omniauth_openid_federation 1.3.2 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f8bba8b102bcf8c24fdd775d5d898d92b27c27d8e6df40c63ff23756aee4f8d
-  data.tar.gz: 900a1851f0a9917b5593f6146d965271180a979d312b9ff5fa15c295578172e5
+  metadata.gz: da45b4e4b8bb24f3b4191c0a3c297e23dad26f3d89ffefaceebc0b225117dc59
+  data.tar.gz: 1f8f747bc2f5815fc0d9b2005fa21a2c542dc08f6b3f223072cc7b9e95f0f089
 SHA512:
-  metadata.gz: 31a7bcc8b8e1661dc9bcc13604e2e92279d81501e0a1da25b8b48a6f9bf35251489720aa1879b6beeb89de32bd2970d72c086e58b1be43d0f4c125809339fb51
-  data.tar.gz: 5c27ea824e18a49a0fe899f6f6f2ade3c6a10872ade9b2eca3690cada27e06aa5ada813f1cdf34763881bc8c4ee5d1033f0a7ed821a8378602ee72db169150f7
+  metadata.gz: 16d2a33e35399bc802f47e6f7d69e7995a20781024bfb22e7d938f8035069dc5f4bfb4a62c0de5aa4a1a42842472e7c19d4bacea342c5cad9cd92d81d59f0d90
+  data.tar.gz: efec81bf4ec61d381ee7c03f2dc5e598c9d4d47a7768847f4353c746849cc141b339f301f9f99c3e5f8758d43248bd2682fc7c70fa2df612620f4f6805e878da

data/CHANGELOG.md

@@ -1,5 +1,55 @@
 # CHANGELOG
 
+## Unreleased
+
+## 2.1.0 (2026-10-29)
+
+- BREAKING: Require Ruby `>= 3.4` (gemspec); drop Rails 6 and TruffleRuby appraisal targets from the tested matrix
+- Fix trust chain resolution to bind fetched entity configurations to the requested entity id and verify trust-anchor statements with pinned `trust_anchors[].jwks`
+- Fix `EntityStatementValidator` authority_hints checks to use the subject entity configuration (`subject_entity_configuration:`)
+- Fix UserInfo merge so `sub` must match the ID token and identity claims (`iss`, `sub`, `aud`, `exp`, `iat`) stay from the ID token
+- Fix signed JWKS handling to fail closed on signature, validation, and fetch errors instead of falling back to unsigned `jwks_uri`
+- Fix signed JWKS cache keys to include the verifying `entity_jwks` digest
+- Fix OAuth callback to validate `state` before handling authorization `error` responses
+- Fix configured `entity_statement_path` missing-file handling to raise `ConfigurationError` instead of silent network fallback
+- Fix endpoint resolution so configured entity-statement files under `Dir.tmpdir` are not deleted after resolve
+- Fix `client_entity_statement_url` so `load_client_entity_statement` fetches from the URL
+- Fix `Utils.validate_file_path!` allowed-directory checks to require a path-separator boundary
+- Stop streaming HTTP responses at the configured byte limit and close oversized responses before buffering the remaining body
+- Add `rfcs/` starter pack: process (RFC 0001), positioning (RFC 0002), and Standards Track design RFCs 0003–0006 for strategy, trust chain, token verification, and federation endpoint
+- Document Ruby `>= 3.4` in README requirements
+
+## 2.0.0 (2026-07-06)
+
+- BREAKING: Replace `openid_connect` and `json-jwt` with `OmniauthOpenidFederation::OidcClient`, `AccessToken`, and `IdToken` built on `oauth2` and `jwt`
+- BREAKING: Drop explicit `rack` runtime dependency; load Rack federation endpoints via `require "omniauth_openid_federation/rack"`
+- BREAKING: Validate ID token `iss`, `aud`, and session `nonce` in `callback_phase`
+- BREAKING: Fail closed on trust chain resolution errors instead of returning empty metadata
+- BREAKING: Reject `alg: none` in access token JWT handling
+- BREAKING: Remove broad JWKS decode retry on non-signature errors
+- BREAKING: Reject unknown `crit` claims in entity statement validation
+- BREAKING: Enforce minimum RSA key size (2048 bits) in `Validators.validate_private_key!`
+- Use `jwe` gem for JWE encrypt/decrypt instead of `json-jwt`
+- Refactor `OmniAuth::Strategies::OpenIDFederation` into concern modules under `lib/omniauth_openid_federation/strategy/`
+- Add `OmniauthOpenidFederation::SecureCompare` for constant-time string comparison in the strategy
+- Add `OmniauthOpenidFederation::JwtResponseDecoder` for encrypted/signed JWT userinfo and resource responses
+- Add behavioral contract specs for token exchange, userinfo, and JWE parity with former `openid_connect` flow
+- Add Telia Tunnistus PP entity statement fixture and contract spec (A128GCM and A128CBC-HS256)
+- Add provider-agnostic strategy options: `default_request_object_claims`, `required_request_object_claims`, `allowed_acr_values`, `require_entity_statement_fingerprint`
+- Use `Jwe.encrypted?` for JWE detection in `AccessToken#resource_request` and `TasksHelper`
+- Deduplicate entity statement loading in `access_token.rb` via `load_entity_statement_content`
+- Verify subordinate entity statement signatures in trust chain resolution
+- Wire `verify_ssl` into `HttpClient` SSL options
+- Use `CacheAdapter` in `RateLimiter` instead of `Rails.cache` directly
+- Use issuer-scoped cache keys for federation JWKS and signed JWKS endpoints
+- Fix OAuth callback failures in `callback_phase` to return the Rack response from `fail!` instead of `nil`; avoids `Rack::ETag` `NoMethodError` and HTTP 500 on auth failure
+- Fix flaky `test_local_endpoint` spec when `SSL_CERT_FILE` is set in the environment
+- Replace internal `decode_id_token` stubs in strategy specs with JWKS-backed setup
+- Add `HttpClient.post` with form data, headers, and connect/read timeouts
+- Retry GET requests on HTTP 429, 502, and 503; POST requests default to no retry
+- Auto-configure SSL CA file when peer verification is enabled
+- Route rake task HTTP through `HttpClient` instead of ad hoc `Net::HTTP`
+
 ## 1.3.2 (2025-12-09)
 
