openid_connect 0.6.1 → 2.3.0

data/spec/openid_connect/response_object/id_token_spec.rb

@@ -19,7 +19,20 @@ describe OpenIDConnect::ResponseObject::IdToken do
   describe 'attributes' do
     subject { klass }
     its(:required_attributes) { should == [:iss, :sub, :aud, :exp, :iat] }
-    its(:optional_attributes) { should == [:acr, :auth_time, :nonce, :sub_jwk, :at_hash, :c_hash] }
+    its(:optional_attributes) { should == [:acr, :amr, :azp, :jti, :sid, :auth_time, :nonce, :sub_jwk, :at_hash, :c_hash, :s_hash] }
+
+    describe 'auth_time' do
+      subject { id_token.auth_time }
+
+      context 'when Time object given' do
+        let(:attributes) do
+          required_attributes.merge(auth_time: Time.now)
+        end
+        it do
+          should be_a Numeric
+        end
+      end
+    end
   end
 
   describe '#verify!' do
@@ -28,7 +41,18 @@ describe OpenIDConnect::ResponseObject::IdToken do
         id_token.verify!(
           issuer: attributes[:iss],
           client_id: attributes[:aud]
-        ).should be_true
+        ).should == true
+      end
+
+      context 'when aud(ience) is an array of identifiers' do
+        let(:client_id) { 'client_id' }
+        let(:attributes) { required_attributes.merge(aud: ['some_other_identifier', client_id]) }
+        it do
+          id_token.verify!(
+            issuer: attributes[:iss],
+            client_id: client_id
+          ).should == true
+        end
       end
 
       context 'when expired' do
@@ -95,7 +119,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
             issuer: attributes[:iss],
             client_id: attributes[:aud],
             nonce: attributes[:nonce]
-          ).should be_true
+          ).should == true
         end
       end
 
@@ -133,7 +157,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
         t = id_token.to_jwt private_key do |t|
           t.header[:x5u] = "http://server.example.com/x5u"
         end
-        h = UrlSafeBase64.decode64 t.split('.').first
+        h = Base64.urlsafe_decode64 t.split('.').first
         h.should include 'x5u'
       end
     end
@@ -145,8 +169,9 @@ describe OpenIDConnect::ResponseObject::IdToken do
           jwt = JSON::JWT.decode t, public_key
           jwt.should include :at_hash
           jwt.should_not include :c_hash
-          jwt[:at_hash].should == UrlSafeBase64.encode64(
-            OpenSSL::Digest::SHA256.digest('access_token')[0, 128 / 8]
+          jwt[:at_hash].should == Base64.urlsafe_encode64(
+            OpenSSL::Digest::SHA256.digest('access_token')[0, 128 / 8],
+            padding: false
           )
         end
       end
@@ -169,8 +194,9 @@ describe OpenIDConnect::ResponseObject::IdToken do
         jwt = JSON::JWT.decode t, public_key
         jwt.should_not include :at_hash
         jwt.should include :c_hash
-        jwt[:c_hash].should == UrlSafeBase64.encode64(
