openid_connect 0.5.1 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 96fafd3eb7736041bdf5095494885111a934d6ee
-  data.tar.gz: 6dbcf5e2c2bc38151707b5aae05260ebaa3e7324
+  metadata.gz: 77b0fff4702e56386e8fc0e50c10cf58ab662d0f
+  data.tar.gz: 1adf047cf6615943b05ed5b7aa34ae504ce2d9e2
 SHA512:
-  metadata.gz: 32676583d740a314dc97c5c0e7311b83584e26df6aad0f6f037ba2fa7cd53d39f7a3f0d9d0c745fdeb0a8d53589d672e2dffe6ddc353cccabf3a3d43561583f3
-  data.tar.gz: 65b85979a7d62275d5dfe727b1e821132e94115a3b589cf9d76d917459e2b9515ca7e447a77b5f3644c57b69ce55771d9a0c8820907299fd30071476d30e4879
+  metadata.gz: 915d6d6a304106f2862a8c0235a63153145c454526265a1bf1e1cf1f27eb72df2379a73b719fb6c31b5ae43bdae5d6ba3ceaffeb37edd09724ae6ac533572470
+  data.tar.gz: 47963961ff61a3d530787c238c5ed57b028b07eb48e1558483277906f27988ca66740951bc2764a9ede790ac0584dda7cbe276ec12c0e584cb538f53d9fd4ba8

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    openid_connect (0.5.1)
+    openid_connect (0.6.0)
       activemodel (>= 3)
       attr_required (>= 0.0.5)
       json (>= 1.4.3)
@@ -36,7 +36,8 @@ GEM
     httpclient (2.3.3)
     i18n (0.6.4)
     json (1.7.7)
-    json-jwt (0.4.2)
+    json (1.7.7-java)
+    json-jwt (0.4.3)
       activesupport (>= 2.3)
       i18n
       multi_json (>= 1.3)

data/VERSION

@@ -1 +1 @@
-0.5.1
+0.6.0

data/lib/openid_connect/access_token.rb

@@ -8,12 +8,13 @@ module OpenIDConnect
       @token_type = :bearer
     end
 
-    def user_info!(schema = :openid)
+    def userinfo!(schema = :openid)
       hash = resource_request do
-        get client.user_info_uri, schema: schema
+        get client.userinfo_uri, schema: schema
       end
       ResponseObject::UserInfo::OpenID.new hash
     end
+    alias_method :user_info!, :userinfo!
 
     private
 

data/lib/openid_connect/client.rb

@@ -1,10 +1,13 @@
 module OpenIDConnect
   class Client < Rack::OAuth2::Client
-    attr_optional :user_info_endpoint, :expires_in
+    attr_optional :userinfo_endpoint, :expires_in
+    alias_method :user_info_endpoint, :userinfo_endpoint
+    alias_method :user_info_endpoint=, :userinfo_endpoint=
 
     def initialize(attributes = {})
-      super
-      @user_info_endpoint ||= '/user_info'
+      attributes[:userinfo_endpoint] ||= attributes[:user_info_endpoint]
+      super attributes
+      self.userinfo_endpoint ||= '/user_info'
     end
 
     def authorization_uri(params = {})
@@ -13,9 +16,10 @@ module OpenIDConnect
       super
     end
 
-    def user_info_uri
-      absolute_uri_for user_info_endpoint
+    def userinfo_uri
+      absolute_uri_for userinfo_endpoint
     end
+    alias_method :user_info_uri, :userinfo_uri
 
     private
 

data/lib/openid_connect/client/registrar.rb

@@ -6,21 +6,22 @@ module OpenIDConnect
       class RegistrationFailed < HttpError; end
 
       singular_attributes = [
-        :type,
+        :operation,
         :client_id,
         :client_secret,
         :access_token,
         :application_type,
-        :application_name,
+        :client_name,
         :logo_url,
-        :token_endpoint_auth_type,
+        :token_endpoint_auth_method,
         :policy_url,
+        :tos_url,
         :jwk_url,
         :jwk_encryption_url,
         :x509_url,
         :x509_encryption_url,
         :sector_identifier_url,
-        :user_id_type,
+        :subject_type,
         :request_object_signing_alg,
         :userinfo_signed_response_alg,
         :userinfo_encrypted_response_alg,
@@ -30,7 +31,9 @@ module OpenIDConnect
         :id_token_encrypted_response_enc,
         :default_max_age,
         :require_auth_time,
-        :default_acr
+        :default_acr,
+        :initiate_login_uri,
+        :post_logout_redirect_url
       ]
       plurar_attributes = [
         :contacts,
@@ -52,25 +55,28 @@ module OpenIDConnect
         alias_method_chain _attr_, :split
       end
 
-      validates :type,                  presence: true
-      validates :client_id,             presence: {if: ->(c) { ['client_update', 'rotate_secret'].include?(c.type.to_s) }}
+      validates :operation,             presence: true
+      validates :client_id,             presence: {if: ->(c) { ['client_update', 'rotate_secret'].include?(c.operation.to_s) }}
       validates :sector_identifier_url, presence: {if: :sector_identifier_required?}
 
-      validates :type,             inclusion: {in: ['client_associate', 'rotate_secret', 'client_update']}
+      validates :operation,        inclusion: {in: ['client_register', 'rotate_secret', 'client_update']}
       validates :application_type, inclusion: {in: ['native', 'web']},      allow_nil: true
-      validates :user_id_type,     inclusion: {in: ['pairwise', 'public']}, allow_nil: true
-      validates :token_endpoint_auth_type, inclusion: {
+      validates :subject_type,     inclusion: {in: ['pairwise', 'public']}, allow_nil: true
+      validates :token_endpoint_auth_method, inclusion: {
         in: ['client_secret_post', 'client_secret_basic', 'client_secret_jwt', 'private_key_jwt']
       }, allow_nil: true
 
       validates(
         :logo_url,
         :policy_url,
+        :tos_url,
         :jwk_url,
         :jwk_encryption_url,
         :x509_url,
         :x509_encryption_url,
         :sector_identifier_url,
+        :initiate_login_uri,
+        :post_logout_redirect_url,
         url: true,
         allow_nil: true
       )
@@ -128,18 +134,18 @@ module OpenIDConnect
         end
       end
 
