rodauth-oauth 1.6.7 → 1.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47de1ced2a621692058d69609ccb69999440ac8ca3de7f7a43f8522a81b93a20
-  data.tar.gz: 4822470b6f682648a772b8d7244000a68557875ee12ebd2126033f58128d9241
+  metadata.gz: d761a48ee8be007c6187f9ca5a5f0f0841bdca69e4073bec8dd2e5531b142f78
+  data.tar.gz: a2947b276b22823d0ba2bd0591afb39f94140809b13cdb5056adecc2941d16ef
 SHA512:
-  metadata.gz: 29604d9791ebdab3ea7a85a8ad05cc1ff32aaf8b73aad85b367be9cdd2ab5f199540d25b179147ef5346da7d709fcbf470aac05db6b903d80c483ce47214d399
-  data.tar.gz: 7d853b0d1a139fe2d10ec2d865493c8bdf9db313df79e4778e44943900f5634eabb03ac851a65f4f0bc31708014b037116ac46bf150b9fed8bee93fab5f9909c
+  metadata.gz: d2ac23c7f202b800cb9ef6d9c0f51861dce374ddadb3b23d8d360abff304631b8752bd426fdb046cececccdf37b3c20253261bc2a2c4c047da4823f20f63b44f
+  data.tar.gz: 86461d2cbb0a16fe0d692d18fd1ce68ab7ef17d6a5051553ee6871904ee14236d0a0392dbb9d1a8c7881f63cc86e8b479efceafd2e75ca6290c0dcbd7073844a

data/README.md

@@ -55,6 +55,7 @@ This gem implements the following RFCs and features of OAuth:
 * `oauth_dynamic_client_registration` - [Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) and [Dynamic Client Registration Management](https://www.rfc-editor.org/rfc/rfc7592);
 * OAuth application and token management dashboards;
 *  The recommendations for [Native Apps](https://www.rfc-editor.org/rfc/rfc8252);
+* `oauth_client_id_metadata_document` - [Client ID Metadata Document](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/);
 
 It also implements several components of [OpenID Connect](https://openid.net/connect/) on top of the OAuth features it provides, including:
 

data/doc/release_notes/1_7_0.md

@@ -0,0 +1,9 @@
+# 1.7.0
+
+## Features
+
+### Client ID Metadata Document Support
+
+`rodauth-oauth` supports the Client ID Metadata Document Standard (also known as CIMD), via the `oauth_client_id_metadata_document` feature. In a nutshell, this provides a way by which a Client Application can identify itself to the authorization server, without prior dynamic client registration or other existing registration.
+
+More info about the feature [in the docs](https://gitlab.com/os85/rodauth-oauth/-/wikis/Client-ID-Metadata-Document).

data/doc/release_notes/1_7_1.md

@@ -0,0 +1,11 @@
+# 1.7.1
+
+## Improvements
+
+* `oauth_application_management`: added `token_endpoint_auth_method` to the default supported fields
+
+## Bugfixes
+
+* `oauth_pkce`: authenticate client application using token endpoint auth method in endpoints other than the token endpoint (when the PKCE code is present).
+* `oidc`: fixed signing/encryption alg fields exposed from the `"/.well-known/openid-configuration"` suched that overridden values from dependent features are taken into account (one consequence of that not happening was the `oidc_self_issued` feature not advertising *only* support for `RS256` in the mentioned fields).
+* `oauth_saml_bearer_grant`: do not override, but add, `"urn:ietf:params:oauth:client-assertion-type:saml2-bearer"` as a supported `token_endpoint_auth_method` in the metadata payload.

data/lib/generators/rodauth/oauth/templates/app/views/rodauth/new_oauth_application.html.erb

