Class: OmniAuth::Strategies::Oidc

Inherits:
Object
  • Object
show all
Extended by:
Forwardable
Includes:
Callback, Request, Verify, OmniAuth::Strategy
Defined in:
lib/omniauth/strategies/oidc.rb,
lib/omniauth/strategies/oidc/verify.rb,
lib/omniauth/strategies/oidc/request.rb,
lib/omniauth/strategies/oidc/callback.rb

Overview

OIDC strategy for OmniAuth

Defined Under Namespace

Modules: Callback, Request, Verify Classes: CallbackError

Constant Summary collapse

RESPONSE_TYPE_EXCEPTIONS = 
{
  "id_token" => { exception_class: OmniauthOidc::MissingIdTokenError, key: :missing_id_token }.freeze,
  "code" => { exception_class: OmniauthOidc::MissingCodeError, key: :missing_code }.freeze
}.freeze
REQUIRED_OPTIONS = 
i[identifier secret config_endpoint].freeze

Instance Method Summary collapse

Methods included from Verify

#pkce_authorize_params, #public_key, #public_key_with_refresh, #secret

Methods included from Callback

#callback_phase

Methods included from Request

#authorize_uri, #request_phase

Instance Method Details

#client ⇒ Object

Initialize our custom OIDC Client with options



124
125
126
127
128
129
130
131
132
133
134
135
136
 
# File 'lib/omniauth/strategies/oidc.rb', line 124

def client
  @client ||= begin
    set_client_endpoints
    OmniauthOidc::Client.new(
      identifier: client_options.identifier,
      secret: client_options.secret,
      authorization_endpoint: client_options.authorization_endpoint,
      token_endpoint: client_options.token_endpoint,
      userinfo_endpoint: client_options.userinfo_endpoint,
      redirect_uri: redirect_uri
    )
  end
end

#config ⇒ Object

Config is built from the json response from the OIDC config endpoint



147
148
149
150
151
152
153
 
# File 'lib/omniauth/strategies/oidc.rb', line 147

def config
  validate_configuration!

  @config ||= OmniauthOidc::Logging.instrument("config.fetch", config_endpoint: client_options.config_endpoint) do
    OmniauthOidc::ConfigFetcher.fetch(client_options.config_endpoint)
  end
end

#end_session_uri ⇒ Object

URL to end authenticated user's session with OIDC provider



166
167
168
169
170
171
172
 
# File 'lib/omniauth/strategies/oidc.rb', line 166

def end_session_uri
  return unless end_session_endpoint_is_valid?

  end_session_uri = URI(client_options.end_session_endpoint)
  end_session_uri.query = encoded_post_logout_redirect_uri
  end_session_uri.to_s
end

#other_phase ⇒ Object

Detects if current request is for the logout url and makes a redirect to end session with OIDC provider



156
157
158
159
160
161
162
163
 
# File 'lib/omniauth/strategies/oidc.rb', line 156

def other_phase
  if logout_path_pattern.match?(request.url)
    options.issuer = issuer if options.issuer.to_s.empty?

    return redirect(end_session_uri) if end_session_uri
  end
  call_app!
end

#set_client_endpoints ⇒ Object 



138
139
140
141
142
143
144
 
# File 'lib/omniauth/strategies/oidc.rb', line 138

def set_client_endpoints
  client_options.authorization_endpoint ||= config.authorization_endpoint
  client_options.token_endpoint ||= config.token_endpoint
  client_options.userinfo_endpoint ||= config.userinfo_endpoint
  client_options.jwks_uri ||= config.jwks_uri
  client_options.end_session_endpoint ||= config.end_session_endpoint
end

#uid ⇒ Object 



90
91
92
 
# File 'lib/omniauth/strategies/oidc.rb', line 90

def uid
  .raw_attributes[options.uid_field.to_sym] || .sub
end