 - Added `TimeHelpers` module for compatibility with non-Rails environments
@@ -38,7 +88,7 @@
 ## 1.1.0 (2025-11-26)
 
 - Enhanced instrumentation: All blocking exceptions automatically reported through instrumentation system, including OmniAuth middleware errors (like AuthenticityTokenProtection)
-- CSRF protection instrumentation: New authenticity_error event type for reporting OmniAuth CSRF protection failures
+- CSRF protection instrumentation: New authenticity_error event type for reporting OmniAuth CSRF failures
 - Comprehensive error reporting: Override fail! method in strategy to catch and instrument all authentication failures
 - CSRF protection documentation: Added comprehensive Step 7 in README explaining CSRF protection configuration for both request and callback phases
 - CSRF configuration examples: Added complete examples in examples/config/initializers/devise.rb.example and examples/app/controllers/users/omniauth_callbacks_controller.rb.example

data/README.md

@@ -1,14 +1,10 @@
 # omniauth_openid_federation
 
-[![Gem Version](https://badge.fury.io/rb/omniauth_openid_federation.svg?v=1.1.0)](https://badge.fury.io/rb/omniauth_openid_federation) [![Test Status](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb/graph/badge.svg?token=CX3O9M1GIT)](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_omniauth_openid_federation.rb&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=amkisko_omniauth_openid_federation.rb)
+[![Gem Version](https://badge.fury.io/rb/omniauth_openid_federation.svg?v=1.1.0)](https://badge.fury.io/rb/omniauth_openid_federation) [![Test Status](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb/graph/badge.svg?token=CX3O9M1GIT)](https://app.codecov.io/github/amkisko/omniauth_openid_federation.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_omniauth_openid_federation.rb&metric=alert_status)](https://sonarcloud.io/project/overview?id=amkisko_omniauth_openid_federation.rb)
 
 OmniAuth strategy for OpenID Federation providers with comprehensive security features, supporting signed request objects, ID token encryption, and full OpenID Federation 1.0 compliance.
 