-      def associate!
-        self.type = 'client_associate'
+      def register!
+        self.operation = 'client_register'
         post!
       end
 
       def rotate_secret!
-        self.type = 'rotate_secret'
+        self.operation = 'rotate_secret'
         post!
       end
 
       def update!
-        self.type = 'client_update'
+        self.operation = 'client_update'
         post!
       end
 
@@ -150,7 +156,7 @@ module OpenIDConnect
       private
 
       def sector_identifier_required?
-        user_id_type == 'pairwise' &&
+        subject_type == 'pairwise' &&
         sector_identifier.blank?
       end
 

data/lib/openid_connect/discovery/provider/config/response.rb

@@ -11,7 +11,7 @@ module OpenIDConnect
             :issuer,
             :authorization_endpoint,
             :token_endpoint,
-            :user_info_endpoint,
+            :userinfo_endpoint,
             :refresh_session_endpoint,
             :check_session_endpoint,
             :end_session_endpoint,
@@ -22,30 +22,41 @@ module OpenIDConnect
             :registration_endpoint,
             :scopes_supported,
             :response_types_supported,
-            :acrs_supported,
-            :user_id_types_supported,
-            :user_info_signing_alg_values_supported,
-            :user_info_encryption_alg_values_supported,
-            :user_info_encryption_enc_values_supported,
+            :acr_values_supported,
+            :subject_types_supported,
+            :claims_supported,
+            :userinfo_signing_alg_values_supported,
+            :userinfo_encryption_alg_values_supported,
+            :userinfo_encryption_enc_values_supported,
             :id_token_signing_alg_values_supported,
             :id_token_encryption_alg_values_supported,
             :id_token_encryption_enc_values_supported,
             :request_object_signing_alg_values_supported,
             :request_object_encryption_alg_values_supported,
             :request_object_encryption_enc_values_supported,
-            :token_endpoint_auth_types_supported,
+            :token_endpoint_auth_methods_supported,
             :token_endpoint_auth_signing_alg_values_supported
           )
+          [
+            :userinfo_endpoint,
+            :userinfo_signing_alg_values_supported,
+            :userinfo_encryption_alg_values_supported,
+            :userinfo_encryption_enc_values_supported
+          ].each do |userinfo_attribute|
+            user_info_attribute = userinfo_attribute.to_s.sub('userinfo', 'user_info').to_sym
+            alias_method user_info_attribute, userinfo_attribute
+            alias_method :"#{user_info_attribute}=", userinfo_attribute
+          end
 
           def initialize(hash)
             optional_attributes.each do |key|
               self.send "#{key}=", hash[key]
             end
-            @user_info_endpoint ||= hash[:userinfo_endpoint]
-            @user_info_signing_alg_values_supported ||= hash[:userinfo_signing_alg_values_supported]
-            @user_info_encryption_alg_values_supported ||= hash[:userinfo_encryption_alg_values_supported]
-            @user_info_encryption_enc_values_supported ||= hash[:userinfo_encryption_enc_values_supported]
-            @version ||= '3.0'
+            self.userinfo_endpoint ||= hash[:user_info_endpoint]
+            self.userinfo_signing_alg_values_supported ||= hash[:user_info_signing_alg_values_supported]
+            self.userinfo_encryption_alg_values_supported ||= hash[:user_info_encryption_alg_values_supported]
+            self.userinfo_encryption_enc_values_supported ||= hash[:user_info_encryption_enc_values_supported]
+            self.version ||= '3.0'
             @raw = hash
           end
 
@@ -55,10 +66,6 @@ module OpenIDConnect
                 _attr_ => self.send(_attr_)
               )
             end
-            hash[:userinfo_endpoint] = hash.delete(:user_info_endpoint)
-            hash[:userinfo_signing_alg_values_supported] = hash.delete(:user_info_signing_alg_values_supported)
-            hash[:userinfo_encryption_alg_values_supported] = hash.delete(:user_info_encryption_alg_values_supported)
-            hash[:userinfo_encryption_enc_values_supported] = hash.delete(:user_info_encryption_enc_values_supported)
             hash.delete_if do |key, value|
               value.nil?
             end

data/lib/openid_connect/request_object.rb

@@ -1,10 +1,13 @@
 module OpenIDConnect
   class RequestObject < ConnectObject
-    attr_optional :client_id, :response_type, :redirect_uri, :scope, :state, :nonce, :display, :prompt, :user_info, :id_token
+    include JWTnizable
+
+    attr_optional :client_id, :response_type, :redirect_uri, :scope, :state, :nonce, :display, :prompt, :userinfo, :id_token
+    alias_method :user_info, :userinfo
     validate :require_at_least_one_attributes
 
     def initialize(attributes = {})
-      attributes[:user_info] ||= attributes[:userinfo]
+      attributes[:userinfo] ||= attributes[:user_info]
       super attributes
     end
 
@@ -12,20 +15,16 @@ module OpenIDConnect
       @id_token = IdToken.new(attributes) if attributes.present?
     end
 
-    def user_info=(attributes = {})
-      @user_info = UserInfo.new(attributes) if attributes.present?
+    def userinfo=(attributes = {})
+      @userinfo = UserInfo.new(attributes) if attributes.present?
     end
+    alias_method :user_info=, :userinfo=
 