-          OpenSSL::Digest::SHA256.digest('authorization_code')[0, 128 / 8]
+        jwt[:c_hash].should == Base64.urlsafe_encode64(
+          OpenSSL::Digest::SHA256.digest('authorization_code')[0, 128 / 8],
+          padding: false
         )
       end
     end
@@ -185,11 +211,13 @@ describe OpenIDConnect::ResponseObject::IdToken do
         jwt = JSON::JWT.decode t, public_key
         jwt.should include :at_hash
         jwt.should include :c_hash
-        jwt[:at_hash].should == UrlSafeBase64.encode64(
-          OpenSSL::Digest::SHA256.digest('access_token')[0, 128 / 8]
+        jwt[:at_hash].should == Base64.urlsafe_encode64(
+          OpenSSL::Digest::SHA256.digest('access_token')[0, 128 / 8],
+          padding: false
         )
-        jwt[:c_hash].should == UrlSafeBase64.encode64(
-          OpenSSL::Digest::SHA256.digest('authorization_code')[0, 128 / 8]
+        jwt[:c_hash].should == Base64.urlsafe_encode64(
+          OpenSSL::Digest::SHA256.digest('authorization_code')[0, 128 / 8],
+          padding: false
         )
       end
     end
@@ -221,11 +249,60 @@ describe OpenIDConnect::ResponseObject::IdToken do
       its(key) { should == attributes[key] }
     end
     its(:exp) { should == attributes[:exp].to_i }
+    its(:raw_attributes) { should be_instance_of JSON::JWS }
+
+    context 'when IdP config is given' do
+      subject { klass.decode id_token.to_jwt(private_key), idp_config }
+      let(:jwks) do
+        jwk_str = File.read(File.join(__dir__, '../../mock_response/public_keys/jwks_with_private_key.json'))
+        jwk = JSON::JWK::Set.new JSON.parse(jwk_str)
+      end
+      let(:idp_config) do
+        OpenIDConnect::Discovery::Provider::Config::Response.new(
+          issuer: attributes[:issuer],
+          authorization_endpoint: File.join(attributes[:iss], 'authorize'),
+          jwks_uri: File.join(attributes[:iss], 'jwks'),
+          response_types_supported: ['code'],
+          subject_types_supported: ['public'],
+          id_token_signing_alg_values_supported: ['RS256']
+        )
+      end
+
+      context 'when id_token has kid' do
+        let(:private_key) do
+          OpenSSL::PKey::RSA.new(
+            File.read(File.join(__dir__, '../../mock_response/public_keys/private_key.pem'))
+          ).to_jwk
+        end
+
+        it do
+          mock_json :get, idp_config.jwks_uri, 'public_keys/jwks_with_private_key' do
+            should be_a klass
+          end
+        end
+      end
+
+      context 'otherwise' do
+        let(:private_key) do
+          OpenSSL::PKey::RSA.new(
+            File.read(File.join(__dir__, '../../mock_response/public_keys/private_key.pem'))
+          )
+        end
+
+        it do
+          mock_json :get, idp_config.jwks_uri, 'public_keys/jwks_with_private_key' do
+            expect do
+              should
+            end.to raise_error JSON::JWK::Set::KidNotFound
+          end
+        end
+      end
+    end
 
