rodauth-oauth 0.0.2 → 0.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +189 -0
- data/LICENSE.txt +191 -0
- data/README.md +258 -30
- data/lib/generators/roda/oauth/install_generator.rb +1 -1
- data/lib/generators/roda/oauth/templates/db/migrate/create_rodauth_oauth.rb +4 -1
- data/lib/generators/roda/oauth/views_generator.rb +1 -6
- data/lib/rodauth/features/oauth.rb +567 -295
- data/lib/rodauth/features/oauth_http_mac.rb +110 -0
- data/lib/rodauth/features/oauth_jwt.rb +448 -0
- data/lib/rodauth/features/oidc.rb +267 -0
- data/lib/rodauth/oauth/ttl_store.rb +59 -0
- data/lib/rodauth/oauth/version.rb +1 -1
- metadata +11 -5
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3eac600d006a2c78509f608575db062b7ba6d67356b890c7d38414b9b82875f9
|
|
4
|
+
data.tar.gz: c37fc18c093f546023481a88cc526c5a0b721b1a3bfeac827c21184e0583071b
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 0a04fdb5ab370ed5736208cbd4ccb1e6da801af52cd68004625a21008c4a10a04bc143d99c9e1a71bccb9fad882fc3cff27d9c0900689dbd5cf6c0616e4d43a0
|
|
7
|
+
data.tar.gz: e6d5cb6e8ff31d64eb588fa39ad6a1e7bb1ae9416adac64e5f9a21bf451ffd4115a8c2d3bb8759f1a32192a88a4a401336e1baca7621a33934dc1b2a873c8402
|
data/CHANGELOG.md
CHANGED
|
@@ -2,8 +2,195 @@
|
|
|
2
2
|
|
|
3
3
|
## master
|
|
4
4
|
|
|
5
|
+
### 0.1.0
|
|
6
|
+
|
|
7
|
+
(31/7/2020)
|
|
8
|
+
|
|
9
|
+
#### Features
|
|
10
|
+
|
|
11
|
+
##### OpenID
|
|
12
|
+
|
|
13
|
+
`rodauth-oauth` now ships with support for [OpenID Connect](https://openid.net/connect/). In order to enable, you have to:
|
|
14
|
+
|
|
15
|
+
```ruby
|
|
16
|
+
plugin :rodauth do
|
|
17
|
+
enable :oidc
|
|
18
|
+
end
|
|
19
|
+
```
|
|
20
|
+
|
|
21
|
+
For more info about integrating it, [check the wiki](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/wikis/home#openid-connect-since-v01).
|
|
22
|
+
|
|
23
|
+
It supports omniauth openID integrations out-of-the-box, [check the OpenID example, which integrates with omniauth_openid_connect](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/tree/master/examples).
|
|
24
|
+
|
|
25
|
+
#### Improvements
|
|
26
|
+
|
|
27
|
+
* JWT: `sub` claim now also handles "pairwise" subjects. For that, you have to set the `oauth_jwt_subject_type` option (`"public"` or `"pairwise"`) and `oauth_jwt_subject_secret` (will be used for salting the `sub` when the type is `"pairwise"`).
|
|
28
|
+
* JWT: `auth_time` claim is now supported; if your application uses the `rodauth` feature `:account_expiration`, it'll use the `last_account_login_at` method, otherwise you can set the `last_account_login_at` option:
|
|
29
|
+
|
|
30
|
+
```ruby
|
|
31
|
+
last_account_login_at do
|
|
32
|
+
convert_timestamp(db[accounts_table].where(account_id_column => account_id).get(:that_column_where_you_keep_the_data))
|
|
33
|
+
end
|
|
34
|
+
```
|
|
35
|
+
* JWT: `iss` claim now defaults to `authorization_server_url` when not defined;
|
|
36
|
+
* JWT: `aud` claim now defaults to the token application's client ID (`client_id` claim was removed as a result);
|
|
37
|
+
|
|
38
|
+
|
|
39
|
+
|
|
40
|
+
#### Breaking Changes
|
|
41
|
+
|
|
42
|
+
`rodauth-oauth` URLs no longer have the `oauth-` prefix, so make sure you update your integrations accordingly, i.e. where you used to rely on `/oauth-authorize`, you'll have to use `/authorize`.
|
|
43
|
+
|
|
44
|
+
URI schemes for client applications redirect URIs have to be `https`. In order to override this, set the `oauth_valid_uri_schemes` to an array of your expected URI schemes.
|
|
45
|
+
|
|
46
|
+
|
|
47
|
+
#### Bugfixes
|
|
48
|
+
|
|
49
|
+
* Authorization request submission can receive the `scope` as an array of values now, instead of only dealing with receiving a white-space separated list.
|
|
50
|
+
* fixed trailing "/" in the "issuer" value in server metadata (`https://server.com/` -> `https://server.com`).
|
|
51
|
+
|
|
52
|
+
|
|
53
|
+
### 0.0.6
|
|
54
|
+
|
|
55
|
+
(6/7/2020)
|
|
56
|
+
|
|
57
|
+
#### Features
|
|
58
|
+
|
|
59
|
+
The `oauth_jwt` feature now supports JWT Secured Authorization Request (JAR) (see https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20). This means that client applications can send the authorization parameters inside a signed JWT. The client applications keeps the private key, while the authorization server **must** store a public key for the client application. For encrypted JWTs, the client application should use one of the public encryption keys exposed in the JWKs URI, to encrypt the JWT. Remember, **tokens must be signed then encrypted** (or just signed).
|
|
60
|
+
|
|
61
|
+
###### Options:
|
|
62
|
+
|
|
63
|
+
* `:oauth_application_jws_jwk_column`: db column where the public key is stored; since it's stored in the JWS format, it can be stored either as a String (JSON-encoded), or as an hstore (if you're using postgresql);
|
|
64
|
+
* `:oauth_jwt_jwe_key`: key used to decrypt the request JWT;
|
|
65
|
+
* `:oauth_jwt_jwe_public_key`: key used to encrypt the request JWT, and which will be exposed in the JWKs URI in the JWK format;
|
|
66
|
+
|
|
67
|
+
|
|
68
|
+
#### Improvements
|
|
69
|
+
|
|
70
|
+
* Removing all `_param` options; these defined the URL params, however we're using protocol-defined params, so it's unlikely (and undesired) that these'll change.
