omniauth_openid_federation 1.3.2 → 2.1.0

data/lib/omniauth_openid_federation/federation/entity_statement.rb

@@ -1,4 +1,3 @@
-require "net/http"
 require "digest"
 require "jwt"
 require "base64"
@@ -94,9 +93,6 @@ module OmniauthOpenidFederation
       # @raise [FetchError] If fetching fails
       # @raise [ValidationError] If validation fails
       def self.fetch!(url, fingerprint: nil, previous_statement: nil, timeout: 10)
-        # Use HttpClient for retry logic and configurable SSL verification
-        # Note: HttpClient uses HTTP gem, but entity statements might need Net::HTTP
-        # For now, we'll use a simple HTTP.get approach with HttpClient's retry logic
         begin
           # Convert URL to URI for HttpClient
           response = HttpClient.get(url, timeout: timeout)

data/lib/omniauth_openid_federation/federation/entity_statement_validator.rb

@@ -39,9 +39,13 @@ module OmniauthOpenidFederation
       # @param issuer_entity_configuration [Hash, EntityStatement, nil] Optional: Entity Configuration of the issuer
       #   Required for validating Subordinate Statements (when iss != sub)
       # @param clock_skew_tolerance [Integer, nil] Clock skew tolerance in seconds (default: from config)
-      def initialize(jwt_string:, issuer_entity_configuration: nil, clock_skew_tolerance: nil)
+      def initialize(jwt_string:, issuer_entity_configuration: nil, subject_entity_configuration: nil, clock_skew_tolerance: nil)
         @jwt_string = jwt_string
         @issuer_entity_configuration = issuer_entity_configuration
+        # Subject Entity Configuration supplies authority_hints for Subordinate Statements.
+        # When omitted, issuer_entity_configuration is used for backward compatibility with
+        # callers that historically passed the subject config under that name.
+        @subject_entity_configuration = subject_entity_configuration
         @clock_skew_tolerance = clock_skew_tolerance || OmniauthOpenidFederation.config.clock_skew_tolerance
         @header = nil
         @payload = nil
@@ -153,32 +157,42 @@ module OmniauthOpenidFederation
         @is_subordinate_statement = !@is_entity_configuration
       end
 
-      # Step 7: For Subordinate Statements, validate iss matches authority_hints
+      # Step 7: For Subordinate Statements, validate iss matches subject's authority_hints
       def validate_authority_hints
-        unless @issuer_entity_configuration
-          # If issuer configuration not provided, we can't validate authority_hints
-          # This is acceptable for basic validation, but should be done for full validation
-          OmniauthOpenidFederation::Logger.warn("[EntityStatementValidator] Cannot validate authority_hints: issuer entity configuration not provided")
+        subject_source = @subject_entity_configuration || @issuer_entity_configuration
+        unless subject_source
+          OmniauthOpenidFederation::Logger.warn("[EntityStatementValidator] Cannot validate authority_hints: subject entity configuration not provided")
           return
         end
 
-        issuer_config = if @issuer_entity_configuration.is_a?(Hash)
-          @issuer_entity_configuration
-        elsif @issuer_entity_configuration.respond_to?(:parse)
-          @issuer_entity_configuration.parse
-        else
-          raise ValidationError, "Invalid issuer entity configuration format"
-        end
-
-        authority_hints = issuer_config[:claims]&.fetch("authority_hints", []) ||
-          issuer_config["claims"]&.fetch("authority_hints", []) ||
-          issuer_config.fetch("authority_hints", [])
+        subject_config = normalize_entity_configuration_hash(subject_source)
+        authority_hints = extract_authority_hints_from_config(subject_config)
 
         unless authority_hints.is_a?(Array) && authority_hints.include?(@payload["iss"])
           raise ValidationError, "Subordinate Statement issuer '#{@payload["iss"]}' MUST be listed in the authority_hints array of the subject's Entity Configuration"
         end
       end
 
