omniauth_openid_federation 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed139d6baa665a3a7dce282bed397079492844cef7b45de0b5787edf3de9284e
-  data.tar.gz: c4d1f5e957c5aa2340d8cd223bfe1c591ed8b85f79417f775468868a54e4d465
+  metadata.gz: da45b4e4b8bb24f3b4191c0a3c297e23dad26f3d89ffefaceebc0b225117dc59
+  data.tar.gz: 1f8f747bc2f5815fc0d9b2005fa21a2c542dc08f6b3f223072cc7b9e95f0f089
 SHA512:
-  metadata.gz: bb56e08a749c63510e1d1456766ed2375827cb41f4171e25fbc260a5e06563fd59559fed10c7cf95ccdf7893a70d1567a8372fbda13c454fa7be765ae775db0d
-  data.tar.gz: 576b586169d64ba1b4989db48badd0cb1da1f145336e0786dabd8b41770344b9a19b0c43b4a28859738f0d72c63fb985069372868d41fcb64665ab6821cfcf4b
+  metadata.gz: 16d2a33e35399bc802f47e6f7d69e7995a20781024bfb22e7d938f8035069dc5f4bfb4a62c0de5aa4a1a42842472e7c19d4bacea342c5cad9cd92d81d59f0d90
+  data.tar.gz: efec81bf4ec61d381ee7c03f2dc5e598c9d4d47a7768847f4353c746849cc141b339f301f9f99c3e5f8758d43248bd2682fc7c70fa2df612620f4f6805e878da

data/CHANGELOG.md

@@ -1,5 +1,24 @@
 # CHANGELOG
 
+## Unreleased
+
+## 2.1.0 (2026-10-29)
+
+- BREAKING: Require Ruby `>= 3.4` (gemspec); drop Rails 6 and TruffleRuby appraisal targets from the tested matrix
+- Fix trust chain resolution to bind fetched entity configurations to the requested entity id and verify trust-anchor statements with pinned `trust_anchors[].jwks`
+- Fix `EntityStatementValidator` authority_hints checks to use the subject entity configuration (`subject_entity_configuration:`)
+- Fix UserInfo merge so `sub` must match the ID token and identity claims (`iss`, `sub`, `aud`, `exp`, `iat`) stay from the ID token
+- Fix signed JWKS handling to fail closed on signature, validation, and fetch errors instead of falling back to unsigned `jwks_uri`
+- Fix signed JWKS cache keys to include the verifying `entity_jwks` digest
+- Fix OAuth callback to validate `state` before handling authorization `error` responses
+- Fix configured `entity_statement_path` missing-file handling to raise `ConfigurationError` instead of silent network fallback
+- Fix endpoint resolution so configured entity-statement files under `Dir.tmpdir` are not deleted after resolve
+- Fix `client_entity_statement_url` so `load_client_entity_statement` fetches from the URL
+- Fix `Utils.validate_file_path!` allowed-directory checks to require a path-separator boundary
+- Stop streaming HTTP responses at the configured byte limit and close oversized responses before buffering the remaining body
+- Add `rfcs/` starter pack: process (RFC 0001), positioning (RFC 0002), and Standards Track design RFCs 0003–0006 for strategy, trust chain, token verification, and federation endpoint
+- Document Ruby `>= 3.4` in README requirements
+
 ## 2.0.0 (2026-07-06)
 
 - BREAKING: Replace `openid_connect` and `json-jwt` with `OmniauthOpenidFederation::OidcClient`, `AccessToken`, and `IdToken` built on `oauth2` and `jwt`

data/README.md

@@ -1,9 +1,11 @@
 # omniauth_openid_federation
 
-[![Gem Version](https://badge.fury.io/rb/omniauth_openid_federation.svg?v=1.1.0)](https://badge.fury.io/rb/omniauth_openid_federation) [![Test Status](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb/graph/badge.svg?token=CX3O9M1GIT)](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_omniauth_openid_federation.rb&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=amkisko_omniauth_openid_federation.rb)
+[![Gem Version](https://badge.fury.io/rb/omniauth_openid_federation.svg?v=1.1.0)](https://badge.fury.io/rb/omniauth_openid_federation) [![Test Status](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/omniauth_openid_federation.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/omniauth_openid_federation.rb/graph/badge.svg?token=CX3O9M1GIT)](https://app.codecov.io/github/amkisko/omniauth_openid_federation.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_omniauth_openid_federation.rb&metric=alert_status)](https://sonarcloud.io/project/overview?id=amkisko_omniauth_openid_federation.rb)
 
 OmniAuth strategy for OpenID Federation providers with comprehensive security features, supporting signed request objects, ID token encryption, and full OpenID Federation 1.0 compliance.
 
+Design changes go through `rfcs/` (RFC 0001).
+
 ## Installation
 
 ```ruby
@@ -471,8 +473,8 @@ rake openid_federation:test_authentication_flow[
 
 ## Requirements
 
-- Ruby >= 3.0
-- Rails >= 6.1 (or compatible Rack application)
+- Ruby >= 3.4
+- Rails >= 7.2 (or compatible Rack application; see Appraisal gemfiles)
 - OpenSSL (for RSA key operations)
 
 ## Example Files
@@ -492,7 +494,7 @@ bundle install
 bundle exec polyrun parallel-rspec --workers 5 -c polyrun.yml
 ```
 
-Same flow as CI; optional wrappers [`bin/rspec_parallel`](bin/rspec_parallel) and [`bin/appraisals`](bin/appraisals) (runs **`polyrun parallel-rspec`** per Appraisal gemfile). Details: **[POLYRUN.md](POLYRUN.md)**.
+Same flow as CI; optional wrappers [`bin/rspec_parallel`](bin/rspec_parallel) and [`bin/appraisals`](bin/appraisals) (runs **`polyrun parallel-rspec`** per Appraisal gemfile). Details: **[spec/README.md](spec/README.md)** and **`polyrun.yml`**.
 
