rack_entra_id_auth 1.3.3 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbee29e061f4499a9a8ddfe96f7cb76a0c57c25fa98a10d2edbe830ba832dccd
-  data.tar.gz: dd246584193ba03782c92e41a7b72e32824c8ecd4515678b4ed39e6e5ec35c8a
+  metadata.gz: d4de08ceb491ee5f4fc94eafde1b0a76710a9db7fcc0a0cae198ec66ef993dd0
+  data.tar.gz: e9e3ef35102d6f5d88fe13abd5f812c7e18c930391e0432b061934e742ac6bbf
 SHA512:
-  metadata.gz: e4c3cee936287beec22c6593a36c18e4d82f4b0d99ba9a4d768bddd7108b661f24cbe32b5082697ebb3a166f44fc9230c0d6419bd8865705e2f8e0a1934f4a03
-  data.tar.gz: c88a785fea49772f49920d7b09dfbeeb116675b4111d652ecf237bc0fbcd9d6fc9c331c0e0d04af1a0295d6c6eee19946589a16ae502672c63d9d9d8c423352a
+  metadata.gz: 0fe33f7129a61e27ef94042734c5110ac756e74e7969012a607fc06a5171fad01e459f763ea790fab85e26c296fd8670da9fce9ec2f879d787605d12a424929a
+  data.tar.gz: 5cdf8ed28ed3208bdc06fc70b580f30dc366f6722fd73938fd01c6c7e882c8fd405543b09a9c000fad4f8c32fc80336a795e2a5a7fc0a3377938e077b49c235a

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2024 David Susco
+Copyright (c) 2026 David Susco
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -1,35 +1,128 @@
 # RackEntraIdAuth
 
-TODO: Delete this and the text below, and describe your gem
+Rails-aware Rack middleware for Microsoft Entra ID (SAML) authentication, built on [ruby-saml](https://github.com/SAML-Toolkits/ruby-saml).
 
-Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/rack_entra_id_auth`. To experiment with that code, run `bin/console` for an interactive prompt.
+The middleware handles single sign-on and single logout with Entra ID. It stores the user's SAML attributes in the session and redirects any `401 Unauthorized` response from your app to the Entra ID login. In development it can run a mock login server instead, so you don't need a real IdP.
+
+## Requirements
+
+- Ruby 3.2+
+- Rails 7.2+
+- Rack 3.2+
 
 ## Installation
 
-TODO: Replace `UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG` with your gem name right after releasing it to RubyGems.org. Please do not do it earlier due to security reasons. Alternatively, replace this section with instructions to install your gem from git if you don't plan to release to RubyGems.org.
+Add the gem to your Gemfile:
+
+```ruby
+gem 'rack_entra_id_auth'
+```
+
+Or install it straight from GitHub:
+
+```ruby
+gem 'rack_entra_id_auth', github: 'dsusco/rack_entra_id_auth'
+```
+
+Then run `bundle install`. In a Rails app the middleware is added automatically by the gem's Railtie.
+
+## Setup
+
+Generate the initializer, then fill in your Entra ID (IdP) and app (SP) settings:
+
+```bash
+bin/rails generate rack_entra_id_auth:initializer
+```
+
+This creates `config/initializers/rack_entra_id_auth.rb`, which documents every available setting. A minimal configuration looks like this:
+
+```ruby
+RackEntraIdAuth.configure do |config|
+  config.idp_sso_service_url = 'https://login.microsoftonline.com/<tenant>/saml2'
+  config.idp_slo_service_url = 'https://login.microsoftonline.com/<tenant>/saml2'
+  config.idp_cert            = '<Entra ID X.509 certificate>'
+
+  config.sp_entity_id                   = 'https://your.app/'
+  config.assertion_consumer_service_url = 'https://your.app/saml/login'
+  config.single_logout_service_url      = 'https://your.app/saml/logout'
+end
+```
+
+Instead of setting the IdP values by hand, you can load them from your Entra ID app's federation metadata URL:
+
+```ruby
+config.metadata_url = 'https://login.microsoftonline.com/<tenant>/federationmetadata/2007-06/federationmetadata.xml?appid=<app id>'
+```
 
-Install the gem and add to the application's Gemfile by executing:
+The middleware intercepts requests to the assertion consumer service and single logout URLs, so make sure they don't clash with routes in your app.
 