|
|
71
|
+
* Hitting the revoke endpoint with a JWT access token returns a 400 error;
|
|
72
|
+
|
|
73
|
+
#### Chore
|
|
74
|
+
|
|
75
|
+
Removed React Javascript from example applications.
|
|
76
|
+
|
|
77
|
+
|
|
78
|
+
### 0.0.5
|
|
79
|
+
|
|
80
|
+
(26/6/2020)
|
|
81
|
+
|
|
82
|
+
#### Features
|
|
83
|
+
|
|
84
|
+
* new option: `oauth_scope_separator` (default: `" "`), to define how scopes are stored;
|
|
85
|
+
|
|
86
|
+
##### Resource Server mode
|
|
87
|
+
|
|
88
|
+
`rodauth-oauth` can now be used in a resource server, i.e. only for authorizing access to resources:
|
|
89
|
+
|
|
90
|
+
|
|
91
|
+
```ruby
|
|
92
|
+
plugin :rodauth do
|
|
93
|
+
enable :oauth
|
|
94
|
+
|
|
95
|
+
is_authorization_server? false
|
|
96
|
+
authorization_server_url "https://auth-server"
|
|
97
|
+
end
|
|
98
|
+
```
|
|
99
|
+
|
|
100
|
+
It **requires** the authorization to implement the server metadata endpoint (`/.well-known/oauth-authorization-server`), and if using JWS, the JWKs URI endpoint (unless `oauth_jwt_public_key` is defined).
|
|
101
|
+
|
|
102
|
+
#### Improvements
|
|
103
|
+
|
|
104
|
+
* Multiple Redirect URIs are now allowed for client applications out-of-the-box. In order to use it in API mode, you can pass the `redirect_uri` with an array of strings (the URLs) as values; in the new client application form, you can add several input fields with name field as `redirect_uri[]`. **ATTENTION!!** When using multiple redirect URIs, passing the desired redirect URI to the authorize form becomes mandatory.
|
|
105
|
+
* store scopes with whitespace instead of comma; set separator as `oauth_scope_separator` option, to keep backwards-compatibility;
|
|
106
|
+
* client application can now store multiple redirect uris; the POST API parameters can accept the redirect_uri param value both as a string or an array of string; internally, they'll be stored in a whitespace-separated string;
|
|
107
|
+
|
|
108
|
+
#### Bugfixes
|
|
109
|
+
|
|
110
|
+
* Fixed `RETURNING` support in the databases supporting it (such as postgres).
|
|
111
|
+
|
|
112
|
+
#### Chore
|
|
113
|
+
|
|
114
|
+
* option `scopes_param` renamed to `scope_param`;
|
|
115
|
+
*
|
|
116
|
+
|
|
117
|
+
## 0.0.4
|
|
118
|
+
|
|
119
|
+
(13/6/2020)
|
|
120
|
+
|
|
121
|
+
### Features
|
|
122
|
+
|
|
123
|
+
#### Token introspection
|
|
124
|
+
|
|
125
|
+
`rodauth-oauth` now ships with an introspection endpoint (`/oauth-introspect`).
|
|
126
|
+
|
|
127
|
+
#### Authorization Server Metadata
|
|
128
|
+
|
|
129
|
+
`rodauth-oauth` now allows to define an authorization metadata endpoint, which has to be defined at the route of the router:
|
|
130
|
+
|
|
131
|
+
```ruby
|
|
132
|
+
route do |r|
|
|
133
|
+
r.rodauth
|
|
134
|
+
rodauth.oauth_server_metadata
|
|
135
|
+
...
|
|
136
|
+
```
|
|
137
|
+
|
|
138
|
+
#### JWKs URI
|
|
139
|
+
|
|
140
|
+
the `oauth_jwt` feature now ships with an endpoint, `/oauth-jwks`, where client applications can retrieve the JWK set to verify generated tokens.
|
|
141
|
+
|
|
142
|
+
#### JWT access tokens as authorization grants
|
|
143
|
+
|
|
144
|
+
The `oauth_jwt` feature now allows the usage of access tokens to authorize the generation of new tokens, [as per the RFC](https://tools.ietf.org/html/rfc7523#section-4);
|
|
145
|
+
|
|
146
|
+
### Improvements
|
|
147
|
+
|
|
148
|
+
* using `client_secret_basic` authorization where client id/secret params were allowed (i.e. in the token and revoke endpoints, for example);
|
|
149
|
+
* improved JWK usage for both supported jwt libraries;
|
|
150
|
+
* marked `fetch_access_token` as auth_value_method, thereby allowing users to fetch the access token from other sources than the "Authorization" header (i.e. form body, query params, etc...)
|
|
151
|
+
|
|
152
|
+
### Bugfixes
|
|
153
|
+
|
|
154
|
+
* Fixed scope claim of JWT ("scopes" -> "scope");
|
|
155
|
+
|
|
156
|
+
## 0.0.3
|
|
157
|
+
|
|
158
|
+
(5/6/2020)
|
|
159
|
+
|
|
160
|
+
### Features
|
|
161
|
+
|
|
162
|
+
#### `:oauth_http_mac`
|
|
163
|
+
|
|
164
|
+
A new feature builds on top of `:oauth` to allow MAC authorization.
|
|
165
|
+
|
|
166
|
+
```ruby
|
|
167
|
+
plugin :rodauth do
|
|
168
|
+
enable :oauth_http_mac
|
|
169
|
+
# options here...
|
|
170
|
+
end
|
|
171
|
+
```
|
|
172
|
+
|
|
173
|
+
#### `:oauth_jwt`
|
|
174
|
+
|
|
175
|
+
Another new feature, this time supporting the generation of JWT access tokens.
