omniauth_strong_auth_oidc 0.1.0

data/lib/omniauth_strong_auth_oidc/relying_party_jwks_storage/cache_storage.rb

@@ -0,0 +1,235 @@
+module OmniauthStrongAuthOidc
+  module RelyingPartyJwksStorage
+    # Cached implementation of KeyStorage that stores keys in Rails cache
+    # Returns a single JWT::JWK::Set containing both signing and encryption keys
+    # Supports key rotation while keeping previous keys available
+    class CacheStorage < Base
+      CACHE_PREFIX = 'telia_oidc:keys'
+      CURRENT_SIGNING_KEY = "#{CACHE_PREFIX}:signing:current"
+      PREVIOUS_SIGNING_KEYS = "#{CACHE_PREFIX}:signing:previous"
+      CURRENT_ENCRYPTION_KEY = "#{CACHE_PREFIX}:encryption:current"
+      PREVIOUS_ENCRYPTION_KEYS = "#{CACHE_PREFIX}:encryption:previous"
+      MAX_PREVIOUS_KEYS = 2 # Keep up to 2 previous keys for rotation
+
+      attr_reader :cache_store
+
+      # @param key_length [Integer] RSA key length in bits (default: 4096)
+      # @param cache_store [ActiveSupport::Cache::Store] Cache store to use (Rails.cache for example)
+      def initialize(key_length: DEFAULT_KEY_LENGTH, cache_store:)
+        @key_length = key_length
+        @cache_store = cache_store
+        validate_key_length!
+        ensure_keys_exist!
+      end
+
+      def support_rotation?
+        true
+      end
+
+      # Returns the JWK set containing all keys (signing + encryption, current + previous)
+      # @return [JWT::JWK::Set]
+      def jwks
+        @jwks ||= create_jwk_set(
+          signing_key_data: all_signing_keys,
+          encryption_key_data: all_encryption_keys
+        )
+      end
+
+      # Rotates the signing key, moving current to previous
+      # @return [JWT::JWK] The new signing JWK
+      def rotate_signing_key!
+        old_key_data = load_key_data(CURRENT_SIGNING_KEY)
+        new_key = generate_rsa_key(@key_length)
+        new_key_data = {
+          pem: new_key.to_pem,
+          created_at: Time.now.to_i
+        }
+
+        # Move current key to previous keys list
+        add_to_previous_keys(PREVIOUS_SIGNING_KEYS, old_key_data)
+
+        # Store new key as current
+        store_key_data(CURRENT_SIGNING_KEY, new_key_data)
+
+        # Clear cached JWK set
+        clear_jwks_cache!
+
+        JWT::JWK.new(new_key, use: 'sig')  # Return JWK representation of
+      end
+
+      # Rotates the encryption key, moving current to previous
+      # @return [JWT::JWK] The new encryption JWK
+      def rotate_encryption_key!
+        old_key_data = load_key_data(CURRENT_ENCRYPTION_KEY)
+        new_key = generate_rsa_key(@key_length)
+        new_key_data = {
+          pem: new_key.to_pem,
+          created_at: Time.now.to_i
+        }
+
+        # Move current key to previous keys list
+        add_to_previous_keys(PREVIOUS_ENCRYPTION_KEYS, old_key_data)
+
+        # Store new key as current
+        store_key_data(CURRENT_ENCRYPTION_KEY, new_key_data)
+
+        # Clear cached JWK set
+        clear_jwks_cache!
+
+        JWT::JWK.new(new_key, use: 'enc')  # Return JWK representation of
+      end
+
+      # Clear cached JWK set (useful for testing or after rotation)
+      # @return [void]
+      def clear_jwks_cache!
+        @jwks = nil
+      end
+
+      # Completely removes all keys from storage (use with caution!)
+      # @return [void]
+      def self.clear_all_keys!(cache_store)
+        store = cache_store
+        store.delete(CURRENT_SIGNING_KEY)
+        store.delete(PREVIOUS_SIGNING_KEYS)
+        store.delete(CURRENT_ENCRYPTION_KEY)
+        store.delete(PREVIOUS_ENCRYPTION_KEYS)
+      end
+
+      private
+
+      # Returns the current signing key (for internal use)
+      # @return [OpenSSL::PKey::RSA]
+      def current_signing_key
+        load_key(CURRENT_SIGNING_KEY)
+      end
+
+      # Returns the current encryption key (for internal use)
+      # @return [OpenSSL::PKey::RSA]
+      def current_encryption_key
+        load_key(CURRENT_ENCRYPTION_KEY)
+      end
+