+      def normalize_entity_configuration_hash(config)
+        if config.is_a?(Hash)
+          config
+        elsif config.respond_to?(:parse)
+          config.parse
+        else
+          raise ValidationError, "Invalid entity configuration format"
+        end
+      end
+
+      def extract_authority_hints_from_config(config)
+        claims = config[:claims] || config["claims"]
+        if claims.is_a?(Hash)
+          hints = claims[:authority_hints] || claims["authority_hints"]
+          return hints if hints
+        end
+
+        config[:authority_hints] || config["authority_hints"] || []
+      end
+
       def validate_iat_claim
         iat = @payload["iat"]
         if iat.nil?
@@ -319,10 +333,8 @@ module OmniauthOpenidFederation
         unknown_claims = crit - standard_claims
 
         if unknown_claims.any?
-          # For now, we'll log a warning but not reject
-          # In a strict implementation, we should reject if we don't understand the claims
-          # Future enhancement: Add strict_mode option to reject unknown crit claims
-          OmniauthOpenidFederation::Logger.warn("[EntityStatementValidator] Entity statement contains crit claim with unknown claims: #{unknown_claims.join(", ")}. These claims MUST be understood and processed.")
+          raise ValidationError,
+            "Entity statement crit claim contains unknown claims that MUST be understood: #{unknown_claims.join(", ")}"
         end
       end
 

data/lib/omniauth_openid_federation/federation/signed_jwks.rb

@@ -1,4 +1,3 @@
-require "http"
 require "jwt"
 require "base64"
 require "openssl"
@@ -61,7 +60,10 @@ module OmniauthOpenidFederation
       # @raise [FetchError] If fetching fails
       # @raise [ValidationError] If validation fails
       def self.fetch!(signed_jwks_uri, entity_jwks, cache_key: nil, cache_ttl: nil, force_refresh: false)
-        cache_key ||= OmniauthOpenidFederation::Cache.key_for_signed_jwks(signed_jwks_uri)
+        cache_key ||= OmniauthOpenidFederation::Cache.key_for_signed_jwks(
+          signed_jwks_uri,
+          entity_jwks: entity_jwks
+        )
         config = OmniauthOpenidFederation::Configuration.config
         cache_ttl ||= config.cache_ttl
         rotate_on_errors = config.rotate_on_errors

data/lib/omniauth_openid_federation/federation/trust_chain_resolver.rb

@@ -1,3 +1,9 @@
+require_relative "trust_chain_signature"
+
+require "cgi"
+require "json"
+require "base64"
+require "jwt"
 require_relative "entity_statement"
 require_relative "entity_statement_validator"
 require_relative "../http_client"
@@ -5,7 +11,7 @@ require_relative "../logger"
 require_relative "../errors"
 require_relative "../utils"
 require_relative "../string_helpers"
-require "cgi"
+require_relative "../key_extractor"
 
 # Trust Chain Resolver for OpenID Federation 1.0
 # @see https://openid.net/specs/openid-federation-1_0.html#section-10 Section 10: Trust Chain Resolution
@@ -33,6 +39,8 @@ module OmniauthOpenidFederation
     #
     # Resolves and validates trust chains from a Leaf Entity to a Trust Anchor.
     class TrustChainResolver
+      include TrustChainSignature
+
       # Initialize resolver
       #
       # @param leaf_entity_id [String] Entity Identifier of the Leaf Entity
@@ -49,6 +57,7 @@ module OmniauthOpenidFederation
         @timeout = timeout
         @resolved_statements = []
         @visited_entities = Set.new
+        @entity_configurations = {}
       end
 
       # Resolve the trust chain
@@ -67,7 +76,7 @@ module OmniauthOpenidFederation
         current_entity_id = @leaf_entity_id
         current_config = leaf_config
 
-        while current_config && !is_trust_anchor?(current_config)
+        while current_config && !trust_anchor_for(current_entity_id)
           authority_hints = extract_authority_hints(current_config)
 
           if StringHelpers.blank?(authority_hints)
@@ -83,13 +92,22 @@ module OmniauthOpenidFederation
             end
 
             begin
+              issuer_config = fetch_entity_configuration(authority_id)
+              validate_entity_statement(issuer_config, nil)
+
               subordinate_statement = fetch_subordinate_statement(
                 issuer: authority_id,
-                subject: current_entity_id
+                subject: current_entity_id,
+                issuer_config: issuer_config
               )
 