 ## Contributing
 
@@ -517,6 +519,19 @@ Contributions welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for guidel
 - [anyway_config](https://github.com/palkan/anyway_config) - Configuration management
 - [action_reporter](https://github.com/basecamp/action_reporter) - Error reporting
 
+## Links
+
+- [GitHub](https://github.com/amkisko/omniauth_openid_federation.rb)
+- [GitLab](https://gitlab.com/amkisko/omniauth_openid_federation.rb)
+- [RubyGems](https://rubygems.org/gems/omniauth_openid_federation)
+- [Versions Atom](https://rubygems.org/gems/omniauth_openid_federation/versions.atom) (feed id `10007301350098`)
+- [libraries.io](https://libraries.io/rubygems/omniauth_openid_federation)
+- [Deps.dev](https://deps.dev/rubygems/omniauth_openid_federation)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_omniauth_openid_federation.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/omniauth_openid_federation.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/omniauth_openid_federation.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/omniauth_openid_federation.rb)
+
 ## License
 
 MIT License. See [LICENSE.md](LICENSE.md) for details.

data/SECURITY.md

@@ -2,27 +2,24 @@
 
 ## Reporting a Vulnerability
 
-**Do NOT** open a public GitHub issue for security vulnerabilities.
+Email security details to: security@kiskolabs.com
 
-Email security details to: **security@kiskolabs.com**
-
-Include: description, steps to reproduce, potential impact, and suggested fix (if available).
+Send the report only to that address. Include description, steps to reproduce, potential impact, and a suggested fix when you have one.
 
 ### Response Timeline
 
-- We will acknowledge receipt of your report
-- We will provide an initial assessment
-- We will keep you informed of our progress and resolution timeline
+- We will acknowledge receipt of your report.
+- We will provide an initial assessment.
+- We will keep you informed of our progress and resolution timeline.
 
 ### Disclosure Policy
 
-- We will work with you to understand and resolve the issue
-- We will credit you for the discovery (unless you prefer to remain anonymous)
-- We will publish a security advisory after the vulnerability is patched
-- We will coordinate public disclosure with you
+- We will work with you to understand and resolve the issue.
+- We will credit you for the discovery unless you prefer to remain anonymous.
+- We will publish a security advisory after the vulnerability is patched.
+- We will coordinate public disclosure with you.
 
 ## Automation Security
 
-* **Context Isolation:** It is strictly forbidden to include production credentials, API keys, or Personally Identifiable Information (PII) in prompts sent to third-party LLMs or automation services.
-
-* **Supply Chain:** All automated dependencies must be verified.
+- Keep production credentials, API keys, and personal data out of prompts sent to third-party models or automation services.
+- Verify automated dependencies.

data/lib/omniauth_openid_federation/cache.rb

@@ -15,11 +15,32 @@ module OmniauthOpenidFederation
     # Generate cache key for signed JWKS
     #
     # @param signed_jwks_uri [String] The signed JWKS URI
+    # @param entity_jwks [Hash, Array, nil] Entity JWKS used to verify the signed set
     # @return [String] Cache key
-    def self.key_for_signed_jwks(signed_jwks_uri)
-      "omniauth_openid_federation:signed_jwks:#{Digest::SHA256.hexdigest(signed_jwks_uri)}"
+    def self.key_for_signed_jwks(signed_jwks_uri, entity_jwks: nil)
+      material = "#{signed_jwks_uri}:#{canonical_jwks_digest(entity_jwks)}"
+      "omniauth_openid_federation:signed_jwks:#{Digest::SHA256.hexdigest(material)}"
     end
 
+    def self.canonical_jwks_digest(entity_jwks)
+      return "none" if entity_jwks.nil?
+
+      require "json"
+      Digest::SHA256.hexdigest(JSON.generate(deep_sort_keys(entity_jwks)))
+    end
+
+    def self.deep_sort_keys(value)
+      case value
+      when Hash
+        value.keys.map(&:to_s).sort.index_with { |key| deep_sort_keys(value[key] || value[key.to_sym]) }
+      when Array
+        value.map { |item| deep_sort_keys(item) }
+      else
+        value
+      end
+    end
+    private_class_method :canonical_jwks_digest, :deep_sort_keys
+
     # Generate cache key for locally served JWKS (federation endpoint)
     #
     # @param issuer [String] Federation endpoint issuer entity identifier
@@ -47,9 +68,10 @@ module OmniauthOpenidFederation
     # Delete signed JWKS cache
     #
     # @param signed_jwks_uri [String] The signed JWKS URI
-    def self.delete_signed_jwks(signed_jwks_uri)
+    # @param entity_jwks [Hash, Array, nil] Entity JWKS used when the entry was cached
+    def self.delete_signed_jwks(signed_jwks_uri, entity_jwks: nil)
       return unless CacheAdapter.available?
-      CacheAdapter.delete(key_for_signed_jwks(signed_jwks_uri))
+      CacheAdapter.delete(key_for_signed_jwks(signed_jwks_uri, entity_jwks: entity_jwks))
     end
   end
 end

data/lib/omniauth_openid_federation/constants.rb

@@ -17,5 +17,8 @@ module OmniauthOpenidFederation
 
     # Minimum RSA modulus size for OIDC signing and encryption keys (FTN and common federation profiles)
     MIN_RSA_KEY_BITS = 2048
+
+    # Maximum HTTP response body size for federation/JWKS fetches (1 MiB)
+    MAX_HTTP_RESPONSE_BODY_BYTES = 1_048_576
   end
 end