+      # Returns all signing keys (current + previous) with their metadata
+      # @return [Array<OpenSSL::PKey::RSA>]
+      def all_signing_keys
+        current_data = load_key_data(CURRENT_SIGNING_KEY)
+        previous_data = load_previous_key_data(PREVIOUS_SIGNING_KEYS)
+
+        [current_data] + previous_data
+      end
+
+      # Returns all encryption keys (current + previous) with their metadata
+      # @return [Array<OpenSSL::PKey::RSA>]
+      def all_encryption_keys
+        current_data = load_key_data(CURRENT_ENCRYPTION_KEY)
+        previous_data = load_previous_key_data(PREVIOUS_ENCRYPTION_KEYS)
+
+        [current_data] + previous_data
+      end
+
+      def validate_key_length!
+        raise ArgumentError, "Key length must be at least #{MINIMUM_KEY_LENGTH} bits" if @key_length < MINIMUM_KEY_LENGTH
+      end
+
+      def ensure_keys_exist!
+        # Generate signing key if it doesn't exist
+        unless cache_store.exist?(CURRENT_SIGNING_KEY)
+          key_data = {
+            pem: generate_rsa_key(@key_length).to_pem,
+            created_at: Time.now.to_i
+          }
+          store_key_data(CURRENT_SIGNING_KEY, key_data)
+        end
+
+        # Generate encryption key if it doesn't exist
+        unless cache_store.exist?(CURRENT_ENCRYPTION_KEY)
+          key_data = {
+            pem: generate_rsa_key(@key_length).to_pem,
+            created_at: Time.now.to_i
+          }
+          store_key_data(CURRENT_ENCRYPTION_KEY, key_data)
+        end
+
+        # Initialize previous keys arrays if they don't exist
+        cache_store.write(PREVIOUS_SIGNING_KEYS, []) unless cache_store.exist?(PREVIOUS_SIGNING_KEYS)
+        cache_store.write(PREVIOUS_ENCRYPTION_KEYS, []) unless cache_store.exist?(PREVIOUS_ENCRYPTION_KEYS)
+      end
+
+      def load_key(cache_key)
+        key_data = cache_store.read(cache_key)
+        raise "Key not found in cache: #{cache_key}" unless key_data
+
+        # Handle legacy PEM-only format
+        if key_data.is_a?(String)
+          return OpenSSL::PKey::RSA.new(key_data)
+        end
+
+        OpenSSL::PKey::RSA.new(key_data[:pem])
+      end
+
+      def load_key_data(cache_key)
+        key_data = cache_store.read(cache_key)
+        raise "Key not found in cache: #{cache_key}" unless key_data
+
+        # Handle legacy PEM-only format
+        if key_data.is_a?(String)
+          return { pem: key_data, kid: nil, created_at: nil }
+        end
+
+        key_data
+      end
+
+      def store_key(cache_key, key)
+        # This method is for backward compatibility
+        pem_data = key.to_pem
+        cache_store.write(cache_key, pem_data)
+      end
+
+      def store_key_data(cache_key, key_data)
+        cache_store.write(cache_key, key_data)
+      end
+
+      def previous_signing_keys
+        load_previous_keys(PREVIOUS_SIGNING_KEYS)
+      end
+
+      def previous_encryption_keys
+        load_previous_keys(PREVIOUS_ENCRYPTION_KEYS)
+      end
+
+      def load_previous_keys(cache_key)
+        key_data_list = cache_store.read(cache_key) || []
+        key_data_list.map do |data|
+          # Handle legacy PEM-only format
+          if data.is_a?(String)
+            OpenSSL::PKey::RSA.new(data)
+          else
+            OpenSSL::PKey::RSA.new(data[:pem])
+          end
+        end
+      end
+
+      def load_previous_key_data(cache_key)
+        key_data_list = cache_store.read(cache_key) || []
+        key_data_list.map do |data|
+          # Handle legacy PEM-only format
+          if data.is_a?(String)
+            { pem: data, kid: nil, created_at: nil }
+          else
+            data
+          end
+        end
+      end
+
+      def add_to_previous_keys(cache_key, key_data)
+        previous_keys = cache_store.read(cache_key) || []
+        previous_keys.unshift(key_data)
+
+        # Keep only the most recent keys
+        previous_keys = previous_keys.first(MAX_PREVIOUS_KEYS)
+
+        cache_store.write(cache_key, previous_keys)
+      end
+    end
+  end
+end

