class OmniAuth::Strategies::AdfsOpenIdConnect
Constants
- DEFAULT_SCOPE
Public Instance Methods
callback_url()
click to toggle source
# File lib/omniauth/strategies/adfs_open_id_connect.rb, line 40 def callback_url full_host + script_name + callback_path end
client()
click to toggle source
Calls superclass method
# File lib/omniauth/strategies/adfs_open_id_connect.rb, line 12 def client options.authorize_params.scope = (options.scope if options.respond_to?(:scope) && options.scope) || DEFAULT_SCOPE options.client_options.authorize_url = "#{options.base_adfs_url}/adfs/oauth2/authorize" options.client_options.token_url = "#{options.base_adfs_url}/adfs/oauth2/token" super end
raw_info()
click to toggle source
The omniauth-azure-activedirectory-v2 gem implements the raw_info
method as follows. It’s unclear if this is required for AD FS, but will implement with the fallback on the ID token just as a precaution and we can later remove and use access_token.token directly if it’s not needed.
Some account types from Microsoft seem to only have a decodable ID token, with JWT unable to decode the access token. Information is limited in those cases. Other account types provide an expanded set of data inside the auth token, which does decode as a JWT.
Merge the two, allowing the expanded auth token data to overwrite the ID token data if keys collide, and use this as raw info.
# File lib/omniauth/strategies/adfs_open_id_connect.rb, line 57 def raw_info if @raw_info.nil? id_token_data = begin ::JWT.decode(access_token.params['id_token'], nil, false).first rescue StandardError # no-op, ignore the error if token decoding fails end auth_token_data = begin ::JWT.decode(access_token.token, nil, false).first rescue StandardError # no-op, ignore the error if token decoding fails end id_token_data.merge!(auth_token_data) @raw_info = id_token_data end @raw_info end