openid_connect 0.0.5 → 0.0.6

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    openid_connect (0.0.4)
+    openid_connect (0.0.5)
       activemodel (>= 3)
       attr_required (>= 0.0.3)
       json (>= 1.4.3)
@@ -14,18 +14,18 @@ PATH
 GEM
   remote: http://rubygems.org/
   specs:
-    activemodel (3.0.9)
-      activesupport (= 3.0.9)
+    activemodel (3.0.5)
+      activesupport (= 3.0.5)
       builder (~> 2.1.2)
-      i18n (~> 0.5.0)
-    activesupport (3.0.9)
+      i18n (~> 0.4)
+    activesupport (3.0.5)
     addressable (2.2.6)
     attr_required (0.0.3)
     builder (2.1.2)
     crack (0.1.8)
     diff-lcs (1.1.2)
     httpclient (2.2.1)
-    i18n (0.5.0)
+    i18n (0.6.0)
     json (1.5.3)
     jwt (0.1.3)
       json (>= 1.2.4)

data/VERSION

@@ -1 +1 @@
-0.0.5
+0.0.6

data/lib/openid_connect/access_token.rb

@@ -18,7 +18,9 @@ module OpenIDConnect
       hash = resource_request do
         get client.introspection_uri
       end
-      ResponseObject::IdToken.new hash
+      id_token = ResponseObject::IdToken.new hash
+      id_token.verify! client.identifier
+      id_token
     end
 
     private

data/lib/openid_connect/response_object/id_token.rb

@@ -3,9 +3,17 @@ require 'jwt'
 module OpenIDConnect
   class ResponseObject
     class IdToken < ResponseObject
+      class InvalidToken < Exception; end
+
       attr_required :iss, :user_id, :aud, :exp
       attr_optional :iso29115, :nonce, :issued_to, :secret
 
+      def verify!(client_id)
+        aud == client_id or
+        issued_to == client_id or
+        raise InvalidToken.new('Invalid audience or issued_to')
+      end
+
       def to_jwt
         raise Exception.new('Secret Required') unless secret
         JWT.encode as_json, secret

data/spec/mock_response/id_token.json

@@ -1,7 +1,7 @@
 {
   "iss": "http://server.example.com",
-  "client_id": "http://client.example.com",
-  "aud": "http://client.example.com",
+  "aud": "client_id",
+  "issued_to": "http://client.example.com",
   "user_id": "user_328723",
   "exp": 1303852880
 }

data/spec/openid_connect/access_token_spec.rb

@@ -64,5 +64,20 @@ describe OpenIDConnect::AccessToken do
         token.id_token!.should be_a OpenIDConnect::ResponseObject::IdToken
       end
     end
+
+    context 'when invalid client is given' do
+      let :client do
+        OpenIDConnect::Client.new(
+          :identifier => 'invalid_client',
+          :host => 'server.example.com'
+        )
+      end
+
+      it 'should raise OpenIDConnect::ResponseObject::IdToken::InvalidToken' do
+        mock_json :get, client.introspection_uri, 'id_token', :HTTP_AUTHORIZATION => 'Bearer access_token' do
+          expect { token.id_token! }.should raise_error OpenIDConnect::ResponseObject::IdToken::InvalidToken
+        end
+      end
+    end
   end
 end

data/spec/openid_connect/response_object/id_token_spec.rb

@@ -3,6 +3,7 @@ require 'spec_helper'
 describe OpenIDConnect::ResponseObject::IdToken do
   let(:klass) { OpenIDConnect::ResponseObject::IdToken }
   let(:id_token) { klass.new attributes }
+  let(:attributes) { required_attributes }
   let :required_attributes do
     {
       :iss => 'https://server.example.com',
@@ -18,6 +19,18 @@ describe OpenIDConnect::ResponseObject::IdToken do
     its(:optional_attributes) { should == [:iso29115, :nonce, :issued_to, :secret] }
   end
 
+  describe '#verify!' do
+    context 'when valid client_id is given' do
+      it { id_token.verify!('client_id').should be_true }
+    end
+
+    context 'otherwise' do
+      it do
+        expect { id_token.verify! 'invalid_client' }.should raise_error OpenIDConnect::ResponseObject::IdToken::InvalidToken
+      end
+    end
+  end
+
   describe '#to_jwt' do
     subject { id_token.to_jwt }
 
@@ -27,7 +40,6 @@ describe OpenIDConnect::ResponseObject::IdToken do
     end
 
     context 'otherwise' do
-      let(:attributes) { required_attributes }
       it do
         expect { id_token.to_jwt }.should raise_error OpenIDConnect::Exception, 'Secret Required'
       end

metadata

@@ -2,7 +2,7 @@
 name: openid_connect
 version: !ruby/object:Gem::Version 
   prerelease: 
-  version: 0.0.5
+  version: 0.0.6
 platform: ruby
 authors: 
 - nov matake