data/lib/omniauth_strong_auth_oidc/relying_party_jwks_storage/env_storage.rb

@@ -0,0 +1,112 @@
+module OmniauthStrongAuthOidc
+  module RelyingPartyJwksStorage
+    # Environment variable-based key storage for production deployments
+    # Loads RSA keys from environment variables without rotation support
+    # Keys should be base64-encoded PEM-encoded RSA private keys
+    #
+    # Default environment variables:
+    # - OIDC_SIGNING_KEY_BASE64: Base64-encoded PEM RSA private key for signing
+    # - OIDC_ENCRYPTION_KEY_BASE64: Base64-encoded PEM RSA private key for encryption
+    #
+    # Example with custom environment variable names:
+    #   RelyingPartyJwksStorage::EnvStorage.new(
+    #     signing_key_env: 'MY_SIGNING_KEY',
+    #     encryption_key_env: 'MY_ENCRYPTION_KEY'
+    #   )
+    #
+    # To create a storage with only signing key (no encryption):
+    #   RelyingPartyJwksStorage::EnvStorage.new(
+    #     signing_key_env: 'ENTITY_STATEMENT_SIGNING_KEY',
+    #     encryption_key_env: nil
+    #   )
+    class EnvStorage < Base
+      DEFAULT_SIGNING_KEY_ENV = 'OIDC_SIGNING_KEY_BASE64'
+      DEFAULT_ENCRYPTION_KEY_ENV = 'OIDC_ENCRYPTION_KEY_BASE64'
+
+      attr_reader :signing_key_env, :encryption_key_env
+
+      def initialize(signing_key_env: DEFAULT_SIGNING_KEY_ENV, encryption_key_env: DEFAULT_ENCRYPTION_KEY_ENV)
+        @signing_key_env = signing_key_env
+        @encryption_key_env = encryption_key_env
+        validate_env_keys!
+      end
+
+      def support_rotation?
+        false
+      end
+
+      # Returns the JWK set containing both signing and encryption keys
+      # @return [JWT::JWK::Set]
+      def jwks
+        @jwks ||= begin
+          encryption_data = encryption_key_env && !ENV[encryption_key_env].nil? && !ENV[encryption_key_env].empty? ? [{ pem: encryption_key_pem }] : []
+
+          create_jwk_set(
+            signing_key_data: [{ pem: signing_key_pem }],
+            encryption_key_data: encryption_data
+          )
+        end
+      end
+
+      # Rotation is not supported for environment-based keys
+      # @raise [NotImplementedError]
+      def rotate_signing_key!
+        raise NotImplementedError, "Key rotation is not supported for EnvKeyStorage. Update environment variables instead."
+      end
+
+      # Rotation is not supported for environment-based keys
+      # @raise [NotImplementedError]
+      def rotate_encryption_key!
+        raise NotImplementedError, "Key rotation is not supported for EnvKeyStorage. Update environment variables instead."
+      end
+
+      private
+
+      def signing_key_pem
+        Base64.decode64(ENV[signing_key_env])
+      end
+
+      def encryption_key_pem
+        return nil unless encryption_key_env && !ENV[encryption_key_env].nil? && !ENV[encryption_key_env].empty?
+        Base64.decode64(ENV[encryption_key_env])
+      end
+
+      def validate_env_keys!
+        # Signing key is always required
+        if ENV[signing_key_env].nil? || ENV[signing_key_env].empty?
+          raise ArgumentError, "Missing required environment variable: #{signing_key_env}"
+        end
+
+        # Validate signing key
+        begin
+          OpenSSL::PKey::RSA.new(signing_key_pem)
+        rescue OpenSSL::PKey::RSAError => e
+          raise ArgumentError, "Invalid RSA key in #{signing_key_env}: #{e.message}"
+        end
+
+        signing_key = OpenSSL::PKey::RSA.new(signing_key_pem)
+        if signing_key.n.num_bits < MINIMUM_KEY_LENGTH
+          raise ArgumentError, "#{signing_key_env} must be at least #{MINIMUM_KEY_LENGTH} bits (got #{signing_key.n.num_bits} bits)"
+        end
+
+        # Return early if no encryption key is configured
+        return unless encryption_key_env
+
+        if ENV[encryption_key_env].nil? || ENV[encryption_key_env].empty?
+          raise ArgumentError, "Missing required environment variable: #{encryption_key_env}"
+        end
+
+        begin
+          OpenSSL::PKey::RSA.new(encryption_key_pem)
+        rescue OpenSSL::PKey::RSAError => e
+          raise ArgumentError, "Invalid RSA key in #{encryption_key_env}: #{e.message}"
+        end
+
+        encryption_key = OpenSSL::PKey::RSA.new(encryption_key_pem)
+        if encryption_key.n.num_bits < MINIMUM_KEY_LENGTH
+          raise ArgumentError, "#{encryption_key_env} must be at least #{MINIMUM_KEY_LENGTH} bits (got #{encryption_key.n.num_bits} bits)"
+        end
+      end
+    end
+  end
+end

