openid_connect 0.3.3 → 0.3.4

data/Gemfile

@@ -1,10 +1,2 @@
-source "http://rubygems.org"
-
-group :test do
-  platforms :jruby do
-    gem 'jruby-openssl', '>= 0.7'
-  end
-end
-
-# Specify your gem's dependencies in openid_connect.gemspec
+source :rubygems
 gemspec

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    openid_connect (0.3.2)
+    openid_connect (0.3.4)
       activemodel (>= 3)
       attr_required (>= 0.0.5)
       json (>= 1.4.3)
@@ -23,8 +23,7 @@ GEM
       multi_json (~> 1.0)
     addressable (2.3.2)
     attr_required (0.0.5)
-    bouncy-castle-java (1.5.0146.1)
-    builder (3.0.3)
+    builder (3.0.4)
     configatron (2.9.1)
       yamler (>= 0.1.0)
     cover_me (1.2.0)
@@ -33,12 +32,11 @@ GEM
     crack (0.3.1)
     diff-lcs (1.1.3)
     hashie (1.2.0)
-    httpclient (2.2.7)
+    httpclient (2.3.0.1)
     i18n (0.6.1)
-    jruby-openssl (0.7.7)
-      bouncy-castle-java (>= 1.5.0146.1)
     json (1.7.5)
-    json-jwt (0.3.0)
+    json (1.7.5-java)
+    json-jwt (0.3.2)
       activesupport (>= 2.3)
       i18n
       json (>= 1.4.3)
@@ -51,7 +49,7 @@ GEM
     multi_json (1.3.6)
     polyglot (0.3.3)
     rack (1.4.1)
-    rack-oauth2 (0.14.9)
+    rack-oauth2 (1.0.0)
       activesupport (>= 2.3)
       attr_required (>= 0.0.5)
       httpclient (>= 2.2.0.2)
@@ -67,13 +65,13 @@ GEM
     rspec-expectations (2.11.3)
       diff-lcs (~> 1.1.3)
     rspec-mocks (2.11.3)
-    swd (0.2.0)
+    swd (0.2.1)
       activesupport (>= 3)
       attr_required (>= 0.0.5)
       httpclient (>= 2.2.1)
       i18n
       json (>= 1.4.3)
-    treetop (1.4.10)
+    treetop (1.4.11)
       polyglot
       polyglot (>= 0.3.1)
     tzinfo (0.3.33)
@@ -94,7 +92,6 @@ PLATFORMS
 
 DEPENDENCIES
   cover_me (>= 1.2.0)
-  jruby-openssl (>= 0.7)
   openid_connect!
   rake (>= 0.8)
   rspec (>= 2)

data/Rakefile

@@ -4,22 +4,16 @@ Bundler::GemHelper.install_tasks
 require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new(:spec)
 
-if RUBY_VERSION >= '1.9'
-  namespace :cover_me do
-    desc "Generates and opens code coverage report."
-    task :report do
-      require 'cover_me'
-      CoverMe.complete!
-    end
-  end
-  task :spec do
-    Rake::Task['cover_me:report'].invoke
-  end
-else
-  RSpec::Core::RakeTask.new(:rcov) do |spec|
-    spec.rcov = true
-    spec.rcov_opts = ['-Ilib -Ispec --exclude spec,gems']
+namespace :cover_me do
+  desc "Generates and opens code coverage report."
+  task :report do
+    require 'cover_me'
+    CoverMe.complete!
   end
 end
 
-task :default => :spec
+task :spec do
+  Rake::Task['cover_me:report'].invoke
+end
+
+task default: :spec

data/VERSION

@@ -1 +1 @@
-0.3.3
+0.3.4

data/lib/openid_connect.rb

@@ -54,7 +54,7 @@ module OpenIDConnect
 
   def self.http_client
     _http_client_ = HTTPClient.new(
-      :agent_name => "OpenIDConnect (#{VERSION})"
+      agent_name: "OpenIDConnect (#{VERSION})"
     )
     _http_client_.request_filter << Debugger::RequestFilter.new if debugging?
     http_config.try(:call, _http_client_)

data/lib/openid_connect/access_token.rb

@@ -10,7 +10,7 @@ module OpenIDConnect
 
     def user_info!(schema = :openid)
       hash = resource_request do
-        get client.user_info_uri, :schema => schema
+        get client.user_info_uri, schema: schema
       end
       ResponseObject::UserInfo::OpenID.new hash
     end
@@ -21,7 +21,7 @@ module OpenIDConnect
       res = yield
       case res.status
       when 200
-        JSON.parse(res.body, :symbolize_names => true)
+        JSON.parse res.body, symbolize_names: true
       when 400
         raise BadRequest.new('API Access Faild', res)
       when 401

data/lib/openid_connect/client.rb

@@ -26,10 +26,10 @@ module OpenIDConnect
     end
 
     def handle_success_response(response)
-      token_hash = JSON.parse(response.body, :symbolize_names => true)
+      token_hash = JSON.parse response.body, symbolize_names: true
       case token_type = token_hash[:token_type].try(:downcase)
       when 'bearer'
-        AccessToken.new token_hash.merge(:client => self)
+        AccessToken.new token_hash.merge(client: self)
       else
         raise Exception.new("Unexpected Token Type: #{token_type}")
       end

data/lib/openid_connect/client/registrar.rb

@@ -54,16 +54,16 @@ module OpenIDConnect
         alias_method_chain _attr_, :split
       end
 