data/lib/omniauth_openid_federation/federation/entity_statement_validator.rb

@@ -39,9 +39,13 @@ module OmniauthOpenidFederation
       # @param issuer_entity_configuration [Hash, EntityStatement, nil] Optional: Entity Configuration of the issuer
       #   Required for validating Subordinate Statements (when iss != sub)
       # @param clock_skew_tolerance [Integer, nil] Clock skew tolerance in seconds (default: from config)
-      def initialize(jwt_string:, issuer_entity_configuration: nil, clock_skew_tolerance: nil)
+      def initialize(jwt_string:, issuer_entity_configuration: nil, subject_entity_configuration: nil, clock_skew_tolerance: nil)
         @jwt_string = jwt_string
         @issuer_entity_configuration = issuer_entity_configuration
+        # Subject Entity Configuration supplies authority_hints for Subordinate Statements.
+        # When omitted, issuer_entity_configuration is used for backward compatibility with
+        # callers that historically passed the subject config under that name.
+        @subject_entity_configuration = subject_entity_configuration
         @clock_skew_tolerance = clock_skew_tolerance || OmniauthOpenidFederation.config.clock_skew_tolerance
         @header = nil
         @payload = nil
@@ -153,32 +157,42 @@ module OmniauthOpenidFederation
         @is_subordinate_statement = !@is_entity_configuration
       end
 
-      # Step 7: For Subordinate Statements, validate iss matches authority_hints
+      # Step 7: For Subordinate Statements, validate iss matches subject's authority_hints
       def validate_authority_hints
-        unless @issuer_entity_configuration
-          # If issuer configuration not provided, we can't validate authority_hints
-          # This is acceptable for basic validation, but should be done for full validation
-          OmniauthOpenidFederation::Logger.warn("[EntityStatementValidator] Cannot validate authority_hints: issuer entity configuration not provided")
+        subject_source = @subject_entity_configuration || @issuer_entity_configuration
+        unless subject_source
+          OmniauthOpenidFederation::Logger.warn("[EntityStatementValidator] Cannot validate authority_hints: subject entity configuration not provided")
           return
         end
 
-        issuer_config = if @issuer_entity_configuration.is_a?(Hash)
-          @issuer_entity_configuration
-        elsif @issuer_entity_configuration.respond_to?(:parse)
-          @issuer_entity_configuration.parse
-        else
-          raise ValidationError, "Invalid issuer entity configuration format"
-        end
-
-        authority_hints = issuer_config[:claims]&.fetch("authority_hints", []) ||
-          issuer_config["claims"]&.fetch("authority_hints", []) ||
-          issuer_config.fetch("authority_hints", [])
+        subject_config = normalize_entity_configuration_hash(subject_source)
+        authority_hints = extract_authority_hints_from_config(subject_config)
 
         unless authority_hints.is_a?(Array) && authority_hints.include?(@payload["iss"])
           raise ValidationError, "Subordinate Statement issuer '#{@payload["iss"]}' MUST be listed in the authority_hints array of the subject's Entity Configuration"
         end
       end
 
+      def normalize_entity_configuration_hash(config)
+        if config.is_a?(Hash)
+          config
+        elsif config.respond_to?(:parse)
+          config.parse
+        else
+          raise ValidationError, "Invalid entity configuration format"
+        end
+      end
+
+      def extract_authority_hints_from_config(config)
+        claims = config[:claims] || config["claims"]
+        if claims.is_a?(Hash)
+          hints = claims[:authority_hints] || claims["authority_hints"]
+          return hints if hints
+        end
+
+        config[:authority_hints] || config["authority_hints"] || []
+      end
+
       def validate_iat_claim
         iat = @payload["iat"]
         if iat.nil?

data/lib/omniauth_openid_federation/federation/signed_jwks.rb

@@ -60,7 +60,10 @@ module OmniauthOpenidFederation
       # @raise [FetchError] If fetching fails
       # @raise [ValidationError] If validation fails
       def self.fetch!(signed_jwks_uri, entity_jwks, cache_key: nil, cache_ttl: nil, force_refresh: false)
-        cache_key ||= OmniauthOpenidFederation::Cache.key_for_signed_jwks(signed_jwks_uri)
+        cache_key ||= OmniauthOpenidFederation::Cache.key_for_signed_jwks(
+          signed_jwks_uri,
+          entity_jwks: entity_jwks
+        )
         config = OmniauthOpenidFederation::Configuration.config
         cache_ttl ||= config.cache_ttl
         rotate_on_errors = config.rotate_on_errors

data/lib/omniauth_openid_federation/federation/trust_chain_resolver.rb

@@ -1,3 +1,5 @@
+require_relative "trust_chain_signature"
+
 require "cgi"
 require "json"
 require "base64"
@@ -37,6 +39,8 @@ module OmniauthOpenidFederation
     #
     # Resolves and validates trust chains from a Leaf Entity to a Trust Anchor.
     class TrustChainResolver
+      include TrustChainSignature
+
       # Initialize resolver
       #
       # @param leaf_entity_id [String] Entity Identifier of the Leaf Entity
@@ -72,7 +76,7 @@ module OmniauthOpenidFederation
         current_entity_id = @leaf_entity_id
         current_config = leaf_config
 
-        while current_config && !is_trust_anchor?(current_config)
+        while current_config && !trust_anchor_for(current_entity_id)
           authority_hints = extract_authority_hints(current_config)
 
           if StringHelpers.blank?(authority_hints)
@@ -89,13 +93,21 @@ module OmniauthOpenidFederation
 
             begin
               issuer_config = fetch_entity_configuration(authority_id)
+              validate_entity_statement(issuer_config, nil)
+
               subordinate_statement = fetch_subordinate_statement(
                 issuer: authority_id,
                 subject: current_entity_id,
                 issuer_config: issuer_config
               )
 
-              validate_entity_statement(subordinate_statement, issuer_config)
+              validate_entity_statement(
+                subordinate_statement,
+                issuer_config,
+                subject_config: current_config,
+                expected_issuer: authority_id,
+                expected_subject: current_entity_id
+              )
 