-    def as_json_with_user_info(options = {})
-      hash = as_json_without_user_info options
-      if hash.include?(:user_info)
-        hash[:userinfo] = hash.delete(:user_info)
-      end
+    def as_json_with_mixed_keys(options = {})
+      hash = as_json_without_mixed_keys options
       hash.with_indifferent_access
     end
-    alias_method_chain :as_json, :user_info
-
-    include JWTnizable
+    alias_method_chain :as_json, :mixed_keys
 
     class << self
       def decode(jwt_string, key = nil)

data/lib/openid_connect/response_object/id_token.rb

@@ -5,13 +5,15 @@ module OpenIDConnect
     class IdToken < ConnectObject
       class InvalidToken < Exception; end
 
-      attr_required :iss, :user_id, :aud, :exp, :iat
-      attr_optional :acr, :auth_time, :nonce, :user_jwk, :at_hash, :c_hash
+      attr_required :iss, :sub, :aud, :exp, :iat
+      attr_optional :acr, :auth_time, :nonce, :sub_jwk, :at_hash, :c_hash
       attr_accessor :access_token, :code
+      alias_method :subject, :sub
+      alias_method :subject=, :sub=
 
       def initialize(attributes = {})
         super
-        (all_attributes - [:exp, :iat, :auth_time, :user_jwk]).each do |key|
+        (all_attributes - [:exp, :iat, :auth_time, :sub_jwk]).each do |key|
           self.send "#{key}=", self.send(key).try(:to_s)
         end
       end
@@ -61,25 +63,25 @@ module OpenIDConnect
 
         def decode_self_issued(jwt_string)
           jwt = JSON::JWT.decode jwt_string, :skip_verification
-          jwk = jwt[:user_jwk]
-          raise InvalidToken.new('Missing user_jwk') if jwk.blank?
-          raise InvalidToken.new('Invalid user_id') unless jwt[:user_id] == self_issued_user_id(jwk)
+          jwk = jwt[:sub_jwk]
+          raise InvalidToken.new('Missing sub_jwk') if jwk.blank?
+          raise InvalidToken.new('Invalid subject') unless jwt[:sub] == self_issued_subject(jwk)
           public_key = JSON::JWK.decode jwk
           jwt = JSON::JWT.decode jwt_string, public_key
           new jwt
         end
 
         def self_issued(attributes = {})
-          attributes[:user_jwk] ||= JSON::JWK.new attributes.delete(:public_key)
+          attributes[:sub_jwk] ||= JSON::JWK.new attributes.delete(:public_key)
           _attributes_ = {
-            iss:     'https://self-issued.me',
-            user_id: self_issued_user_id(attributes[:user_jwk])
+            iss: 'https://self-issued.me',
+            sub: self_issued_subject(attributes[:sub_jwk])
           }.merge(attributes)
           new _attributes_
         end
 
-        def self_issued_user_id(jwk)
-          user_id_base_string = case jwk[:alg].to_s
+        def self_issued_subject(jwk)
+          subject_base_string = case jwk[:alg].to_s
           when 'RSA'
             [jwk[:n], jwk[:e]].join
           when 'EC'
@@ -88,7 +90,7 @@ module OpenIDConnect
             # Shouldn't reach here. All unknown algorithm error should occurs when decoding JWK
             raise InvalidToken.new('Unknown Algorithm')
           end
-          UrlSafeBase64.encode64 OpenSSL::Digest::SHA256.digest(user_id_base_string)
+          UrlSafeBase64.encode64 OpenSSL::Digest::SHA256.digest(subject_base_string)
         end
       end
     end

data/lib/openid_connect/response_object/user_info/open_id.rb

@@ -3,7 +3,7 @@ module OpenIDConnect
     module UserInfo
       class OpenID < ConnectObject
         attr_optional(
-          :user_id,
+          :sub,
           :name,
           :given_name,
           :family_name,
@@ -23,6 +23,8 @@ module OpenIDConnect
           :address,
           :updated_time
         )
+        alias_method :subject, :sub
+        alias_method :subject=, :sub=
 
         validates :email_verified, inclusion: {in: [true, false]},                             allow_nil: true
         validates :gender,         inclusion: {in: ['male', 'female']},                        allow_nil: true

data/spec/mock_response/discovery/config.json

@@ -7,6 +7,7 @@
     "registration_endpoint": "https://connect-op.heroku.com/connect/client",
     "scopes_supported": ["openid", "profile", "email", "address"],
     "response_types_supported": ["code", "token", "id_token", "code token", "code id_token", "id_token token"],
-    "user_id_types_supported": ["public", "pairwise"],
+    "subject_types_supported": ["public", "pairwise"],
+    "claims_supported": ["sub", "iss", "name", "email"],
     "x509_url": "https://connect-op.heroku.com/cert.pem"
 }

data/spec/openid_connect/access_token_spec.rb

@@ -32,7 +32,7 @@ describe OpenIDConnect::AccessToken do
       let :id_token do
         OpenIDConnect::ResponseObject::IdToken.new(
           iss: 'https://server.example.com',
-          user_id: 'user_id',
+          sub: 'user_id',
           aud: 'client_id',
           nonce: 'nonce',
           exp: 1.week.from_now,

data/spec/openid_connect/client/registrar_spec.rb

@@ -5,7 +5,7 @@ describe OpenIDConnect::Client::Registrar do
   let(:attributes) { minimum_attributes }
   let(:minimum_attributes) do
     {
-      type: :client_associate
+      operation: :client_register
     }
   end
   let(:instance) { OpenIDConnect::Client::Registrar.new(endpoint, attributes) }
@@ -13,18 +13,18 @@ describe OpenIDConnect::Client::Registrar do
 
   context 'when endpoint given' do
     context 'when attributes given' do
-      context 'when type=client_associate' do
+      context 'when operation=client_register' do
         let(:attributes) do
           minimum_attributes
         end
         it { should be_valid }
       end
 