-              issuer_config = fetch_entity_configuration(authority_id)
-              validate_entity_statement(subordinate_statement, issuer_config)
+              validate_entity_statement(
+                subordinate_statement,
+                issuer_config,
+                subject_config: current_config,
+                expected_issuer: authority_id,
+                expected_subject: current_entity_id
+              )
 
               @resolved_statements << subordinate_statement
               @visited_entities.add(authority_id)
@@ -98,7 +116,8 @@ module OmniauthOpenidFederation
               current_config = issuer_config
               found_next = true
               break
-            rescue ValidationError, FetchError => e
+            rescue ValidationError, FetchError, SignatureError => e
+              @visited_entities.add(authority_id)
               OmniauthOpenidFederation::Logger.warn("[TrustChainResolver] Failed to resolve via #{authority_id}: #{e.message}")
               OmniauthOpenidFederation::Instrumentation.notify_trust_chain_validation_failed(
                 entity_id: current_entity_id,
@@ -116,7 +135,7 @@ module OmniauthOpenidFederation
           end
         end
 
-        unless is_trust_anchor?(current_config)
+        unless trust_anchor_for(current_entity_id)
           error_msg = "Trust chain did not terminate at a configured Trust Anchor"
           OmniauthOpenidFederation::Instrumentation.notify_trust_chain_validation_failed(
             entity_id: @leaf_entity_id,
@@ -143,18 +162,32 @@ module OmniauthOpenidFederation
       end
 
       def fetch_entity_configuration(entity_id)
+        return @entity_configurations[entity_id] if @entity_configurations.key?(entity_id)
+
         entity_statement_url = OmniauthOpenidFederation::Utils.build_entity_statement_url(entity_id)
         OmniauthOpenidFederation::Logger.debug("[TrustChainResolver] Fetching Entity Configuration from: #{entity_statement_url}")
 
         begin
-          EntityStatement.fetch!(entity_statement_url, timeout: @timeout)
+          config = EntityStatement.fetch!(entity_statement_url, timeout: @timeout)
+          assert_entity_configuration_ids!(config, entity_id)
+          @entity_configurations[entity_id] = config
         rescue OmniauthOpenidFederation::NetworkError => e
           raise FetchError, "Failed to fetch entity configuration from #{entity_statement_url}: #{e.message}"
         end
       end
 
-      def fetch_subordinate_statement(issuer:, subject:)
-        issuer_config = fetch_entity_configuration(issuer)
+      def assert_entity_configuration_ids!(config, expected_entity_id)
+        parsed = config.parse
+        iss = entity_issuer(parsed)
+        sub = field(parsed, :sub)
+
+        unless iss == expected_entity_id && sub == expected_entity_id
+          raise ValidationError,
+            "Entity configuration iss/sub must equal requested entity id '#{expected_entity_id}' (iss=#{iss}, sub=#{sub})"
+        end
+      end
+
+      def fetch_subordinate_statement(issuer:, subject:, issuer_config:)
         fetch_endpoint = extract_fetch_endpoint(issuer_config)
 
         unless fetch_endpoint
@@ -178,10 +211,17 @@ module OmniauthOpenidFederation
       end
 
       def extract_fetch_endpoint(entity_config)
-        # Fetch endpoint is typically at /.well-known/openid-federation/fetch
-        # or can be specified in metadata
         parsed = entity_config.parse
-        issuer = parsed[:issuer] || parsed[:iss] || parsed["issuer"] || parsed["iss"]
+        payload = entity_config.decode_payload
+        metadata = field(payload, :metadata) || {}
+        federation_entity = field(metadata, :federation_entity) || {}
+        openid_provider = field(metadata, :openid_provider) || {}
+
+        endpoint = field(federation_entity, :federation_fetch_endpoint) || field(openid_provider, :federation_fetch_endpoint)
+
+        return endpoint if StringHelpers.present?(endpoint)
+
+        issuer = entity_issuer(parsed)
         return nil unless issuer
 