               @resolved_statements << subordinate_statement
               @visited_entities.add(authority_id)
@@ -104,7 +116,8 @@ module OmniauthOpenidFederation
               current_config = issuer_config
               found_next = true
               break
-            rescue ValidationError, FetchError => e
+            rescue ValidationError, FetchError, SignatureError => e
+              @visited_entities.add(authority_id)
               OmniauthOpenidFederation::Logger.warn("[TrustChainResolver] Failed to resolve via #{authority_id}: #{e.message}")
               OmniauthOpenidFederation::Instrumentation.notify_trust_chain_validation_failed(
                 entity_id: current_entity_id,
@@ -122,7 +135,7 @@ module OmniauthOpenidFederation
           end
         end
 
-        unless is_trust_anchor?(current_config)
+        unless trust_anchor_for(current_entity_id)
           error_msg = "Trust chain did not terminate at a configured Trust Anchor"
           OmniauthOpenidFederation::Instrumentation.notify_trust_chain_validation_failed(
             entity_id: @leaf_entity_id,
@@ -156,12 +169,24 @@ module OmniauthOpenidFederation
 
         begin
           config = EntityStatement.fetch!(entity_statement_url, timeout: @timeout)
+          assert_entity_configuration_ids!(config, entity_id)
           @entity_configurations[entity_id] = config
         rescue OmniauthOpenidFederation::NetworkError => e
           raise FetchError, "Failed to fetch entity configuration from #{entity_statement_url}: #{e.message}"
         end
       end
 
+      def assert_entity_configuration_ids!(config, expected_entity_id)
+        parsed = config.parse
+        iss = entity_issuer(parsed)
+        sub = field(parsed, :sub)
+
+        unless iss == expected_entity_id && sub == expected_entity_id
+          raise ValidationError,
+            "Entity configuration iss/sub must equal requested entity id '#{expected_entity_id}' (iss=#{iss}, sub=#{sub})"
+        end
+      end
+
       def fetch_subordinate_statement(issuer:, subject:, issuer_config:)
         fetch_endpoint = extract_fetch_endpoint(issuer_config)
 
@@ -186,10 +211,17 @@ module OmniauthOpenidFederation
       end
 
       def extract_fetch_endpoint(entity_config)
-        # Fetch endpoint is typically at /.well-known/openid-federation/fetch
-        # or can be specified in metadata
         parsed = entity_config.parse
-        issuer = parsed[:issuer] || parsed[:iss] || parsed["issuer"] || parsed["iss"]
+        payload = entity_config.decode_payload
+        metadata = field(payload, :metadata) || {}
+        federation_entity = field(metadata, :federation_entity) || {}
+        openid_provider = field(metadata, :openid_provider) || {}
+
+        endpoint = field(federation_entity, :federation_fetch_endpoint) || field(openid_provider, :federation_fetch_endpoint)
+
+        return endpoint if StringHelpers.present?(endpoint)
+
+        issuer = entity_issuer(parsed)
         return nil unless issuer
 
         "#{issuer}/.well-known/openid-federation/fetch"
@@ -200,58 +232,46 @@ module OmniauthOpenidFederation
         parsed[:authority_hints] || parsed["authority_hints"]
       end
 
-      def validate_entity_statement(statement, issuer_config)
+      def validate_entity_statement(statement, issuer_config, subject_config: nil, expected_issuer: nil, expected_subject: nil)
         validator = EntityStatementValidator.new(
           jwt_string: statement.entity_statement,
-          issuer_entity_configuration: issuer_config
+          issuer_entity_configuration: issuer_config,
+          subject_entity_configuration: subject_config
         )
         validator.validate!
-        verify_entity_statement_signature!(statement, issuer_config)
-      end
 
-      def verify_entity_statement_signature!(statement, issuer_config)
-        jwt_string = statement.entity_statement
-        parts = jwt_string.split(".")
-        if parts.length != EntityStatementValidator::JWT_PARTS_COUNT
-          raise ValidationError, "Invalid JWT format: expected #{EntityStatementValidator::JWT_PARTS_COUNT} parts, got #{parts.length}"
-        end
+        if expected_issuer || expected_subject
+          parsed = statement.parse
+          iss = entity_issuer(parsed)
+          sub = parsed[:sub] || parsed["sub"]
 
-        header = JSON.parse(Base64.urlsafe_decode64(parts[0]))
-        kid = header["kid"] || header[:kid]
+          if expected_issuer && iss != expected_issuer
+            raise ValidationError, "Subordinate statement iss '#{iss}' does not match expected issuer '#{expected_issuer}'"
+          end
+          if expected_subject && sub != expected_subject
+            raise ValidationError, "Subordinate statement sub '#{sub}' does not match expected subject '#{expected_subject}'"
+          end
+        end
 
-        signing_keys = issuer_signing_keys(statement, issuer_config)
-        keys = signing_keys["keys"] || signing_keys[:keys] || []
-        signing_key_data = keys.find { |key| (key["kid"] || key[:kid]) == kid }
+        verify_entity_statement_signature!(statement, issuer_config)
+      end
 
-        unless signing_key_data
-          raise ValidationError, "Signing key with kid '#{kid}' not found in issuer JWKS for signature verification"
-        end
+      def normalize_jwks(jwks)
+        return {} if jwks.nil?
+        return jwks if jwks.is_a?(Hash)
+        return {"keys" => jwks} if jwks.is_a?(Array)
 
