rodauth-oauth 1.3.1 → 1.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac42aa0fb7d65030b403957a408d6d5b1f999614c957ec8176d814030ddb9381
-  data.tar.gz: f67cf98dfdb162d1e015d3930b569756f2a25737a64e68ed36fcf31e2d672be2
+  metadata.gz: bf721a3632883e34bff44e33ca84c9a5aa2248748ccecf52c180edd25086abad
+  data.tar.gz: 59966edc773dbee470be46770532ee9159dfe370d346eca936a2ebc48a8fd224
 SHA512:
-  metadata.gz: e86da1d43f30dfb18e1ae530dc5b1cc9cf69903d32a39bade2dc5881075140d79ef5644159ff40b1406b58dfb12197c79d13f683f20b431330d02d452b3cf87e
-  data.tar.gz: ad35b6bc881f1e22f7cb7227115daee9556ebeada9e10b21e8ecfeb9dc0e7a51ddd606ef481f1125064e49d6ee39076bd8bc2043d58d0d103df6a27813a022db
+  metadata.gz: 6855059fe2d8225e4f3650dca01ad4ff3d82ad4e42623b43e5ea1d42ef3dbec317bf9488a2b1598556c135f9b9bf1d45ac41512d7347e3c5c55b7c5e8bd63305
+  data.tar.gz: 9a564b8ad6812841f4a2737ee263af188e5231c49b8b475f0c575a5b0496aa6f534709552845caaaacbb73dbe1afabb9079a17265683be5df73f62075a78896e

data/README.md

@@ -90,8 +90,8 @@ Or install it yourself as:
 
 ## Articles
 
-* [How to use rodauth-oauth with rails and rodauth](https://honeyryderchuck.gitlab.io/httpx/2021/03/15/oidc-provider-on-rails-using-rodauth-oauth.html)
-* [How to use rodauth-oauth with rails and without rodauth](https://honeyryderchuck.gitlab.io/httpx/2021/09/08/using-rodauth-oauth-in-rails-without-rodauth-based-auth.html)
+* [How to use rodauth-oauth with rails and rodauth](https://honeyryderchuck.gitlab.io/2021/03/15/oidc-provider-on-rails-using-rodauth-oauth.html)
+* [How to use rodauth-oauth with rails and without rodauth](https://honeyryderchuck.gitlab.io/2021/09/08/using-rodauth-oauth-in-rails-without-rodauth-based-auth.html)
 
 ## Usage
 

data/doc/release_notes/1_3_2.md

@@ -0,0 +1,14 @@
+### 1.3.2 (27/07/2023)
+
+#### Improvements
+
+* `require_signed_request_object` option for JAR (`oauth_jwt_secured_authorization_request` plugin) is now supported:
+  * in the oauth server metadata endpoint
+  * as a plugin config option (`oauth_require_signed_request_object`, defaults to `false`)
+  * as a oauth dynamic registration endpoint param (`require_signed_request_object`, requires corresponding columnn)
+  * enforces JAR-based authorization, andd does not allow unsigned JAR JWTs, when turned on.
+
+#### Bugfixes
+
+* JWT decoding failed in circumstances where a declared encryption algo didn't have key/method declared.
+* fix for when PAR (`oauth_pushed_authorization_request` feature) is used with JAR (`oauth_jwt_secured_authorization_request` plugin), and PAR `request_uri` param wasn't being removed when validating authorize request parameters, thereby making JAR logic evaluate it as a JAR `requuest_uri` (it is now correctly not taken into account in such a case);

data/lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -46,6 +46,7 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.string :request_object_encryption_alg, null: true
       t.string :request_object_encryption_enc, null: true
       t.string :request_uris, null: true
+      t.boolean :require_signed_request_object, null: true
       t.boolean :require_pushed_authorization_requests, null: false, default: false
 
       # :oauth_tls_client_auth

data/lib/rodauth/features/oauth_dynamic_client_registration.rb

@@ -200,6 +200,14 @@ module Rodauth
         when "client_name"
           register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(value)) unless value.is_a?(String)
           key = oauth_applications_name_column
+        when "require_signed_request_object"
+          unless respond_to?(:oauth_applications_require_signed_request_object_column)
+            register_throw_json_response_error("invalid_client_metadata",
+                                               register_invalid_param_message(key))
+          end
+          request_params[key] = value = convert_to_boolean(key, value)
+
+          key = oauth_applications_require_signed_request_object_column
         when "require_pushed_authorization_requests"
           unless respond_to?(:oauth_applications_require_pushed_authorization_requests_column)
             register_throw_json_response_error("invalid_client_metadata",

data/lib/rodauth/features/oauth_jwt_base.rb

@@ -189,14 +189,16 @@ module Rodauth
         jwt = jwt.sign(jwk, signing_algorithm)
         jwt.kid = jwk.thumbprint
 