-      validates :type,                  :presence => true
-      validates :client_id,             :presence => {:if => lambda { |c| ['client_update', 'rotate_secret'].include?(c.type.to_s) }}
-      validates :sector_identifier_url, :presence => {:if => :sector_identifier_required?}
+      validates :type,                  presence: true
+      validates :client_id,             presence: {if: ->(c) { ['client_update', 'rotate_secret'].include?(c.type.to_s) }}
+      validates :sector_identifier_url, presence: {if: :sector_identifier_required?}
 
-      validates :type,             :inclusion => {:in => ['client_associate', 'rotate_secret', 'client_update']}
-      validates :application_type, :inclusion => {:in => ['native', 'web']},      :allow_nil => true
-      validates :user_id_type,     :inclusion => {:in => ['pairwise', 'public']}, :allow_nil => true
-      validates :token_endpoint_auth_type, :inclusion => {
-        :in => ['client_secret_post', 'client_secret_basic', 'client_secret_jwt', 'private_key_jwt']
-      }, :allow_nil => true
+      validates :type,             inclusion: {in: ['client_associate', 'rotate_secret', 'client_update']}
+      validates :application_type, inclusion: {in: ['native', 'web']},      allow_nil: true
+      validates :user_id_type,     inclusion: {in: ['pairwise', 'public']}, allow_nil: true
+      validates :token_endpoint_auth_type, inclusion: {
+        in: ['client_secret_post', 'client_secret_basic', 'client_secret_jwt', 'private_key_jwt']
+      }, allow_nil: true
 
       validates(
         :logo_url,
@@ -73,7 +73,8 @@ module OpenIDConnect
         :x509_url,
         :x509_encryption_url,
         :sector_identifier_url,
-        :url => true, :allow_nil => true
+        url: true,
+        allow_nil: true
       )
 
       validate :validate_contacts
@@ -209,7 +210,7 @@ module OpenIDConnect
           access_token
         else
           Rack::OAuth2::AccessToken::Bearer.new(
-            :access_token => access_token
+            access_token: access_token
           )
         end
       end
@@ -225,11 +226,11 @@ module OpenIDConnect
       end
 
       def handle_success_response(response)
-        credentials = JSON.parse(response.body, :symbolize_names => true)
+        credentials = JSON.parse response.body, symbolize_names: true
         Client.new(
-          :identifier => credentials[:client_id],
-          :secret     => credentials[:client_secret],
-          :expires_in => credentials[:expires_in]
+          identifier: credentials[:client_id],
+          secret:     credentials[:client_secret],
+          expires_in: credentials[:expires_in]
         )
       end
 

data/lib/openid_connect/discovery/principal.rb

@@ -16,11 +16,11 @@ module OpenIDConnect
 
       def discover!(cache_options = {})
         SWD.discover!(
-          :principal => identifier,
-          :service => Provider::SERVICE_URI,
-          :host => host,
-          :port => port,
-          :cache => cache_options
+          principal: identifier,
+          service:   Provider::SERVICE_URI,
+          host:      host,
+          port:      port,
+          cache: cache_options
         )
       rescue SWD::Exception => e
         raise DiscoveryFailed.new(e.message)

data/lib/openid_connect/discovery/provider/config.rb

@@ -4,7 +4,7 @@ module OpenIDConnect
       class Config
         def self.discover!(identifier, cache_options = {})
           principal = Principal.parse(identifier)
-          Resource.new(principal.host).discover!(cache_options)
+          Resource.new(principal).discover!(cache_options)
         rescue SWD::Exception => e
           raise DiscoveryFailed.new(e.message)
         end

data/lib/openid_connect/discovery/provider/config/resource.rb

@@ -7,14 +7,15 @@ module OpenIDConnect
 
           class Expired < SWD::Resource::Expired; end
 
-          def initialize(host)
-            @host = host
+          def initialize(principal)
+            @host = principal.host
+            @port = principal.port unless [80, 443].include?(principal.port)
             @path ||= '/.well-known/openid-configuration'
             attr_missing!
           end
 
           def endpoint
-            SWD.url_builder.build [nil, host, nil, path, nil, nil]
+            SWD.url_builder.build [nil, host, port, path, nil, nil]
           rescue URI::Error => e
             raise SWD::Exception.new(e.message)
           end