         "#{issuer}/.well-known/openid-federation/fetch"
@@ -192,21 +232,46 @@ module OmniauthOpenidFederation
         parsed[:authority_hints] || parsed["authority_hints"]
       end
 
-      def validate_entity_statement(statement, issuer_config)
+      def validate_entity_statement(statement, issuer_config, subject_config: nil, expected_issuer: nil, expected_subject: nil)
         validator = EntityStatementValidator.new(
           jwt_string: statement.entity_statement,
-          issuer_entity_configuration: issuer_config
+          issuer_entity_configuration: issuer_config,
+          subject_entity_configuration: subject_config
         )
         validator.validate!
+
+        if expected_issuer || expected_subject
+          parsed = statement.parse
+          iss = entity_issuer(parsed)
+          sub = parsed[:sub] || parsed["sub"]
+
+          if expected_issuer && iss != expected_issuer
+            raise ValidationError, "Subordinate statement iss '#{iss}' does not match expected issuer '#{expected_issuer}'"
+          end
+          if expected_subject && sub != expected_subject
+            raise ValidationError, "Subordinate statement sub '#{sub}' does not match expected subject '#{expected_subject}'"
+          end
+        end
+
+        verify_entity_statement_signature!(statement, issuer_config)
+      end
+
+      def normalize_jwks(jwks)
+        return {} if jwks.nil?
+        return jwks if jwks.is_a?(Hash)
+        return {"keys" => jwks} if jwks.is_a?(Array)
+
+        {}
+      end
+
+      def trust_anchor_for(entity_id)
+        @trust_anchors.find { |ta| ta[:entity_id] == entity_id }
       end
 
       def is_trust_anchor?(entity_config)
         parsed = entity_config.parse
-        entity_id = parsed[:issuer] || parsed[:iss] || parsed["issuer"] || parsed["iss"]
-
-        @trust_anchors.any? do |ta|
-          ta[:entity_id] == entity_id
-        end
+        entity_id = entity_issuer(parsed)
+        !trust_anchor_for(entity_id).nil?
       end
     end
   end

data/lib/omniauth_openid_federation/federation/trust_chain_signature.rb

@@ -0,0 +1,62 @@
+module OmniauthOpenidFederation
+  module Federation
+    module TrustChainSignature
+      private
+
+      def verify_entity_statement_signature!(statement, issuer_config)
+        jwt_string = statement.entity_statement
+        kid, algorithm = signature_header(jwt_string)
+        public_key = signing_public_key(statement, issuer_config, kid)
+        ::JWT.decode(jwt_string, public_key, true, {algorithm: algorithm})
+      rescue ::JWT::DecodeError, ::JWT::VerificationError => e
+        error_msg = "Entity statement signature validation failed: #{e.class} - #{e.message}"
+        OmniauthOpenidFederation::Logger.error("[TrustChainResolver] #{error_msg}")
+        raise SignatureError, error_msg, e.backtrace
+      end
+
+      def signature_header(jwt_string)
+        parts = jwt_string.split(".")
+        if parts.length != EntityStatementValidator::JWT_PARTS_COUNT
+          raise ValidationError, "Invalid JWT format: expected #{EntityStatementValidator::JWT_PARTS_COUNT} parts, got #{parts.length}"
+        end
+
+        header = JSON.parse(Base64.urlsafe_decode64(parts[0]))
+        kid = field(header, :kid)
+        algorithm = field(header, :alg) || "RS256"
+
+        unless EntityStatementValidator::SUPPORTED_ALGORITHMS.include?(algorithm)
+          raise ValidationError, "Unsupported entity statement algorithm: #{algorithm}"
+        end
+
+        [kid, algorithm]
+      end
+
+      def signing_public_key(statement, issuer_config, kid)
+        signing_keys = issuer_signing_keys(statement, issuer_config)
+        keys = field(signing_keys, :keys) || []
+        signing_key_data = keys.find { |key| field(key, :kid) == kid }
+        unless signing_key_data
+          raise ValidationError, "Signing key with kid '#{kid}' not found in issuer JWKS for signature verification"
+        end
+
+        OmniauthOpenidFederation::KeyExtractor.jwk_to_openssl_key(signing_key_data)
+      end
+
+      def issuer_signing_keys(statement, issuer_config)
+        parsed = (issuer_config || statement).parse
+        trust_anchor = trust_anchor_for(entity_issuer(parsed))
+        return normalize_jwks(trust_anchor[:jwks]) if trust_anchor
+
+        field(parsed, :jwks) || {}
+      end
+
+      def entity_issuer(parsed)
+        parsed[:issuer] || parsed[:iss] || parsed["issuer"] || parsed["iss"]
+      end
+
+      def field(hash, key)
+        hash[key] || hash[key.to_s]
+      end
+    end
+  end
+end