|
|
176
|
+
|
|
177
|
+
```ruby
|
|
178
|
+
plugin :rodauth do
|
|
179
|
+
enable :oauth_jwt
|
|
180
|
+
# options here...
|
|
181
|
+
end
|
|
182
|
+
```
|
|
183
|
+
|
|
184
|
+
### Improvements
|
|
185
|
+
|
|
186
|
+
* added options for disabling pkce and access type (respectively, `use_oauth_pkce?` and `use_oauth_access_type?`);
|
|
187
|
+
* renamed the existing `use_oauth_implicit_grant_type` to `use_oauth_implicit_grant_type?`;
|
|
188
|
+
* It's now usable as JSON API (small caveat: POST authorize will still redirect on success...);
|
|
189
|
+
|
|
5
190
|
## 0.0.2
|
|
6
191
|
|
|
192
|
+
(29/5/2020)
|
|
193
|
+
|
|
7
194
|
### Features
|
|
8
195
|
|
|
9
196
|
* Implementation of PKCE by OAuth Public Clients (https://tools.ietf.org/html/rfc7636);
|
|
@@ -20,4 +207,6 @@
|
|
|
20
207
|
|
|
21
208
|
## 0.0.1
|
|
22
209
|
|
|
210
|
+
(14/5/2020)
|
|
211
|
+
|
|
23
212
|
Initial implementation of the Oauth 2.0 framework, with an example app done using roda.
|
data/LICENSE.txt
ADDED
|
@@ -0,0 +1,191 @@
|
|
|
1
|
+
|
|
2
|
+
Apache License
|
|
3
|
+
Version 2.0, January 2004
|
|
4
|
+
https://www.apache.org/licenses/
|
|
5
|
+
|
|
6
|
+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
7
|
+
|
|
8
|
+
1. Definitions.
|
|
9
|
+
|
|
10
|
+
"License" shall mean the terms and conditions for use, reproduction,
|
|
11
|
+
and distribution as defined by Sections 1 through 9 of this document.
|
|
12
|
+
|
|
13
|
+
"Licensor" shall mean the copyright owner or entity authorized by
|
|
14
|
+
the copyright owner that is granting the License.
|
|
15
|
+
|
|
16
|
+
"Legal Entity" shall mean the union of the acting entity and all
|
|
17
|
+
other entities that control, are controlled by, or are under common
|
|
18
|
+
control with that entity. For the purposes of this definition,
|
|
19
|
+
"control" means (i) the power, direct or indirect, to cause the
|
|
20
|
+
direction or management of such entity, whether by contract or
|
|
21
|
+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
22
|
+
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
23
|
+
|
|
24
|
+
"You" (or "Your") shall mean an individual or Legal Entity
|
|
25
|
+
exercising permissions granted by this License.
|
|
26
|
+
|
|
27
|
+
"Source" form shall mean the preferred form for making modifications,
|
|
28
|
+
including but not limited to software source code, documentation
|
|
29
|
+
source, and configuration files.
|
|
30
|
+
|
|
31
|
+
"Object" form shall mean any form resulting from mechanical
|
|
32
|
+
transformation or translation of a Source form, including but
|
|
33
|
+
not limited to compiled object code, generated documentation,
|
|
34
|
+
and conversions to other media types.
|
|
35
|
+
|
|
36
|
+
"Work" shall mean the work of authorship, whether in Source or
|
|
37
|
+
Object form, made available under the License, as indicated by a
|
|
38
|
+
copyright notice that is included in or attached to the work
|
|
39
|
+
(an example is provided in the Appendix below).
|
|
40
|
+
|
|
41
|
+
"Derivative Works" shall mean any work, whether in Source or Object
|
|
42
|
+
form, that is based on (or derived from) the Work and for which the
|
|
43
|
+
editorial revisions, annotations, elaborations, or other modifications
|
|
44
|
+
represent, as a whole, an original work of authorship. For the purposes
|
|
45
|
+
of this License, Derivative Works shall not include works that remain
|
|
46
|
+
separable from, or merely link (or bind by name) to the interfaces of,
|
|
47
|
+
the Work and Derivative Works thereof.
|
|
48
|
+
|
|
49
|
+
"Contribution" shall mean any work of authorship, including
|
|
50
|
+
the original version of the Work and any modifications or additions
|
|
51
|
+
to that Work or Derivative Works thereof, that is intentionally
|
|
52
|
+
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
53
|
+
or by an individual or Legal Entity authorized to submit on behalf of
|
|
54
|
+
the copyright owner. For the purposes of this definition, "submitted"
|
|
55
|
+
means any form of electronic, verbal, or written communication sent
|
|
56
|
+
to the Licensor or its representatives, including but not limited to
|
|
57
|
+
communication on electronic mailing lists, source code control systems,
|
|
58
|
+
and issue tracking systems that are managed by, or on behalf of, the
|
|
59
|
+
Licensor for the purpose of discussing and improving the Work, but
|
|
60
|
+
excluding communication that is conspicuously marked or otherwise
|
|
61
|
+
designated in writing by the copyright owner as "Not a Contribution."
|
|
62
|
+
|
|
63
|
+
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
64
|
+
on behalf of whom a Contribution has been received by Licensor and
|
|
65
|
+
subsequently incorporated within the Work.
|
|
66
|
+
|
|
67
|
+
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
68
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
69
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
70
|
+
copyright license to reproduce, prepare Derivative Works of,
|
|
71
|
+
publicly display, publicly perform, sublicense, and distribute the
|
|
72
|
+
Work and such Derivative Works in Source or Object form.
|
|
73
|
+
|
|
74
|
+
3. Grant of Patent License. Subject to the terms and conditions of
|
|
75
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
76
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
77
|
+
(except as stated in this section) patent license to make, have made,
|
|
78
|
+
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
79
|
+
where such license applies only to those patent claims licensable
|
|
80
|
+
by such Contributor that are necessarily infringed by their
|
|
81
|
+
Contribution(s) alone or by combination of their Contribution(s)
|
|
82
|
+
with the Work to which such Contribution(s) was submitted. If You
|
|
83
|
+
institute patent litigation against any entity (including a
|
|
84
|
+
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
85
|
+
or a Contribution incorporated within the Work constitutes direct
|
|
86
|
+
or contributory patent infringement, then any patent licenses
|
|
87
|
+
granted to You under this License for that Work shall terminate
|
|
88
|
+
as of the date such litigation is filed.
