class OmniAuth::Strategies::AdfsOpenIdConnect

Constants

DEFAULT_SCOPE

Public Instance Methods

callback_url() click to toggle source
# File lib/omniauth/strategies/adfs_open_id_connect.rb, line 40
def callback_url
  full_host + script_name + callback_path
end
client() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/adfs_open_id_connect.rb, line 12
def client
  options.authorize_params.scope =
    (options.scope if options.respond_to?(:scope) && options.scope) || DEFAULT_SCOPE

  options.client_options.authorize_url = "#{options.base_adfs_url}/adfs/oauth2/authorize"
  options.client_options.token_url = "#{options.base_adfs_url}/adfs/oauth2/token"

  super
end
raw_info() click to toggle source

The omniauth-azure-activedirectory-v2 gem implements the raw_info method as follows. It’s unclear if this is required for AD FS, but will implement with the fallback on the ID token just as a precaution and we can later remove and use access_token.token directly if it’s not needed.

Some account types from Microsoft seem to only have a decodable ID token, with JWT unable to decode the access token. Information is limited in those cases. Other account types provide an expanded set of data inside the auth token, which does decode as a JWT.

Merge the two, allowing the expanded auth token data to overwrite the ID token data if keys collide, and use this as raw info.

# File lib/omniauth/strategies/adfs_open_id_connect.rb, line 57
def raw_info
  if @raw_info.nil?
    id_token_data = begin
      ::JWT.decode(access_token.params['id_token'], nil, false).first
    rescue StandardError
      # no-op, ignore the error if token decoding fails
    end
    auth_token_data = begin
      ::JWT.decode(access_token.token, nil, false).first
    rescue StandardError
      # no-op, ignore the error if token decoding fails
    end

    id_token_data.merge!(auth_token_data)
    @raw_info = id_token_data
  end

  @raw_info
end