Class: OmniauthOidc::JwkHandler

Inherits:
Object
  • Object
show all
Defined in:
lib/omniauth/oidc/jwk_handler.rb

Overview

Handles JWK/JWKS operations for JWT verification

Defined Under Namespace

Classes: KeyWithId

Class Method Summary collapse

Class Method Details

.find_key(keys, kid = nil) ⇒ Object

Find the right key from JWKS based on kid (key ID)



36
37
38
39
40
41
42
43
44
45
46
 
# File 'lib/omniauth/oidc/jwk_handler.rb', line 36

def self.find_key(keys, kid = nil)
  return keys.first&.keypair if kid.nil? || keys.size <= 1

  matched = keys.find { |k| k.kid == kid }
  if matched
    matched.keypair
  else
    OmniauthOidc::Logging.warn("No JWK found matching kid '#{kid}', falling back to first key")
    keys.first&.keypair
  end
end

.jwk_to_key(jwk_data) ⇒ Object 



26
27
28
29
30
31
32
33
 
# File 'lib/omniauth/oidc/jwk_handler.rb', line 26

def self.jwk_to_key(jwk_data)
  keypair = JWT::JWK.import(jwk_data).keypair
  kid = jwk_data["kid"] || jwk_data[:kid]
  KeyWithId.new(kid: kid, keypair: keypair)
rescue StandardError => e
  OmniauthOidc::Logging.error("Failed to import JWK", error: e.message)
  nil
end

.parse_jwks(jwks_data) ⇒ Object 



12
13
14
15
16
17
18
19
20
21
22
23
24
 
# File 'lib/omniauth/oidc/jwk_handler.rb', line 12

def self.parse_jwks(jwks_data)
  return nil unless jwks_data

  jwks_data = JSON.parse(jwks_data) if jwks_data.is_a?(String)

  # Handle JWKS (set of keys)
  if jwks_data["keys"]
    jwks_data["keys"].filter_map { |key_data| jwk_to_key(key_data) }
  # Handle single JWK
  else
    [jwk_to_key(jwks_data)].compact
  end
end