-Sponsored by [Kisko Labs](https://www.kiskolabs.com).
-
-<a href="https://www.kiskolabs.com">
-  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
-</a>
+Design changes go through `rfcs/` (RFC 0001).
 
 ## Installation
 
@@ -279,7 +275,14 @@ Use `prepare_request_object_params` proc to modify parameters before they're add
 
 ```ruby
 config.omniauth :openid_federation,
-  request_object_params: [:ftn_spname], # Allow-list for custom params
+  request_object_params: [:ftn_spname], # Allow-list for provider-specific params (example: Finnish FTN)
+  default_request_object_claims: {
+    ui_locales: "fi",
+    acr_values: ENV["OPENID_ACR_VALUES"]
+  },
+  required_request_object_claims: %w[ftn_spname acr_values ui_locales],
+  allowed_acr_values: [ENV["OPENID_ACR_VALUES"]].compact,
+  require_entity_statement_fingerprint: true,
   prepare_request_object_params: proc do |params|
     # Combine config acr_values with form acr_values
     form_acr_values = params["acr_values"]&.to_s&.strip
@@ -310,6 +313,96 @@ config.omniauth :openid_federation,
 
 The proc will combine this with config values before adding to the signed JWT.
 
+## Rodauth Integration
+
+This strategy can be used with the Rodauth authentication framework via the
+[`rodauth-omniauth` feature](https://github.com/janko/rodauth-omniauth).
+
+### Minimal Roda/Rodauth setup
+
+```ruby
+require "roda"
+require "rodauth"
+require "rodauth/omniauth"
+require "omniauth_openid_federation"
+
+DB = Sequel.sqlite # or your production database
+
+DB.create_table? :accounts do
+  primary_key :id
+  String :email, null: false
+end
+
+DB.create_table? :account_identities do
+  primary_key :id
+  foreign_key :account_id, :accounts, null: false
+  String :provider, null: false
+  String :uid, null: false
+  index [:provider, :uid], unique: true
+end
+
+class App < Roda
+  plugin :sessions, secret: ENV.fetch("SESSION_SECRET") { SecureRandom.hex(32) }
+  plugin :json
+
+  plugin :rodauth, json: true do
+    db DB
+    enable :omniauth
+
+    # Mount OmniAuth under /auth, as recommended by rodauth-omniauth
+    omniauth_prefix "/auth"
+
+    omniauth_provider :openid_federation,
+      nil,
+      nil,
+      strategy_class: OmniAuth::Strategies::OpenIDFederation,
+      name: :openid_federation,
+      issuer: ENV.fetch("OPENID_ISSUER", "https://provider.example.com"),
+      audience: ENV.fetch("OPENID_AUDIENCE", "https://provider.example.com"),
+      client_options: {
+        identifier: ENV["OPENID_CLIENT_ID"],
+        redirect_uri: ENV["OPENID_REDIRECT_URI"] || "https://your-app.example.com/auth/openid_federation/callback",
+        host: URI.parse(ENV.fetch("OPENID_ISSUER", "https://provider.example.com")).host,
+        scheme: URI.parse(ENV.fetch("OPENID_ISSUER", "https://provider.example.com")).scheme,
+        authorization_endpoint: "/oauth2/authorize",
+        token_endpoint: "/oauth2/token",
+        userinfo_endpoint: "/oauth2/userinfo",
+        jwks_uri: "/.well-known/jwks.json",
+        private_key: OpenSSL::PKey::RSA.new(
+          Base64.decode64(ENV.fetch("OPENID_CLIENT_PRIVATE_KEY_BASE64"))
+        )
+      },
+      entity_statement_url: ENV["OPENID_ENTITY_STATEMENT_URL"],
+      entity_statement_fingerprint: ENV["OPENID_ENTITY_STATEMENT_FINGERPRINT"]
+  end
+
+  route do |r|