data/lib/openid_connect/discovery/provider/config/response.rb

@@ -17,7 +17,7 @@ module OpenIDConnect
             :jwk_url,
             :jwk_encryption_url,
             :x509_url,
-            :x509_encryption_ur,
+            :x509_encryption_url,
             :registration_endpoint,
             :scopes_supported,
             :response_types_supported,
@@ -52,6 +52,46 @@ module OpenIDConnect
               value.nil?
             end
           end
+
+          def signing_key
+            x509_public_key || jwk_public_key
+          end
+
+          def encryption_key
+            if x509_encryption_url
+              x509_public_key :for_encryption
+            elsif jwk_encryption_url
+              jwk_public_key :for_encryption
+            else
+              signing_key
+            end
+          end
+
+          private
+
+          def x509_public_key(for_encryption = false)
+            endpoint = if for_encryption
+              x509_encryption_url || x509_url
+            else
+              x509_url
+            end
+            if endpoint
+              cert = OpenSSL::X509::Certificate.new OpenIDConnect.http_client.get_content(endpoint)
+              cert.public_key
+            end
+          end
+
+          def jwk_public_key(for_encryption = false)
+            endpoint = if for_encryption
+              jwk_encryption_url || jwk_url
+            else
+              jwk_url
+            end
+            if endpoint
+              jwk_set = JSON.parse OpenIDConnect.http_client.get_content(endpoint), symbolize_names: true
+              JSON::JWK.decode jwk_set[:keys].first
+            end
+          end
         end
       end
     end

data/lib/openid_connect/request_object/claimable.rb

@@ -15,11 +15,11 @@ module OpenIDConnect
             _claims_[key] = case value
             when :optional, :voluntary
               {
-                :essential => false
+                essential: false
               }
             when :required, :essential
               {
-                :essential => true
+                essential: true
               }
             else
               value

data/lib/openid_connect/response_object/id_token.rb

@@ -40,7 +40,7 @@ module OpenIDConnect
           public_key = JSON::JWK.decode jwk
           user_id_base_string = case public_key
           when OpenSSL::PKey::RSA
-            [jwk[:mod], jwk[:exp]].join
+            [jwk[:mod], jwk[:xpo]].join
           when OpenSSL::PKey::EC
             raise NotImplementedError.new('Not Implemented Yet')
           else

data/lib/openid_connect/response_object/user_info/open_id.rb

@@ -24,11 +24,11 @@ module OpenIDConnect
           :phone_number
         )
 
-        validates :email_verified, :inclusion => {:in => [true, false]},                       :allow_nil => true
-        validates :gender,   :inclusion => {:in => ['male', 'female']},                        :allow_nil => true
-        validates :zoneinfo, :inclusion => {:in => TZInfo::TimezoneProxy.all.collect(&:name)}, :allow_nil => true
-        validates :profile, :picture, :website, :url => true, :allow_nil => true
-        validates :email, :email => true, :allow_nil => true
+        validates :email_verified, inclusion: {in: [true, false]},                             allow_nil: true
+        validates :gender,         inclusion: {in: ['male', 'female']},                        allow_nil: true
+        validates :zoneinfo,       inclusion: {in: TZInfo::TimezoneProxy.all.collect(&:name)}, allow_nil: true
+        validates :profile, :picture, :website, url: true, allow_nil: true
+        validates :email, email: true, allow_nil: true
         validate :validate_address
         validate :require_at_least_one_attributes
         # TODO: validate locale

data/lib/rack/oauth2/server/authorize/error_with_connect_ext.rb

@@ -4,13 +4,13 @@ module Rack
       class Authorize
         module ErrorWithConnectExt
           DEFAULT_DESCRIPTION = {
-            :invalid_redirect_uri => 'The redirect_uri in the request does not match any of pre-registered redirect_uris.',
-            :interaction_required => 'End-User interaction required.',
-            :login_required => 'End-User authentication required.',
-            :session_selection_required => 'The End-User is required to select a session at the Authorization Server.',
-            :consent_required => 'End-User consent required.',
-            :invalid_request_uri => 'The request_uri in the request returns an error or invalid data.',
-            :invalid_openid_request_object => 'The request parameter contains an invalid OpenID Request Object.'
+            invalid_redirect_uri: 'The redirect_uri in the request does not match any of pre-registered redirect_uris.',
+            interaction_required: 'End-User interaction required.',
+            login_required: 'End-User authentication required.',
+            session_selection_required: 'The End-User is required to select a session at the Authorization Server.',
+            consent_required: 'End-User consent required.',
+            invalid_request_uri: 'The request_uri in the request returns an error or invalid data.',
+            invalid_openid_request_object: 'The request parameter contains an invalid OpenID Request Object.'
           }
 