|
|
89
|
+
|
|
90
|
+
4. Redistribution. You may reproduce and distribute copies of the
|
|
91
|
+
Work or Derivative Works thereof in any medium, with or without
|
|
92
|
+
modifications, and in Source or Object form, provided that You
|
|
93
|
+
meet the following conditions:
|
|
94
|
+
|
|
95
|
+
(a) You must give any other recipients of the Work or
|
|
96
|
+
Derivative Works a copy of this License; and
|
|
97
|
+
|
|
98
|
+
(b) You must cause any modified files to carry prominent notices
|
|
99
|
+
stating that You changed the files; and
|
|
100
|
+
|
|
101
|
+
(c) You must retain, in the Source form of any Derivative Works
|
|
102
|
+
that You distribute, all copyright, patent, trademark, and
|
|
103
|
+
attribution notices from the Source form of the Work,
|
|
104
|
+
excluding those notices that do not pertain to any part of
|
|
105
|
+
the Derivative Works; and
|
|
106
|
+
|
|
107
|
+
(d) If the Work includes a "NOTICE" text file as part of its
|
|
108
|
+
distribution, then any Derivative Works that You distribute must
|
|
109
|
+
include a readable copy of the attribution notices contained
|
|
110
|
+
within such NOTICE file, excluding those notices that do not
|
|
111
|
+
pertain to any part of the Derivative Works, in at least one
|
|
112
|
+
of the following places: within a NOTICE text file distributed
|
|
113
|
+
as part of the Derivative Works; within the Source form or
|
|
114
|
+
documentation, if provided along with the Derivative Works; or,
|
|
115
|
+
within a display generated by the Derivative Works, if and
|
|
116
|
+
wherever such third-party notices normally appear. The contents
|
|
117
|
+
of the NOTICE file are for informational purposes only and
|
|
118
|
+
do not modify the License. You may add Your own attribution
|
|
119
|
+
notices within Derivative Works that You distribute, alongside
|
|
120
|
+
or as an addendum to the NOTICE text from the Work, provided
|
|
121
|
+
that such additional attribution notices cannot be construed
|
|
122
|
+
as modifying the License.
|
|
123
|
+
|
|
124
|
+
You may add Your own copyright statement to Your modifications and
|
|
125
|
+
may provide additional or different license terms and conditions
|
|
126
|
+
for use, reproduction, or distribution of Your modifications, or
|
|
127
|
+
for any such Derivative Works as a whole, provided Your use,
|
|
128
|
+
reproduction, and distribution of the Work otherwise complies with
|
|
129
|
+
the conditions stated in this License.
|
|
130
|
+
|
|
131
|
+
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
132
|
+
any Contribution intentionally submitted for inclusion in the Work
|
|
133
|
+
by You to the Licensor shall be under the terms and conditions of
|
|
134
|
+
this License, without any additional terms or conditions.
|
|
135
|
+
Notwithstanding the above, nothing herein shall supersede or modify
|
|
136
|
+
the terms of any separate license agreement you may have executed
|
|
137
|
+
with Licensor regarding such Contributions.
|
|
138
|
+
|
|
139
|
+
6. Trademarks. This License does not grant permission to use the trade
|
|
140
|
+
names, trademarks, service marks, or product names of the Licensor,
|
|
141
|
+
except as required for reasonable and customary use in describing the
|
|
142
|
+
origin of the Work and reproducing the content of the NOTICE file.
|
|
143
|
+
|
|
144
|
+
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
145
|
+
agreed to in writing, Licensor provides the Work (and each
|
|
146
|
+
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
147
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
148
|
+
implied, including, without limitation, any warranties or conditions
|
|
149
|
+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
150
|
+
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
151
|
+
appropriateness of using or redistributing the Work and assume any
|
|
152
|
+
risks associated with Your exercise of permissions under this License.
|
|
153
|
+
|
|
154
|
+
8. Limitation of Liability. In no event and under no legal theory,
|
|
155
|
+
whether in tort (including negligence), contract, or otherwise,
|
|
156
|
+
unless required by applicable law (such as deliberate and grossly
|
|
157
|
+
negligent acts) or agreed to in writing, shall any Contributor be
|
|
158
|
+
liable to You for damages, including any direct, indirect, special,
|
|
159
|
+
incidental, or consequential damages of any character arising as a
|
|
160
|
+
result of this License or out of the use or inability to use the
|
|
161
|
+
Work (including but not limited to damages for loss of goodwill,
|
|
162
|
+
work stoppage, computer failure or malfunction, or any and all
|
|
163
|
+
other commercial damages or losses), even if such Contributor
|
|
164
|
+
has been advised of the possibility of such damages.
|
|
165
|
+
|
|
166
|
+
9. Accepting Warranty or Additional Liability. While redistributing
|
|
167
|
+
the Work or Derivative Works thereof, You may choose to offer,
|
|
168
|
+
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
169
|
+
or other liability obligations and/or rights consistent with this
|
|
170
|
+
License. However, in accepting such obligations, You may act only
|
|
171
|
+
on Your own behalf and on Your sole responsibility, not on behalf
|
|
172
|
+
of any other Contributor, and only if You agree to indemnify,
|
|
173
|
+
defend, and hold each Contributor harmless for any liability
|
|
174
|
+
incurred by, or claims asserted against, such Contributor by reason
|
|
175
|
+
of your accepting any such warranty or additional liability.
|
|
176
|
+
|
|
177
|
+
END OF TERMS AND CONDITIONS
|
|
178
|
+
|
|
179
|
+
Copyright 2013-2017 Docker, Inc.
|
|
180
|
+
|
|
181
|
+
Licensed under the Apache License, Version 2.0 (the "License");
|
|
182
|
+
you may not use this file except in compliance with the License.
|
|
183
|
+
You may obtain a copy of the License at
|
|
184
|
+
|
|
185
|
+
https://www.apache.org/licenses/LICENSE-2.0
|
|
186
|
+
|
|
187
|
+
Unless required by applicable law or agreed to in writing, software
|
|
188
|
+
distributed under the License is distributed on an "AS IS" BASIS,
|
|
189
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
190
|
+
See the License for the specific language governing permissions and
|
|
191
|
+
limitations under the License.
|
data/README.md
CHANGED
|
@@ -1,24 +1,30 @@
|
|
|
1
1
|
# Rodauth::Oauth
|
|
2
2
|
|
|
3
|
-
[](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/
|
|
4
|
-
[](https://gitlab.
|
|
3
|
+
[](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/pipelines?page=1&ref=master)
|
|
4
|
+
[](https://honeyryderchuck.gitlab.io/rodauth-oauth/coverage/#_AllFiles)
|
|
5
5
|
|
|
6
6
|
This is an extension to the `rodauth` gem which implements the [OAuth 2.0 framework](https://tools.ietf.org/html/rfc6749) for an authorization server.
