rbsso 0.2.2 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 996a190fc1fa080d95879c4ea3394e775d7702c4
-  data.tar.gz: 9952ff5c4043e76c7bb7676e0548294732a10459
+  metadata.gz: 20a13f10826dbcca961f89065f7813b021b30752
+  data.tar.gz: 38cb04d71b45bfe194a25044f7ca871a7edbc7da
 SHA512:
-  metadata.gz: f21e9d6425249836f09d683899bb9b95a96f5a8d0f1f20e0b3d0cfb51d0715522720d336622d3573848f2073c2fadf8975a92773928f65f5ce558f5f9d97deac
-  data.tar.gz: 132676840c808b18a78788561a867f045f41ee25659836b3faaf316b363c62a3631846836d1ccbbf6f7f0cf6167e95ff89fb2b706c934d5387c4e94c8965a635
+  metadata.gz: a50eb1a6b08d678e656e3beef4185b6c35cc64556768aa455385550902f6a027d83b3fb3c41f008fee05bfb8d0e6baef47ce08782f446b8f5abd7dec3bfbe7c8
+  data.tar.gz: 1b22eff992387af15a847d1c23c622fc477bf67322ec83b4fbb0b70cfed6f28688e26f62787c96307bcbde64994118088f702c39bcc0f25da0f02fb97ac450e6

data/lib/rbsso/authentication.rb

@@ -1,6 +1,6 @@
 module RbSSO
   class Authentication
-    VERSION = 3
+    VERSION = 4
 
     class VersionMismatch < ArgumentError
       def initialize(version)
@@ -8,20 +8,22 @@ module RbSSO
       end
     end
 
-    attr_reader :user, :service, :domain, :groups, :expires
+    attr_reader :user, :service, :domain, :groups, :nonce, :expires
 
-    def initialize(user:, service:, domain:, groups: [], ttl: 3600, expires: nil)
+    def initialize(user:, service:, domain:, groups: [], nonce: nil, ttl: 3600, expires: nil)
       @user, @service, @domain, @groups = user, service, domain, groups
+      @nonce = nonce
       @expires = expires || (Time.now + ttl).to_i
     end
 
     def self.parse(string)
-      version, user, service, domain, expires, groups = string.split '|'
+      version, user, service, domain, expires, nonce, groups = string.split '|'
       check_version(version)
       new user: user,
         service: service,
         domain: domain,
         expires: expires.to_i,
+        nonce: nonce,
         groups: (groups || '').split(',')
     end
 
@@ -34,7 +36,7 @@ module RbSSO
     end
 
     def content
-      [VERSION, user, service, domain, expires.to_s, groups.join(',')]
+      [VERSION, user, service, domain, expires.to_s, nonce, groups.join(',')]
     end
 
     def ==(other)
@@ -42,7 +44,8 @@ module RbSSO
         service == other.service &&
         domain == other.domain &&
         groups == other.groups &&
-        expires == other.expires
+        expires == other.expires &&
+        nonce == other.nonce
     end
 
     def expired?

data/lib/rbsso/client.rb

@@ -16,6 +16,12 @@ module RbSSO
       end
     end
 
+    class NonceMismatch < RuntimeError
+      def initialize(expected, was)
+        super "Ticket nonce '#{was}' differs from session nonce '#{expected}'."
+      end
+    end
+
     def initialize(service, key)
       if !key || key !~ /[0-9a-f]{64}/i
         raise ArgumentError, "key MUST be 32 bytes, hex encoded string, was: #{key}"
@@ -25,11 +31,12 @@ module RbSSO
       @verify_key = key
     end
 
-    def open(ticket_string)
+    def open(ticket_string, nonce: nil)
       ticket = RbSSO::Ticket.open ticket_string, verify_key
       auth = RbSSO::Authentication.parse ticket.content
       raise TicketExpired.new(auth.expires) if auth.expired?
       raise WrongService.new(service, auth.service) if auth.service != service
+      raise NonceMismatch.new(nonce, auth.nonce) if auth.nonce != nonce
       auth.to_info
     end
 

data/lib/rbsso/server.rb

@@ -13,10 +13,11 @@ module RbSSO
       @key = RbNaCl::SigningKey.new seed_binary
     end
 
-    def ticket(user, service, domain)
+    def ticket(user:, service:, domain:, nonce: nil)
       auth = RbSSO::Authentication.new user: user,
         service: service,
-        domain: domain
+        domain: domain,
+        nonce: nonce
       ticket = RbSSO::Ticket.sign auth, key
       return ticket.to_base64
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rbsso
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.3.0
 platform: ruby
 authors:
 - Azul
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-01-13 00:00:00.000000000 Z
+date: 2017-01-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rbnacl