     context 'when self-issued' do
       context 'when valid' do
         let(:self_issued) do
-          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NlbGYtaXNzdWVkLm1lIiwic3ViIjoiUFdFYXFfVnlUd1hTSFR4QVlSZHdWTjNMN2s0UnNxOVBwaTZ4WHZ6ZGZWTSIsImF1ZCI6InRhcGlkLnRhcGlkZW50aXR5LmNvbSIsImV4cCI6MTM2MjI3OTkwMCwiaWF0IjoxMzYyMjc2MzAwLCJzdWJfandrIjp7ImFsZyI6IlJTQSIsIm4iOiJ5R21SUm5qSkk2VWhXYUtYcUJxa0RodDVQa0FPdDNqV2Y0SUxIdUlKZHJHR3h1ajBhcDIzLXlxaS16N29jZmF3dnlNbkRfakRpY0JjRTFtVHduZ2ZLRURMdmp5ZWw4U3VhZlZJWTR4ZDVDcG42Nlp4U2pocE1yTWZtMF9palZtdkQ0OTZHZzZSYUR4cHA4OEVqcUlaZUtyZEtqd2lOeTRGZ0dkVnZPQURXWG85R0xLenBOdlc2MGU3MkdrRGFkUVJncEhGNjNVaE9zaVltYmwxRVRMaVhLMGpUdldDdEZVdUlfT2lTN3hIUmU0X3FSaWxRc240cGlHTy1lNzJ2azRpaFlPaldoRXNpcnU2X0JtSC03YWs2Qk9lY3pUYTFVOFZyQzY1ZkRabzRxeG9uRWVoeVpVVnItSmxXMFVvbFVTS1dKOE1OMGRBV1VaeTFBZUxtRzliZlEiLCJlIjoiQVFBQiJ9fQ.obpb9tshLoZG6O32w4nB4I3nBtR_2mscVeNuPWZAGIwq9SqpiNF24KrGrhgbJMzRndafXbOdiiTFjq15BDwoSUrRF2H2EQXm1_lZxhw66JK4get7zEihtmsljGxB03LRlej-ec6baAKJxCBZdJ7SIantjgyt_WbAY27ImeryD7Wi9VKtgEzX2cFbU8u5VwxpisDfosp7fpp0_jdAdk948eJnercM-6t0a3UhLoLaW1RWZSbzXzef9aDuMezsnSrwafjYuF6dzUF7uAEdsYAzMeISch2_Gl4Twbrovmmqj50IKIctkLxQBTI1_v0oU63_a4jLami1cux8XTEfgPEPmg'
+          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NlbGYtaXNzdWVkLm1lIiwic3ViIjoiMmdDUWFLUmJkY0RaeUlDTE92ODJJR2EtdHBSVU52QW1ZN3BnZ3Z5NGdENCIsImF1ZCI6ImNsaWVudC5leGFtcGxlLmNvbSIsImV4cCI6MTQ0MjQ4Mjc4MiwiaWF0IjoxNDQxODc3OTgyLCJzdWJfandrIjp7Imt0eSI6IlJTQSIsImUiOiJBUUFCIiwibiI6IjN1RzNiSTV6MTFhM1hlOXUyZFVJNDBpcWZrVl9vTmFQVmNlalN4V3l0YnMybTZKMGMzNjJESlJQNGtyUl9TZjNtQXJ3Qjd6Qm5UWExkbW1tZW85VzloSDhsSnFGOUthMTY3dHBTQWJCajB1MjhyaTgwZFZ4NUxzblJTX19uUUd6Y3dNa2sxTTBERUx2X0FXbVYwU2JudDhJZEpSeFhwdG5xRE5tWXJ0cmItMkk0a1lwRHlwN2pvTXd0bDNXeGp2cnkwbENLNExqOU9SeXdod05zYUU2MHFsako5aHBGZV8wTmpmaThzaVBlMDRJSkFaUjl3NXo0TnAtQS1HbWdmeTNJTmNZVFYyQ25FekNSY29HSGl5OGduRzA1a015TnRtZTFVdV8xanBhdF9lcF9QUG9PWEJ6Q1NwbzB5QlRNSWhmdEJTQ3p2a2V1ZFdhNks2aW5LMkYxdyJ9fQ.wchF80oFxdjEcOEwPZ9TUlV6R96Vz8XK9MzednMOsZmEMnNSEqKKTyO0Mhp9lijJPZX8J7lTtAGkz4gfsjyoYBIHQOTf0qHRHSx9RTeC31whw1TJ9x5V6UXpKN0EW1EhjAEGIZ0EyFJ-cRTgVs0V7PT7e63JOUYyW6LqqHa4MV9SdK8BdnaN0D4-402Pf7yFqjneSHq3KZbXcgjUPT_hszsGvnn9qEyuIHQqON6YnDt55z5SvP_RfKtBfUe2VY-yglJT41LfhkIgpvjLYdYYRPh9G9ftJr17qht5RtHSNpTp4FPw7BR7rCnptb4xTxyq-sLu7qjSLRtqQ35Xpi_6qQ'
         end
 