@@ -1,6 +1,7 @@
 <h2><%= rodauth.new_oauth_application_page_title %></h2>
 <%= form_tag rodauth.oauth_applications_path, method: :post, class: "form-horizontal" do %>
   <%= rodauth.field_error('scope') %>
+  <%= rodauth.field_error('token_endpoint_auth_method') %>
   <div class="form-group">
     <%= label_tag "name", rodauth.oauth_applications_name_label %>
     <%= text_field_tag "name", rodauth.param('name'), class: "form-control#{' is-invalid' if rodauth.field_error('name')}" %>
@@ -38,9 +39,15 @@
       <%= rodauth.field_error('jwks_uri') %>
     </div>
   <% end %>
+  <% rodauth.oauth_token_endpoint_auth_methods_supported.each do |auth_method| %>
+    <div class="form-check">
+      <%= check_box_tag "#{rodauth.oauth_application_token_endpoint_auth_method_param}[]", auth_method, false, id: auth_method, class: "form-check-input" %>
+      <%= auth_method %>
+    </div>
+  <% end %>
   <% rodauth.oauth_application_scopes.each do |scope| %>
     <div class="form-check">
-      <%= check_box_tag "scopes[]", scope, false, id: scope, class: "form-check-input" %>
+      <%= check_box_tag "#{rodauth.oauth_application_scopes_param}[]", scope, false, id: scope, class: "form-check-input" %>
       <%= scope %>
     </div>
   <% end %>

data/lib/generators/rodauth/oauth/templates/app/views/rodauth/oauth_application.html.erb

@@ -8,6 +8,8 @@
     <dt><%= rodauth.oauth_applications_homepage_url_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_homepage_url_column] %></dd>
     <dt><%= rodauth.oauth_applications_client_type_label %>: </dt>
+    <dt><%= rodauth.oauth_applications_token_endpoint_auth_method_label %>: </dt>
+    <dd><%= oauth_application[rodauth.oauth_applications_token_endpoint_auth_method_column] %></dd>
     <dd><%= rodauth.oauth_application_client_type_label(oauth_application) %></dd>
     <dt><%= rodauth.oauth_applications_client_id_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_client_id_column] %></dd>

data/lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -9,7 +9,8 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.string :redirect_uri, null: false
       t.string :client_id, null: false, index: { unique: true }
       # change `:null` contraints to false if you want to support confidential clients only, and
-      # no scheme relying on JWT private keys advertised by the JWKs uri.
+      # no scheme relying on JWT private keys advertised by the JWKs uri; keep this as true if
+      # supporting public clients or CIMD.
       t.string :client_secret, null: true, index: { unique: true }
       t.string :registration_access_token, null: true
       t.string :scopes, null: false

data/lib/rodauth/features/oauth_application_management.rb

@@ -21,7 +21,7 @@ module Rodauth
     APPLICATION_REQUIRED_PARAMS = %w[name scopes homepage_url redirect_uri client_secret].freeze
     auth_value_method :oauth_application_required_params, APPLICATION_REQUIRED_PARAMS
 
-    (APPLICATION_REQUIRED_PARAMS + %w[description client_id]).each do |param|
+    (APPLICATION_REQUIRED_PARAMS + %w[description client_id token_endpoint_auth_method]).each do |param|
       auth_value_method :"oauth_application_#{param}_param", param
     end
 
@@ -40,6 +40,7 @@ module Rodauth
     translatable_method :oauth_applications_client_type_label, "Client Type"
     translatable_method :oauth_applications_confidential_label, "Confidential"
     translatable_method :oauth_applications_public_label, "Public"
+    translatable_method :oauth_applications_token_endpoint_auth_method_label, "Token Endpoint Authentication Methods"
 
     %w[type token refresh_token expires_in revoked_at].each do |param|
       translatable_method :"oauth_grants_#{param}_label", param.gsub("_", " ").capitalize
@@ -55,6 +56,7 @@ module Rodauth
     auth_value_method :oauth_grants_per_page, 20
 
     translatable_method :invalid_url_message, "Invalid URL"
+    translatable_method :oauth_invalid_token_endpoint_auth_method_message, "Invalid Token Endpoint Authentication Method"
     translatable_method :null_error_message, "is not filled"
 
     translatable_method :oauth_no_applications_text, "No oauth applications yet!"
@@ -174,12 +176,14 @@ module Rodauth
     end
 
     def validate_oauth_application_params
-      oauth_application_params.each do |key, value|
-        if key == oauth_application_homepage_url_param
+      oauth_application_params # eager load and validate
+      request.params.each do |key, value|
+        case key
+        when oauth_application_homepage_url_param
 
           set_field_error(key, invalid_url_message) unless check_valid_uri?(value)
 