+    # Rodauth authentication + OmniAuth endpoints
+    # r.rodauth automatically handles omniauth routes based on omniauth_prefix setting
+    r.rodauth
+
+    r.root do
+      if rodauth.logged_in?
+        {logged_in: true, account_id: rodauth.session_value}
+      else
+        {logged_in: false}
+      end
+    end
+  end
+end
+```
+
+With this configuration, the Rodauth `:omniauth` feature:
+
+- uses `OmniAuth::Strategies::OpenIDFederation` as the strategy implementation,
+- calls the strategy's request and callback phases under `/auth/openid_federation`,
+- persists external identities into the `account_identities` table following the
+  [`rodauth-omniauth` schema](https://github.com/janko/rodauth-omniauth),
+- and exposes helper methods like `rodauth.omniauth_auth`, `rodauth.omniauth_email`,
+  and `rodauth.omniauth_name` as documented in the
+  [Rodauth documentation](https://rodauth.jeremyevans.net/documentation.html)
+  and [`rodauth-omniauth` README](https://github.com/janko/rodauth-omniauth).
+
 ## Rake Tasks
 
 ### Prepare Client Keys
@@ -356,6 +449,10 @@ rake openid_federation:test_authentication_flow[
 - `always_encrypt_request_object` - Force encryption of request objects (default: false)
 - `request_object_params` - Array of parameter names to include in request object (allow-list)
 - `prepare_request_object_params` - Proc to modify params before adding to signed request object: `proc { |params| modified_params }`
+- `default_request_object_claims` - Hash of default claims merged before `prepare_request_object_params` (request params override defaults)
+- `required_request_object_claims` - Array of claim names that must be present in the signed request object (raises before redirect)
+- `allowed_acr_values` - When set, ID token `acr` must match one of the configured values
+- `require_entity_statement_fingerprint` - When true, fetching provider entity statements from URL or issuer requires `entity_statement_fingerprint`
 - `discovery` - Enable automatic endpoint discovery (default: true)
 
 ## Security
@@ -376,16 +473,17 @@ rake openid_federation:test_authentication_flow[
 
 ## Requirements
 
-- Ruby >= 3.0
-- Rails >= 6.1 (or compatible Rack application)
+- Ruby >= 3.4
+- Rails >= 7.2 (or compatible Rack application; see Appraisal gemfiles)
 - OpenSSL (for RSA key operations)
 
 ## Example Files
 
 See `examples/` directory for complete configuration examples:
-- `examples/config/initializers/devise.rb.example`
-- `examples/config/initializers/omniauth_openid_federation.rb.example`
-- `examples/config/open_id_connect_config.rb.example`
+- `examples/standalone_multiple_endpoints_example.rb` - Standalone Sinatra app with multiple auth endpoints and entrance point-based redirects
+- `examples/config/initializers/devise.rb.example` - Devise integration example (Rails)
+- `examples/config/initializers/omniauth_openid_federation.rb.example` - Federation endpoint configuration
+- `examples/config/open_id_connect_config.rb.example` - Configuration class example
 
 ## Development
 
@@ -393,9 +491,11 @@ See `examples/` directory for complete configuration examples:
 git clone https://github.com/amkisko/omniauth_openid_federation.rb.git
 cd omniauth_openid_federation.rb
 bundle install
-bin/rspec
+bundle exec polyrun parallel-rspec --workers 5 -c polyrun.yml
 ```
 