         context 'when key == :self_issued' do
@@ -247,7 +324,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
 
       context 'when invalid subject' do
         let(:self_issued) do
-          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJkZXZpY2VfdG9rZW4iOiI2NjYxNmI2NTJkNjQ2NTc2Njk2MzY1MmQ3NDZmNmI2NTZlIiwiaXNzIjoiaHR0cHM6Ly9zZWxmLWlzc3VlZC5tZSIsInN1YiI6IlBXRWFxX1Z5VHdYU0hUeEFZUmR3Vk4zTDdrNFJzcTlQcGk2eFh2emRmVk1pbnZhbGlkIiwiYXVkIjoidGFwaWQudGFwaWRlbnRpdHkuY29tIiwiZXhwIjoxMzYyMjgwMDQxLCJpYXQiOjEzNjIyNzY0NDEsInN1Yl9qd2siOnsiYWxnIjoiUlNBIiwibiI6InlHbVJSbmpKSTZVaFdhS1hxQnFrRGh0NVBrQU90M2pXZjRJTEh1SUpkckdHeHVqMGFwMjMteXFpLXo3b2NmYXd2eU1uRF9qRGljQmNFMW1Ud25nZktFREx2anllbDhTdWFmVklZNHhkNUNwbjY2WnhTamhwTXJNZm0wX2lqVm12RDQ5NkdnNlJhRHhwcDg4RWpxSVplS3JkS2p3aU55NEZnR2RWdk9BRFdYbzlHTEt6cE52VzYwZTcyR2tEYWRRUmdwSEY2M1VoT3NpWW1ibDFFVExpWEswalR2V0N0RlV1SV9PaVM3eEhSZTRfcVJpbFFzbjRwaUdPLWU3MnZrNGloWU9qV2hFc2lydTZfQm1ILTdhazZCT2VjelRhMVU4VnJDNjVmRFpvNHF4b25FZWh5WlVWci1KbFcwVW9sVVNLV0o4TU4wZEFXVVp5MUFlTG1HOWJmUSIsImUiOiJBUUFCIn19.K8NpQ1r89v9KFcrAU19-qTEtUv94gTJp25xwYwKPttkMOduGMIBn1lCTUsWhUC8NDc0lJrIq-MAa3Eav6wlW9HkX4Gw7vD-fwx6bijm_0LnxLcK2PwMPeeAaeztEOj6WNnUlipZAkOjYhFWG_4gK4sbnoXv80LSV3dHf0mwDEp0vWJ5rba24YfyFb_CoGfeluaHVQiCWTNFa4rh5ohCb1oC4IAZd607KNryLBbjGdyRgIgeIBtph_rx4Jf2tYhBs1_Y32KQMgKHy7QBJHD1hr2HEAu_pCXirwpNFcBCV7K5vUYntYSjdrKfvEzeW0Jxjm1AGgMZr_NsGwNS0bMYoUA'
+          'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NlbGYtaXNzdWVkLm1lIiwic3ViIjoiUFdFYXFfVnlUd1hTSFR4QVlSZHdWTjNMN2s0UnNxOVBwaTZ4WHZ6ZGZWTSIsImF1ZCI6InRhcGlkLnRhcGlkZW50aXR5LmNvbSIsImV4cCI6MTM2MjI3OTkwMCwiaWF0IjoxMzYyMjc2MzAwLCJzdWJfandrIjp7Imt0eSI6IlJTQSIsImUiOiJBUUFCIiwibiI6IjRGTWl5M08zbFlOd2RzeC15aXVjemRsek81eU11d1p4WFlzSDgydmM0RkM0QXgyMGpNVV94emJHSUhWVUtFQ0pndFp3clBlajhRSWUtZFZFYXQtaGxjNTB5TXluM0h3cmtJVjVZOTdET1E2Sks4azk2QTFqVWxPLW5sRjl4ZUx2VDlwYTJXRTZtYm1KOG5EQW5mR0d6bmRNd3VKNzVLZDI2YmZHY21wcm5qUUJLTkVrakdJbW9MMEhFODFUcjROeC1tN1lsYkRGaVFNRDVpYjhCY3N4S0tvMTZTeG5tSi1EeUY2c094Y2JtV1ZrdkZBa3FKWFBnVFVoNXVYT3YwYk9nN0I2d2RHdUMtWnpJUl8tdUx3YlcxN2V4NGx3ZTFPb0ppdFJ3SFczYlo3NEc3RkdoSmhfTUp4YzB3WXBkbW5uNVpjRFFOWl9sWVRvMHYzaU1PUWk3USJ9fQ.DZKaSne22DjKFSpSUphsTeCMkcMWDexQCm8BPb1nI1PzQYsEAOfwumDajt85UA0x28y2zuOevMj29VpwTzbpRDkduv2NWAI4MHw8DYEsIN__-QGANmdU1sKmthET2iFmeFySwWomLqFvYIaNmVYVLkD53Zqfct5qH3Wznd_hrK8T1d6Cxg-gyZlAeqEu2V8EL2yuz8Gdaeze4b78l5Ux-B_5FQhZ3UkXbL1B2gzKJQVKAQdFJb9zUfzmCeIiUmeM9mw_VU64tAvFDRiTKS1P6b62Gxuyx1DhMLFg2evDaTJERJOta9ywtPfdcLH3qcIiUBffP2-FnAz44bOlKzJorQ'
         end
 