|
|
7
7
|
|
|
8
8
|
## Features
|
|
9
9
|
|
|
10
|
-
This gem implements:
|
|
10
|
+
This gem implements the following RFCs and features of OAuth:
|
|
11
11
|
|
|
12
12
|
* [The OAuth 2.0 protocol framework](https://tools.ietf.org/html/rfc6749):
|
|
13
13
|
* [Authorization grant flow](https://tools.ietf.org/html/rfc6749#section-1.3);
|
|
14
14
|
* [Access Token generation](https://tools.ietf.org/html/rfc6749#section-1.4);
|
|
15
15
|
* [Access Token refresh](https://tools.ietf.org/html/rfc6749#section-1.5);
|
|
16
|
-
* [Token revocation](https://tools.ietf.org/html/rfc7009);
|
|
17
16
|
* [Implicit grant (off by default)[https://tools.ietf.org/html/rfc6749#section-4.2];
|
|
18
|
-
|
|
17
|
+
* [Token revocation](https://tools.ietf.org/html/rfc7009);
|
|
18
|
+
* [Token introspection](https://tools.ietf.org/html/rfc7662);
|
|
19
|
+
* [Authorization Server Metadata](https://tools.ietf.org/html/rfc8414);
|
|
20
|
+
* [PKCE](https://tools.ietf.org/html/rfc7636);
|
|
19
21
|
* Access Type (Token refresh online and offline);
|
|
22
|
+
* [MAC Authentication Scheme](https://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-02);
|
|
23
|
+
* [JWT Acess Tokens](https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-07);
|
|
24
|
+
* [JWT Secured Authorization Requests](https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20);
|
|
20
25
|
* OAuth application and token management dashboards;
|
|
21
26
|
|
|
27
|
+
It also implements the [OpenID Connect layer](https://openid.net/connect/) on top of the OAuth features it provides.
|
|
22
28
|
|
|
23
29
|
This gem supports also rails (through [rodauth-rails]((https://github.com/janko/rodauth-rails))).
|
|
24
30
|
|
|
@@ -39,6 +45,15 @@ Or install it yourself as:
|
|
|
39
45
|
|
|
40
46
|
$ gem install rodauth-oauth
|
|
41
47
|
|
|
48
|
+
|
|
49
|
+
## Resources
|
|
50
|
+
| | |
|
|
51
|
+
| ------------- | ----------------------------------------------------------- |
|
|
52
|
+
| Website | https://honeyryderchuck.gitlab.io/rodauth-oauth/ |
|
|
53
|
+
| Documentation | https://honeyryderchuck.gitlab.io/rodauth-oauth/rdoc/ |
|
|
54
|
+
| Wiki | https://gitlab.com/honeyryderchuck/rodauth-oauth/wikis/home |
|
|
55
|
+
| CI | https://gitlab.com/honeyryderchuck/rodauth-oauth/pipelines |
|
|
56
|
+
|
|
42
57
|
## Usage
|
|
43
58
|
|
|
44
59
|
This tutorial assumes you already read the documentation and know how to set up `rodauth`. After that, integrating `roda-auth` will look like:
|
|
@@ -82,11 +97,22 @@ route do |r|
|
|
|
82
97
|
end
|
|
83
98
|
```
|
|
84
99
|
|
|
85
|
-
|
|
100
|
+
|
|
101
|
+
For OpenID, it's very similar to the example above:
|
|
102
|
+
|
|
103
|
+
```ruby
|
|
104
|
+
plugin :rodauth do
|
|
105
|
+
# enable it in the plugin
|
|
106
|
+
enable :login, :openid
|
|
107
|
+
oauth_application_default_scope %w[openid]
|
|
108
|
+
oauth_application_scopes %w[openid email profile]
|
|
109
|
+
end
|
|
110
|
+
```
|
|
111
|
+
|
|
86
112
|
|
|
87
113
|
### Example (TL;DR)
|
|
88
114
|
|
|
89
|
-
If you're familiar with the technology and want to skip the next paragraphs, just [check our
|
|
115
|
+
If you're familiar with the technology and want to skip the next paragraphs, just [check our example applications](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/tree/master/examples/).
|
|
90
116
|
|
|
91
117
|
|
|
92
118
|
Generating tokens happens mostly server-to-server, so here's an example using:
|
|
@@ -97,7 +123,7 @@ Generating tokens happens mostly server-to-server, so here's an example using:
|
|
|
97
123
|
|
|
98
124
|
```ruby
|
|
99
125
|
require "httpx"
|
|
100
|
-
response = HTTPX.post("https://auth_server/
|
|
126
|
+
response = HTTPX.post("https://auth_server/token",json: {
|
|
101
127
|
client_id: ENV["OAUTH_CLIENT_ID"],
|
|
102
128
|
client_secret: ENV["OAUTH_CLIENT_SECRET"],
|
|
103
129
|
grant_type: "authorization_code",
|
|
@@ -105,13 +131,13 @@ response = HTTPX.post("https://auth_server/oauth-token",json: {
|
|
|
105
131
|
})
|
|
106
132
|
response.raise_for_status
|
|
107
133
|
payload = JSON.parse(response.to_s)
|
|
108
|
-
puts payload #=> {"
|
|
134
|
+
puts payload #=> {"access_token" => "awr23f3h8f9d2h89...", "refresh_token" => "23fkop3kr290kc..." ....