-    $ bundle add UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG
+Optionally, generate `login` and `logout` routes so you can use `login_path` and `logout_path` helpers in your views:
 
-If bundler is not being used to manage dependencies, install the gem by executing:
+```bash
+bin/rails generate rack_entra_id_auth:routes
+```
 
-    $ gem install UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG
+### Mock server
+
+The mock server is **on by default**. It shows a simple login page where you pick one of the users defined in `config.mock_attributes`. Turn it off wherever you use Entra ID.
+
+This setting must go in `config/application.rb` or an environment file, not the initializer, because the middleware is chosen before initializers run:
+
+```ruby
+# config/environments/production.rb
+config.rack_entra_id_auth.mock_server = false
+```
 
 ## Usage
 
-TODO: Write usage instructions here
+To require a login, return a `401`. The middleware turns it into a redirect to Entra ID (or the mock login page), and sends the user back to the original URL afterwards.
 
-## Development
+```ruby
+class ApplicationController < ActionController::Base
+  before_action :authenticate!
+
+  private
+
+    def authenticate!
+      head :unauthorized if current_user.blank?
+    end
+
+    def current_user
+      session[:entra_id]
+    end
+end
+```
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+After login, `session[:entra_id]` holds the user's SAML attributes, for example `displayname`, `emailaddress`, `name` and `groups`. You can change the session key with `config.session_key`, and change how attributes are stored with `config.session_value_proc`.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+Linking to `/login` or `/logout` starts a login or logout. Add a `relay_state` query parameter to choose where the user lands afterwards:
 
-## Contributing
+```erb
+<%= link_to 'Log out', logout_path(relay_state: root_url) %>
+```
+
+To leave paths alone entirely (health checks, public assets), list them as strings or regular expressions:
+
+```ruby
+config.exclude_paths = ['/up', %r{\A/assets/}]
+```
+
+### Single logout
+
+Single logout is disabled by default, so `/logout` only clears the local session. To also sign the user out of Entra ID, switch to a session store that can be cleared server-side, such as [entra_id_active_record_session_store](https://github.com/dsusco/entra_id_active_record_session_store), then set:
+
+```ruby
+config.skip_single_logout = false
+```
+
+## Development
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/rack_entra_id_auth.
+```bash
+bundle install
+bundle exec rake test
+bundle exec rubocop
+```
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+Available as open source under the terms of the [MIT License](MIT-LICENSE).

data/lib/generators/rack_entra_id_auth/templates/config_initializer.rb

@@ -94,8 +94,8 @@ RackEntraIdAuth.configure do |config|
   # requests and should be set below as well.
 
   # config.idp_entity_id                  = ''
-  config.idp_sso_service_url            = "IdP SINGLE SIGN-ON SERVICE URL"
-  config.idp_slo_service_url            = "IdP SINGLE LOGOUT SERVICE URL"
+  config.idp_sso_service_url            = 'IdP SINGLE SIGN-ON SERVICE URL'
+  config.idp_slo_service_url            = 'IdP SINGLE LOGOUT SERVICE URL'
   # config.idp_slo_response_service_url   = ''
   config.idp_cert                       = 'IdP X509CERTIFICATE'
   # config.idp_cert_fingerprint           = ''

data/lib/rack_entra_id_auth/configuration.rb

@@ -1,11 +1,9 @@
-require 'active_support/configurable'
+require 'active_support/core_ext/object/blank'
 require 'ruby-saml'
 
 module RackEntraIdAuth
   class Configuration
-    include ActiveSupport::Configurable
-
-    RUBY_SAML_SETTINGS = %i(
+    RUBY_SAML_SETTINGS = %i[
       idp_entity_id
       idp_sso_service_url
       idp_slo_service_url
@@ -40,54 +38,53 @@ module RackEntraIdAuth
       authn_context_decl_ref
       security
       soft
-    )
+    ].freeze
 
-    RUBY_SAML_SETTINGS.each { |ruby_saml_setting| config_accessor ruby_saml_setting }
+    DEFAULTS = {
+      exclude_paths: [],
+      login_path: '/login',
+      logout_path: '/logout',
+      # mock_server must be set in `config/application.rb` or an environment-
+      # specific configuration file. I.e. it must happen before initializers as
+      # it's used in the initializer created in the Railtie.
+      mock_server: true,
+      mock_attributes: {},
+      session_key: :entra_id,
+      session_value_proc: proc do |attributes|
+        attributes.each_with_object({}) do |(key, value), memo|
+          key = key.split('/').last
+          value = value.first if value.is_a?(Array) and value.length.eql?(1) and !key.eql?('groups')
+          memo[key] = value
+        end
+      end,
+      skip_single_logout: true
+    }.freeze
 