-        elsif key == oauth_application_redirect_uri_param
+        when oauth_application_redirect_uri_param
 
           if value.respond_to?(:each)
             value.each do |uri|
@@ -190,11 +194,18 @@ module Rodauth
           else
             set_field_error(key, invalid_url_message) unless check_valid_no_fragment_uri?(value)
           end
-        elsif key == oauth_application_scopes_param
+        when oauth_application_scopes_param
 
           value.each do |scope|
             set_field_error(key, oauth_invalid_scope_message) unless oauth_application_scopes.include?(scope)
           end
+        when oauth_application_token_endpoint_auth_method_param
+          value.each do |auth_method|
+            unless oauth_token_endpoint_auth_methods_supported.include?(auth_method)
+              set_field_error(key,
+                              oauth_invalid_token_endpoint_auth_method_message)
+            end
+          end
         end
       end
 
@@ -210,6 +221,9 @@ module Rodauth
         oauth_applications_homepage_url_column => oauth_application_params[oauth_application_homepage_url_param]
       }
 
+      auth_methods = request.params.fetch(oauth_application_token_endpoint_auth_method_param, oauth_token_endpoint_auth_methods_supported)
+      create_params[oauth_applications_token_endpoint_auth_method_column] = auth_methods.join(oauth_scope_separator)
+
       redirect_uris = oauth_application_params[oauth_application_redirect_uri_param]
       redirect_uris = redirect_uris.to_a.reject(&:empty?).join(" ") if redirect_uris.respond_to?(:each)
       create_params[oauth_applications_redirect_uri_column] = redirect_uris unless redirect_uris.empty?

data/lib/rodauth/features/oauth_authorize_base.rb

@@ -30,7 +30,6 @@ module Rodauth
 
     auth_methods(
       :resource_owner_params,
-      :oauth_grants_resource_owner_columns,
       :authorize_form_params
     )
 
@@ -154,10 +153,6 @@ module Rodauth
       { oauth_grants_account_id_column => account_id }
     end
 
-    def oauth_grants_resource_owner_columns
-      [oauth_grants_account_id_column]
-    end
-
     def try_approval_prompt
       approval_prompt = param_or_nil("approval_prompt")
 

data/lib/rodauth/features/oauth_base.rb

@@ -441,13 +441,13 @@ module Rodauth
       oauth_application
     end
 
-    def supports_auth_method?(oauth_application, auth_method)
+    def supports_auth_method?(oauth_application, auth_method, default_supported_auth_methods = oauth_default_token_endpoint_auth_methods)
       return false unless oauth_application
 
       supported_auth_methods = if (auth_methods = oauth_application[oauth_applications_token_endpoint_auth_method_column])
                                  auth_methods.split(/ +/)
                                else
-                                 oauth_default_token_endpoint_auth_methods
+                                 default_supported_auth_methods
                                end
 
       supported_auth_methods.include?(auth_method)