|
|
109
135
|
```
|
|
110
136
|
|
|
111
137
|
##### cURL
|
|
112
138
|
|
|
113
139
|
```
|
|
114
|
-
> curl --data '{"client_id":"$OAUTH_CLIENT_ID","client_secret":"$OAUTH_CLIENT_SECRET","grant_type":"authorization_code","code":"oiweicnewdh32fhoi3hf3ihfo2ih3f2o3as"}' https://auth_server/
|
|
140
|
+
> curl --data '{"client_id":"$OAUTH_CLIENT_ID","client_secret":"$OAUTH_CLIENT_SECRET","grant_type":"authorization_code","code":"oiweicnewdh32fhoi3hf3ihfo2ih3f2o3as"}' https://auth_server/token
|
|
115
141
|
```
|
|
116
142
|
|
|
117
143
|
#### Refresh Token
|
|
@@ -122,7 +148,7 @@ Refreshing expired tokens also happens mostly server-to-server, here's an exampl
|
|
|
122
148
|
|
|
123
149
|
```ruby
|
|
124
150
|
require "httpx"
|
|
125
|
-
response = HTTPX.post("https://auth_server/
|
|
151
|
+
response = HTTPX.post("https://auth_server/token",json: {
|
|
126
152
|
client_id: ENV["OAUTH_CLIENT_ID"],
|
|
127
153
|
client_secret: ENV["OAUTH_CLIENT_SECRET"],
|
|
128
154
|
grant_type: "refresh_token",
|
|
@@ -130,13 +156,13 @@ response = HTTPX.post("https://auth_server/oauth-token",json: {
|
|
|
130
156
|
})
|
|
131
157
|
response.raise_for_status
|
|
132
158
|
payload = JSON.parse(response.to_s)
|
|
133
|
-
puts payload #=> {"
|
|
159
|
+
puts payload #=> {"access_token" => "awr23f3h8f9d2h89...", "token_type" => "Bearer" ....
|
|
134
160
|
```
|
|
135
161
|
|
|
136
162
|
##### cURL
|
|
137
163
|
|
|
138
164
|
```
|
|
139
|
-
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","client_secret":"$OAUTH_CLIENT_SECRET","grant_type":"token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/
|
|
165
|
+
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","client_secret":"$OAUTH_CLIENT_SECRET","grant_type":"token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/token
|
|
140
166
|
```
|
|
141
167
|
|
|
142
168
|
#### Revoking tokens
|
|
@@ -145,22 +171,70 @@ Token revocation can be done both by the idenntity owner or the application owne
|
|
|
145
171
|
|
|
146
172
|
```ruby
|
|
147
173
|
require "httpx"
|
|
148
|
-
httpx = HTTPX.plugin(:
|
|
149
|
-
response = httpx.
|
|
150
|
-
.post("https://auth_server/
|
|
151
|
-
|
|
174
|
+
httpx = HTTPX.plugin(:basic_authorization)
|
|
175
|
+
response = httpx.basic_authentication(ENV["CLIENT_ID"], ENV["CLIENT_SECRET"])
|
|
176
|
+
.post("https://auth_server/revoke",json: {
|
|
177
|
+
token_type_hint: "access_token", # can also be "refresh:tokn"
|
|
178
|
+
token: "2r89hfef4j9f90d2j2390jf390g"
|
|
179
|
+
})
|
|
180
|
+
response.raise_for_status
|
|
181
|
+
payload = JSON.parse(response.to_s)
|
|
182
|
+
puts payload #=> {"access_token" => "awr23f3h8f9d2h89...", "token_type" => "Bearer" ....
|
|
183
|
+
```
|
|
184
|
+
|
|
185
|
+
##### cURL
|
|
186
|
+
|
|
187
|
+
```
|
|
188
|
+
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","token_type_hint":"access_token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/revoke
|
|
189
|
+
```
|
|
190
|
+
|
|
191
|
+
#### Token introspection
|
|
192
|
+
|
|
193
|
+
Token revocation can be used to determine the state of a token (whether active, what's the scope...) . Here's an example using server-to-server:
|
|
194
|
+
|
|
195
|
+
```ruby
|
|
196
|
+
require "httpx"
|
|
197
|
+
httpx = HTTPX.plugin(:basic_authorization)
|
|
198
|
+
response = httpx.basic_authentication(ENV["CLIENT_ID"], ENV["CLIENT_SECRET"])
|
|
199
|
+
.post("https://auth_server/introspect",json: {
|
|
152
200
|
token_type_hint: "access_token", # can also be "refresh:tokn"
|
|
153
201
|
token: "2r89hfef4j9f90d2j2390jf390g"
|
|
154
202
|
})
|
|
155
203
|
response.raise_for_status
|
|
156
204
|
payload = JSON.parse(response.to_s)
|
|
157
|
-
puts payload #=> {"
|
|
205
|
+
puts payload #=> {"active" => true, "scope" => "read write" ....
|
|
158
206
|
```
|
|
159
207
|
|
|
160
208
|
##### cURL
|
|
161
209
|
|
|
162
210
|
```
|
|
163
|
-
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","token_type_hint":"access_token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/
|
|
211
|
+
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","token_type_hint":"access_token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/revoke
|
|
212
|
+
```
|
|
213
|
+
|
|
214
|
+
### Authorization Server Metadata
|
|
215
|
+
|
|
216
|
+
The Authorization Server Metadata endpoint can be used by clients to obtain the information needed to interact with an
|
|
217
|
+
OAuth 2.0 authorization server, i.e. know which endpoint is used to authorize clients.
|
|
218
|
+
|
|
219
|
+
Because this endpoint **must be https://AUTHSERVER/.well-known/oauth-authorization-server**, you'll have to define it at the root-level of your app:
|
|
220
|
+
|
|
221
|
+
```ruby
|
|
222
|
+
plugin :rodauth do
|
|
223
|
+
# enable it in the plugin
|
|
224
|
+
enable :login, :oauth
|
|
225
|
+
oauth_application_default_scope %w[profile.read]
|
|
226
|
+
oauth_application_scopes %w[profile.read profile.write]