         it do
@@ -286,43 +363,8 @@ describe OpenIDConnect::ResponseObject::IdToken do
     [:iss, :sub, :aud, :exp, :iat, :sub_jwk].each do |attribute|
       its(attribute) { should be_present }
     end
-    its(:iss)      { should == 'https://self-issued.me' }
+    its(:iss)     { should == 'https://self-issued.me' }
     its(:sub_jwk) { should == sub_jwk}
-    its(:subject)  { should == OpenIDConnect::ResponseObject::IdToken.self_issued_subject(sub_jwk) }
-  end
-
-  describe '.self_issued_subject' do
-    context 'when RSA key given' do
-      let(:jwk) { JSON::JWK.new(public_key) }
-      it do
-        user_id = klass.self_issued_subject jwk
-        user_id.should == UrlSafeBase64.encode64(
-          OpenSSL::Digest::SHA256.digest([jwk[:n], jwk[:e]].join)
-        )
-      end
-    end
-
-    context 'when EC key given' do
-      let(:jwk) { JSON::JWK.new(ec_public_key) }
-      it do
-        expect do
-          klass.self_issued_subject jwk
-        end.to raise_error NotImplementedError
-      end
-    end
-
-    context 'when unknown algorithm JWK given' do
-      let(:jwk) do
-        {
-          alg: 'unknown'
-        }
-      end
-
-      it do
-        expect do
-          klass.self_issued_subject jwk
-        end.to raise_error OpenIDConnect::ResponseObject::IdToken::InvalidToken
-      end
-    end
+    its(:subject) { should == sub_jwk.thumbprint }
   end
-end
+end

data/spec/openid_connect/response_object/user_info/{open_id/address_spec.rb → address_spec.rb}

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
-describe OpenIDConnect::ResponseObject::UserInfo::OpenID::Address do
-  let(:klass) { OpenIDConnect::ResponseObject::UserInfo::OpenID::Address }
+describe OpenIDConnect::ResponseObject::UserInfo::Address do
+  let(:klass) { OpenIDConnect::ResponseObject::UserInfo::Address }
 
   describe 'attributes' do
     subject { klass }
@@ -20,7 +20,7 @@ describe OpenIDConnect::ResponseObject::UserInfo::OpenID::Address do
       let :attributes do
         {}
       end
-      its(:valid?) { should be_false }
+      its(:valid?) { should == false }
       its(:errors) { should include :base }
     end
   end

data/spec/openid_connect/response_object/{user_info/open_id_spec.rb → user_info_spec.rb}

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
-describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
-  let(:klass) { OpenIDConnect::ResponseObject::UserInfo::OpenID }
+describe OpenIDConnect::ResponseObject::UserInfo do
+  let(:klass) { OpenIDConnect::ResponseObject::UserInfo }
   let(:instance) { klass.new attributes }
   subject { instance }
 
@@ -27,8 +27,9 @@ describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
         :zoneinfo,
         :locale,
         :phone_number,
+        :phone_number_verified,
         :address,
-        :updated_time
+        :updated_at
       ]
     end
   end
@@ -44,7 +45,7 @@ describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
       let :attributes do
         {}
       end
-      its(:valid?) { should be_false }
+      its(:valid?) { should == false }
       its(:errors) { should include :base }
     end
 
@@ -52,16 +53,16 @@ describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
       let :attributes do
         {email: 'nov@localhost'}
       end
-      its(:valid?) { should be_false }
+      its(:valid?) { should == false }
       its(:errors) { should include :email }
     end
 
-    [:email_verified, :gender, :zoneinfo].each do |one_of_list|
+    [:email_verified, :zoneinfo].each do |one_of_list|
       context "when #{one_of_list} is invalid" do
         let :attributes do
           {one_of_list => 'Out of List'}
         end
-        its(:valid?) { should be_false }
+        its(:valid?) { should == false }
         its(:errors) { should include one_of_list }
       end
     end
@@ -75,7 +76,7 @@ describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
         let :attributes do
           {url => 'Invalid'}
         end
-        its(:valid?) { should be_false }
+        its(:valid?) { should == false }
         its(:errors) { should include url }
       end
     end
@@ -84,7 +85,7 @@ describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
       let :attributes do
         {address: {}}
       end
-      its(:valid?) { should be_false }
+      its(:valid?) { should == false }
       its(:errors) { should include :address }
     end
   end
@@ -94,14 +95,14 @@ describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
       let :attributes do
         {address: {}}
       end
-      its(:address) { should be_a OpenIDConnect::ResponseObject::UserInfo::OpenID::Address }
+      its(:address) { should be_a OpenIDConnect::ResponseObject::UserInfo::Address }
     end
 