data/lib/rodauth/features/oauth_client_id_metadata_document.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require "rodauth/oauth"
+
+module Rodauth
+  Feature.define(:oauth_client_id_metadata_document, :OauthClientIdMetadataDocument) do
+    depends :oauth_authorize_base
+
+    DOT_SEGMENTS = %w[. ..].freeze
+
+    FORBIDDEN_TOKEN_AUTH_METHODS = %w[client_secret_post client_secret_basic client_secret_jwt].freeze
+
+    def oauth_application
+      super || begin
+        client_id = param_or_nil("client_id")
+
+        return unless client_id && valid_cimd_url?(client_id)
+
+        return if @client_id_lookup
+
+        @client_id_lookup = true
+
+        client_metadata = http_request_with_cache(client_id)
+
+        # 4.1 The client metadata document MUST contain a client_id property whose value MUST match the URL of the document
+        redirect_response_error("invalid_request") unless client_metadata[:client_id] == client_id
+
+        validate_client_metadata_document(client_metadata)
+
+        @client_id_lookup = false
+
+        # rewrite metadata params into column names
+        create_params = Hash[
+          client_metadata.map do |k, v|
+            k = case k
+                when :redirect_uris
+                  v = v.join(" ")
+                  :redirect_uri
+                when :client_uri
+                  :homepage_url
+                when :grant_types, :response_types, :contacts
+                  v = v.join(" ")
+                  k
+                when :client_name
+                  :name
+                when :scope
+                  :scopes
+                else
+                  k
+                end
+            [send(:"oauth_applications_#{k}_column"), v]
+          end
+        ]
+
+        applications_ds = db[oauth_applications_table]
+        application_columns = applications_ds.columns
+
+        create_params.delete_if { |k, _| !application_columns.include?(k) }
+        @oauth_application = __insert_or_do_nothing_and_return__(
+          applications_ds,
+          oauth_applications_id_column,
+          [oauth_applications_client_id_column],
+          create_params
+        )
+      end
+    end
+
+    private
+
+    def valid_cimd_url?(client_id)
+      return false unless URI::DEFAULT_PARSER.make_regexp("https").match?(client_id)
+
+      uri = URI(client_id)
+      # Client identifier URLs MUST have an "https" scheme,
+      return false unless uri.scheme == "https"
+
+      path = uri.path
+      # MUST contain a path component
+      return false if path.empty? ||
+                      # MUST NOT contain single-dot or double-dot path segments
+                      path.split("/").any? { |seg| DOT_SEGMENTS.include?(seg) }
+
+      return false unless
+        # MUST NOT contain a fragment component
+        (uri.fragment.nil? || uri.fragment.empty?) &&
+        # MUST NOT contain a username or password Client identifier URLs
+        (uri.userinfo.nil? || uri.userinfo.empty?) &&
+        # SHOULD NOT include a query string component, and MAY contain a port.
+        (uri.query.nil? || uri.query.empty?)
+
+      true
+    end
+
+    def validate_client_metadata_document(metadata)
+      if (token_endpoint_auth_method = metadata[:token_endpoint_auth_method]) &&
+         FORBIDDEN_TOKEN_AUTH_METHODS.include?(token_endpoint_auth_method)
+        # the token_endpoint_auth_method property MUST NOT include client_secret_post, client_secret_basic, client_secret_jwt,
+        # or any other method based around a shared symmetric secret
+        redirect_response_error("invalid_request")
+      end
+
+      # the client_secret and client_secret_expires_at properties MUST NOT be used
+      redirect_response_error("invalid_request") if metadata.key?(:client_secret) || metadata.key?(:client_secret_expires_at)
+    end
+
+    def oauth_server_metadata_body(*)
+      super.tap do |data|
+        data[:client_id_metadata_document_supported] = true
+      end
+    end
+  end
+end

data/lib/rodauth/features/oauth_pkce.rb

@@ -34,10 +34,17 @@ module Rodauth
 
     private
 
+    # PKCE lets public clients redeem authorization codes without client credentials.
+    # The relaxation only applies to the authorization code grant, and not to applications which
+    # registered a token endpoint auth method other than "none" (RFC 6749 section 3.2.1).
     def supports_auth_method?(oauth_application, auth_method)
-      return super unless auth_method == "none"
+      return super unless auth_method == "none" &&
+                          # check if it's a /token request with PKCE params
+                          request.path == token_path &&
+                          request.params.key?("code_verifier") &&
+                          param_or_nil("grant_type") == "authorization_code"
 