-      context 'when type=client_update' do
+      context 'when operation=client_update' do
         context 'when client_id given' do
           let(:attributes) do
             {
-              type: :client_update,
+              operation: :client_update,
               client_id: 'client.example.com'
             }
           end
@@ -34,7 +34,7 @@ describe OpenIDConnect::Client::Registrar do
         context 'otherwise' do
           let(:attributes) do
             {
-              type: :client_update
+              operation: :client_update
             }
           end
           it { should_not be_valid }
@@ -44,7 +44,7 @@ describe OpenIDConnect::Client::Registrar do
       context 'otherwise' do
         let(:attributes) do
           {
-            type: :invalid_type
+            operation: :invalid_operation
           }
         end
         it { should_not be_valid }
@@ -209,7 +209,7 @@ describe OpenIDConnect::Client::Registrar do
       end
       its(:as_json) do
         should == {
-          type: 'client_associate',
+          operation: 'client_register',
           redirect_uris: 'https://client1.example.com/callback https://client2.example.com/callback'
         }
       end
@@ -218,7 +218,7 @@ describe OpenIDConnect::Client::Registrar do
     context 'otherwise' do
       let(:attributes) do
         {
-          type: :client_update
+          operation: :client_update
         }
       end
       it do
@@ -229,16 +229,16 @@ describe OpenIDConnect::Client::Registrar do
     end
   end
 
-  describe '#associate!' do
+  describe '#register!' do
     let(:attributes) do
       {}
     end
 
     it 'should return OpenIDConnect::Client' do
       mock_json :post, endpoint, 'client/registered', params: {
-        type: 'client_associate'
+        operation: 'client_register'
       } do
-        client = instance.associate!
+        client = instance.register!
         client.should be_instance_of OpenIDConnect::Client
         client.identifier.should == 'client.example.com'
         client.secret.should == 'client_secret'
@@ -249,10 +249,10 @@ describe OpenIDConnect::Client::Registrar do
     context 'when failed' do
       it 'should raise OpenIDConnect::Client::Registrar::RegistrationFailed' do
         mock_json :post, endpoint, 'errors/unknown', params: {
-          type: 'client_associate'
+          operation: 'client_register'
         }, status: 400 do
           expect do
-            instance.associate!
+            instance.register!
           end.to raise_error OpenIDConnect::Client::Registrar::RegistrationFailed
         end
       end
@@ -269,12 +269,12 @@ describe OpenIDConnect::Client::Registrar do
 
     it 'should return OpenIDConnect::Client' do
       mock_json :post, endpoint, 'client/updated', params: {
-        type: 'client_update',
+        operation: 'client_update',
         client_id: 'client.example.com',
         client_secret: 'client_secret',
-        application_name: 'New Name'
+        client_name: 'New Name'
       } do
-        instance.application_name = 'New Name'
+        instance.client_name = 'New Name'
         client = instance.update!
         client.should be_instance_of OpenIDConnect::Client
         client.identifier.should == 'client.example.com'
@@ -284,7 +284,7 @@ describe OpenIDConnect::Client::Registrar do
     context 'when failed' do
       it 'should raise OpenIDConnect::Client::Registrar::RegistrationFailed' do
         mock_json :post, endpoint, 'errors/unknown', params: {
-          type: 'client_update',
+          operation: 'client_update',
           client_id: 'client.example.com',
           client_secret: 'client_secret'
         }, status: 400 do
@@ -306,7 +306,7 @@ describe OpenIDConnect::Client::Registrar do
 
     it 'should return OpenIDConnect::Client' do
       mock_json :post, endpoint, 'client/rotated', params: {
-        type: 'rotate_secret',
+        operation: 'rotate_secret',
         client_id: 'client.example.com',
         client_secret: 'client_secret'
       } do
@@ -331,7 +331,7 @@ describe OpenIDConnect::Client::Registrar do
     context 'otherwise' do
       let(:attributes) do
         {
-          type: :client_update
+          operation: :client_update
         }
       end
       it do

data/spec/openid_connect/discovery/provider/config_spec.rb

@@ -21,8 +21,9 @@ describe OpenIDConnect::Discovery::Provider::Config do
         config.registration_endpoint.should == 'https://connect-op.heroku.com/connect/client'
         config.scopes_supported.should == ["openid", "profile", "email", "address"]
         config.response_types_supported.should == ["code", "token", "id_token", "code token", "code id_token", "id_token token"]
-        config.acrs_supported.should be_nil
-        config.user_id_types_supported.should == ["public", "pairwise"]
+        config.acr_values_supported.should be_nil
+        config.subject_types_supported.should == ["public", "pairwise"]
+        config.claims_supported.should == ["sub", "iss", "name", "email"]
       end
     end
 