     context 'when Address is given' do
       let :attributes do
-        {address: OpenIDConnect::ResponseObject::UserInfo::OpenID::Address.new}
+        {address: OpenIDConnect::ResponseObject::UserInfo::Address.new}
       end
-      its(:address) { should be_a OpenIDConnect::ResponseObject::UserInfo::OpenID::Address }
+      its(:address) { should be_a OpenIDConnect::ResponseObject::UserInfo::Address }
     end
   end
 

data/spec/openid_connect_spec.rb

@@ -4,24 +4,24 @@ describe OpenIDConnect do
   after { OpenIDConnect.debugging = false }
 
   its(:logger) { should be_a Logger }
-  its(:debugging?) { should be_false }
+  its(:debugging?) { should == false }
 
   describe '.debug!' do
     before { OpenIDConnect.debug! }
-    its(:debugging?) { should be_true }
+    its(:debugging?) { should == true }
   end
 
   describe '.debug' do
     it 'should enable debugging within given block' do
       OpenIDConnect.debug do
-        SWD.debugging?.should be_true
-        WebFinger.debugging?.should be_true
-        Rack::OAuth2.debugging?.should be_true
-        OpenIDConnect.debugging?.should be_true
+        SWD.debugging?.should == true
+        WebFinger.debugging?.should == true
+        Rack::OAuth2.debugging?.should == true
+        OpenIDConnect.debugging?.should == true
       end
-      SWD.debugging?.should be_false
-      Rack::OAuth2.debugging?.should be_false
-      OpenIDConnect.debugging?.should be_false
+      SWD.debugging?.should == false
+      Rack::OAuth2.debugging?.should == false
+      OpenIDConnect.debugging?.should == false
     end
 
     it 'should not force disable debugging' do
@@ -30,15 +30,15 @@ describe OpenIDConnect do
       Rack::OAuth2.debug!
       OpenIDConnect.debug!
       OpenIDConnect.debug do
-        SWD.debugging?.should be_true
-        WebFinger.debugging?.should be_true
-        Rack::OAuth2.debugging?.should be_true
-        OpenIDConnect.debugging?.should be_true
+        SWD.debugging?.should == true
+        WebFinger.debugging?.should == true
+        Rack::OAuth2.debugging?.should == true
+        OpenIDConnect.debugging?.should == true
       end
-      SWD.debugging?.should be_true
-      WebFinger.debugging?.should be_true
-      Rack::OAuth2.debugging?.should be_true
-      OpenIDConnect.debugging?.should be_true
+      SWD.debugging?.should == true
+      WebFinger.debugging?.should == true
+      Rack::OAuth2.debugging?.should == true
+      OpenIDConnect.debugging?.should == true
     end
   end
 
@@ -46,12 +46,12 @@ describe OpenIDConnect do
     context 'with http_config' do
       before do
         OpenIDConnect.http_config do |config|
-          config.ssl_config.verify_mode = OpenSSL::SSL::VERIFY_NONE
+          config.ssl.verify = false
         end
       end
       it 'should configure OpenIDConnect, SWD and Rack::OAuth2\'s http_client' do
         [OpenIDConnect, SWD, WebFinger, Rack::OAuth2].each do |klass|
-          klass.http_client.ssl_config.verify_mode.should == OpenSSL::SSL::VERIFY_NONE
+          klass.http_client.ssl.verify.should be_falsy
         end
       end
     end

data/spec/rack/oauth2/server/authorize/extension/code_and_id_token_and_token_spec.rb