+Same flow as CI; optional wrappers [`bin/rspec_parallel`](bin/rspec_parallel) and [`bin/appraisals`](bin/appraisals) (runs **`polyrun parallel-rspec`** per Appraisal gemfile). Details: **[spec/README.md](spec/README.md)** and **`polyrun.yml`**.
+
 ## Contributing
 
 Contributions welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
@@ -413,12 +513,33 @@ Contributions welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for guidel
 - [omniauth](https://github.com/omniauth/omniauth) - Authentication framework
 - [devise](https://github.com/heartcombo/devise) - Rails authentication solution
 - [jwt](https://github.com/jwt/ruby-jwt) - JSON Web Token implementation
-- [jwe](https://github.com/nov/jwe) - JSON Web Encryption
-- [openid_connect](https://github.com/nov/openid_connect) - OpenID Connect client
+- [jwe](https://rubygems.org/gems/jwe) - JSON Web Encryption (via `OmniauthOpenidFederation::Jwe`)
+- [oauth2](https://github.com/oauth-xx/oauth2) - OAuth 2.0 client (via `OmniauthOpenidFederation::OidcClient`)
 - [http](https://github.com/httprb/http) - HTTP client
 - [anyway_config](https://github.com/palkan/anyway_config) - Configuration management
 - [action_reporter](https://github.com/basecamp/action_reporter) - Error reporting
 
+## Links
+
+- [GitHub](https://github.com/amkisko/omniauth_openid_federation.rb)
+- [GitLab](https://gitlab.com/amkisko/omniauth_openid_federation.rb)
+- [RubyGems](https://rubygems.org/gems/omniauth_openid_federation)
+- [Versions Atom](https://rubygems.org/gems/omniauth_openid_federation/versions.atom) (feed id `10007301350098`)
+- [libraries.io](https://libraries.io/rubygems/omniauth_openid_federation)
+- [Deps.dev](https://deps.dev/rubygems/omniauth_openid_federation)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_omniauth_openid_federation.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/omniauth_openid_federation.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/omniauth_openid_federation.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/omniauth_openid_federation.rb)
+
 ## License
 
 MIT License. See [LICENSE.md](LICENSE.md) for details.
+
+## Sponsors
+
+Sponsored by [Kisko Labs](https://www.kiskolabs.com).
+
+<a href="https://www.kiskolabs.com">
+  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
+</a>

data/SECURITY.md

@@ -2,27 +2,24 @@
 
 ## Reporting a Vulnerability
 
-**Do NOT** open a public GitHub issue for security vulnerabilities.
+Email security details to: security@kiskolabs.com
 
-Email security details to: **security@kiskolabs.com**
-
-Include: description, steps to reproduce, potential impact, and suggested fix (if available).
+Send the report only to that address. Include description, steps to reproduce, potential impact, and a suggested fix when you have one.
 
 ### Response Timeline
 
-- We will acknowledge receipt of your report
-- We will provide an initial assessment
-- We will keep you informed of our progress and resolution timeline
+- We will acknowledge receipt of your report.
+- We will provide an initial assessment.
+- We will keep you informed of our progress and resolution timeline.
 
 ### Disclosure Policy
 
-- We will work with you to understand and resolve the issue
-- We will credit you for the discovery (unless you prefer to remain anonymous)
-- We will publish a security advisory after the vulnerability is patched
-- We will coordinate public disclosure with you
+- We will work with you to understand and resolve the issue.
+- We will credit you for the discovery unless you prefer to remain anonymous.
+- We will publish a security advisory after the vulnerability is patched.
+- We will coordinate public disclosure with you.
 
 ## Automation Security
 
-* **Context Isolation:** It is strictly forbidden to include production credentials, API keys, or Personally Identifiable Information (PII) in prompts sent to third-party LLMs or automation services.
-
-* **Supply Chain:** All automated dependencies must be verified.
+- Keep production credentials, API keys, and personal data out of prompts sent to third-party models or automation services.
+- Verify automated dependencies.

data/app/controllers/omniauth_openid_federation/federation_controller.rb

@@ -105,7 +105,7 @@ module OmniauthOpenidFederation
       jwks_to_serve = OmniauthOpenidFederation::FederationEndpoint.current_jwks
 
       # Apply server-side caching if available
-      cache_key = "federation:jwks:#{Digest::SHA256.hexdigest(jwks_to_serve.to_json)}"
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_jwks(config.issuer)
       cache_ttl = config.jwks_cache_ttl || 3600
 
       jwks_json = if OmniauthOpenidFederation::CacheAdapter.available?
@@ -144,7 +144,7 @@ module OmniauthOpenidFederation
       signed_jwks_jwt = OmniauthOpenidFederation::FederationEndpoint.generate_signed_jwks
 