+        return jwt.to_s unless encryption_algorithm && encryption_method
+
         if jwks && (jwk = jwks.find { |k| k[:use] == "enc" && k[:alg] == encryption_algorithm && k[:enc] == encryption_method })
           jwk = JSON::JWK.new(jwk)
           jwe = jwt.encrypt(jwk, encryption_algorithm.to_sym, encryption_method.to_sym)
           jwe.to_s
         elsif jwe_key
           jwe_key = jwe_key.first if jwe_key.is_a?(Array)
-          algorithm = encryption_algorithm.to_sym if encryption_algorithm
-          meth = encryption_method.to_sym if encryption_method
+          algorithm = encryption_algorithm.to_sym
+          meth = encryption_method.to_sym
           jwt.encrypt(jwe_key, algorithm, meth)
         else
           jwt.to_s
@@ -246,6 +248,8 @@ module Rodauth
                      jws
                    elsif jws_key
                      JSON::JWT.decode(token, jws_key)
+                   else
+                     JSON::JWT.decode(token, nil, jws_algorithm)
                    end
                  elsif (jwks = auth_server_jwks_set)
                    JSON::JWT.decode(token, JSON::JWK::Set.new(jwks))
@@ -428,6 +432,8 @@ module Rodauth
                      end
                    elsif jws_key
                      JWT.decode(token, jws_key, true, algorithms: [jws_algorithm], **verify_claims_params).first
+                   else
+                     JWT.decode(token, jws_key, false, **verify_claims_params).first
                    end
                  elsif (jwks = auth_server_jwks_set)
                    algorithms = jwks[:keys].select { |k| k[:use] == "sig" }.map { |k| k[:alg] }

data/lib/rodauth/features/oauth_jwt_secured_authorization_request.rb

@@ -9,13 +9,15 @@ module Rodauth
     depends :oauth_authorize_base, :oauth_jwt_base
 
     auth_value_method :oauth_require_request_uri_registration, false
+    auth_value_method :oauth_require_signed_request_object, false
     auth_value_method :oauth_request_object_signing_alg_allow_none, false
 
-    auth_value_method :oauth_applications_request_uris_column, :request_uris
-
-    auth_value_method :oauth_applications_request_object_signing_alg_column, :request_object_signing_alg
-    auth_value_method :oauth_applications_request_object_encryption_alg_column, :request_object_encryption_alg
-    auth_value_method :oauth_applications_request_object_encryption_enc_column, :request_object_encryption_enc
+    %i[
+      request_uris require_signed_request_object request_object_signing_alg
+      request_object_encryption_alg request_object_encryption_enc
+    ].each do |column|
+      auth_value_method :"oauth_applications_#{column}_column", column
+    end
 
     translatable_method :oauth_invalid_request_object_message, "request object is invalid"
 
@@ -30,7 +32,13 @@ module Rodauth
 
       request_uri = param_or_nil("request_uri")
 
-      return super unless (request_object || request_uri) && oauth_application
+      unless (request_object || request_uri) && oauth_application
+        if request.path == authorize_path && request.get? && require_signed_request_object?
+          redirect_response_error("invalid_request_object")
+        end
+
+        return super
+      end
 
       if request_uri
         request_uri = CGI.unescape(request_uri)
@@ -84,6 +92,14 @@ module Rodauth
       request_uris.nil? || request_uris.split(oauth_scope_separator).one? { |uri| request_uri.start_with?(uri) }
     end
 