-    config_accessor :exclude_paths, default: []
-    config_accessor :login_path, default: '/login'
-    config_accessor :login_relay_state_url
-    config_accessor :logout_path, default: '/logout'
-    config_accessor :logout_relay_state_url
-    # mock_server must be set in `config/application.rb` or an environment-
-    # specific configuration file. I.e. it must happen before initializers as
-    # it's used in the initializer created in the Railtie.
-    config_accessor :mock_server, default: true
-    config_accessor :mock_attributes, default: {}
-    config_accessor :session_key, default: :entra_id
-    config_accessor :session_value_proc, default: Proc.new { |attributes|
-      attributes.inject({}) do |memo, (key, value)|
-        key = key.split('/').last
-        value = value.first if value.kind_of?(Array) and value.length.eql?(1) and !key.eql?('groups')
-        memo[key] = value
-        memo
-      end
-    }
-    config_accessor :skip_single_logout, default: true
+    attr_accessor(*RUBY_SAML_SETTINGS, *DEFAULTS.keys, :login_relay_state_url, :logout_relay_state_url)
+    attr_reader :metadata_url
+
+    def initialize
+      DEFAULTS.each { |key, value| public_send("#{key}=", value.dup) }
+    end
 
     def configuration_options (configuration_options = {})
       configuration_options.slice(:metadata_url, *RUBY_SAML_SETTINGS).each do |key, value|
-        self.send("#{key}=", value) unless value.nil?
+        send("#{key}=", value) unless value.nil?
       end
     end
 
-    def metadata_url
-      @metadata_url
-    end
-
     def metadata_url= (metadata_url)
       @metadata_url = metadata_url
 
-      OneLogin::RubySaml::IdpMetadataParser.new.parse_remote_to_hash(metadata_url)
-        .slice(*RUBY_SAML_SETTINGS).each do |key, value|
-          self.send("#{key}=", value) unless value.nil?
-        end
+      idp_settings = OneLogin::RubySaml::IdpMetadataParser.new.parse_remote_to_hash(metadata_url)
 
-      @metadata_url
+      idp_settings.slice(*RUBY_SAML_SETTINGS).each do |key, value|
+        send("#{key}=", value) unless value.nil?
+      end
     end
 
     def ruby_saml_settings
-      config.to_h.slice(*RUBY_SAML_SETTINGS).compact
+      RUBY_SAML_SETTINGS.to_h { |key| [key, public_send(key)] }.compact
     end
   end
 end

data/lib/rack_entra_id_auth/entra_id_request.rb

@@ -1,3 +1,5 @@
+require 'uri'
+require 'active_support/core_ext/object/blank'
 require 'ruby-saml'
 
 module RackEntraIdAuth
@@ -97,7 +99,22 @@ module RackEntraIdAuth
     # @return [String]
     #
     def relay_state_url
-      request.get_header('rack.request.form_hash')['RelayState'] rescue request.params['RelayState'] || base_url
+      safe_redirect_url(request.POST['RelayState'].presence || request.GET['RelayState']) || base_url
+    end
+
+    # Returns the URL if it's an http(s) URL on the same host as the request,
+    # otherwise returns nil. Used to keep relay state redirects on-site.
+    #
+    # @param url [String]
+    #
+    # @return [String|nil]
+    #
+    def safe_redirect_url (url)
+      uri = URI.parse(url.to_s)
+
+      url if uri.is_a?(URI::HTTP) and uri.host.eql?(request.host)
+    rescue URI::InvalidURIError
+      nil
     end
 