       # Apply server-side caching if available
-      cache_key = "federation:signed_jwks:#{Digest::SHA256.hexdigest(signed_jwks_jwt)}"
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(config.issuer)
       cache_ttl = config.jwks_cache_ttl || 3600
 
       cached_jwt = if OmniauthOpenidFederation::CacheAdapter.available?

data/config/polyrun_coverage.yml

@@ -0,0 +1,15 @@
+# Polyrun::Coverage::Rails — loaded from spec/spec_helper via Polyrun::Coverage::Rails.start!
+# (must run before application code; keep coverage config here, not in initializers)
+#
+# Do not set track_files here: with track_files, Polyrun merges the full Coverage.result blob
+# (every loaded gem / dependency) before filtering, which dilutes the line % and breaks the gate.
+# Default track_under: ["lib"] keeps only this gem under the project root.
+
+track_under:
+  - lib
+reject_patterns:
+  - "/lib/tasks/"
+  - "/lib/omniauth_openid_federation/version.rb"
+  - "/spec/"
+minimum_line_percent: 80
+strict: true

data/config/polyrun_spec_quality.yml

@@ -0,0 +1,29 @@
+# Per-example spec quality (coverage deltas, resource use). See polyrun report-spec-quality.
+track_under:
+  - lib
+  - app
+ignore_paths:
+  - /lib/omniauth_openid_federation/version.rb
+  - /lib/tasks/
+min_line_churn: 40
+min_query_count: 15
+hot_line_example_overlap: 8
+strict: false
+sample: 1.0
+ignore_examples:
+  - version_spec.rb
+  - omniauth_openid_federation_spec.rb:2
+  - /handles missing URL/
+  - /handles configuration errors/
+  - /handles validation errors/
+  - /handles unexpected errors/
+  - /handles fetch errors/
+ignore_query_patterns: []
+profile:
+  - cpu
+  - mem
+sql_counter: true
+# CI gates (POLYRUN_SPEC_QUALITY_STRICT=1 or strict: true):
+# minimum_unique_lines_per_example: 1
+# max_zero_hit_examples: 0
+# max_hot_line_overlap: 100

data/examples/README_INTEGRATION_TESTING.md

@@ -145,6 +145,9 @@ This will:
 5. Run all integration tests
 6. Clean up (kill servers, remove tmp dirs) on exit
 
+CI runs the same flow on every push to `main` (see `.github/workflows/test.yml`, job `integration`).
+Locally: `make integration-test` or `bundle exec ruby examples/integration_test_flow.rb` (exits non-zero on failure).
+
 ### Manual Start (For Debugging)
 
 If you want to start servers manually for debugging:

data/examples/integration_test_flow.rb

@@ -42,7 +42,7 @@ require "securerandom"
 require "fileutils"
 require "timeout"
 require "open3"
-require "jwe"
+require_relative "../lib/omniauth_openid_federation"
 require "jwt"
 
 $LOAD_PATH.unshift(File.expand_path("../lib", __dir__))
@@ -272,7 +272,7 @@ class IntegrationTestFlow
     script_path = File.expand_path(script, __dir__)
     project_root = File.expand_path("..", __dir__)
 
-    # Use bundle exec to ensure all dependencies (jwt, jwe, etc.) are available
+    # Use bundle exec to ensure all dependencies (jwt, jwe, oauth2, etc.) are available
     pid = Process.spawn(
       {
         "RUBYOPT" => "-W0", # Suppress warnings
@@ -319,7 +319,7 @@ class IntegrationTestFlow
       attempt = 0
       ready = false
       server_name = url.include?("9292") ? "OP" : "RP"
-      start_time = Time.zone.now
+      start_time = OmniauthOpenidFederation::TimeHelpers.now
 
       while attempt < max_attempts && !ready
         begin
@@ -330,7 +330,7 @@ class IntegrationTestFlow
           response = http.get(uri.path)
 
