rodauth-oauth 1.7.0 → 1.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86f6ed47ccab8da1af7b8be2bd1929e24c12f1fd6fa959a5edfdee273bd0b70d
-  data.tar.gz: 10e0c26c907bfb5027ce2f77d67f4a85135cae1bf487a33c0847914084423896
+  metadata.gz: d761a48ee8be007c6187f9ca5a5f0f0841bdca69e4073bec8dd2e5531b142f78
+  data.tar.gz: a2947b276b22823d0ba2bd0591afb39f94140809b13cdb5056adecc2941d16ef
 SHA512:
-  metadata.gz: 8564ff9e316d23f319b3f26746175971c0ac5d027f50ceade63728aaddd5013edf8b36ab9547be421525e15856234a69505c69c0cfa8176f24a770e7817b9a2e
-  data.tar.gz: d1e4d2f419de9dda4eafb7d91d320e3cbc80eae5ab511ad45ab5f52c4ec38f7b0c8c18b8154fd743f53b87028d77f789278530235ab336d0ee638a6b3f80f73f
+  metadata.gz: d2ac23c7f202b800cb9ef6d9c0f51861dce374ddadb3b23d8d360abff304631b8752bd426fdb046cececccdf37b3c20253261bc2a2c4c047da4823f20f63b44f
+  data.tar.gz: 86461d2cbb0a16fe0d692d18fd1ce68ab7ef17d6a5051553ee6871904ee14236d0a0392dbb9d1a8c7881f63cc86e8b479efceafd2e75ca6290c0dcbd7073844a

data/doc/release_notes/1_7_1.md

@@ -0,0 +1,11 @@
+# 1.7.1
+
+## Improvements
+
+* `oauth_application_management`: added `token_endpoint_auth_method` to the default supported fields
+
+## Bugfixes
+
+* `oauth_pkce`: authenticate client application using token endpoint auth method in endpoints other than the token endpoint (when the PKCE code is present).
+* `oidc`: fixed signing/encryption alg fields exposed from the `"/.well-known/openid-configuration"` suched that overridden values from dependent features are taken into account (one consequence of that not happening was the `oidc_self_issued` feature not advertising *only* support for `RS256` in the mentioned fields).
+* `oauth_saml_bearer_grant`: do not override, but add, `"urn:ietf:params:oauth:client-assertion-type:saml2-bearer"` as a supported `token_endpoint_auth_method` in the metadata payload.

data/lib/generators/rodauth/oauth/templates/app/views/rodauth/new_oauth_application.html.erb

@@ -1,6 +1,7 @@
 <h2><%= rodauth.new_oauth_application_page_title %></h2>
 <%= form_tag rodauth.oauth_applications_path, method: :post, class: "form-horizontal" do %>
   <%= rodauth.field_error('scope') %>
+  <%= rodauth.field_error('token_endpoint_auth_method') %>
   <div class="form-group">
     <%= label_tag "name", rodauth.oauth_applications_name_label %>
     <%= text_field_tag "name", rodauth.param('name'), class: "form-control#{' is-invalid' if rodauth.field_error('name')}" %>
@@ -38,9 +39,15 @@
       <%= rodauth.field_error('jwks_uri') %>
     </div>
   <% end %>
+  <% rodauth.oauth_token_endpoint_auth_methods_supported.each do |auth_method| %>
+    <div class="form-check">
+      <%= check_box_tag "#{rodauth.oauth_application_token_endpoint_auth_method_param}[]", auth_method, false, id: auth_method, class: "form-check-input" %>
+      <%= auth_method %>
+    </div>
+  <% end %>
   <% rodauth.oauth_application_scopes.each do |scope| %>
     <div class="form-check">
-      <%= check_box_tag "scopes[]", scope, false, id: scope, class: "form-check-input" %>
+      <%= check_box_tag "#{rodauth.oauth_application_scopes_param}[]", scope, false, id: scope, class: "form-check-input" %>
       <%= scope %>
     </div>
   <% end %>

data/lib/generators/rodauth/oauth/templates/app/views/rodauth/oauth_application.html.erb

