch_jwks(jwks_uri, entity_statement_keys)
-              end
-            rescue KeyRelatedError => e
-              # Rotate on key-related errors if configured
-              if rotate_on_errors
-                OmniauthOpenidFederation::Logger.warn("[Jwks::Fetch] Key-related error detected, rotating cache: #{e.message}")
-                CacheAdapter.delete(cache_key)
-                fetch_jwks(jwks_uri, entity_statement_keys)
-              else
-                raise
-              end
-            end
-          else
-            # TTL-based cache: expires after cache_ttl seconds
-            # Rotate on errors if configured
-            begin
-              CacheAdapter.fetch(cache_key, expires_in: cache_ttl) do
-                fetch_jwks(jwks_uri, entity_statement_keys)
-              end
-            rescue KeyRelatedError => e
-              # Rotate on key-related errors if configured
-              if rotate_on_errors
-                OmniauthOpenidFederation::Logger.warn("[Jwks::Fetch] Key-related error detected, rotating cache: #{e.message}")
-                CacheAdapter.delete(cache_key)
-                fetch_jwks(jwks_uri, entity_statement_keys)
-              else
-                raise
-              end
-            end
+          fetch_from_cache(cache_key, cache_ttl: cache_ttl, rotate_on_errors: rotate_on_errors) do
+            fetch_jwks(jwks_uri, entity_statement_keys)
           end
         else
           fetch_jwks(jwks_uri, entity_statement_keys)
         end
       end
 
+      def self.fetch_from_cache(cache_key, cache_ttl:, rotate_on_errors:)
+        CacheAdapter.fetch(cache_key, expires_in: cache_ttl) { yield }
+      rescue KeyRelatedError => error
+        if rotate_on_errors
+          OmniauthOpenidFederation::Logger.warn("[Jwks::Fetch] Key-related error detected, rotating cache: #{error.message}")
+          CacheAdapter.delete(cache_key)
+          yield
+        else
+          raise
+        end
+      end
+      private_class_method :fetch_from_cache
+
       def self.fetch_jwks(jwks_uri, entity_statement_keys)
         # Rate limiting to prevent DoS
         unless RateLimiter.allow?(jwks_uri)

data/lib/omniauth_openid_federation/jws.rb

@@ -1,5 +1,4 @@
 require "jwt"
-require "jwe"
 require "securerandom"
 require "base64"
 require_relative "string_helpers"
@@ -56,10 +55,6 @@ module OmniauthOpenidFederation
   #   )
   #   signed_jwt = jws.sign
   class Jws
-    # Request object expiration constants
-    REQUEST_OBJECT_EXPIRATION_SECONDS = 600 # 10 minutes in seconds
-    REQUEST_OBJECT_EXPIRATION_MINUTES = 10
-
     # State generation constants
     STATE_BYTES = 16 # Number of hex bytes for state parameter
 
@@ -223,7 +218,7 @@ module OmniauthOpenidFederation
         response_type: @response_type,
         scope: @scope,
         state: state,
-        exp: (TimeHelpers.now + (defined?(ActiveSupport) ? REQUEST_OBJECT_EXPIRATION_MINUTES.minutes : REQUEST_OBJECT_EXPIRATION_SECONDS)).to_i,
+        exp: (TimeHelpers.now + TimeHelpers.request_object_expiration_offset).to_i,
         jti: SecureRandom.uuid # JWT ID to prevent replay
       }
 
@@ -393,11 +388,7 @@ module OmniauthOpenidFederation
         # Convert JWK to OpenSSL public key
         public_key = KeyExtractor.jwk_to_openssl_key(encryption_key_data)
 
-        # Encrypt the signed JWT using JWE gem
-        # For JWE, we encrypt the signed JWT string as plaintext
-        # The pattern is: sign first, then encrypt (nested JWT)
-        # JWE.encrypt(plaintext, key, alg: "RSA-OAEP", enc: "A128CBC-HS256")
-        JWE.encrypt(
+        OmniauthOpenidFederation::Jwe.encrypt(
           signed_jwt,
           public_key,
           alg: encryption_alg,