data/spec/openid_connect/request_object_spec.rb

@@ -15,12 +15,6 @@ describe OpenIDConnect::RequestObject do
         nonce: 'nonce1234',
         display: 'touch',
         prompt: 'none',
-        userinfo: {
-          claims: {
-            name: :required,
-            email: :optional
-          }
-        },
         id_token: {
           max_age: 10,
           claims: {
@@ -28,11 +22,17 @@ describe OpenIDConnect::RequestObject do
               values: ['2', '3', '4']
             }
           }
+        },
+        userinfo: {
+          claims: {
+            name: :required,
+            email: :optional
+          }
         }
       }
     end
     let(:jwtnized) do
-      'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJjbGllbnRfaWQiOiJjbGllbnRfaWQiLCJyZXNwb25zZV90eXBlIjoidG9rZW4gaWRfdG9rZW4iLCJyZWRpcmVjdF91cmkiOiJodHRwczovL2NsaWVudC5leGFtcGxlLmNvbSIsInNjb3BlIjoib3BlbmlkIGVtYWlsIiwic3RhdGUiOiJzdGF0ZTEyMzQiLCJub25jZSI6Im5vbmNlMTIzNCIsImRpc3BsYXkiOiJ0b3VjaCIsInByb21wdCI6Im5vbmUiLCJpZF90b2tlbiI6eyJjbGFpbXMiOnsiYWNyIjp7InZhbHVlcyI6WyIyIiwiMyIsIjQiXX19LCJtYXhfYWdlIjoxMH0sInVzZXJpbmZvIjp7ImNsYWltcyI6eyJuYW1lIjp7ImVzc2VudGlhbCI6dHJ1ZX0sImVtYWlsIjp7ImVzc2VudGlhbCI6ZmFsc2V9fX19.MLTDQVPdhAdkJhboM06IRtjHJrvamJ_H2vFGRupXmTA'
+      'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJjbGllbnRfaWQiOiJjbGllbnRfaWQiLCJyZXNwb25zZV90eXBlIjoidG9rZW4gaWRfdG9rZW4iLCJyZWRpcmVjdF91cmkiOiJodHRwczovL2NsaWVudC5leGFtcGxlLmNvbSIsInNjb3BlIjoib3BlbmlkIGVtYWlsIiwic3RhdGUiOiJzdGF0ZTEyMzQiLCJub25jZSI6Im5vbmNlMTIzNCIsImRpc3BsYXkiOiJ0b3VjaCIsInByb21wdCI6Im5vbmUiLCJ1c2VyaW5mbyI6eyJjbGFpbXMiOnsibmFtZSI6eyJlc3NlbnRpYWwiOnRydWV9LCJlbWFpbCI6eyJlc3NlbnRpYWwiOmZhbHNlfX19LCJpZF90b2tlbiI6eyJjbGFpbXMiOnsiYWNyIjp7InZhbHVlcyI6WyIyIiwiMyIsIjQiXX19LCJtYXhfYWdlIjoxMH19.yOc76jnkDusf5ZUzI5Gq7vnteTeOVUXd2Fr1EBZFNYU'
     end
     let(:jsonized) do
       {

data/spec/openid_connect/response_object/id_token_spec.rb

@@ -9,7 +9,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
   let :required_attributes do
     {
       iss: 'https://server.example.com',
-      user_id: 'user_id',
+      sub: 'user_id',
       aud: 'client_id',
       exp: ext,
       iat: iat
@@ -18,8 +18,8 @@ describe OpenIDConnect::ResponseObject::IdToken do
 
   describe 'attributes' do
     subject { klass }
-    its(:required_attributes) { should == [:iss, :user_id, :aud, :exp, :iat] }
-    its(:optional_attributes) { should == [:acr, :auth_time, :nonce, :user_jwk, :at_hash, :c_hash] }
+    its(:required_attributes) { should == [:iss, :sub, :aud, :exp, :iat] }
+    its(:optional_attributes) { should == [:acr, :auth_time, :nonce, :sub_jwk, :at_hash, :c_hash] }
   end
 
   describe '#verify!' do
@@ -217,7 +217,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
     subject { klass.decode id_token.to_jwt(private_key), public_key }
     let(:attributes) { required_attributes }
     it { should be_a klass }
-    [:iss, :user_id, :aud].each do |key|
+    [:iss, :sub, :aud].each do |key|
       its(key) { should == attributes[key] }
     end
     its(:exp) { should == attributes[:exp].to_i }
@@ -225,7 +225,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
     context 'when self-issued' do
       context 'when valid' do
         let(:self_issued) do
-          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NlbGYtaXNzdWVkLm1lIiwidXNlcl9pZCI6ImY2UW1VLVFEbEtmanlwMHd3UmNnRms3QUhIYVMyZnFud2lIMlRCdDl5WDgiLCJhdWQiOiJiYWZkOGI3ODdhMDQyOWRiZDBiNmY5ZTE4Mzk3OThjNDFkNGQxOTJhYWYzMTFhZGY0MGRhMmM0ZDQxNGU1OGZkIiwiZXhwIjoxMzUwMzI1OTg3LCJpYXQiOjEzNTAzMjIzODcsInVzZXJfandrIjp7ImFsZyI6IlJTQSIsImUiOiJBUUFCIiwibiI6Im9iSGdFR01ITU9JVU1OZmkxMFY1RXhCai10d3ljY0txV0hhb2tvaUs4TGRGazdTNnpLYndjUUUtaGRXc0NvT0xfZVhaU2VZRHp1UjhGbG1NcVYxdzB5LUlkdERaRmFBcHgxLTJhWWVnRGJwQmxRc29UWURvU09xVmpfeFRPNTlQX2s0bHk0WHk4bUp0UUktX1dlR3lLZXV2SXItQzVUV1RnYnBobkZaVjA4a29KOHE1WHZRRjJpdndoZ1cweXRvYi1fdzNtWkFOb1FDUGxhSWV3WUFXSGdMdFZ6OElweVVhTWlDWU5kVkZoQjlzMjdRLU1CVGw3OHMtcm01VjhJZXZWZE1jcFVGTDhNSktGaC0ydklhcHljZjhCVmtGUmUzYW42eV9BY2c3eEQ4RFFSc3N3SHRlMkFiT3FENkZrLTJMM255SUdyOVJUM0tKY3ByaFlwYkJndyJ9fQ.H4lZwnV4nY3eWPTSi3anelcQPvAs7zzwChYuHWnKGUSalLO53vQ9XNV8klrEAq8UQntNMtIly-DeCVBU6Hcg3W_ZBuB2EXn1X4Lc6vRRCPeHBFwt085m6zanQsvuiTllUJssUjTnFJvBO9juopMJvisJX7cxDfHpZQF52bWYXuDp5UEFs-8TXQuDpn02BaOnzW32vaf1Vx871EdlGj-NrOpzwWaqnDM0p0o6j8tQPl76WJIB8LIGWxA7sNMnt8YCykzZXofK17veogrFd4tsLYbzFp80oqz0vsCsw4Q3WgLBRgOfoCGB8wfFt7Wdu6clotDIviPqmfPPx1gls2_JJw'
+          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NlbGYtaXNzdWVkLm1lIiwic3ViIjoiUFdFYXFfVnlUd1hTSFR4QVlSZHdWTjNMN2s0UnNxOVBwaTZ4WHZ6ZGZWTSIsImF1ZCI6InRhcGlkLnRhcGlkZW50aXR5LmNvbSIsImV4cCI6MTM2MjI3OTkwMCwiaWF0IjoxMzYyMjc2MzAwLCJzdWJfandrIjp7ImFsZyI6IlJTQSIsIm4iOiJ5R21SUm5qSkk2VWhXYUtYcUJxa0RodDVQa0FPdDNqV2Y0SUxIdUlKZHJHR3h1ajBhcDIzLXlxaS16N29jZmF3dnlNbkRfakRpY0JjRTFtVHduZ2ZLRURMdmp5ZWw4U3VhZlZJWTR4ZDVDcG42Nlp4U2pocE1yTWZtMF9palZtdkQ0OTZHZzZSYUR4cHA4OEVqcUlaZUtyZEtqd2lOeTRGZ0dkVnZPQURXWG85R0xLenBOdlc2MGU3MkdrRGFkUVJncEhGNjNVaE9zaVltYmwxRVRMaVhLMGpUdldDdEZVdUlfT2lTN3hIUmU0X3FSaWxRc240cGlHTy1lNzJ2azRpaFlPaldoRXNpcnU2X0JtSC03YWs2Qk9lY3pUYTFVOFZyQzY1ZkRabzRxeG9uRWVoeVpVVnItSmxXMFVvbFVTS1dKOE1OMGRBV1VaeTFBZUxtRzliZlEiLCJlIjoiQVFBQiJ9fQ.obpb9tshLoZG6O32w4nB4I3nBtR_2mscVeNuPWZAGIwq9SqpiNF24KrGrhgbJMzRndafXbOdiiTFjq15BDwoSUrRF2H2EQXm1_lZxhw66JK4get7zEihtmsljGxB03LRlej-ec6baAKJxCBZdJ7SIantjgyt_WbAY27ImeryD7Wi9VKtgEzX2cFbU8u5VwxpisDfosp7fpp0_jdAdk948eJnercM-6t0a3UhLoLaW1RWZSbzXzef9aDuMezsnSrwafjYuF6dzUF7uAEdsYAzMeISch2_Gl4Twbrovmmqj50IKIctkLxQBTI1_v0oU63_a4jLami1cux8XTEfgPEPmg'
         end
 