data/lib/omniauth_openid_federation/federation_endpoint.rb

@@ -462,7 +462,7 @@ module OmniauthOpenidFederation
       #     end
       #   end
       def rack_app
-        require_relative "rack_endpoint"
+        require_relative "rack"
         RackEndpoint.new
       end
 

data/lib/omniauth_openid_federation/http_client.rb

@@ -1,8 +1,19 @@
+require "http"
+require "openssl"
 require_relative "constants"
 
 # HTTP client with retry logic and SSL configuration
 module OmniauthOpenidFederation
   class HttpClient
+    RETRYABLE_ERRORS = [
+      HTTP::Error,
+      Timeout::Error,
+      Errno::ECONNREFUSED,
+      Errno::ETIMEDOUT
+    ].freeze
+
+    RETRYABLE_HTTP_STATUS_CODES = [429, 502, 503].freeze
+
     # Execute an HTTP GET request with retry logic
     #
     # @param uri [String, URI] The URI to fetch
@@ -10,61 +21,200 @@ module OmniauthOpenidFederation
     # @option options [Integer] :max_retries Maximum number of retries (default: from config)
     # @option options [Integer] :retry_delay Base retry delay in seconds (default: from config)
     # @option options [Integer] :timeout Request timeout in seconds (default: from config)
+    # @option options [Integer] :connect_timeout Connect timeout in seconds
+    # @option options [Integer] :read_timeout Read timeout in seconds
+    # @option options [Hash] :headers Request headers
     # @return [HTTP::Response] The HTTP response
     # @raise [NetworkError] If the request fails after all retries
     def self.get(uri, options = {})
-      max_retries = options[:max_retries] || Configuration.config.max_retries
-      retry_delay = options[:retry_delay] || Configuration.config.retry_delay
-      timeout = options[:timeout] || Configuration.config.http_timeout
+      request(:get, uri, options)
+    end
+
+    # Execute an HTTP POST request with retry logic
+    #
+    # POST defaults to max_retries: 0 because retries are not safe for non-idempotent requests.
+    # Pass max_retries explicitly when duplicate POST attempts are acceptable.
+    #
+    # @param uri [String, URI] The URI to post to
+    # @param options [Hash] Request options (same as get, plus :form)
+    # @option options [Hash] :form Form parameters
+    # @return [HTTP::Response] The HTTP response
+    # @raise [NetworkError] If the request fails after all retries
+    def self.post(uri, options = {})
+      request(:post, uri, options)
+    end
 
-      http_client = build_http_client(timeout)
+    def self.request(method, uri, options = {})
+      max_retries = max_retries_for(options, method)
+      retry_delay = options[:retry_delay] || Configuration.config.retry_delay
+      http_client = build_http_client(resolve_timeout(options))
+      headers = options[:headers] || {}
+      form = options[:form]
+      max_attempts = max_retries + 1
 
       retries = 0
-      begin
-        http_client.get(uri)
-      rescue HTTP::Error, Timeout::Error, Errno::ECONNREFUSED, Errno::ETIMEDOUT => e
-        retries += 1
-        if retries > max_retries
-          error_msg = "Failed to fetch #{uri} after #{max_retries} retries: #{e.class} - #{e.message}"
-          OmniauthOpenidFederation::Logger.error("[HttpClient] #{error_msg}")
-          raise OmniauthOpenidFederation::NetworkError, error_msg, e.backtrace
+
+      loop do
+        response = perform_request(http_client, headers, method, uri, form)
+
+        if should_retry_for_status?(method, response, retries, max_retries)
+          retries = retry_after_status(response, retries, max_attempts, retry_delay)
+          next
         end
 