-        public_key = OmniauthOpenidFederation::KeyExtractor.jwk_to_openssl_key(signing_key_data)
-        ::JWT.decode(jwt_string, public_key, true, {algorithm: "RS256"})
-      rescue ::JWT::DecodeError, ::JWT::VerificationError => e
-        error_msg = "Entity statement signature validation failed: #{e.class} - #{e.message}"
-        OmniauthOpenidFederation::Logger.error("[TrustChainResolver] #{error_msg}")
-        raise SignatureError, error_msg, e.backtrace
+        {}
       end
 
-      def issuer_signing_keys(statement, issuer_config)
-        if issuer_config.nil?
-          parsed = statement.parse
-          parsed[:jwks] || parsed["jwks"] || {}
-        else
-          issuer_parsed = issuer_config.parse
-          issuer_parsed[:jwks] || issuer_parsed["jwks"] || {}
-        end
+      def trust_anchor_for(entity_id)
+        @trust_anchors.find { |ta| ta[:entity_id] == entity_id }
       end
 
       def is_trust_anchor?(entity_config)
         parsed = entity_config.parse
-        entity_id = parsed[:issuer] || parsed[:iss] || parsed["issuer"] || parsed["iss"]
-
-        @trust_anchors.any? do |ta|
-          ta[:entity_id] == entity_id
-        end
+        entity_id = entity_issuer(parsed)
+        !trust_anchor_for(entity_id).nil?
       end
     end
   end

data/lib/omniauth_openid_federation/federation/trust_chain_signature.rb

@@ -0,0 +1,62 @@
+module OmniauthOpenidFederation
+  module Federation
+    module TrustChainSignature
+      private
+
+      def verify_entity_statement_signature!(statement, issuer_config)
+        jwt_string = statement.entity_statement
+        kid, algorithm = signature_header(jwt_string)
+        public_key = signing_public_key(statement, issuer_config, kid)
+        ::JWT.decode(jwt_string, public_key, true, {algorithm: algorithm})
+      rescue ::JWT::DecodeError, ::JWT::VerificationError => e
+        error_msg = "Entity statement signature validation failed: #{e.class} - #{e.message}"
+        OmniauthOpenidFederation::Logger.error("[TrustChainResolver] #{error_msg}")
+        raise SignatureError, error_msg, e.backtrace
+      end
+
+      def signature_header(jwt_string)
+        parts = jwt_string.split(".")
+        if parts.length != EntityStatementValidator::JWT_PARTS_COUNT
+          raise ValidationError, "Invalid JWT format: expected #{EntityStatementValidator::JWT_PARTS_COUNT} parts, got #{parts.length}"
+        end
+
+        header = JSON.parse(Base64.urlsafe_decode64(parts[0]))
+        kid = field(header, :kid)
+        algorithm = field(header, :alg) || "RS256"
+
+        unless EntityStatementValidator::SUPPORTED_ALGORITHMS.include?(algorithm)
+          raise ValidationError, "Unsupported entity statement algorithm: #{algorithm}"
+        end
+
+        [kid, algorithm]
+      end
+
+      def signing_public_key(statement, issuer_config, kid)
+        signing_keys = issuer_signing_keys(statement, issuer_config)
+        keys = field(signing_keys, :keys) || []
+        signing_key_data = keys.find { |key| field(key, :kid) == kid }
+        unless signing_key_data
+          raise ValidationError, "Signing key with kid '#{kid}' not found in issuer JWKS for signature verification"
+        end
+
+        OmniauthOpenidFederation::KeyExtractor.jwk_to_openssl_key(signing_key_data)
+      end
+
+      def issuer_signing_keys(statement, issuer_config)
+        parsed = (issuer_config || statement).parse
+        trust_anchor = trust_anchor_for(entity_issuer(parsed))
+        return normalize_jwks(trust_anchor[:jwks]) if trust_anchor
+
+        field(parsed, :jwks) || {}
+      end
+
+      def entity_issuer(parsed)
+        parsed[:issuer] || parsed[:iss] || parsed["issuer"] || parsed["iss"]
+      end
+
+      def field(hash, key)
+        hash[key] || hash[key.to_s]
+      end
+    end
+  end
+end

data/lib/omniauth_openid_federation/http_client.rb

@@ -62,12 +62,49 @@ module OmniauthOpenidFederation
           next
         end
 
-        return response
+        return enforce_body_limit!(response)
       rescue *RETRYABLE_ERRORS => error
         retries = handle_network_error(method, uri, error, retries, max_retries, max_attempts, retry_delay)
       end
     end
 
+    def self.enforce_body_limit!(response)
+      max_bytes = Constants::MAX_HTTP_RESPONSE_BODY_BYTES
+      content_length = response.headers&.[]("Content-Length") || response.headers&.[]("content-length")
+      if content_length && content_length.to_i > max_bytes
+        raise OmniauthOpenidFederation::NetworkError,
+          "HTTP response Content-Length exceeds limit (#{max_bytes} bytes)"
+      end
+
+      response = buffer_streamed_response(response, max_bytes) if response.body.is_a?(HTTP::Response::Body)
+      body = response.body
+      size = if body.respond_to?(:bytesize)
+        body.bytesize
+      else
+        body.to_s.bytesize
+      end
+
+      if size > max_bytes
+        raise OmniauthOpenidFederation::NetworkError,
+          "HTTP response body exceeds limit (#{max_bytes} bytes)"
+      end
+      response
+    end
+
+    def self.buffer_streamed_response(response, max_bytes)
+      contents = String.new(encoding: response.body.encoding)
+      response.body.each do |chunk|
+        if contents.bytesize + chunk.bytesize > max_bytes
+          response.connection.close
+          raise OmniauthOpenidFederation::NetworkError, "HTTP response body exceeds limit (#{max_bytes} bytes)"
+        end
+        contents << chunk
+      end
+      HTTP::Response.new(status: response.status.code, version: response.version,
+        headers: response.headers, proxy_headers: response.proxy_headers,
+        request: response.request, body: contents)
+    end
+
     def self.perform_request(http_client, headers, method, uri, form)
       client = http_client
       client = client.headers(headers) unless headers.empty?
@@ -178,6 +215,6 @@ module OmniauthOpenidFederation
 