@@ -8,6 +8,8 @@
     <dt><%= rodauth.oauth_applications_homepage_url_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_homepage_url_column] %></dd>
     <dt><%= rodauth.oauth_applications_client_type_label %>: </dt>
+    <dt><%= rodauth.oauth_applications_token_endpoint_auth_method_label %>: </dt>
+    <dd><%= oauth_application[rodauth.oauth_applications_token_endpoint_auth_method_column] %></dd>
     <dd><%= rodauth.oauth_application_client_type_label(oauth_application) %></dd>
     <dt><%= rodauth.oauth_applications_client_id_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_client_id_column] %></dd>

data/lib/rodauth/features/oauth_application_management.rb

@@ -21,7 +21,7 @@ module Rodauth
     APPLICATION_REQUIRED_PARAMS = %w[name scopes homepage_url redirect_uri client_secret].freeze
     auth_value_method :oauth_application_required_params, APPLICATION_REQUIRED_PARAMS
 
-    (APPLICATION_REQUIRED_PARAMS + %w[description client_id]).each do |param|
+    (APPLICATION_REQUIRED_PARAMS + %w[description client_id token_endpoint_auth_method]).each do |param|
       auth_value_method :"oauth_application_#{param}_param", param
     end
 
@@ -40,6 +40,7 @@ module Rodauth
     translatable_method :oauth_applications_client_type_label, "Client Type"
     translatable_method :oauth_applications_confidential_label, "Confidential"
     translatable_method :oauth_applications_public_label, "Public"
+    translatable_method :oauth_applications_token_endpoint_auth_method_label, "Token Endpoint Authentication Methods"
 
     %w[type token refresh_token expires_in revoked_at].each do |param|
       translatable_method :"oauth_grants_#{param}_label", param.gsub("_", " ").capitalize
@@ -55,6 +56,7 @@ module Rodauth
     auth_value_method :oauth_grants_per_page, 20
 
     translatable_method :invalid_url_message, "Invalid URL"
+    translatable_method :oauth_invalid_token_endpoint_auth_method_message, "Invalid Token Endpoint Authentication Method"
     translatable_method :null_error_message, "is not filled"
 
     translatable_method :oauth_no_applications_text, "No oauth applications yet!"
@@ -174,12 +176,14 @@ module Rodauth
     end
 
     def validate_oauth_application_params
-      oauth_application_params.each do |key, value|
-        if key == oauth_application_homepage_url_param
+      oauth_application_params # eager load and validate
+      request.params.each do |key, value|
+        case key
+        when oauth_application_homepage_url_param
 
           set_field_error(key, invalid_url_message) unless check_valid_uri?(value)
 
-        elsif key == oauth_application_redirect_uri_param
+        when oauth_application_redirect_uri_param
 
           if value.respond_to?(:each)
             value.each do |uri|
@@ -190,11 +194,18 @@ module Rodauth
           else
             set_field_error(key, invalid_url_message) unless check_valid_no_fragment_uri?(value)
           end
-        elsif key == oauth_application_scopes_param
+        when oauth_application_scopes_param
 
           value.each do |scope|
             set_field_error(key, oauth_invalid_scope_message) unless oauth_application_scopes.include?(scope)
           end
+        when oauth_application_token_endpoint_auth_method_param
+          value.each do |auth_method|
+            unless oauth_token_endpoint_auth_methods_supported.include?(auth_method)
+              set_field_error(key,
+                              oauth_invalid_token_endpoint_auth_method_message)
+            end
+          end
         end
       end
 
@@ -210,6 +221,9 @@ module Rodauth
         oauth_applications_homepage_url_column => oauth_application_params[oauth_application_homepage_url_param]
       }
 
+      auth_methods = request.params.fetch(oauth_application_token_endpoint_auth_method_param, oauth_token_endpoint_auth_methods_supported)
+      create_params[oauth_applications_token_endpoint_auth_method_column] = auth_methods.join(oauth_scope_separator)
+
       redirect_uris = oauth_application_params[oauth_application_redirect_uri_param]
       redirect_uris = redirect_uris.to_a.reject(&:empty?).join(" ") if redirect_uris.respond_to?(:each)
       create_params[oauth_applications_redirect_uri_column] = redirect_uris unless redirect_uris.empty?

data/lib/rodauth/features/oauth_authorize_base.rb

@@ -30,7 +30,6 @@ module Rodauth
 
     auth_methods(
       :resource_owner_params,
-      :oauth_grants_resource_owner_columns,
       :authorize_form_params
     )
 
@@ -154,10 +153,6 @@ module Rodauth
       { oauth_grants_account_id_column => account_id }
     end
 