-        delay = [retry_delay * retries, Constants::MAX_RETRY_DELAY_SECONDS].min
-        OmniauthOpenidFederation::Logger.warn("[HttpClient] Request failed (attempt #{retries}/#{max_retries}), retrying in #{delay}s: #{e.message}")
-        sleep(delay)
-        retry
+        return enforce_body_limit!(response)
+      rescue *RETRYABLE_ERRORS => error
+        retries = handle_network_error(method, uri, error, retries, max_retries, max_attempts, retry_delay)
       end
     end
 
-    # Build HTTP client with SSL configuration
-    #
-    # @param timeout [Integer] Request timeout in seconds
-    # @return [HTTP::Client] Configured HTTP client
-    def self.build_http_client(timeout)
-      http_options_hash = build_http_options_hash || {}
-      http_options = HTTP::Options.new(http_options_hash)
-      HTTP::Client.new(http_options).timeout(timeout)
+    def self.enforce_body_limit!(response)
+      max_bytes = Constants::MAX_HTTP_RESPONSE_BODY_BYTES
+      content_length = response.headers&.[]("Content-Length") || response.headers&.[]("content-length")
+      if content_length && content_length.to_i > max_bytes
+        raise OmniauthOpenidFederation::NetworkError,
+          "HTTP response Content-Length exceeds limit (#{max_bytes} bytes)"
+      end
+
+      response = buffer_streamed_response(response, max_bytes) if response.body.is_a?(HTTP::Response::Body)
+      body = response.body
+      size = if body.respond_to?(:bytesize)
+        body.bytesize
+      else
+        body.to_s.bytesize
+      end
+
+      if size > max_bytes
+        raise OmniauthOpenidFederation::NetworkError,
+          "HTTP response body exceeds limit (#{max_bytes} bytes)"
+      end
+      response
+    end
+
+    def self.buffer_streamed_response(response, max_bytes)
+      contents = String.new(encoding: response.body.encoding)
+      response.body.each do |chunk|
+        if contents.bytesize + chunk.bytesize > max_bytes
+          response.connection.close
+          raise OmniauthOpenidFederation::NetworkError, "HTTP response body exceeds limit (#{max_bytes} bytes)"
+        end
+        contents << chunk
+      end
+      HTTP::Response.new(status: response.status.code, version: response.version,
+        headers: response.headers, proxy_headers: response.proxy_headers,
+        request: response.request, body: contents)
+    end
+
+    def self.perform_request(http_client, headers, method, uri, form)
+      client = http_client
+      client = client.headers(headers) unless headers.empty?
+
+      case method
+      when :get
+        client.get(uri)
+      when :post
+        client.post(uri, form: form || {})
+      else
+        raise ArgumentError, "Unsupported HTTP method: #{method}"
+      end
+    end
+
+    def self.should_retry_for_status?(method, response, retries, max_retries)
+      method == :get && retryable_http_status?(response.status.code) && retries < max_retries
+    end
+
+    def self.retry_after_status(response, retries, max_attempts, retry_delay)
+      retries += 1
+      delay = retry_delay_for(retries, retry_delay)
+      OmniauthOpenidFederation::Logger.warn(
+        "[HttpClient] HTTP #{response.status.code} on attempt #{retries}/#{max_attempts}, retrying in #{delay}s"
+      )
+      sleep(delay)
+      retries
+    end
+
+    def self.handle_network_error(method, uri, error, retries, max_retries, max_attempts, retry_delay)
+      retries += 1
+      if retries > max_retries
+        error_message = "Failed to #{method.to_s.upcase} #{uri} after #{max_attempts} attempts: #{error.class} - #{error.message}"
+        OmniauthOpenidFederation::Logger.error("[HttpClient] #{error_message}")
+        raise OmniauthOpenidFederation::NetworkError, error_message, error.backtrace
+      end
+
+      delay = retry_delay_for(retries, retry_delay)
+      OmniauthOpenidFederation::Logger.warn(
+        "[HttpClient] Request failed on attempt #{retries}/#{max_attempts}, retrying in #{delay}s: #{error.message}"
+      )
+      sleep(delay)
+      retries
+    end
+
+    def self.build_http_client(timeout_config)
+      http_options = HTTP::Options.new(build_http_options_hash)
+      HTTP::Client.new(http_options).timeout(timeout_config)
     end
 