           if response.code == "200"
-            elapsed = (Time.zone.now - start_time).round(1)
+            elapsed = (OmniauthOpenidFederation::TimeHelpers.now - start_time).round(1)
             puts "  ✓ #{url} is ready (#{elapsed}s)"
             ready = true
           end
@@ -342,7 +342,7 @@ class IntegrationTestFlow
           attempt += 1
           # Show progress every 5 attempts (1 second)
           if attempt % 5 == 0
-            elapsed = (Time.zone.now - start_time).round(1)
+            elapsed = (OmniauthOpenidFederation::TimeHelpers.now - start_time).round(1)
             print "."
           end
           sleep check_interval
@@ -350,7 +350,7 @@ class IntegrationTestFlow
       end
 
       unless ready
-        elapsed = (Time.zone.now - start_time).round(1)
+        elapsed = (OmniauthOpenidFederation::TimeHelpers.now - start_time).round(1)
         puts "\n  ✗ #{server_name} server at #{url} did not become ready in time (#{elapsed}s)"
         err_log = File.join(@tmp_dir, "#{server_name.downcase}_server_error.log")
         log_file = File.join(@tmp_dir, "#{server_name.downcase}_server.log")
@@ -679,7 +679,7 @@ class IntegrationTestFlow
 
       # Encrypt with wrong key (provider won't be able to decrypt with its key)
       signed_jwt = jws.sign
-      encrypted_request = JWE.encrypt(signed_jwt, wrong_key)
+      encrypted_request = OmniauthOpenidFederation::Jwe.encrypt(signed_jwt, wrong_key, alg: "RSA-OAEP", enc: "A128CBC-HS256")
 
       # Verify it's encrypted (JWE has 5 parts)
       parts = encrypted_request.split(".")
@@ -1261,6 +1261,8 @@ class IntegrationTestFlow
 
     puts ""
     puts (passed == @test_results.length) ? "✅ All tests passed!" : "❌ Some tests failed."
+
+    passed == @test_results.length
   end
 
   def cleanup
@@ -1330,5 +1332,5 @@ if __FILE__ == $0
   puts ""
 
   test_flow = IntegrationTestFlow.new
-  test_flow.run
+  exit(test_flow.run ? 0 : 1)
 end

data/examples/jobs/federation_cache_refresh_job.rb.example

@@ -32,14 +32,17 @@ class FederationCacheRefreshJob < ApplicationJob
 
     Rails.logger.info "[FederationCacheRefreshJob] Starting cache refresh..."
 
+    config = OmniauthOpenidFederation::FederationEndpoint.configuration
+
     # Clear all federation caches
     if Rails.cache.respond_to?(:delete_matched)
       Rails.cache.delete_matched("federation:*")
       Rails.logger.info "[FederationCacheRefreshJob] Cleared federation caches"
     else
       # Fallback: clear known cache keys
-      Rails.cache.delete("federation:jwks")
-      Rails.cache.delete("federation:signed_jwks")
+      issuer = config.issuer
+      Rails.cache.delete(OmniauthOpenidFederation::Cache.key_for_served_jwks(issuer))
+      Rails.cache.delete(OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(issuer))
       Rails.cache.delete("federation:entity_statement")
       Rails.logger.info "[FederationCacheRefreshJob] Cleared federation caches (fallback)"
     end
@@ -47,20 +50,17 @@ class FederationCacheRefreshJob < ApplicationJob
     # Optionally: Pre-warm caches by generating data
     # This ensures data is ready immediately after cache clear
     begin
-      config = OmniauthOpenidFederation::FederationEndpoint.configuration
-      
       # Pre-warm JWKS cache
       if config.current_jwks || config.current_jwks_proc
         jwks = OmniauthOpenidFederation::FederationEndpoint.current_jwks
-        cache_key = "federation:jwks:#{Digest::SHA256.hexdigest(jwks.to_json)}"
+        cache_key = OmniauthOpenidFederation::Cache.key_for_served_jwks(config.issuer)
         Rails.cache.write(cache_key, jwks.to_json, expires_in: config.jwks_cache_ttl || 3600)
         Rails.logger.info "[FederationCacheRefreshJob] Pre-warmed JWKS cache"
       end
 