     private_class_method :request, :perform_request, :should_retry_for_status?, :retry_after_status,
       :handle_network_error, :build_http_client, :build_http_options_hash, :ssl_verify_mode, :ssl_ca_file,
-      :max_retries_for, :resolve_timeout, :retryable_http_status?, :retry_delay_for
+      :max_retries_for, :resolve_timeout, :retryable_http_status?, :retry_delay_for, :enforce_body_limit!, :buffer_streamed_response
   end
 end

data/lib/omniauth_openid_federation/jwt_response_decoder.rb

@@ -176,12 +176,10 @@ module OmniauthOpenidFederation
       return nil if OmniauthOpenidFederation::StringHelpers.blank?(signed_jwks_uri)
 
       OmniauthOpenidFederation::Federation::SignedJWKS.fetch!(signed_jwks_uri, parsed[:entity_jwks])
-    rescue OmniauthOpenidFederation::SecurityError => error
-      OmniauthOpenidFederation::Logger.error("[JwtResponseDecoder] Security error: #{error.message}")
-      nil
-    rescue
-      OmniauthOpenidFederation::Logger.warn("[JwtResponseDecoder] Failed to fetch signed JWKS, falling back to standard JWKS")
-      nil
+    rescue OmniauthOpenidFederation::SecurityError, OmniauthOpenidFederation::ValidationError,
+      OmniauthOpenidFederation::FetchError => error
+      OmniauthOpenidFederation::Logger.error("[JwtResponseDecoder] Signed JWKS failure (fail closed): #{error.message}")
+      raise
     end
 
     def load_entity_statement_keys_for_jwks_validation(strategy_options)

data/lib/omniauth_openid_federation/strategy/callback_handling.rb

@@ -12,30 +12,13 @@ module OmniauthOpenidFederation
         code_param = code_param_raw ? OmniauthOpenidFederation::Validators.sanitize_request_param(code_param_raw) : nil
         error_param = error_param_raw ? OmniauthOpenidFederation::Validators.sanitize_request_param(error_param_raw) : nil
         error_description_param = error_description_raw ? OmniauthOpenidFederation::Validators.sanitize_request_param(error_description_raw) : nil
-        if error_param
-          error_msg = "Authorization error: #{error_param}"
-          error_msg += " - #{error_description_param}" if error_description_param
-          OmniauthOpenidFederation::Instrumentation.notify_unexpected_authentication_break(
-            stage: "callback_phase",
-            error_message: error_msg,
-            error_class: "AuthorizationError",
-            request_info: {
-              remote_ip: request.env["REMOTE_ADDR"],
-              user_agent: request.env["HTTP_USER_AGENT"],
-              path: request.path
-            }
-          )
-          env["omniauth_openid_federation.instrumented"] = true
-          return fail!(:authorization_error, OmniauthOpenidFederation::ValidationError.new(error_msg))
-        end
 
-        # CSRF protection: constant-time state comparison
+        # CSRF protection: constant-time state comparison before any OAuth outcome
         state_session = session["omniauth.state"]
 
         if OmniauthOpenidFederation::StringHelpers.blank?(state_param) ||
             state_session.nil? ||
             !OmniauthOpenidFederation::SecureCompare.secure_compare(state_param.to_s, state_session.to_s)
-          # Instrument CSRF detection
           OmniauthOpenidFederation::Instrumentation.notify_csrf_detected(
             state_param: state_param ? "[PRESENT]" : "[MISSING]",
             state_session: state_session ? "[PRESENT]" : "[MISSING]",
@@ -45,14 +28,29 @@ module OmniauthOpenidFederation
               path: request.path
             }
           )
-          # Mark as instrumented to prevent double instrumentation in fail!
           env["omniauth_openid_federation.instrumented"] = true
           return fail!(:csrf_detected, OmniauthOpenidFederation::SecurityError.new("CSRF detected"))
         end
 
-        # Clear state from session
         session.delete("omniauth.state")
 
+        if error_param
+          error_msg = "Authorization error: #{error_param}"
+          error_msg += " - #{error_description_param}" if error_description_param
+          OmniauthOpenidFederation::Instrumentation.notify_unexpected_authentication_break(
+            stage: "callback_phase",
+            error_message: error_msg,
+            error_class: "AuthorizationError",
+            request_info: {
+              remote_ip: request.env["REMOTE_ADDR"],
+              user_agent: request.env["HTTP_USER_AGENT"],
+              path: request.path
+            }
+          )
+          env["omniauth_openid_federation.instrumented"] = true
+          return fail!(:authorization_error, OmniauthOpenidFederation::ValidationError.new(error_msg))
+        end
+
         if OmniauthOpenidFederation::StringHelpers.blank?(code_param)
           # Instrument unexpected authentication break
           OmniauthOpenidFederation::Instrumentation.notify_unexpected_authentication_break(

data/lib/omniauth_openid_federation/strategy/client_entity_statement.rb

@@ -9,7 +9,12 @@ module OmniauthOpenidFederation
           return load_client_entity_statement_from_file(entity_statement_path)
         end
 