-    # Build HTTP options hash from configuration
-    #
-    # @return [Hash, nil] HTTP options hash or nil
     def self.build_http_options_hash
       config = Configuration.config
-
-      # If http_options is configured, use it (can be Hash or Proc)
-      if config.http_options
+      user_options = if config.http_options
         if config.http_options.is_a?(Proc)
           config.http_options.call
         else
           config.http_options
         end
       end
+
+      options = (user_options || {}).dup
+      options[:ssl] = (options[:ssl] || {}).dup
+      options[:ssl][:verify_mode] ||= ssl_verify_mode(config.verify_ssl)
+      if options[:ssl][:verify_mode] == OpenSSL::SSL::VERIFY_PEER && !options[:ssl][:ca_file]
+        ca_file = ssl_ca_file
+        options[:ssl][:ca_file] = ca_file if ca_file
+      end
+      options
+    end
+
+    def self.ssl_verify_mode(verify_ssl)
+      verify_ssl ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
+    end
+
+    def self.ssl_ca_file
+      if ENV["SSL_CERT_FILE"] && File.file?(ENV["SSL_CERT_FILE"])
+        ENV["SSL_CERT_FILE"]
+      elsif File.exist?(OpenSSL::X509::DEFAULT_CERT_FILE)
+        OpenSSL::X509::DEFAULT_CERT_FILE
+      end
+    end
+
+    def self.max_retries_for(options, method)
+      return options[:max_retries] if options.key?(:max_retries)
+
+      (method == :post) ? 0 : Configuration.config.max_retries
+    end
+
+    def self.resolve_timeout(options)
+      default_timeout = Configuration.config.http_timeout
+
+      if options[:connect_timeout] || options[:read_timeout]
+        {
+          connect: options[:connect_timeout] || default_timeout,
+          read: options[:read_timeout] || default_timeout
+        }
+      else
+        options[:timeout] || default_timeout
+      end
     end
 
-    private_class_method :build_http_options_hash
+    def self.retryable_http_status?(status_code)
+      RETRYABLE_HTTP_STATUS_CODES.include?(status_code)
+    end
+
+    def self.retry_delay_for(retry_count, base_delay)
+      [base_delay * retry_count, Constants::MAX_RETRY_DELAY_SECONDS].min
+    end
 
-    private_class_method :build_http_client
+    private_class_method :request, :perform_request, :should_retry_for_status?, :retry_after_status,
+      :handle_network_error, :build_http_client, :build_http_options_hash, :ssl_verify_mode, :ssl_ca_file,
+      :max_retries_for, :resolve_timeout, :retryable_http_status?, :retry_delay_for, :enforce_body_limit!, :buffer_streamed_response
   end
 end

data/lib/omniauth_openid_federation/http_errors.rb

@@ -0,0 +1,14 @@
+module OmniauthOpenidFederation
+  class HttpError < Error
+    attr_reader :response
+
+    def initialize(status, message = nil, response = nil)
+      @response = response
+      super(message || "HTTP error #{status}")
+    end
+  end
+
+  class BadRequest < HttpError; end
+  class Unauthorized < HttpError; end
+  class Forbidden < HttpError; end
+end

data/lib/omniauth_openid_federation/id_token.rb

@@ -0,0 +1,19 @@
+module OmniauthOpenidFederation
+  class IdToken
+    CLAIM_READERS = %i[iss sub aud exp iat nonce acr auth_time amr].freeze
+
+    attr_reader :raw_attributes
+
+    def initialize(raw_attributes)
+      @raw_attributes = raw_attributes.each_with_object({}) do |(key, value), claims|
+        claims[key.to_sym] = value
+      end
+    end
+
+    CLAIM_READERS.each do |claim_name|
+      define_method(claim_name) do
+        raw_attributes[claim_name]
+      end
+    end
+  end
+end