-    def oauth_grants_resource_owner_columns
-      [oauth_grants_account_id_column]
-    end
-
     def try_approval_prompt
       approval_prompt = param_or_nil("approval_prompt")
 

data/lib/rodauth/features/oauth_base.rb

@@ -441,13 +441,13 @@ module Rodauth
       oauth_application
     end
 
-    def supports_auth_method?(oauth_application, auth_method)
+    def supports_auth_method?(oauth_application, auth_method, default_supported_auth_methods = oauth_default_token_endpoint_auth_methods)
       return false unless oauth_application
 
       supported_auth_methods = if (auth_methods = oauth_application[oauth_applications_token_endpoint_auth_method_column])
                                  auth_methods.split(/ +/)
                                else
-                                 oauth_default_token_endpoint_auth_methods
+                                 default_supported_auth_methods
                                end
 
       supported_auth_methods.include?(auth_method)

data/lib/rodauth/features/oauth_pkce.rb

@@ -34,10 +34,17 @@ module Rodauth
 
     private
 
+    # PKCE lets public clients redeem authorization codes without client credentials.
+    # The relaxation only applies to the authorization code grant, and not to applications which
+    # registered a token endpoint auth method other than "none" (RFC 6749 section 3.2.1).
     def supports_auth_method?(oauth_application, auth_method)
-      return super unless auth_method == "none"
+      return super unless auth_method == "none" &&
+                          # check if it's a /token request with PKCE params
+                          request.path == token_path &&
+                          request.params.key?("code_verifier") &&
+                          param_or_nil("grant_type") == "authorization_code"
 
-      request.params.key?("code_verifier") || super
+      super(oauth_application, auth_method, %w[none])
     end
 
     def validate_authorize_params

data/lib/rodauth/features/oauth_saml_bearer_grant.rb

@@ -138,7 +138,7 @@ module Rodauth
 
     def oauth_server_metadata_body(*)
       super.tap do |data|
-        data[:token_endpoint_auth_methods_supported] << "urn:ietf:params:oauth:client-assertion-type:saml2-bearer"
+        data[:token_endpoint_auth_methods_supported] += %w[urn:ietf:params:oauth:client-assertion-type:saml2-bearer]
       end
     end
   end

data/lib/rodauth/features/oidc.rb

@@ -833,13 +833,13 @@ module Rodauth
         id_token_encryption_alg_values_supported: oauth_jwt_jwe_algorithms_supported,
         id_token_encryption_enc_values_supported: oauth_jwt_jwe_encryption_methods_supported,
 
-        userinfo_signing_alg_values_supported: oauth_jwt_jws_algorithms_supported,
-        userinfo_encryption_alg_values_supported: oauth_jwt_jwe_algorithms_supported,
-        userinfo_encryption_enc_values_supported: oauth_jwt_jwe_encryption_methods_supported,
+        userinfo_signing_alg_values_supported: userinfo_signing_alg_values_supported,
+        userinfo_encryption_alg_values_supported: userinfo_encryption_alg_values_supported,
+        userinfo_encryption_enc_values_supported: userinfo_encryption_enc_values_supported,
 
-        request_object_signing_alg_values_supported: oauth_jwt_jws_algorithms_supported,
-        request_object_encryption_alg_values_supported: oauth_jwt_jwe_algorithms_supported,
-        request_object_encryption_enc_values_supported: oauth_jwt_jwe_encryption_methods_supported,
+        request_object_signing_alg_values_supported: request_object_signing_alg_values_supported,
+        request_object_encryption_alg_values_supported: request_object_encryption_alg_values_supported,
+        request_object_encryption_enc_values_supported: request_object_encryption_enc_values_supported,
 
         # These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core].
         # Values defined by this specification are normal, aggregated, and distributed.

data/lib/rodauth/features/oidc_self_issued.rb

@@ -46,15 +46,15 @@ module Rodauth
       end
     end
 
-    private
+    def request_object_signing_alg_values_supported
+      %w[none RS256]
+    end
 
     def oauth_response_types_supported
       %w[id_token]
     end
 
-    def request_object_signing_alg_values_supported
-      %w[none RS256]
-    end
+    private
 
     def id_token_claims(oauth_grant, signing_algorithm)
       claims = super

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.7.0"
+    VERSION = "1.7.1"
   end
 end

