class OmniAuth::Strategies::Oauth2
Public Instance Methods
callback_phase()
click to toggle source
Calls superclass method
# File lib/omniauth/strategies/test_openid_connect.rb, line 95 def callback_phase if request.params["error"] && request.params["error_description"] # verbose_log("Error handled, redirecting\n\n#{response.to_yaml}") return redirect(response) end begin discover! oauth2_callback_phase = super return oauth2_callback_phase if env['omniauth.error'] if id_token_info["nonce"].nil? || id_token_info["nonce"].empty? || id_token_info["nonce"] != session.delete("omniauth.nonce") return fail!(:csrf_detected, CallbackError.new(:csrf_detected, "CSRF detected")) end oauth2_callback_phase rescue ::OmniAuth::Oauth2::DiscoveryError => e fail!(:openid_connect_discovery_error, e) rescue JWT::DecodeError => e fail!(:jwt_decode_failed, e) end end
discover!()
click to toggle source
def verbose_log(message)
options.verbose_logger.call(message)
end
# File lib/omniauth/strategies/test_openid_connect.rb, line 34 def discover! # verbose_log("Fetching discovery document from #{options[:client_options][:discovery_document]}") discovery_document = client.request(:get, options[:client_options][:discovery_document], parse: :json).parsed # verbose_log("Discovery document loaded\n\n#{discovery_document.to_yaml}") puts "****************" puts discovery_document puts "****************" discovery_params = { authorize_url: "authorization_endpoint", token_url: "token_endpoint", site: "issuer" } discovery_params.each do |internal_key, external_key| val = discovery_document[external_key].to_s raise ::OmniAuth::Oauth2::DiscoveryError.new("missing discovery parameter #{external_key}") if val.nil? || val.empty? options[:client_options][internal_key] = val end userinfo_endpoint = options[:client_options][:userinfo_endpoint] = discovery_document["userinfo_endpoint"].to_s options.use_userinfo = false if userinfo_endpoint.nil? || userinfo_endpoint.empty? end
id_token_info()
click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 118 def id_token_info # Verify the claims in the JWT # The signature does not need to be verified because the # token was acquired via a direct server-server connection to the issuer @id_token_info ||= begin decoded = JWT.decode(access_token['id_token'], nil, false).first # verbose_log("Loaded JWT\n\n#{decoded.to_yaml}") JWT::Verify.verify_claims(decoded, verify_iss: true, iss: options[:client_options][:site], verify_aud: true, aud: options.client_id, verify_sub: false, verify_expiration: true, verify_not_before: true, verify_iat: false, verify_jti: false ) # verbose_log("Verified JWT\n\n#{decoded.to_yaml}") decoded end end
request_phase()
click to toggle source
Calls superclass method
# File lib/omniauth/strategies/test_openid_connect.rb, line 57 def request_phase begin discover! rescue ::OmniAuth::Oauth2::DiscoveryError => e fail!(:openid_connect_discovery_error, e) end super end
token_params()
click to toggle source
Calls superclass method
# File lib/omniauth/strategies/test_openid_connect.rb, line 86 def token_params params = {} options[:passthrough_token_options].each do |k| val = session.delete("omniauth.param.#{k}") params[k] = val unless [nil, ''].include?(val) end super.merge(params) end
userinfo_response()
click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 142 def userinfo_response @raw_info ||= begin info = access_token.get(options[:client_options][:userinfo_endpoint]).parsed # verbose_log("Fetched userinfo response\n\n#{info.to_yaml}") info end return fail!(:csrf_detected, CallbackError.new(:csrf_detected, "CSRF detected")) unless @raw_info['sub'] == id_token_info['sub'] @raw_info end
Protected Instance Methods
build_access_token()
click to toggle source
Calls superclass method
# File lib/omniauth/strategies/test_openid_connect.rb, line 197 def build_access_token return super if options.use_userinfo response = client.request(:post, options[:client_options][:token_url], body: get_token_options) ::OAuth2::AccessToken.from_hash(client, response.parsed) end
Private Instance Methods
callback_url()
click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 175 def callback_url full_host + script_name + callback_path end
get_token_options()
click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 179 def get_token_options { redirect_uri: callback_url, grant_type: 'authorization_code', code: request.params["code"], client_id: options[:client_id], client_secret: options[:client_secret] }.merge(token_params.to_hash(symbolize_keys: true)) end
prune!(hash)
click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 188 def prune!(hash) hash.delete_if do |_, v| prune!(v) if v.is_a?(Hash) v.nil? || (v.respond_to?(:empty?) && v.empty?) end end