Class: OmniAuth::Strategies::OpenIDConnect

Inherits:
Object
  • Object
show all
Extended by:
Forwardable
Includes:
OmniAuth::Strategy
Defined in:
lib/omniauth/strategies/openid_connect.rb

Defined Under Namespace

Classes: CallbackError

Constant Summary collapse

RESPONSE_TYPE_EXCEPTIONS = 
{
  'id_token' => { exception_class: OmniAuth::OpenIDConnect::MissingIdTokenError, key: :missing_id_token }.freeze,
  'code' => { exception_class: OmniAuth::OpenIDConnect::MissingCodeError, key: :missing_code }.freeze,
}.freeze

Instance Method Summary collapse

Instance Method Details

#authorization_code ⇒ Object 



158
159
160
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 158

def authorization_code
  params['code']
end

#authorize_uri ⇒ Object 



170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 170

def authorize_uri
  client.redirect_uri = redirect_uri
  opts = {
    response_type: options.response_type,
    response_mode: options.response_mode,
    scope: options.scope,
    state: new_state,
    login_hint: params['login_hint'],
    ui_locales: params['ui_locales'],
    claims_locales: params['claims_locales'],
    prompt: options.prompt,
    nonce: (new_nonce if options.send_nonce),
    hd: options.hd,
    acr_values: options.acr_values,
  }

  opts.merge!(options.extra_authorize_params) unless options.extra_authorize_params.empty?

  if options.pkce
    opts.merge!(pkce_authorize_params)
    session["omniauth.pkce.verifier"] = options.pkce_verifier
  end

  options.allow_authorize_params.each do |key|
    opts[key] = request.params[key.to_s] unless opts.key?(key)
  end

  client.authorization_uri(opts.reject { |_k, v| v.nil? })
end

#callback_phase ⇒ Object 



118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 118

def callback_phase
  error = params['error_reason'] || params['error']
  error_description = params['error_description'] || params['error_reason']
  invalid_state = params['state'].to_s.empty? || params['state'] != stored_state

  raise CallbackError, error: params['error'], reason: error_description, uri: params['error_uri'] if error
  raise CallbackError, error: :csrf_detected, reason: "Invalid 'state' parameter" if invalid_state

  return unless valid_response_type?

  options.issuer = issuer if options.issuer.nil? || options.issuer.empty?

  verify_id_token!(params['id_token']) if configured_response_type == 'id_token'
  discover!
  client.redirect_uri = redirect_uri

  return id_token_callback_phase if configured_response_type == 'id_token'

  client.authorization_code = authorization_code
  access_token
  super
rescue CallbackError => e
  fail!(e.error, e)
rescue ::Rack::OAuth2::Client::Error => e
  fail!(e.response[:error], e)
rescue ::Timeout::Error, ::Errno::ETIMEDOUT => e
  fail!(:timeout, e)
rescue ::SocketError => e
  fail!(:failed_to_connect, e)
end

#client ⇒ Object 



104
105
106
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 104

def client
  @client ||= ::OpenIDConnect::Client.new(client_options)
end

#config ⇒ Object 



108
109
110
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 108

def config
  @config ||= ::OpenIDConnect::Discovery::Provider::Config.discover!(options.issuer)
end

#end_session_uri ⇒ Object 



162
163
164
165
166
167
168
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 162

def end_session_uri
  return unless end_session_endpoint_is_valid?

  end_session_uri = URI(client_options.end_session_endpoint)
  end_session_uri.query = encoded_post_logout_redirect_uri
  end_session_uri.to_s
end

#other_phase ⇒ Object 



149
150
151
152
153
154
155
156
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 149

def other_phase
  if logout_path_pattern.match?(current_path)
    options.issuer = issuer if options.issuer.to_s.empty?
    discover!
    return redirect(end_session_uri) if end_session_uri
  end
  call_app!
end

#pkce_authorize_params ⇒ Object 



206
207
208
209
210
211
212
213
214
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 206

def pkce_authorize_params
  options.pkce_verifier = SecureRandom.hex(64) if options.pkce_verifier.nil?

  # NOTE: see https://tools.ietf.org/html/rfc7636#appendix-A
  {
    :code_challenge => options.pkce_options[:code_challenge].call(options.pkce_verifier),
    :code_challenge_method => options.pkce_options[:code_challenge_method],
  }
end

#pkce_token_params ⇒ Object 



216
217
218
219
220
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 216

def pkce_token_params
  return {} unless options.pkce

  {:code_verifier => session.delete("omniauth.pkce.verifier")}
end

#public_key ⇒ Object 



200
201
202
203
204
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 200

def public_key
  return config.jwks if options.discovery

  key_or_secret
end

#request_phase ⇒ Object 



112
113
114
115
116
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 112

def request_phase
  options.issuer = issuer if options.issuer.to_s.empty?
  discover!
  redirect authorize_uri
end

#uid ⇒ Object 



72
73
74
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 72

def uid
  .raw_attributes[options.uid_field.to_sym] || .sub
end