         context 'when key == :self_issued' do
@@ -245,27 +245,27 @@ describe OpenIDConnect::ResponseObject::IdToken do
         end
       end
 
-      context 'when invalid user_id' do
+      context 'when invalid subject' do
         let(:self_issued) do
-          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NlbGYtaXNzdWVkLm1lIiwidXNlcl9pZCI6ImludmFsaWQiLCJhdWQiOiJ0YXBpZC50YXBpZGVudGl0eS5jb20iLCJleHAiOjEzNTAzMjYyNjEsImlhdCI6MTM1MDMyMjY2MSwidXNlcl9qd2siOnsiYWxnIjoiUlNBIiwibW9kIjoidnVLay1YdDR3bXF3Wl9HR2FXMTNVeV9RUExobThJVUM1SGpsZlJTZEpXRGY4bnRWV1p2bVRZcjEyd2tfUU1XN3RkQ25Eb0d2dnd0VVczajhIaTlEOG5aNW84c0FhSUxmbm1MSE9sdHNVT01IWTRlOWZtVzQ5eWJUS25sbFRkTGlJMy13NWJtZC1VTVE4WnBSQ2dhN0Z5WERMR2tpeXNrSTNtdjAxcUVfOURMc0dEVTFjWHBaM19TY05MY1RuN0hYSHRCcnVVOHhhOHZkUGxncEdXQjFTaTIxRWhubnNOQnZmUmkzUW9UcFlkbnFqTGk4NzQtWDd4anJWUDNzRURoRnNvdzdNR0s2WVF3X2JsNzAxdGJIU3F1SG5aWDZ0ZklQaFNMYVNWbXdGVzNTem9GdDBWNGxpbzlPOHhqNWlpQnBNV0cwcDd4MTJpYno1bEktaGYzcTJ3IiwieHBvIjoiQVFBQiJ9fQ.p_Zh-nLBVaDQXTvDe3YCDQsA8QKepMfEtEzmBBQEmnFEmLSDAcsTnAbkTNlRZ-BQ-CuEF_NFJ2KK0B8s4GEfb5IO3afBHi5nxk269d1BLypuLRG1oI5GWoO5kPPjcjdZHUHXv56w_c8KeOtRazCKhcVwvErs8vXi1hlAfln5cGMhJ-jlBztk1ZUHefvdCecGyqxzCVnjowA1MsMDhdchDX3njza6qxL8IkPZ04u57KnLsfYTh84jZ4vv0_5bdCs_-fSWXDMvyhDN69_YRT6QqX312421IJqDsIjUWk6VpCFi6Yti7iRZ8qixd5UVyxLHMkomY8okVG04oMHs9lMzDQ'
+          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJkZXZpY2VfdG9rZW4iOiI2NjYxNmI2NTJkNjQ2NTc2Njk2MzY1MmQ3NDZmNmI2NTZlIiwiaXNzIjoiaHR0cHM6Ly9zZWxmLWlzc3VlZC5tZSIsInN1YiI6IlBXRWFxX1Z5VHdYU0hUeEFZUmR3Vk4zTDdrNFJzcTlQcGk2eFh2emRmVk1pbnZhbGlkIiwiYXVkIjoidGFwaWQudGFwaWRlbnRpdHkuY29tIiwiZXhwIjoxMzYyMjgwMDQxLCJpYXQiOjEzNjIyNzY0NDEsInN1Yl9qd2siOnsiYWxnIjoiUlNBIiwibiI6InlHbVJSbmpKSTZVaFdhS1hxQnFrRGh0NVBrQU90M2pXZjRJTEh1SUpkckdHeHVqMGFwMjMteXFpLXo3b2NmYXd2eU1uRF9qRGljQmNFMW1Ud25nZktFREx2anllbDhTdWFmVklZNHhkNUNwbjY2WnhTamhwTXJNZm0wX2lqVm12RDQ5NkdnNlJhRHhwcDg4RWpxSVplS3JkS2p3aU55NEZnR2RWdk9BRFdYbzlHTEt6cE52VzYwZTcyR2tEYWRRUmdwSEY2M1VoT3NpWW1ibDFFVExpWEswalR2V0N0RlV1SV9PaVM3eEhSZTRfcVJpbFFzbjRwaUdPLWU3MnZrNGloWU9qV2hFc2lydTZfQm1ILTdhazZCT2VjelRhMVU4VnJDNjVmRFpvNHF4b25FZWh5WlVWci1KbFcwVW9sVVNLV0o4TU4wZEFXVVp5MUFlTG1HOWJmUSIsImUiOiJBUUFCIn19.K8NpQ1r89v9KFcrAU19-qTEtUv94gTJp25xwYwKPttkMOduGMIBn1lCTUsWhUC8NDc0lJrIq-MAa3Eav6wlW9HkX4Gw7vD-fwx6bijm_0LnxLcK2PwMPeeAaeztEOj6WNnUlipZAkOjYhFWG_4gK4sbnoXv80LSV3dHf0mwDEp0vWJ5rba24YfyFb_CoGfeluaHVQiCWTNFa4rh5ohCb1oC4IAZd607KNryLBbjGdyRgIgeIBtph_rx4Jf2tYhBs1_Y32KQMgKHy7QBJHD1hr2HEAu_pCXirwpNFcBCV7K5vUYntYSjdrKfvEzeW0Jxjm1AGgMZr_NsGwNS0bMYoUA'
         end
 