-      request.params.key?("code_verifier") || super
+      super(oauth_application, auth_method, %w[none])
     end
 
     def validate_authorize_params

data/lib/rodauth/features/oauth_saml_bearer_grant.rb

@@ -138,7 +138,7 @@ module Rodauth
 
     def oauth_server_metadata_body(*)
       super.tap do |data|
-        data[:token_endpoint_auth_methods_supported] << "urn:ietf:params:oauth:client-assertion-type:saml2-bearer"
+        data[:token_endpoint_auth_methods_supported] += %w[urn:ietf:params:oauth:client-assertion-type:saml2-bearer]
       end
     end
   end

data/lib/rodauth/features/oidc.rb

@@ -833,13 +833,13 @@ module Rodauth
         id_token_encryption_alg_values_supported: oauth_jwt_jwe_algorithms_supported,
         id_token_encryption_enc_values_supported: oauth_jwt_jwe_encryption_methods_supported,
 
-        userinfo_signing_alg_values_supported: oauth_jwt_jws_algorithms_supported,
-        userinfo_encryption_alg_values_supported: oauth_jwt_jwe_algorithms_supported,
-        userinfo_encryption_enc_values_supported: oauth_jwt_jwe_encryption_methods_supported,
+        userinfo_signing_alg_values_supported: userinfo_signing_alg_values_supported,
+        userinfo_encryption_alg_values_supported: userinfo_encryption_alg_values_supported,
+        userinfo_encryption_enc_values_supported: userinfo_encryption_enc_values_supported,
 
-        request_object_signing_alg_values_supported: oauth_jwt_jws_algorithms_supported,
-        request_object_encryption_alg_values_supported: oauth_jwt_jwe_algorithms_supported,
-        request_object_encryption_enc_values_supported: oauth_jwt_jwe_encryption_methods_supported,
+        request_object_signing_alg_values_supported: request_object_signing_alg_values_supported,
+        request_object_encryption_alg_values_supported: request_object_encryption_alg_values_supported,
+        request_object_encryption_enc_values_supported: request_object_encryption_enc_values_supported,
 
         # These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core].
         # Values defined by this specification are normal, aggregated, and distributed.

data/lib/rodauth/features/oidc_self_issued.rb

@@ -46,15 +46,15 @@ module Rodauth
       end
     end
 
-    private
+    def request_object_signing_alg_values_supported
+      %w[none RS256]
+    end
 
     def oauth_response_types_supported
       %w[id_token]
     end
 
-    def request_object_signing_alg_values_supported
-      %w[none RS256]
-    end
+    private
 
     def id_token_claims(oauth_grant, signing_algorithm)
       claims = super

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.6.7"
+    VERSION = "1.7.1"
   end
 end

data/locales/en.yml

@@ -43,6 +43,7 @@ en:
     oauth_applications_client_type_label: "Client Type"
     oauth_applications_confidential_label: "Confidential"
     oauth_applications_public_label: "Public"
+    oauth_applications_token_endpoint_auth_method_label: "Token Endpoint Authentication Method"
     oauth_no_applications_text: "No oauth applications yet!"
     oauth_grant_user_code_label: "User code"
     oauth_grant_user_jws_jwk_label: "JSON Web Keys"
@@ -62,6 +63,7 @@ en:
     oauth_invalid_grant_message: "Invalid grant"
     oauth_invalid_scope_message: "Invalid scope"
     invalid_url_message: "Invalid URL"
+    oauth_invalid_token_endpoint_auth_method_message: "Invalid Token Endpoint Authentication Method"
     oauth_unsupported_token_type_message: "Invalid token type hint"
     null_error_message: "is not filled"
     oauth_unsupported_response_type_message: "Unsupported response type"