-        # Priority 2: Check cache (if Rails.cache is available)
+        # Priority 2: Fetch from configured URL
+        if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_url)
+          return load_client_entity_statement_from_url(entity_statement_url)
+        end
+
+        # Priority 3: Check cache (if Rails.cache is available)
         # This respects background job cache refresh and key rotation
         if defined?(Rails) && Rails.cache
           cache_key = "federation:entity_statement"

data/lib/omniauth_openid_federation/strategy/endpoint_resolution.rb

@@ -22,14 +22,15 @@ module OmniauthOpenidFederation
 
         begin
           # Resolve endpoints from entity statement
-          # Use temporary file if we have content but no path
+          # Use temporary file if we have content but no readable configured path
+          created_temp_entity_statement = false
           entity_statement_path = if options.entity_statement_path && File.exist?(resolve_entity_statement_path(options.entity_statement_path))
             resolve_entity_statement_path(options.entity_statement_path)
           else
-            # Create temporary file for EndpointResolver
             temp_file = Tempfile.new(["entity_statement", ".jwt"])
             temp_file.write(entity_statement_content)
             temp_file.close
+            created_temp_entity_statement = true
             temp_file.path
           end
 
@@ -38,8 +39,7 @@ module OmniauthOpenidFederation
             config: {} # Don't pass client_options here - we want entity statement values
           )
 
-          # Clean up temp file if we created one
-          if entity_statement_path.start_with?(Dir.tmpdir)
+          if created_temp_entity_statement
             begin
               File.unlink(entity_statement_path)
             rescue
@@ -175,13 +175,14 @@ module OmniauthOpenidFederation
 
         if entity_statement_content
           begin
-            # Use temporary file for EndpointResolver
+            created_temp_entity_statement = false
             entity_statement_path = if options.entity_statement_path && File.exist?(resolve_entity_statement_path(options.entity_statement_path))
               resolve_entity_statement_path(options.entity_statement_path)
             else
               temp_file = Tempfile.new(["entity_statement", ".jwt"])
               temp_file.write(entity_statement_content)
               temp_file.close
+              created_temp_entity_statement = true
               temp_file.path
             end
 
@@ -193,8 +194,7 @@ module OmniauthOpenidFederation
 
             if resolved[:audience] && OmniauthOpenidFederation::StringHelpers.present?(resolved[:audience])
               OmniauthOpenidFederation::Logger.debug("[Strategy] Resolved audience from entity statement: #{resolved[:audience]}")
-              # Clean up temp file if we created one
-              if entity_statement_path.start_with?(Dir.tmpdir)
+              if created_temp_entity_statement
                 begin
                   File.unlink(entity_statement_path)
                 rescue
@@ -217,8 +217,7 @@ module OmniauthOpenidFederation
               OmniauthOpenidFederation::Logger.debug("[Strategy] Could not get entity issuer from entity statement: #{e.message}")
             end
 
-            # Clean up temp file if we created one
-            if entity_statement_path.start_with?(Dir.tmpdir)
+            if created_temp_entity_statement
               begin
                 File.unlink(entity_statement_path)
               rescue

data/lib/omniauth_openid_federation/strategy/jwks_resolution.rb

@@ -116,49 +116,43 @@ module OmniauthOpenidFederation
           end
         end
 
-        # 2. Try signed JWKS (if entity statement has signed_jwks_uri)
-        # This is more likely to have the latest keys during key rotation
+        # 2. Try signed JWKS (if entity statement has signed_jwks_uri).
+        # When signed_jwks_uri is advertised, signature/validation failures fail closed
+        # instead of falling back to an unsigned jwks_uri.
         if entity_statement_content
-          begin
-            parsed = OmniauthOpenidFederation::Federation::EntityStatementHelper.parse_for_signed_jwks_from_content(
-              entity_statement_content
+          parsed = OmniauthOpenidFederation::Federation::EntityStatementHelper.parse_for_signed_jwks_from_content(
+            entity_statement_content
+          )
+          if parsed && parsed[:signed_jwks_uri] && parsed[:entity_jwks]
+            OmniauthOpenidFederation::Logger.debug("[Strategy] Fetching signed JWKS for ID token validation (kid: #{kid})")
+            signed_jwks = OmniauthOpenidFederation::Federation::SignedJWKS.fetch!(
+              parsed[:signed_jwks_uri],
+              parsed[:entity_jwks]
             )
-            if parsed && parsed[:signed_jwks_uri] && parsed[:entity_jwks]
-              OmniauthOpenidFederation::Logger.debug("[Strategy] Fetching signed JWKS for ID token validation (kid: #{kid})")
-              signed_jwks = OmniauthOpenidFederation::Federation::SignedJWKS.fetch!(
-                parsed[:signed_jwks_uri],
-                parsed[:entity_jwks]
-              )
-              # Ensure it's in the format expected by JWT.decode
-              jwks_hash = if signed_jwks.is_a?(Hash) && signed_jwks.key?("keys")
-                signed_jwks
-              elsif signed_jwks.is_a?(Hash) && signed_jwks.key?(:keys)
-                {"keys" => signed_jwks[:keys]}
-              elsif signed_jwks.is_a?(Array)
-                {"keys" => signed_jwks}
-              end
 
-              keys = jwks_hash&.dig("keys")
-              if keys&.is_a?(Array) && !keys.empty?
-                # Track first valid JWKS
-                first_valid_jwks ||= jwks_hash
-                # If kid is nil, return JWKS anyway (let JWT decoding fail with proper error)
-                if kid.nil?
-                  OmniauthOpenidFederation::Logger.debug("[Strategy] Kid is nil, returning signed JWKS for validation attempt")
-                  return jwks_hash
-                end
-                # Check if kid is in this JWKS
-                key_data = keys.find { |key| (key["kid"] || key[:kid]) == kid }
-                if key_data
-                  OmniauthOpenidFederation::Logger.debug("[Strategy] Found kid '#{kid}' in signed JWKS")
-                  return jwks_hash
-                else
-                  OmniauthOpenidFederation::Logger.debug("[Strategy] Kid '#{kid}' not found in signed JWKS, trying standard JWKS URI")
-                end
+            jwks_hash = if signed_jwks.is_a?(Hash) && signed_jwks.key?("keys")
+              signed_jwks
+            elsif signed_jwks.is_a?(Hash) && signed_jwks.key?(:keys)
+              {"keys" => signed_jwks[:keys]}
+            elsif signed_jwks.is_a?(Array)
+              {"keys" => signed_jwks}
+            end
+
+            keys = jwks_hash&.dig("keys")
+            if keys&.is_a?(Array) && !keys.empty?
+              first_valid_jwks ||= jwks_hash
+              if kid.nil?
+                OmniauthOpenidFederation::Logger.debug("[Strategy] Kid is nil, returning signed JWKS for validation attempt")
+                return jwks_hash
+              end
+              key_data = keys.find { |key| (key["kid"] || key[:kid]) == kid }
+              if key_data
+                OmniauthOpenidFederation::Logger.debug("[Strategy] Found kid '#{kid}' in signed JWKS")
+                return jwks_hash
+              else
+                OmniauthOpenidFederation::Logger.debug("[Strategy] Kid '#{kid}' not found in signed JWKS, trying standard JWKS URI")
               end
             end
-          rescue => e
-            OmniauthOpenidFederation::Logger.debug("[Strategy] Could not fetch signed JWKS: #{e.message}")
           end
         end
 