         it do
           expect do
             klass.decode self_issued, :self_issued
-          end.to raise_error OpenIDConnect::ResponseObject::IdToken::InvalidToken, 'Invalid user_id'
+          end.to raise_error OpenIDConnect::ResponseObject::IdToken::InvalidToken, 'Invalid subject'
         end
       end
 
-      context 'when no user_jwk' do
+      context 'when no sub_jwk' do
         let(:self_issued) do
-          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NlbGYtaXNzdWVkLm1lIiwidXNlcl9pZCI6IkN5amplQ0trLU9xSS1YcW5GYzduX1pSOG4xaXlLNFlIcXNzNkp1SHlnNkUiLCJhdWQiOiJ0YXBpZC50YXBpZGVudGl0eS5jb20iLCJleHAiOjEzNDkyNDg5NjAsImlhdCI6MTM0OTI0NTM2MH0.SyXFCTAAB0l29qxnfUxj5G217cQqVhCiPlQDCq_ZZmtZyGqM4eLI-5D2MPZTc905i10sbwKHTeKqwjhYki2pVOuU5n-N9duTlO64kimg8hAnwEJKsil9jvRPb5hCnc-5vRyXaRV3N1zYFurCEZFmVvXCg4ccKbA_viyuhIYtiMQPHOGY-ELFokfwsbEv11hi9d0kt89pfBMlDyEIZiEDYT0fEl-w7e8tPEk99rCzD_jkitTtdXv18_UsgeM2pDaO9G7_8wQYAX4ldHZjXSihKp2DuTY7edZpP4arYIFHPibtPVcKEnpmK-25mk9Ujo6k7N5kqz9SX6isktbE9-3W4Q'
+          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJkZXZpY2VfdG9rZW4iOiI2NjYxNmI2NTJkNjQ2NTc2Njk2MzY1MmQ3NDZmNmI2NTZlIiwiaXNzIjoiaHR0cHM6Ly9zZWxmLWlzc3VlZC5tZSIsInN1YiI6IlBXRWFxX1Z5VHdYU0hUeEFZUmR3Vk4zTDdrNFJzcTlQcGk2eFh2emRmVk0iLCJhdWQiOiJ0YXBpZC50YXBpZGVudGl0eS5jb20iLCJleHAiOjEzNjIyODAxNDQsImlhdCI6MTM2MjI3NjU0NH0.HtkguN4xOzJ-yh_kd2JCmG6fgDEiVY5VCgTWUD9l8YOgHjTT7LRZC3b1sNDgkdwBteX3eQIQOVxaYWp4-ftczaIlrznB0jxldqdEdB1Tr591YsiDcyOqmemo1ZYzOKhe_q1l68bdKKeHLc83BzlsJpS659uFDuixvF7G_HIJpCdwckX7x6H3KK73hCLzoYCOVgr_lkFRVVHHAJXzxiUuERLD7JIvg5jCbgmqxArP-jYBdbscHHx8i-UP3WYFBEORBM2rXJuJzGvk4sLhZ4NVGBWyr0DJlE-aWKTyeg-_-4kLPd3d68-k3nLJ82iCwcap-BU_5otSmXufN3_ffq_tTw'
         end
 
         it do
           expect do
             klass.decode self_issued, :self_issued
-          end.to raise_error OpenIDConnect::ResponseObject::IdToken::InvalidToken, 'Missing user_jwk'
+          end.to raise_error OpenIDConnect::ResponseObject::IdToken::InvalidToken, 'Missing sub_jwk'
         end
       end
     end
@@ -273,7 +273,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
 
   describe '.self_issued' do
     subject { self_issued }
-    let(:user_jwk) { JSON::JWK.new(public_key) }
+    let(:sub_jwk) { JSON::JWK.new(public_key) }
     let(:self_issued) do
       klass.self_issued(
         public_key: public_key,
@@ -283,19 +283,19 @@ describe OpenIDConnect::ResponseObject::IdToken do
       )
     end
 