+    def require_signed_request_object?
+      return @require_signed_request_object if defined?(@require_signed_request_object)
+
+      @require_signed_request_object = (oauth_application[oauth_applications_require_signed_request_object_column] if oauth_application)
+      @require_signed_request_object = oauth_require_signed_request_object if @require_signed_request_object.nil?
+      @require_signed_request_object
+    end
+
     def decode_request_object(request_object)
       request_sig_enc_opts = {
         jws_algorithm: oauth_application[oauth_applications_request_object_signing_alg_column],
@@ -94,6 +110,8 @@ module Rodauth
       request_sig_enc_opts[:jws_algorithm] ||= "none" if oauth_request_object_signing_alg_allow_none
 
       if request_sig_enc_opts[:jws_algorithm] == "none"
+        redirect_response_error("invalid_request_object") if require_signed_request_object?
+
         jwks = nil
       elsif (jwks = oauth_application_jwks(oauth_application))
         jwks = JSON.parse(jwks, symbolize_names: true) if jwks.is_a?(String)
@@ -118,6 +136,7 @@ module Rodauth
         data[:request_parameter_supported] = true
         data[:request_uri_parameter_supported] = true
         data[:require_request_uri_registration] = oauth_require_request_uri_registration
+        data[:require_signed_request_object] = oauth_require_signed_request_object
       end
     end
   end

data/lib/rodauth/features/oauth_pushed_authorization_request.rb

@@ -65,32 +65,37 @@ module Rodauth
       # The request_uri authorization request parameter is one exception, and it MUST NOT be provided.
       redirect_response_error("invalid_request") if param_or_nil("request_uri")
 
-      if (request_object = param_or_nil("request")) && features.include?(:oauth_jwt_secured_authorization_request)
-        claims = decode_request_object(request_object)
-
-        # https://datatracker.ietf.org/doc/html/rfc9126#section-3-5.3
-        # reject the request if the authenticated client_id does not match the client_id claim in the Request Object
-        if (client_id = claims["client_id"]) && (client_id != oauth_application[oauth_applications_client_id_column])
-          redirect_response_error("invalid_request_object")
-        end
-
-        # requiring the iss claim to match the client_id is at the discretion of the authorization server
-        if oauth_require_pushed_authorization_request_iss_request_object &&
-           (iss = claims.delete("iss")) &&
-           iss != oauth_application[oauth_applications_client_id_column]
-          redirect_response_error("invalid_request_object")
-        end
-
-        if (aud = claims.delete("aud")) && !verify_aud(aud, oauth_jwt_issuer)
+      if features.include?(:oauth_jwt_secured_authorization_request)
+
+        if (request_object = param_or_nil("request"))
+          claims = decode_request_object(request_object)
+
+          # https://datatracker.ietf.org/doc/html/rfc9126#section-3-5.3
+          # reject the request if the authenticated client_id does not match the client_id claim in the Request Object
+          if (client_id = claims["client_id"]) && (client_id != oauth_application[oauth_applications_client_id_column])
+            redirect_response_error("invalid_request_object")
+          end
+
+          # requiring the iss claim to match the client_id is at the discretion of the authorization server
+          if oauth_require_pushed_authorization_request_iss_request_object &&
+             (iss = claims.delete("iss")) &&
+             iss != oauth_application[oauth_applications_client_id_column]
+            redirect_response_error("invalid_request_object")
+          end
+
+          if (aud = claims.delete("aud")) && !verify_aud(aud, oauth_jwt_issuer)
+            redirect_response_error("invalid_request_object")
+          end
+
+          claims.delete("exp")
+          request.params.delete("request")
+
+          claims.each do |k, v|
+            request.params[k.to_s] = v
+          end
+        elsif require_signed_request_object?
           redirect_response_error("invalid_request_object")
         end
-
-        claims.delete("exp")
-        request.params.delete("request")
-
-        claims.each do |k, v|
-          request.params[k.to_s] = v
-        end
       end
 
       validate_authorize_params
@@ -118,6 +123,10 @@ module Rodauth
           request.params[k.to_s] = v
         end
 
+        request.params.delete("request_uri")
+
+        # we're removing the request_uri here, so the checkup for signed reqest has to be invalidated.
+        @require_signed_request_object = false
       elsif oauth_require_pushed_authorization_requests ||
             (oauth_application && oauth_application[oauth_applications_require_pushed_authorization_requests_column])
         redirect_authorize_error("request_uri")

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.3.1"
+    VERSION = "1.3.2"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.3.2
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-06-27 00:00:00.000000000 Z
+date: 2023-07-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rodauth
@@ -71,6 +71,7 @@ extra_rdoc_files:
 - doc/release_notes/1_2_0.md
 - doc/release_notes/1_3_0.md
 - doc/release_notes/1_3_1.md
+- doc/release_notes/1_3_2.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -113,6 +114,7 @@ files:
 - doc/release_notes/1_2_0.md
 - doc/release_notes/1_3_0.md
 - doc/release_notes/1_3_1.md
+- doc/release_notes/1_3_2.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb