class OmniAuth::Strategies::Oauth2

Public Instance Methods

authorize_params() click to toggle source

def request_phase

redirect client.auth_code.authorize_url({:redirect_uri => callback_url}.merge(options.authorize_params))

end

Calls superclass method
# File lib/omniauth/strategies/test_openid_connect.rb, line 71
def authorize_params
  super.tap do |params|
    options[:passthrough_authorize_options].each do |k|
      params[k] = request.params[k.to_s] unless [nil, ''].include?(request.params[k.to_s])
    end

    params[:scope] = options[:scope]
    session['omniauth.nonce'] = params[:nonce] = SecureRandom.hex(32)

    options[:passthrough_token_options].each do |k|
      session["omniauth.param.#{k}"] = request.params[k.to_s] unless [nil, ''].include?(request.params[k.to_s])
    end
  end
end
callback_phase() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/test_openid_connect.rb, line 95
def callback_phase
  if request.params["error"] && request.params["error_description"]
    # verbose_log("Error handled, redirecting\n\n#{response.to_yaml}")
    return redirect(response)
  end

  begin
    discover!

    oauth2_callback_phase = super
    return oauth2_callback_phase if env['omniauth.error']

    if id_token_info["nonce"].nil? || id_token_info["nonce"].empty? || id_token_info["nonce"] != session.delete("omniauth.nonce")
      return fail!(:csrf_detected, CallbackError.new(:csrf_detected, "CSRF detected"))
    end
    oauth2_callback_phase
  rescue ::OmniAuth::Oauth2::DiscoveryError => e
    fail!(:openid_connect_discovery_error, e)
  rescue JWT::DecodeError => e
    fail!(:jwt_decode_failed, e)
  end
end
discover!() click to toggle source

def verbose_log(message)

options.verbose_logger.call(message)

end

# File lib/omniauth/strategies/test_openid_connect.rb, line 34
def discover!
  # verbose_log("Fetching discovery document from #{options[:client_options][:discovery_document]}")
  discovery_document = client.request(:get, options[:client_options][:discovery_document], parse: :json).parsed
  # verbose_log("Discovery document loaded\n\n#{discovery_document.to_yaml}")
  puts "****************"
  puts discovery_document
  puts "****************"
  discovery_params = {
    authorize_url: "authorization_endpoint",
    token_url: "token_endpoint",
    site: "issuer"
  }

  discovery_params.each do |internal_key, external_key|
    val = discovery_document[external_key].to_s
    raise ::OmniAuth::Oauth2::DiscoveryError.new("missing discovery parameter #{external_key}") if val.nil? || val.empty?
    options[:client_options][internal_key] = val
  end

  userinfo_endpoint = options[:client_options][:userinfo_endpoint] = discovery_document["userinfo_endpoint"].to_s
  options.use_userinfo = false if userinfo_endpoint.nil? || userinfo_endpoint.empty?
end
id_token_info() click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 118
def id_token_info
  # Verify the claims in the JWT
  # The signature does not need to be verified because the
  # token was acquired via a direct server-server connection to the issuer
  @id_token_info ||= begin
    decoded = JWT.decode(access_token['id_token'], nil, false).first
    # verbose_log("Loaded JWT\n\n#{decoded.to_yaml}")
    JWT::Verify.verify_claims(decoded,
      verify_iss: true,
      iss: options[:client_options][:site],
      verify_aud: true,
      aud: options.client_id,
      verify_sub: false,
      verify_expiration: true,
      verify_not_before: true,
      verify_iat: false,
      verify_jti: false
    )
    # verbose_log("Verified JWT\n\n#{decoded.to_yaml}")

    decoded
  end
end
request_phase() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/test_openid_connect.rb, line 57
def request_phase
  begin
    discover!
  rescue ::OmniAuth::Oauth2::DiscoveryError => e
    fail!(:openid_connect_discovery_error, e)
  end

  super
end
token_params() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/test_openid_connect.rb, line 86
def token_params
  params = {}
  options[:passthrough_token_options].each do |k|
    val = session.delete("omniauth.param.#{k}")
    params[k] = val unless [nil, ''].include?(val)
  end
  super.merge(params)
end
userinfo_response() click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 142
def userinfo_response
  @raw_info ||= begin
    info = access_token.get(options[:client_options][:userinfo_endpoint]).parsed
    # verbose_log("Fetched userinfo response\n\n#{info.to_yaml}")
    info
  end

  return fail!(:csrf_detected, CallbackError.new(:csrf_detected, "CSRF detected")) unless @raw_info['sub'] == id_token_info['sub']
  @raw_info
end

Protected Instance Methods

build_access_token() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/test_openid_connect.rb, line 197
def build_access_token
  return super if options.use_userinfo
  response = client.request(:post, options[:client_options][:token_url], body: get_token_options)
  ::OAuth2::AccessToken.from_hash(client, response.parsed)
end

Private Instance Methods

callback_url() click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 175
def callback_url
  full_host + script_name + callback_path
end
get_token_options() click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 179
def get_token_options
  { redirect_uri: callback_url,
    grant_type: 'authorization_code',
    code: request.params["code"],
    client_id: options[:client_id],
    client_secret: options[:client_secret]
  }.merge(token_params.to_hash(symbolize_keys: true))
end
prune!(hash) click to toggle source
# File lib/omniauth/strategies/test_openid_connect.rb, line 188
def prune!(hash)
  hash.delete_if do |_, v|
    prune!(v) if v.is_a?(Hash)
    v.nil? || (v.respond_to?(:empty?) && v.empty?)
  end
end