-    [:iss, :user_id, :aud, :exp, :iat, :user_jwk].each do |attribute|
+    [:iss, :sub, :aud, :exp, :iat, :sub_jwk].each do |attribute|
       its(attribute) { should be_present }
     end
     its(:iss)      { should == 'https://self-issued.me' }
-    its(:user_jwk) { should == user_jwk }
-    its(:user_id)  { should == OpenIDConnect::ResponseObject::IdToken.self_issued_user_id(user_jwk) }
+    its(:sub_jwk) { should == sub_jwk}
+    its(:subject)  { should == OpenIDConnect::ResponseObject::IdToken.self_issued_subject(sub_jwk) }
   end
 
-  describe '.self_issued_user_id' do
+  describe '.self_issued_subject' do
     context 'when RSA key given' do
       let(:jwk) { JSON::JWK.new(public_key) }
       it do
-        user_id = klass.self_issued_user_id jwk
+        user_id = klass.self_issued_subject jwk
         user_id.should == UrlSafeBase64.encode64(
           OpenSSL::Digest::SHA256.digest([jwk[:n], jwk[:e]].join)
         )
@@ -306,7 +306,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
       let(:jwk) { JSON::JWK.new(ec_public_key) }
       it do
         expect do
-          user_id = klass.self_issued_user_id jwk
+          klass.self_issued_subject jwk
         end.to raise_error NotImplementedError
       end
     end
@@ -320,7 +320,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
 
       it do
         expect do
-          user_id = klass.self_issued_user_id jwk
+          klass.self_issued_subject jwk
         end.to raise_error OpenIDConnect::ResponseObject::IdToken::InvalidToken
       end
     end

data/spec/openid_connect/response_object/user_info/open_id_spec.rb

@@ -10,7 +10,7 @@ describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
     its(:required_attributes) { should == [] }
     its(:optional_attributes) do
       should == [
-        :user_id,
+        :sub,
         :name,
         :given_name,
         :family_name,
@@ -108,13 +108,13 @@ describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
   describe '#to_json' do
     let :attributes do
       {
-        user_id: 'nov.matake#12345',
+        sub: 'nov.matake#12345',
         address: {
           formatted: 'Tokyo, Japan'
         }
       }
     end
-    its(:to_json) { should include '"user_id":"nov.matake#12345"'}
+    its(:to_json) { should include '"sub":"nov.matake#12345"'}
     its(:to_json) { should include '"address":{"formatted":"Tokyo, Japan"}'}
   end
 end

data/spec/rack/oauth2/server/authorize/extension/code_and_id_token_and_token_spec.rb

@@ -10,7 +10,7 @@ describe Rack::OAuth2::Server::Authorize::Extension::CodeAndIdTokenAndToken do
   let :id_token do
     OpenIDConnect::ResponseObject::IdToken.new(
       iss: 'https://server.example.com',
-      user_id: 'user_id',
+      sub: 'user_id',
       aud: 'client_id',
       nonce: 'nonce',
       exp: 1313424327,

data/spec/rack/oauth2/server/authorize/extension/code_and_id_token_spec.rb

@@ -9,7 +9,7 @@ describe Rack::OAuth2::Server::Authorize::Extension::CodeAndIdToken do
   let :id_token do
     OpenIDConnect::ResponseObject::IdToken.new(
       iss: 'https://server.example.com',
-      user_id: 'user_id',
+      sub: 'user_id',
       aud: 'client_id',
       nonce: 'nonce',
       exp: 1313424327,

data/spec/rack/oauth2/server/authorize/extension/id_token_and_token_spec.rb

@@ -9,7 +9,7 @@ describe Rack::OAuth2::Server::Authorize::Extension::IdTokenAndToken do
   let :id_token do
     OpenIDConnect::ResponseObject::IdToken.new(
       iss: 'https://server.example.com',
-      user_id: 'user_id',
+      sub: 'user_id',
       aud: 'client_id',
       nonce: 'nonce',
       exp: 1313424327,

data/spec/rack/oauth2/server/authorize/extension/id_token_spec.rb

@@ -8,7 +8,7 @@ describe Rack::OAuth2::Server::Authorize::Extension::IdToken do
   let :id_token do
     OpenIDConnect::ResponseObject::IdToken.new(
       iss: 'https://server.example.com',
-      user_id: 'user_id',
+      sub: 'user_id',
       aud: 'client_id',
       nonce: 'nonce',
       exp: 1313424327,

data/spec/rack/oauth2/server/token/authorization_code_spec.rb

@@ -14,7 +14,7 @@ describe Rack::OAuth2::Server::Token::AuthorizationCode do
   let :id_token do
     OpenIDConnect::ResponseObject::IdToken.new(
       iss: 'https://server.example.com',
-      user_id: 'user_id',
+      sub: 'user_id',
       aud: 'client_id',
       exp: 1313424327,
       iat: 1313420327,

data/spec/rack/oauth2/server/token/refresh_token_spec.rb

@@ -13,7 +13,7 @@ describe Rack::OAuth2::Server::Token::RefreshToken do
   let :id_token do
     OpenIDConnect::ResponseObject::IdToken.new(
       iss: 'https://server.example.com',
-      user_id: 'user_id',
+      sub: 'user_id',
       aud: 'client_id',
       exp: 1313424327,
       iat: 1313420327,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: openid_connect
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.6.0
 platform: ruby
 authors:
 - nov matake
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-03-02 00:00:00.000000000 Z
+date: 2013-03-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json