           def self.included(klass)

data/lib/rack/oauth2/server/id_token_response.rb

@@ -9,7 +9,7 @@ module Rack::OAuth2::Server
 
         def protocol_params_with_id_token
           protocol_params_without_id_token.merge(
-            :id_token => id_token
+            id_token: id_token
           )
         end
         alias_method_chain :protocol_params, :id_token

data/openid_connect.gemspec

@@ -20,11 +20,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "swd", ">= 0.1.2"
   s.add_runtime_dependency "rack-oauth2", ">= 0.14.2"
   s.add_development_dependency "rake", ">= 0.8"
-  if RUBY_VERSION >= '1.9'
-    s.add_development_dependency "cover_me", ">= 1.2.0"
-  else
-    s.add_development_dependency "rcov", ">= 0.9"
-  end
   s.add_development_dependency "rspec", ">= 2"
   s.add_development_dependency "webmock", ">= 1.6.2"
+  s.add_development_dependency "cover_me", ">= 1.2.0"
 end

data/spec/mock_response/public_keys/jwk.json

@@ -0,0 +1,7 @@
+{
+  "keys": [{
+    "alg": "RSA",
+    "xpo": "AQAB",
+    "mod": "u4liYNFzgsRr1ERdUY7CY6r4nefi3RzIhK5fdPgdZSMEEflACWAuJu21_TcDpbZ1-6Kbq7zShFsVTAnBkWdO7EP1Rsn11fZpi9m_zEq_uRY-4RpNwp3S9xSdoQ4F3-js1EMaDQ6km0-c0gvr_TyhFqDj_6w_Bb0vFptfGXwfKewPPnhsi7GJ62ihZ32PzxOvEIYcaoXr9xaeudYD3BzWSDmjKGA7PMaEuBhScdUAoibCmsKB-yAGsz2amHnUhcl4B_EBs6wk65Y7ge0ZQJUOGPdUQL49VuALKmr7cMhHKh5KuQmPAi_20K2uZL_EFDaObDWZrclx98s0DmfTRKINtw"
+  }]
+}

data/spec/mock_response/public_keys/x509.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDeDCCAmACCQDFeFSXWEnHxDANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJK
+UDEOMAwGA1UECAwFVG9reW8xEDAOBgNVBAcMB1NoaWJ1eWExITAfBgNVBAoMGElu
+dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEMMAoGA1UEAwwDTm92MRwwGgYJKoZIhvcN
+AQkBFg1ub3ZAbWF0YWtlLmpwMB4XDTExMDkxMzEzMjIzNFoXDTEyMDkxMjEzMjIz
+NFowfjELMAkGA1UEBhMCSlAxDjAMBgNVBAgMBVRva3lvMRAwDgYDVQQHDAdTaGli
+dXlhMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxDDAKBgNVBAMM
+A05vdjEcMBoGCSqGSIb3DQEJARYNbm92QG1hdGFrZS5qcDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAKSsm7NFmh1P8uHB8Vm5vFs4+uh7XMhZ+xYd5/vf
+ak17ucjWt9DEWCGH0g8HvSVXNSVKBsONcqtkrXRgSeNB8YnIYxPmKKX7twefEJYC
+b06FG1g+IJkwxoDBsUMbb9RJ9snnWsp0O97A6SCvtdiSQ2Oeab3/jwokkPTo8WS4
+lRipQpQ7rOOP7r9t+9G/SDdiYhDhfmuyQamkxGCz6V2qClg0pyTaJ6+/bS9E+4ri
+ZjtZe9OaDt2NE0PiDS2Oo5yhv0abL8rxjZ8D/aTL3D9aYSrFmddKH7roSRkafCMU
+C/UX80/OzrxdEQUjtVO94dPWD/nKK1g7JyiIuk280aTeWA8CAwEAATANBgkqhkiG
+9w0BAQsFAAOCAQEAdiNDw9z6U8lIF0NWVObeGqoxn/MSp/W5S56ts3agw0meqc1J
+gUPkncXbpjZ/wX0Y3pupmGBIO0XAHPhjyCu3HhplhaVxSNqKEg9wB3huYaMZ2Kbi
++Wy77hLO2hOYk8vI/ok5oW0lhhpA0o4GzbyV4SA3nZgT0u8YXC7cqAHqI9KsBU5z
+62mjlptCR/b10xTlC13AtbdDM6s1hWP9XpDrm6Kxgfu7nKQ1Q31ag1Ukm9Gw8qcl
+ILxZxqbqGy/q1C+6ObTmGtiVbJTs+W8u5BPg9S49O6qIhVN5wWCT4lRrlpXpYA3a
+TTVBULB1g7Iod2g+kF0qAXnwqGvZ5LOgwFfmcw==
+-----END CERTIFICATE-----