|
|
227
|
+
end
|
|
228
|
+
|
|
229
|
+
# then, inside roda
|
|
230
|
+
|
|
231
|
+
route do |r|
|
|
232
|
+
r.rodauth
|
|
233
|
+
# server metadata endpoint
|
|
234
|
+
rodauth.oauth_server_metadata
|
|
235
|
+
|
|
236
|
+
# now, your oauth and app code...
|
|
237
|
+
|
|
164
238
|
```
|
|
165
239
|
|
|
166
240
|
### Database migrations
|
|
@@ -191,10 +265,10 @@ The rodauth default setup expects the roda `render` plugin to be activated; by d
|
|
|
191
265
|
|
|
192
266
|
Once you set it up, by default, the following endpoints will be available:
|
|
193
267
|
|
|
194
|
-
* `GET /
|
|
195
|
-
* `POST /
|
|
196
|
-
* `POST /
|
|
197
|
-
* `POST /
|
|
268
|
+
* `GET /authorize`: Loads the OAuth authorization HTML form;
|
|
269
|
+
* `POST /authorize`: Responds to an OAuth authorization request, as [per the spec](https://tools.ietf.org/html/rfc6749#section-4);
|
|
270
|
+
* `POST /token`: Generates OAuth tokens as [per the spec](https://tools.ietf.org/html/rfc6749#section-4.4.2);
|
|
271
|
+
* `POST /revoke`: Revokes OAuth tokens as [per the spec](https://tools.ietf.org/html/rfc7009);
|
|
198
272
|
|
|
199
273
|
### OAuth applications
|
|
200
274
|
|
|
@@ -337,13 +411,21 @@ This will only work **if there was a previous successful online grant** for the
|
|
|
337
411
|
|
|
338
412
|
#### DB schema
|
|
339
413
|
|
|
340
|
-
the "oauth_grants" table will have to include the "access_type row
|
|
414
|
+
the "oauth_grants" table will have to include the "access_type" row:
|
|
341
415
|
|
|
342
416
|
```ruby
|
|
343
417
|
# in migration
|
|
344
418
|
String :access_type, null: false, default: "offline"
|
|
345
419
|
```
|
|
346
420
|
|
|
421
|
+
If you want to disable this flow altogether, you can:
|
|
422
|
+
|
|
423
|
+
```ruby
|
|
424
|
+
enable :oauth
|
|
425
|
+
use_oauth_access_type? false
|
|
426
|
+
```
|
|
427
|
+
|
|
428
|
+
|
|
347
429
|
### Implicit Grant (default: disabled)
|
|
348
430
|
|
|
349
431
|
The implicit grant flow is part of the original OAuth 2.0 RFC, however, if you care about security, you are **strongly recommended** not to enable it.
|
|
@@ -366,9 +448,7 @@ The "Proof Key for Code Exchange by OAuth Public Clients" (aka PKCE) flow, which
|
|
|
366
448
|
```ruby
|
|
367
449
|
# with httpx
|
|
368
450
|
require "httpx"
|
|
369
|
-
|
|
370
|
-
response = httpx.with(headers: { "X-your-auth-scheme" => ENV["SERVER_KEY"] })
|
|
371
|
-
.post("https://auth_server/oauth-token",json: {
|
|
451
|
+
response = HTTPX.post("https://auth_server/token",json: {
|
|
372
452
|
client_id: ENV["OAUTH_CLIENT_ID"],
|
|
373
453
|
grant_type: "authorization_code",
|
|
374
454
|
code: "oiweicnewdh32fhoi3hf3ihfo2ih3f2o3as",
|
|
@@ -376,7 +456,7 @@ response = httpx.with(headers: { "X-your-auth-scheme" => ENV["SERVER_KEY"] })
|
|
|
376
456
|
})
|
|
377
457
|
response.raise_for_status
|
|
378
458
|
payload = JSON.parse(response.to_s)
|
|
379
|
-
puts payload #=> {"
|
|
459
|
+
puts payload #=> {"access_token" => ....
|
|
380
460
|
```
|
|
381
461
|
|
|
382
462
|
By default, the pkce integration sets "S256" as the default challenge method. If you value security, you **should not use plain**. However, if you really need to, you can set it in the `rodauth` plugin:
|
|
@@ -397,13 +477,161 @@ plugin :rodauth do
|
|
|
397
477
|
end
|
|
398
478
|
```
|
|
399
479
|
|
|
480
|
+
If you want, on the other hand. to disable this flow altogether, you can:
|
|
481
|
+
|
|
482
|
+
```ruby
|
|
483
|
+
enable :oauth
|
|
484
|
+
use_oauth_pkce? false
|
|
485
|
+
```
|
|
486
|
+
|
|
487
|
+
### HTTP Mac Authentication
|
|
488
|
+
|
|
489
|
+
You can enable HTTP MAC authentication like this:
|
|
490
|
+
|
|
491
|
+
```ruby
|
|
492
|
+
plugin :rodauth do
|
|
493
|
+
enable :oauth_http_mac
|
|
494
|
+
end
|
|
495
|
+
```
|
|
496
|
+
|
|
497
|
+
Generating an access token will deliver the following fields:
|
|
498
|
+
|
|
499
|
+
```ruby
|
|
500
|
+
# with httpx
|
|
501
|
+
require "httpx"
|
|
502
|
+
response = httpx.post("https://auth_server/token",json: {
|
|
503
|
+
client_id: env["oauth_client_id"],
|
|
504
|
+
client_secret: env["oauth_client_secret"],
|
|
505
|
+
grant_type: "authorization_code",
|
|
506
|
+
code: "oiweicnewdh32fhoi3hf3ihfo2ih3f2o3as"
|
|
507
|
+
})
|
|
508
|
+
response.raise_for_status
|
|
509
|
+
payload = json.parse(response.to_s)
|
|
510
|
+
puts payload #=> {
|
|
511
|
+
# "access_token" => ....
|
|
512
|
+
# "mac_key" => ....
|
|
513
|
+
# "mac_algorithm" =>
|
|
514
|
+
```
|
|
515
|
+
|
|
516
|
+
which you'll be able to use to generate the mac signature to send in the "Authorization" header.
|
|
517
|
+
|
|
518
|
+
#### DB schema
|
|
519
|
+
|
|
520
|
+
the "oauth_tokens" table will have to include a column for the mac key:
|
|
521
|
+
|
|
522
|
+
```ruby
|
|
523
|
+
# in migration
|
|
524
|
+
String :mac_key, token: true
|
|
525
|
+
```
|
|
526
|
+
|
|
527
|
+
|
|
528
|
+
### JWT Access Tokens
|
|
529
|
+
|
|
530
|
+
JWT Acess Tokens are great to avoid DB lookups when validation the authorization token. Quoting the RFC, *The approach is particularly common in topologies where the authorization server and resource server are not co-located, are not run by the same entity, or are otherwise separated by some boundary.*
|
|
531
|
+
|
|
532
|
+
You can enable JWT Access tokens by doing:
|
|
533
|
+
|
|
534
|
+
```ruby
|
|
535
|
+
plugin :rodauth do
|
|
536
|
+
enable :oauth_jwt
|
|
537
|
+
end
|
|
538
|
+
```
|
|
539
|
+
|
|
540
|
+
This will, by default, use the OAuth application as HMAC signature and "HS256" as the algorithm to sign the resulting JWT access tokens. You can tweak those features by editing the following options:
|
|
541
|
+
|
|
542
|
+
```ruby
|
|
543
|
+
enable :oauth_jwt
|
|
544
|
+
oauth_jwt_secret "SECRET"
|
|
545
|
+
oauth_jwt_algorithm "HS512"
|
|
546
|
+
```
|
|
547
|
+
|
|
548
|
+
You can look for other options in [the jwt gem documentation](https://github.com/jwt/ruby-jwt), as this is used under the hood.