       # Pre-warm signed JWKS cache
       signed_jwks = OmniauthOpenidFederation::FederationEndpoint.generate_signed_jwks
-      cache_key = "federation:signed_jwks:#{Digest::SHA256.hexdigest(signed_jwks)}"
-      config = OmniauthOpenidFederation::FederationEndpoint.configuration
+      cache_key = OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(config.issuer)
       Rails.cache.write(cache_key, signed_jwks, expires_in: config.jwks_cache_ttl || 3600)
       Rails.logger.info "[FederationCacheRefreshJob] Pre-warmed signed JWKS cache"
     rescue => e

data/examples/jobs/federation_files_generation_job.rb.example

@@ -72,8 +72,9 @@ class FederationFilesGenerationJob < ApplicationJob
       Rails.logger.info "[FederationFilesGenerationJob] Cleared federation caches"
     else
       # Fallback: clear known cache keys
-      Rails.cache.delete("federation:jwks")
-      Rails.cache.delete("federation:signed_jwks")
+      issuer = OmniauthOpenidFederation::FederationEndpoint.configuration.issuer
+      Rails.cache.delete(OmniauthOpenidFederation::Cache.key_for_served_jwks(issuer))
+      Rails.cache.delete(OmniauthOpenidFederation::Cache.key_for_served_signed_jwks(issuer))
       Rails.logger.info "[FederationFilesGenerationJob] Cleared federation caches (fallback)"
     end
 

data/examples/mock_op_server.rb

@@ -37,7 +37,6 @@ require "webrick"
 require "yaml"
 require "json"
 require "jwt"
-require "jwe"
 require "openssl"
 require "base64"
 require "uri"
@@ -111,7 +110,7 @@ class MockOPServer
   end
 
   def self.load_signing_key(key_data)
-    if key_data.blank?
+    if OmniauthOpenidFederation::StringHelpers.blank?(key_data)
       # Generate a new key for testing
       OpenSSL::PKey::RSA.new(2048)
     elsif key_data.is_a?(String)
@@ -126,7 +125,7 @@ class MockOPServer
   end
 
   def self.load_encryption_key(key_data)
-    return nil if key_data.blank?
+    return nil if OmniauthOpenidFederation::StringHelpers.blank?(key_data)
     load_signing_key(key_data)
   end
 
@@ -478,7 +477,7 @@ class MockOPServer
         redirect_uri: redirect_uri,
         state: state,
         nonce: nonce,
-        created_at: Time.zone.now
+        created_at: OmniauthOpenidFederation::TimeHelpers.now
       }
 
       # Redirect back to RP with authorization code
@@ -566,7 +565,7 @@ class MockOPServer
 
         # Try to decrypt - will fail if wrong key was used
         begin
-          request_jwt = JWE.decrypt(request_jwt, MockOPServer::ENCRYPTION_KEY)
+          request_jwt = OmniauthOpenidFederation::Jwe.decrypt(request_jwt, MockOPServer::ENCRYPTION_KEY)
         rescue => e
           raise OmniauthOpenidFederation::DecryptionError, "Failed to decrypt request object: #{e.message}"
         end

data/examples/mock_rp_server.rb

@@ -66,7 +66,7 @@ class MockRPServer
   end
 
   def self.load_signing_key(key_data)
-    if key_data.blank?
+    if OmniauthOpenidFederation::StringHelpers.blank?(key_data)
       OpenSSL::PKey::RSA.new(2048)
     elsif key_data.is_a?(String)
       if key_data.include?("BEGIN")
@@ -80,7 +80,7 @@ class MockRPServer
   end
 
   def self.load_encryption_key(key_data)
-    return nil if key_data.blank?
+    return nil if OmniauthOpenidFederation::StringHelpers.blank?(key_data)
     load_signing_key(key_data)
   end
 
@@ -297,7 +297,7 @@ class MockRPServer
         provider_entity_id: provider_entity_id,
         redirect_uri: redirect_uri,
         nonce: nonce,
-        created_at: Time.zone.now
+        created_at: OmniauthOpenidFederation::TimeHelpers.now
       }
 
       # Step 5: Redirect to provider