rack-oidc-api 0.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 7873572d744e42c94d3de3fee764ed8da0bbb195
+  data.tar.gz: 6280ec7b6e5dbd384569d74616f12723cfea9161
+SHA512:
+  metadata.gz: 663cd76417eb3b1c66d98671cdb81aa428e2db9584026071959bba36b3b3dc084bed894c01bc641d639ba89df895792c5713bd9358ef2a89db2fad4b9af45b8e
+  data.tar.gz: 0dbb6c08bbb125b4fea95012267637b82c35cbb9bdba1b5dd5d077e6f1250d314c7957f0b20ca2a77254f61a0f6843eb4bcc059bfb4f5fe3bfc834ec742be99c

data/lib/rack-oidc-api/middleware.rb

@@ -0,0 +1,173 @@
+require 'json'
+require 'thread'
+require 'net/http'
+require 'jwt'
+
+module RackOidcApi
+    BEARER_TOKEN_REGEX = %r{
+        \ABearer\s{1}(      # starts with Bearer and a single space
+        [a-zA-Z0-9\-\_]+\.  # 1 or more chars followed by a single period
+        [a-zA-Z0-9\-\_]+\.  # 1 or more chars followed by a single period
+        [a-zA-Z0-9\-\_]+    # 1 or more chars
+        )\z                 # nothing trailing
+    }ix
+
+    ALGORITHMS = %w(RS256 RS384 RS512)
+
+    class Middleware
+        def initialize(app, opts)
+            @app = app
+
+            raise "provider must be specified" if !opts[:provider]
+            raise "audience must be specified" if !opts[:audience]
+
+            @provider = opts[:provider].gsub(/\/\z/, '')
+            @audience = opts[:audience]
+            @pinned_cert = opts[:pinned_provider_ssl]
+            @lock = Mutex.new
+
+            reload_options
+        end
+
+        def reload_options
+            begin
+                oidc_config_uri = URI("#{@provider}/.well-known/openid-configuration")
+                oidc_config_raw = http_get(oidc_config_uri)
+                raise "Failed to retrieve OIDC Discovery Data" unless oidc_config_raw
+                oidc_config = JSON.parse(oidc_config_raw)
+                raise "Invalid or missing OIDC Discovery Data" unless oidc_config
+
+                jwks_uri = oidc_config['jwks_uri']
+                raise "No JWKS URI in OIDC Discovery" unless jwks_uri
+
+                # Do not allow JWKS from a different origin (scheme, host, port)
+                jwks_uri = URI(jwks_uri)
+                jwks_uri.scheme = oidc_config_uri.scheme
+                jwks_uri.host = oidc_config_uri.host
+                jwks_uri.port = oidc_config_uri.port
+
+                jwks_raw = http_get(jwks_uri)
+                raise "Failed to retrieve JWKS File" unless jwks_raw
+                
+                jwks = JSON.parse(jwks_raw)
+                algorithms = ALGORITHMS - (ALGORITHMS - oidc_config['id_token_signing_alg_values_supported'] || [])
+
+                keys = []
+                jwks['keys'].each do |key|
+                    rec = {}
+                    key.each do |k, v|
+                        rec[k.to_sym] = v
+                    end
+                    keys << rec
+                end
+
+                @jwks = {keys: keys}
+                @algorithms = algorithms
+                @valid = Time.now + 300
+                @avail = true
+            rescue JSON::JSONError
+                @avail = false
+                @valid = Time.now + 60
+            rescue StandardError => e
+                STDERR.puts(e.message)
+                @avail = false
+                @valid = Time.now + 60
+            rescue URI::InvalidURIError => e
+                STDERR.puts(e.message)
+                @avail = false
+                @valid = Time.now + 60
+            end
+        end
+
+        def check_reload
+            locked = @lock.try_lock
+            return unless locked # Only have one reload checking thread at once
+            begin
+                if @valid < Time.now
+                    reload_options
+                end
+            ensure
+                @lock.unlock
+            end
+        end
+
+        def call(env)
+            header = env['HTTP_AUTHORIZATION']
+            if !header
+                return mkerror("Missing Authorization Header")
+            end
+
+            if !header.match(BEARER_TOKEN_REGEX)
+                return mkerror("Invalid Bearer token")
+            end
+
+            _, token = header.split(/\s/, 2)
+
+            check_reload
+            if !@avail
+                return mkerror("OIDC provider unavailable")
+            end
+
+            jwk_loader = proc do |options|
+                @jwks
+            end
+
+            begin
+                jwt = JWT.decode(token, nil, true, {
+                    algorithms: @algorithms,
+                    jwks: jwk_loader,
+                    aud: @audience,
+                    verify_aud: true,
+                    nbf_leeway: 30,
+                    exp_leeway: 30
+                })
+                env[:identity_token] = jwt
+            rescue JWT::JWKError => e
+                # Handle problems with the provided JWKs
+                return mkerror("Invalid Bearer token")
+            rescue JWT::DecodeError => e
+                # Handle other decode related issues e.g. no kid in header, no matching public key found etc. 
+                return mkerror(e.message)
+            end
+
+            @app.call(env)
+        end
+
+        private
+
+        def mkerror(message)
+            body    = { error: message }.to_json
+            headers = { 'Content-Type' => 'application/json' }
+
+            [401, headers, [body]]
+        end
+
+        def http_get(uri)
+            http = Net::HTTP.new(uri.host, uri.port)
+            http.use_ssl = uri.scheme != 'http'
+            http.verify_mode = OpenSSL::SSL::VERIFY_PEER # Make sure we're verifying
+            if @pinned_cert
+                http.verify_callback = lambda do | preverify_ok, cert_store |
+                    return false unless preverify_ok
+
+                    # We only want to verify once, and fail the first time the callback
+                    # is invoked (as opposed to checking only the last time it's called).
+                    # Therefore we get at the whole authorization chain.
+                    # The end certificate is at the beginning of the chain (the certificate
+                    # for the host we are talking to)
+                    end_cert = cert_store.chain[0]
+
+                    # Only perform the checks if the current cert is the end certificate
+                    # in the chain. We can compare using the DER representation
+                    # (OpenSSL::X509::Certificate objects are not comparable, and for 
+                    # a good reason). If we don't we are going to perform the verification
+                    # many times - once per certificate in the chain of trust, which is wasteful
+                    return true unless end_cert.to_der == cert_store.current_cert.to_der
+
+                    public_key = end_cert.public_key.to_pem
+                    @pinned_cert == public_key || @pinned_cert == OpenSSL::Digest::SHA256.hexdigest(public_key)
+                end                  
+            end
+        end
+    end
+end

metadata

@@ -0,0 +1,74 @@
+--- !ruby/object:Gem::Specification
+name: rack-oidc-api
+version: !ruby/object:Gem::Version
+  version: 0.0.2
+platform: ruby
+authors:
+- Tim Goddard <tim@goddard.nz>
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2020-02-10 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+description: 
+email: 
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/rack-oidc-api/middleware.rb
+homepage: 
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.2.1
+signing_key: 
+specification_version: 4
+summary: rack-oidc-api provides a JWT validation middleware which automatically discovers
+  the settings supported by a given OIDC provider, and validates the token against
+  the published keys.
+test_files: []