|
|
549
|
+
|
|
550
|
+
#### Pub/Priv key
|
|
551
|
+
|
|
552
|
+
You can decide to keep a private key to encode the JWT token, while other clients hace the public key to decode it. You can then do it like:
|
|
553
|
+
|
|
554
|
+
```ruby
|
|
555
|
+
rsa_private = OpenSSL::PKey::RSA.generate 2048
|
|
556
|
+
rsa_public = rsa_private.public_key
|
|
557
|
+
|
|
558
|
+
plugin :rodauth do
|
|
559
|
+
enable :oauth_jwt
|
|
560
|
+
oauth_jwt_key rsa_private
|
|
561
|
+
oauth_jwt_public_key rsa_public
|
|
562
|
+
oauth_jwt_algorithm "RS256"
|
|
563
|
+
end
|
|
564
|
+
```
|
|
565
|
+
|
|
566
|
+
#### JWK
|
|
567
|
+
|
|
568
|
+
One can further encode the JWT token using JSON Web Keys. Here's how you could enable the feature:
|
|
569
|
+
|
|
570
|
+
```ruby
|
|
571
|
+
rsa_private = OpenSSL::PKey::RSA.generate 2048
|
|
572
|
+
rsa_public = rsa_private.public_key
|
|
573
|
+
|
|
574
|
+
plugin :rodauth do
|
|
575
|
+
enable :oauth_jwt
|
|
576
|
+
oauth_jwt_jwk_key rsa_private
|
|
577
|
+
oauth_jwt_jwk_public_key rsa_public
|
|
578
|
+
oauth_jwt_jwk_algorithm "RS256"
|
|
579
|
+
end
|
|
580
|
+
```
|
|
581
|
+
|
|
582
|
+
#### JWE
|
|
583
|
+
|
|
584
|
+
You can further instruct the jwt feature to encrypt the encoded token using JSON Web Encryption standard:
|
|
585
|
+
|
|
586
|
+
```ruby
|
|
587
|
+
jwe_key = OpenSSL::PKey::RSA.new(2048)
|
|
588
|
+
|
|
589
|
+
plugin :rodauth do
|
|
590
|
+
oauth_jwt_secret "SECRET"
|
|
591
|
+
oauth_jwt_algorithm "HS256"
|
|
592
|
+
oauth_jwt_jwe_key jwe_key
|
|
593
|
+
oauth_jwt_jwe_encryption_method "A192GCM"
|
|
594
|
+
end
|
|
595
|
+
```
|
|
596
|
+
|
|
597
|
+
which adds an extra layer of protection.
|
|
598
|
+
|
|
599
|
+
#### JWKS URI
|
|
600
|
+
|
|
601
|
+
A route is defined for getting the JWK Set in a JSON format; this is typically used by client applications, who need the JWK set to decode the JWT token. This URL is typically `https://oauth-server/jwks`.
|
|
602
|
+
|
|
603
|
+
#### JWT Bearer as authorization grant
|
|
604
|
+
|
|
605
|
+
One can emit a new access token by using the bearer access token as grant. This can be done emitting a request similar to this:
|
|
606
|
+
|
|
607
|
+
```ruby
|
|
608
|
+
# with httpx
|
|
609
|
+
require "httpx"
|
|
610
|
+
response = httpx.post("https://auth_server/token",json: {
|
|
611
|
+
grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
|
|
612
|
+
assertion: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOjEsImlzcyI6IkV4YW1wbGUiLCJpYXQiOjE1OTIwMDk1MDEsImNsaWVudF9pZCI6IkNMSUVOVF9JRCIsImV4cCI6MTU5MjAxMzEwMSwiYXVkIjpudWxsLCJzY29wZSI6InVzZXIucmVhZCB1c2VyLndyaXRlIiwianRpIjoiOGM1NTVjMjdiOWRjNDdmOTcyNWRkYzBhMjk0NzA1ZTA4NzFkY2JlN2Q5ZTNlMmVkNGE1ZTBiOGZlNTZlYzcxMSJ9.AlxKRtE3ec0mtyBSDx4VseND4eC6cH5ubtv8gfYxxsc"
|
|
613
|
+
})
|
|
614
|
+
response.raise_for_status
|
|
615
|
+
payload = json.parse(response.to_s)
|
|
616
|
+
puts payload #=> {
|
|
617
|
+
# "access_token" => "ey....
|
|
618
|
+
```
|
|
619
|
+
|
|
620
|
+
#### DB Schema
|
|
621
|
+
|
|
622
|
+
You'll still need the "oauth_tokens" table, however you can remove the "token" column.
|
|
623
|
+
|
|
624
|
+
#### Caveats
|
|
625
|
+
|
|
626
|
+
Although very handy for the mentioned use case, one can't revoke a JWT token on demand (it must expire first).
|
|
627
|
+
|
|
400
628
|
## Ruby support policy
|
|
401
629
|
|
|
402
|
-
The minimum Ruby version required to run `rodauth-oauth` is 2.3 . Besides that, it should support all rubies that rodauth and roda support.
|
|
630
|
+
The minimum Ruby version required to run `rodauth-oauth` is 2.3 . Besides that, it should support all rubies that rodauth and roda support, including JRuby and (potentially, I don't know yet) truffleruby.
|
|
403
631
|
|
|
404
632
|
### JRuby
|
|
405
633
|
|
|
406
|
-
If you're interested in using this library in rails, be
|
|
634
|
+
If you're interested in using this library in rails, be sure to check `rodauth-rails` policy, as it supports rails 5.2 upwards.
|
|
407
635
|
|
|
408
636
|
## Development
|
|
409
637
|
|