     # A single sign-on response for the SAMLResponse in the request's header.
@@ -119,16 +136,21 @@ module RackEntraIdAuth
     # @return [OneLogin::RubySaml::Response] A single sign-on response for a
     #         Service Provideer initiated single sign-on request.
     #
-    def saml_auth_response (auth_request_id: request.session[:auth_request_id], skip_conditions: false, allowed_clock_drift: nil, skip_subject_confirmation: false, skip_recipient_check: false, skip_audience: false)
+    def saml_auth_response (auth_request_id: request.session[:auth_request_id],
+                            skip_conditions: false,
+                            allowed_clock_drift: nil,
+                            skip_subject_confirmation: false,
+                            skip_recipient_check: false,
+                            skip_audience: false)
       response = OneLogin::RubySaml::Response.new(
         saml_response,
-        { :settings => @saml_settings,
-          :matches_request_id => auth_request_id,
-          :skip_conditions => skip_conditions,
-          :allowed_clock_drift => allowed_clock_drift,
-          :skip_subject_confirmation => skip_subject_confirmation,
-          :skip_recipient_check => skip_recipient_check,
-          :skip_audience => skip_audience })
+        { settings: @saml_settings,
+          matches_request_id: auth_request_id,
+          skip_conditions: skip_conditions,
+          allowed_clock_drift: allowed_clock_drift,
+          skip_subject_confirmation: skip_subject_confirmation,
+          skip_recipient_check: skip_recipient_check,
+          skip_audience: skip_audience })
 
       # the auth request's ID is no longer needed
       request.session.delete(:auth_request_id)
@@ -152,9 +174,9 @@ module RackEntraIdAuth
     def saml_logout_request (allowed_clock_drift: nil, relax_signature_validation: false)
       OneLogin::RubySaml::SloLogoutrequest.new(
         request.params['SAMLRequest'],
-        { :settings => @saml_settings,
-          :allowed_clock_drift => allowed_clock_drift,
-          :relax_signature_validation => relax_signature_validation })
+        { settings: @saml_settings,
+          allowed_clock_drift: allowed_clock_drift,
+          relax_signature_validation: relax_signature_validation })
     end
 
     # A single logout response for the SAMLResponse in the request's query
@@ -175,9 +197,9 @@ module RackEntraIdAuth
       logout_response = OneLogin::RubySaml::Logoutresponse.new(
         request.params['SAMLResponse'],
         @saml_settings,
-        { :get_params => request.params,
-          :matches_request_id => logout_request_id,
-          :relax_signature_validation => relax_signature_validation })
+        { get_params: request.params,
+          matches_request_id: logout_request_id,
+          relax_signature_validation: relax_signature_validation })
 
       # the logout request's ID is no longer needed
       request.session.delete(:logout_request_id)
@@ -222,13 +244,13 @@ module RackEntraIdAuth
     def slo_url (params = {})
       logout_request = OneLogin::RubySaml::Logoutrequest.new
 
-      if @saml_settings.idp_slo_service_url.present?
-        # store the logout request's uuid to validate it in the response
-        request.session[:logout_request_id] = logout_request.uuid
+      return unless @saml_settings.idp_slo_service_url.present?
 
-        # return nil if no single logout url is set
-        logout_request.create(@saml_settings, params)
-      end
+      # store the logout request's uuid to validate it in the response
+      request.session[:logout_request_id] = logout_request.uuid
+
+      # return nil if no single logout url is set
+      logout_request.create(@saml_settings, params)
     end
 
     # Returns a single sign-on authentication request URL for the settings
@@ -251,7 +273,7 @@ module RackEntraIdAuth
     private
 
       def saml_response
-        request.get_header('rack.request.form_hash').try(:[], 'SAMLResponse')
+        request.POST['SAMLResponse']
       end
   end
 end

data/lib/rack_entra_id_auth/middleware.rb

@@ -17,7 +17,7 @@ module RackEntraIdAuth
         log(env, 'Redirecting login request to Entra ID single sign-on URL…')
 
         sso_url = entra_id_request.sso_url(
-          { :RelayState => request.params['relay_state'] ||
+          { RelayState: entra_id_request.safe_redirect_url(request.params['relay_state']) ||
                            RackEntraIdAuth.config.login_relay_state_url ||
                            entra_id_request.base_url })
 
@@ -33,11 +33,11 @@ module RackEntraIdAuth
         # destroy session in case single logout fails
         destroy_session(request.session)
 
-        relay_state_url = request.params['relay_state'] ||
+        relay_state_url = entra_id_request.safe_redirect_url(request.params['relay_state']) ||
                           RackEntraIdAuth.config.logout_relay_state_url ||
                           entra_id_request.base_url
 