data/locales/pt.yml

@@ -43,6 +43,7 @@ pt:
     oauth_applications_client_type_label: "Tipo de cliente"
     oauth_applications_confidential_label: "Confidencial"
     oauth_applications_public_label: "Público"
+    oauth_applications_token_endpoint_auth_method_label: "Método de Autenticação da rota de geração do token"
     oauth_no_applications_text: "Nenhum aplicativo OAuth ainda!"
     oauth_grant_user_code_label: "Código do usuário"
     oauth_grant_user_jws_jwk_label: "Chaves JSON Web"
@@ -62,6 +63,7 @@ pt:
     oauth_invalid_grant_message: "Atribuição inválida"
     oauth_invalid_scope_message: "Escopo inválido"
     invalid_url_message: "URL inválido"
+    oauth_invalid_token_endpoint_auth_method_message: "Método de Autenticação da rota de geração do token inválido"
     oauth_unsupported_token_type_message: "Sugestão de tipo de token inválida"
     null_error_message: "não está preenchido"
     oauth_unsupported_response_type_message: "Tipo de resposta inválido"

data/templates/new_oauth_application.str

@@ -6,6 +6,7 @@
   #{rodauth.render('homepage_url_field')}
   #{rodauth.render('redirect_uri_field')}
   #{rodauth.render('client_secret_field')}
+  #{rodauth.render('token_endpoint_auth_method_field')}
   #{rodauth.render('scope_field')}
   #{
     if rodauth.features.include?(:oauth_jwt)

data/templates/oauth_application.str

@@ -1,6 +1,8 @@
 <div id="oauth-application">
   <dl>
-    <dt class="confidential">#{rodauth.oauth_applications_client_type_label}</dt>
+    <dt class="token_endpoint_auth_method">#{rodauth.oauth_applications_token_endpoint_auth_method_label}: </dt>
+    <dd class="token_endpoint_auth_method">#{@oauth_application[rodauth.oauth_applications_token_endpoint_auth_method_column]}</dd>
+    <dt class="confidential">#{rodauth.oauth_applications_client_type_label}: </dt>
     <dd class="confidential">#{rodauth.oauth_application_client_type_label(@oauth_application)}</dd>
     #{
       params = [*rodauth.oauth_application_required_params, "client_id"]

data/templates/token_endpoint_auth_method_field.str

@@ -0,0 +1,11 @@
+<fieldset class="form-group">
+  <legend>#{rodauth.oauth_applications_token_endpoint_auth_method_label}</legend>
+  #{
+    rodauth.oauth_token_endpoint_auth_methods_supported.map do |auth_method|
+      "<div class=\"form-group form-check\">" +
+      "<input id=\"#{auth_method}\" type=\"checkbox\" class=\"form-check-input\" name=\"#{rodauth.oauth_application_token_endpoint_auth_method_param}[]\" value=\"#{auth_method}\">" +
+      "<label for=\"#{auth_method}\">#{auth_method}</label>" +
+      "</div>"
+    end.join
+  }
+</fieldset>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.6.7
+  version: 1.7.1
 platform: ruby
 authors:
 - Tiago Cardoso
@@ -95,6 +95,8 @@ extra_rdoc_files:
 - doc/release_notes/1_6_5.md
 - doc/release_notes/1_6_6.md
 - doc/release_notes/1_6_7.md
+- doc/release_notes/1_7_0.md
+- doc/release_notes/1_7_1.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -148,6 +150,8 @@ files:
 - doc/release_notes/1_6_5.md
 - doc/release_notes/1_6_6.md
 - doc/release_notes/1_6_7.md
+- doc/release_notes/1_7_0.md
+- doc/release_notes/1_7_1.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
@@ -169,6 +173,7 @@ files:
 - lib/rodauth/features/oauth_authorize_base.rb
 - lib/rodauth/features/oauth_base.rb
 - lib/rodauth/features/oauth_client_credentials_grant.rb
+- lib/rodauth/features/oauth_client_id_metadata_document.rb
 - lib/rodauth/features/oauth_device_code_grant.rb
 - lib/rodauth/features/oauth_dpop.rb
 - lib/rodauth/features/oauth_dynamic_client_registration.rb
@@ -224,6 +229,7 @@ files:
 - templates/oauth_grants.str
 - templates/redirect_uri_field.str
 - templates/scope_field.str
+- templates/token_endpoint_auth_method_field.str
 homepage: https://gitlab.com/os85/rodauth-oauth
 licenses:
 - Apache-2.0