data/lib/omniauth_openid_federation/strategy/provider_entity_statement.rb

@@ -20,9 +20,10 @@ module OmniauthOpenidFederation
           if File.exist?(path)
             OmniauthOpenidFederation::Logger.debug("[Strategy] Loading provider entity statement from file: #{path}")
             return File.read(path).strip
-          else
-            OmniauthOpenidFederation::Logger.warn("[Strategy] Provider entity statement file not found: #{path}, will try to fetch from URL")
           end
+
+          raise OmniauthOpenidFederation::ConfigurationError,
+            "Provider entity statement file not found: #{path}"
         end
 
         # Priority 2: Fetch from URL if provided

data/lib/omniauth_openid_federation/strategy/userinfo_decoding.rb

@@ -1,8 +1,40 @@
+require_relative "../secure_compare"
+require_relative "../string_helpers"
+
 module OmniauthOpenidFederation
   module Strategy
     module UserinfoDecoding
+      IDENTITY_CLAIM_KEYS = %w[iss sub aud exp iat].freeze
+
       private
 
+      def merge_userinfo_with_id_token_claims(id_token_claims, userinfo_hash)
+        normalized_id = stringify_claim_keys(id_token_claims)
+        normalized_userinfo = stringify_claim_keys(userinfo_hash)
+
+        id_sub = normalized_id["sub"]
+        userinfo_sub = normalized_userinfo["sub"]
+
+        if OmniauthOpenidFederation::StringHelpers.blank?(userinfo_sub) ||
+            OmniauthOpenidFederation::StringHelpers.blank?(id_sub) ||
+            !OmniauthOpenidFederation::SecureCompare.secure_compare(userinfo_sub.to_s, id_sub.to_s)
+          raise OmniauthOpenidFederation::ValidationError,
+            "UserInfo sub must match ID token sub"
+        end
+
+        merged = normalized_id.merge(normalized_userinfo)
+        IDENTITY_CLAIM_KEYS.each do |claim|
+          merged[claim] = normalized_id[claim] if normalized_id.key?(claim)
+        end
+        merged
+      end
+
+      def stringify_claim_keys(claims)
+        (claims || {}).each_with_object({}) do |(key, value), hash|
+          hash[key.to_s] = value
+        end
+      end
+
       def decode_userinfo(userinfo)
         if userinfo.is_a?(String)
           if encrypted_token?(userinfo)

data/lib/omniauth_openid_federation/strategy.rb

@@ -162,7 +162,9 @@ module OmniAuth
             begin
               userinfo = access_token.userinfo!
               userinfo_hash = decode_userinfo(userinfo)
-              id_token_claims.merge(userinfo_hash)
+              merge_userinfo_with_id_token_claims(id_token_claims, userinfo_hash)
+            rescue OmniauthOpenidFederation::ValidationError
+              raise
             rescue => e
               error_msg = "Failed to fetch or decode userinfo: #{e.class} - #{e.message}"
               OmniauthOpenidFederation::Logger.error("[Strategy] #{error_msg}")

data/lib/omniauth_openid_federation/utils.rb

@@ -95,7 +95,7 @@ module OmniauthOpenidFederation
       if allowed_dirs && !allowed_dirs.empty?
         allowed = allowed_dirs.any? do |dir|
           expanded_dir = File.expand_path(dir)
-          resolved.start_with?(expanded_dir)
+          resolved == expanded_dir || resolved.start_with?(expanded_dir + File::SEPARATOR)
         end
         unless allowed
           raise SecurityError, "File path outside allowed directories: #{sanitize_path(path)}"

data/lib/omniauth_openid_federation/version.rb

@@ -1,3 +1,3 @@
 module OmniauthOpenidFederation
-  VERSION = "2.0.0".freeze
+  VERSION = "2.1.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth_openid_federation
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -99,14 +99,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.1.2
+        version: 2.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.1.2
+        version: 2.2.0
+- !ruby/object:Gem::Dependency
+  name: prosopite
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -301,14 +315,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.9'
+        version: '4.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.9'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: webrick
   requirement: !ruby/object:Gem::Requirement
@@ -490,6 +504,7 @@ files:
 - lib/omniauth_openid_federation/federation/metadata_policy_merger.rb
 - lib/omniauth_openid_federation/federation/signed_jwks.rb
 - lib/omniauth_openid_federation/federation/trust_chain_resolver.rb
+- lib/omniauth_openid_federation/federation/trust_chain_signature.rb
 - lib/omniauth_openid_federation/federation_endpoint.rb
 - lib/omniauth_openid_federation/http_client.rb
 - lib/omniauth_openid_federation/http_errors.rb
@@ -556,14 +571,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: OmniAuth strategy for OpenID Federation providers with signed request objects
   and ID token encryption.