data/lib/omniauth_strong_auth_oidc/relying_party_jwks_storage.rb

@@ -0,0 +1,10 @@
+require_relative 'relying_party_jwks_storage/base'
+require_relative 'relying_party_jwks_storage/cache_storage'
+require_relative 'relying_party_jwks_storage/env_storage'
+module OmniauthStrongAuthOidc
+  # Abstract interface for OpenID key storage
+  # Implementations must provide a JWK set containing both signing and encryption keys
+  module RelyingPartyJwksStorage
+
+  end
+end

data/lib/omniauth_strong_auth_oidc/version.rb

@@ -0,0 +1,3 @@
+module OmniauthStrongAuthOidc
+  VERSION = "0.1.0"
+end

data/lib/omniauth_strong_auth_oidc.rb

@@ -0,0 +1,15 @@
+
+require_relative 'omniauth_strong_auth_oidc/version'
+require_relative 'omniauth_strong_auth_oidc/entity_statement'
+require_relative 'omniauth_strong_auth_oidc/entity_statement_fetcher'
+require_relative 'omniauth_strong_auth_oidc/jwks_cache'
+require_relative 'omniauth_strong_auth_oidc/jwks_fetcher'
+require_relative 'omniauth_strong_auth_oidc/relying_party_jwks_storage'
+require_relative 'omniauth_strong_auth_oidc/relying_party_entity_statement_generator'
+require_relative 'omniauth_strong_auth_oidc/relying_party_jwks_generator'
+require_relative 'omniauth/strategies/strong_auth_oidc'
+
+module OmniauthStrongAuthOidc
+	# gem version from `lib/omniauth_strong_auth_oidc/version.rb`
+	# kept empty module body intentionally
+end

data/omniauth_strong_auth_oidc.gemspec

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "lib/omniauth_strong_auth_oidc/version"
+
+Gem::Specification.new do |spec|
+  spec.name          = "omniauth_strong_auth_oidc"
+  spec.version       = OmniauthStrongAuthOidc::VERSION
+  spec.authors       = ["Kisko Labs", "Dmitry Gusev"]
+  spec.email         = ["dmitry@kiskolabs.com"]
+
+  spec.summary       = %q{OmniAuth strategy for Strong Auth OIDC}
+  spec.description   = File.exist?("README.md") ? File.read("README.md") : spec.summary
+  spec.homepage      = "https://github.com/kiskolabs/omniauth_strong_auth_oidc"
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^spec/}) }
+  spec.require_paths = ["lib"]
+
+  spec.add_dependency "omniauth-oauth2", "~> 1.8"
+  spec.add_dependency "jwt", "~> 2.10"
+  spec.add_dependency "jwe", "~> 1.1"
+  spec.add_dependency "http", "~> 5.0"
+
+  spec.add_development_dependency "bundler"
+  spec.add_development_dependency "rake"
+  spec.add_development_dependency "rspec", "~> 3.0"
+  spec.add_development_dependency "activesupport", "~> 7.0"
+
+  spec.metadata = {
+    "allowed_push_host" => "https://rubygems.org"
+  }
+end