-        slo_url = entra_id_request.slo_url({ :RelayState => relay_state_url })
+        slo_url = entra_id_request.slo_url({ RelayState: relay_state_url })
 
         if request.params['skip_single_logout'].blank? and
            !RackEntraIdAuth.config.skip_single_logout and
@@ -63,15 +63,15 @@ module RackEntraIdAuth
       if entra_id_request.login_response?
         log(env, 'Received single login response…')
 
-        auth_response = entra_id_request.saml_auth_response()
+        auth_response = entra_id_request.saml_auth_response
 
-        if !auth_response.is_valid?
+        unless auth_response.is_valid?
           log(env, "Invalid single login reponse from Entra ID: #{auth_response.errors.first}")
 
           return internal_server_error_response("Invalid single login reponse from Entra ID: #{auth_response.errors.first}")
         end
 
-        if !auth_response.success?
+        unless auth_response.success?
           log(env, 'Unsuccessful single single reponse from Entra ID.')
 
           return internal_server_error_response('Unsuccessful single login reponse from Entra ID.')
@@ -91,9 +91,9 @@ module RackEntraIdAuth
       if entra_id_request.logout_request? and !RackEntraIdAuth.config.skip_single_logout
         log(env, 'Received single logout request…')
 
-        logout_request = entra_id_request.saml_logout_request()
+        logout_request = entra_id_request.saml_logout_request
 
-        if !logout_request.is_valid?
+        unless logout_request.is_valid?
           log(env, "Invalid single logout request from Entra ID: #{logout_request.errors.first}")
 
           return internal_server_error_response("Invalid single logout request from Entra ID: #{logout_request.errors.first}")
@@ -108,7 +108,7 @@ module RackEntraIdAuth
           request_id: logout_request.id,
           logout_message: nil,
           params: {
-            :RelayState => entra_id_request.relay_state_url
+            RelayState: entra_id_request.relay_state_url
           },
           logout_status_code: nil)
 
@@ -121,15 +121,15 @@ module RackEntraIdAuth
       if entra_id_request.logout_response?
         log(env, 'Received single logout response…')
 
-        logout_response = entra_id_request.saml_logout_response()
+        logout_response = entra_id_request.saml_logout_response
 
-        if !logout_response.validate
+        unless logout_response.validate
           log(env, "Invalid single logout reponse from Entra ID: #{logout_response.errors.first}")
 
           return internal_server_error_response("Invalid single logout reponse from Entra ID: #{logout_response.errors.first}")
         end
 
-        if !logout_response.success?
+        unless logout_response.success?
           log(env, 'Unsuccessful single logout reponse from Entra ID.')
 
           return internal_server_error_response('Unsuccessful single logout reponse from Entra ID.')
@@ -153,7 +153,7 @@ module RackEntraIdAuth
         log(env, 'Intercepted 401 Unauthorized response, redirecting to Entra ID single sign-on URL…')
 
         return found_redirect_response(
-                 entra_id_request.sso_url(:RelayState => request.url),
+                 entra_id_request.sso_url(RelayState: request.url),
                  'Intercepted 401 Unauthorized response, redirecting to Entra ID single sign-on URL')
       end
 
@@ -176,8 +176,8 @@ module RackEntraIdAuth
       def internal_server_error_response (content = 'Internal server error')
         [ 500,
           { 'content-type' => 'text/html',
-            'content-length' => content.length },
-            [ content ] ]
+            'content-length' => content.bytesize.to_s },
+          [ content ] ]
       end
 
       def log (env, message, level = :info)

data/lib/rack_entra_id_auth/mock_middleware.rb

@@ -19,7 +19,7 @@ module RackEntraIdAuth
         log(env, 'Rendering mock login page…')
 
         return [ 200,
-                 { 'Content-Type' => 'text/html' },
+                 { 'content-type' => 'text/html' },
                  [ login_page(request.url) ] ]
       end
 
@@ -28,8 +28,8 @@ module RackEntraIdAuth
         log(env, 'Initializing session and redirecting to relay state URL…')
 
         attributes = RackEntraIdAuth.config.mock_attributes[request.params['username']] || {}
-        redirect_url = request.params['relay_state'] ||
-                       request.params['RelayState'] ||
+        redirect_url = entra_id_request.safe_redirect_url(request.params['relay_state']) ||
+                       entra_id_request.safe_redirect_url(request.params['RelayState']) ||
                        RackEntraIdAuth.config.login_relay_state_url ||
                        entra_id_request.base_url
 