@@ -53,4 +53,15 @@ describe Rack::OAuth2::Server::Authorize::Extension::CodeAndIdTokenAndToken do
       expect { response }.to raise_error AttrRequired::AttrMissing, "'access_token', 'code', 'id_token' required."
     end
   end
+
+  context 'when error response' do
+    let(:env)     { Rack::MockRequest.env_for("/authorize?client_id=client_id") }
+    let(:request) { Rack::OAuth2::Server::Authorize::Extension::CodeAndIdTokenAndToken::Request.new env }
+
+    it 'should set protocol_params_location = :fragment' do
+      expect { request.bad_request! }.to raise_error(Rack::OAuth2::Server::Authorize::BadRequest) { |e|
+        e.protocol_params_location.should == :fragment
+      }
+    end
+  end
 end

data/spec/rack/oauth2/server/authorize/extension/code_and_id_token_spec.rb

@@ -50,4 +50,15 @@ describe Rack::OAuth2::Server::Authorize::Extension::CodeAndIdToken do
       expect { response }.to raise_error AttrRequired::AttrMissing, "'id_token' required."
     end
   end
+
+  context 'when error response' do
+    let(:env)     { Rack::MockRequest.env_for("/authorize?client_id=client_id") }
+    let(:request) { Rack::OAuth2::Server::Authorize::Extension::CodeAndIdToken::Request.new env }
+
+    it 'should set protocol_params_location = :fragment' do
+      expect { request.bad_request! }.to raise_error(Rack::OAuth2::Server::Authorize::BadRequest) { |e|
+        e.protocol_params_location.should == :fragment
+      }
+    end
+  end
 end

data/spec/rack/oauth2/server/authorize/extension/id_token_and_token_spec.rb

@@ -51,4 +51,15 @@ describe Rack::OAuth2::Server::Authorize::Extension::IdTokenAndToken do
       expect { response }.to raise_error AttrRequired::AttrMissing, "'id_token' required."
     end
   end
+
+  context 'when error response' do
+    let(:env)     { Rack::MockRequest.env_for("/authorize?client_id=client_id") }
+    let(:request) { Rack::OAuth2::Server::Authorize::Extension::IdTokenAndToken::Request.new env }
+
+    it 'should set protocol_params_location = :fragment' do
+      expect { request.bad_request! }.to raise_error(Rack::OAuth2::Server::Authorize::BadRequest) { |e|
+        e.protocol_params_location.should == :fragment
+      }
+    end
+  end
 end

data/spec/rack/oauth2/server/authorize/extension/id_token_spec.rb

@@ -62,7 +62,7 @@ describe Rack::OAuth2::Server::Authorize::Extension::IdToken do
     let(:env)     { Rack::MockRequest.env_for("/authorize?client_id=client_id&scope=openid") }
     let(:request) { Rack::OAuth2::Server::Authorize::Extension::IdToken::Request.new env }
     it do
-      request.openid_connect_request?.should be_true
+      request.openid_connect_request?.should == true
     end
   end
 end

data/spec/rack/oauth2/server/authorize/request_with_connect_params_spec.rb

@@ -0,0 +1,45 @@
+require 'spec_helper'
+
+describe Rack::OAuth2::Server::Authorize::RequestWithConnectParams do
+  let(:base_params) do
+    {
+      client_id: 'client_id',
+      redirect_uri: 'https://client.example.com/callback'
+    }
+  end
+  let(:env)     { Rack::MockRequest.env_for("/authorize?#{base_params.to_query}&#{params.to_query}") }
+  let(:request) { Rack::OAuth2::Server::Authorize::Request.new env }
+  subject { request }
+
+  describe 'prompt' do
+    context 'when a space-delimited string given' do
+      let(:params) do
+        {prompt: 'login consent'}
+      end
+      its(:prompt) { should == ['login', 'consent']}
+    end
+
+    context 'when a single string given' do
+      let(:params) do
+        {prompt: 'login'}
+      end
+      its(:prompt) { should == ['login']}
+    end
+  end
+
+  describe 'max_age' do
+    context 'when numeric value given' do
+      let(:params) do
+        {max_age: '5'}
+      end
+      its(:max_age) { should == 5}
+    end
+
+    context 'when non-numeric string given' do
+      let(:params) do
+        {max_age: 'foo'}
+      end
+      its(:max_age) { should == 0}
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -1,7 +1,18 @@
-require 'cover_me'
+require 'simplecov'
+
+SimpleCov.start do
+  add_filter 'spec'
+end
 
 require 'rspec'
+require 'rspec/its'
 require 'openid_connect'
 
+RSpec.configure do |config|
+  config.expect_with :rspec do |c|
+    c.syntax = [:should, :expect]
+  end
+end
+
 require 'helpers/crypto_spec_helper'
 require 'helpers/webmock_helper'