data/locales/en.yml

@@ -43,6 +43,7 @@ en:
     oauth_applications_client_type_label: "Client Type"
     oauth_applications_confidential_label: "Confidential"
     oauth_applications_public_label: "Public"
+    oauth_applications_token_endpoint_auth_method_label: "Token Endpoint Authentication Method"
     oauth_no_applications_text: "No oauth applications yet!"
     oauth_grant_user_code_label: "User code"
     oauth_grant_user_jws_jwk_label: "JSON Web Keys"
@@ -62,6 +63,7 @@ en:
     oauth_invalid_grant_message: "Invalid grant"
     oauth_invalid_scope_message: "Invalid scope"
     invalid_url_message: "Invalid URL"
+    oauth_invalid_token_endpoint_auth_method_message: "Invalid Token Endpoint Authentication Method"
     oauth_unsupported_token_type_message: "Invalid token type hint"
     null_error_message: "is not filled"
     oauth_unsupported_response_type_message: "Unsupported response type"

data/locales/pt.yml

@@ -43,6 +43,7 @@ pt:
     oauth_applications_client_type_label: "Tipo de cliente"
     oauth_applications_confidential_label: "Confidencial"
     oauth_applications_public_label: "Público"
+    oauth_applications_token_endpoint_auth_method_label: "Método de Autenticação da rota de geração do token"
     oauth_no_applications_text: "Nenhum aplicativo OAuth ainda!"
     oauth_grant_user_code_label: "Código do usuário"
     oauth_grant_user_jws_jwk_label: "Chaves JSON Web"
@@ -62,6 +63,7 @@ pt:
     oauth_invalid_grant_message: "Atribuição inválida"
     oauth_invalid_scope_message: "Escopo inválido"
     invalid_url_message: "URL inválido"
+    oauth_invalid_token_endpoint_auth_method_message: "Método de Autenticação da rota de geração do token inválido"
     oauth_unsupported_token_type_message: "Sugestão de tipo de token inválida"
     null_error_message: "não está preenchido"
     oauth_unsupported_response_type_message: "Tipo de resposta inválido"

data/templates/new_oauth_application.str

@@ -6,6 +6,7 @@
   #{rodauth.render('homepage_url_field')}
   #{rodauth.render('redirect_uri_field')}
   #{rodauth.render('client_secret_field')}
+  #{rodauth.render('token_endpoint_auth_method_field')}
   #{rodauth.render('scope_field')}
   #{
     if rodauth.features.include?(:oauth_jwt)

data/templates/oauth_application.str

@@ -1,6 +1,8 @@
 <div id="oauth-application">
   <dl>
-    <dt class="confidential">#{rodauth.oauth_applications_client_type_label}</dt>
+    <dt class="token_endpoint_auth_method">#{rodauth.oauth_applications_token_endpoint_auth_method_label}: </dt>
+    <dd class="token_endpoint_auth_method">#{@oauth_application[rodauth.oauth_applications_token_endpoint_auth_method_column]}</dd>
+    <dt class="confidential">#{rodauth.oauth_applications_client_type_label}: </dt>
     <dd class="confidential">#{rodauth.oauth_application_client_type_label(@oauth_application)}</dd>
     #{
       params = [*rodauth.oauth_application_required_params, "client_id"]

data/templates/token_endpoint_auth_method_field.str

@@ -0,0 +1,11 @@
+<fieldset class="form-group">
+  <legend>#{rodauth.oauth_applications_token_endpoint_auth_method_label}</legend>
+  #{
+    rodauth.oauth_token_endpoint_auth_methods_supported.map do |auth_method|
+      "<div class=\"form-group form-check\">" +
+      "<input id=\"#{auth_method}\" type=\"checkbox\" class=\"form-check-input\" name=\"#{rodauth.oauth_application_token_endpoint_auth_method_param}[]\" value=\"#{auth_method}\">" +
+      "<label for=\"#{auth_method}\">#{auth_method}</label>" +
+      "</div>"
+    end.join
+  }
+</fieldset>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.7.1
 platform: ruby
 authors:
 - Tiago Cardoso
@@ -96,6 +96,7 @@ extra_rdoc_files:
 - doc/release_notes/1_6_6.md
 - doc/release_notes/1_6_7.md
 - doc/release_notes/1_7_0.md
+- doc/release_notes/1_7_1.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -150,6 +151,7 @@ files:
 - doc/release_notes/1_6_6.md
 - doc/release_notes/1_6_7.md
 - doc/release_notes/1_7_0.md
+- doc/release_notes/1_7_1.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
@@ -227,6 +229,7 @@ files:
 - templates/oauth_grants.str
 - templates/redirect_uri_field.str
 - templates/scope_field.str
+- templates/token_endpoint_auth_method_field.str
 homepage: https://gitlab.com/os85/rodauth-oauth
 licenses:
 - Apache-2.0