@@ -44,8 +44,8 @@ module RackEntraIdAuth
       if entra_id_request.logout?
         log(env, 'Destroying session and redirecting to relay state URL…')
 
-        redirect_url = request.params['relay_state'] ||
-                       request.params['RelayState'] ||
+        redirect_url = entra_id_request.safe_redirect_url(request.params['relay_state']) ||
+                       entra_id_request.safe_redirect_url(request.params['RelayState']) ||
                        RackEntraIdAuth.config.logout_relay_state_url ||
                        entra_id_request.base_url
 
@@ -62,10 +62,8 @@ module RackEntraIdAuth
       if response[0] == 401
         log(env, 'Intercepted 401 Unauthorized response, redirecting to mock login URL…')
 
-        login_url = URI::HTTP.build(host: request.host,
-                                    port: request.port,
-                                    path: RackEntraIdAuth.config.login_path,
-                                    query: URI.encode_www_form({ :RelayState => request.url }))
+        login_url = "#{request.base_url}#{RackEntraIdAuth.config.login_path}?" +
+                    URI.encode_www_form(RelayState: request.url)
 
         return found_redirect_response(
                  login_url,
@@ -96,30 +94,30 @@ module RackEntraIdAuth
       end
 
       def login_page (action)
-        options = RackEntraIdAuth.config.mock_attributes.keys.map { |key| %Q~<option value="#{key}">#{key}</option>~ } .join
-
-        <<-EOS
-<!DOCTYPE html>
-<html>
-  <head>
-    <meta charset="utf-8">
-    <title>Mock Middleware Login</title>
-  </head>
-
-  <body>
-    <form action="#{action}" method="post">
-      <label for="username">Username</label>
-
-      <select id="username" name="username">
-        <option label="No User" value=""></option>
-        #{options}
-      </select>
-
-      <input type="submit" value="Login">
-    </form>
-  </body>
-</html>
-        EOS
+        options = RackEntraIdAuth.config.mock_attributes.keys.map { |key| %(<option value="#{key}">#{key}</option>) }.join
+
+        <<~HTML
+          <!DOCTYPE html>
+          <html>
+            <head>
+              <meta charset="utf-8">
+              <title>Mock Middleware Login</title>
+            </head>
+
+            <body>
+              <form action="#{action}" method="post">
+                <label for="username">Username</label>
+
+                <select id="username" name="username">
+                  <option label="No User" value=""></option>
+                  #{options}
+                </select>
+
+                <input type="submit" value="Login">
+              </form>
+            </body>
+          </html>
+        HTML
       end
   end
 end

data/lib/rack_entra_id_auth/version.rb

@@ -1,3 +1,3 @@
 module RackEntraIdAuth
-  VERSION = '1.3.3'
+  VERSION = '1.4.0'.freeze
 end

data/lib/rack_entra_id_auth.rb

@@ -1,4 +1,6 @@
+require 'rack_entra_id_auth/version'
 require 'rack_entra_id_auth/configuration'
+require 'rack_entra_id_auth/entra_id_request'
 
 module RackEntraIdAuth
   def self.configure

metadata

@@ -1,98 +1,62 @@
 --- !ruby/object:Gem::Specification
 name: rack_entra_id_auth
 version: !ruby/object:Gem::Version
-  version: 1.3.3
+  version: 1.4.0
 platform: ruby
 authors:
 - David Susco
 bindir: bin
 cert_chain: []
-date: 2025-11-13 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.2'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '9'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '3.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '3.2'
 - !ruby/object:Gem::Dependency
   name: ruby-saml
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.10'
+        version: '1.18'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.10'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.16'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.16'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.21'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.21'
+        version: '1.18'
 description: Rails aware Rack middleware for Entra ID authentication.
 email:
 - dsusco@gmail.com
@@ -118,9 +82,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dsusco/rack_entra_id_auth/issues
-  changelog_uri: https://github.com/dsusco/rack_entra_id_auth/releases/tag/v1.3.3
+  changelog_uri: https://github.com/dsusco/rack_entra_id_auth/releases/tag/v1.4.0
   homepage_uri: https://github.com/dsusco/rack_entra_id_auth
   source_code_uri: https://github.com/dsusco/rack_entra_id_auth
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -128,14 +93,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Rails aware Rack middleware for Entra ID authentication.
 test_files: []