Class: OmniAuth::Strategies::OpenIDConnect

Inherits:
Object
  • Object
show all
Extended by:
Forwardable
Includes:
OmniAuth::Strategy
Defined in:
lib/omniauth/strategies/openid_connect.rb

Defined Under Namespace

Classes: CallbackError

Constant Summary collapse

RESPONSE_TYPE_EXCEPTIONS = 
{
  'id_token' => { exception_class: OmniAuth::OpenIDConnect::MissingIdTokenError, key: :missing_id_token }.freeze,
  'code' => { exception_class: OmniAuth::OpenIDConnect::MissingCodeError, key: :missing_code }.freeze,
}.freeze

Instance Method Summary collapse

Instance Method Details

#authorization_code ⇒ Object 



146
147
148
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 146

def authorization_code
  params['code']
end

#authorize_uri ⇒ Object 



158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 158

def authorize_uri
  client.redirect_uri = redirect_uri
  opts = {
    response_type: options.response_type,
    response_mode: options.response_mode,
    scope: options.scope,
    state: new_state,
    login_hint: params['login_hint'],
    ui_locales: params['ui_locales'],
    claims_locales: params['claims_locales'],
    prompt: options.prompt,
    nonce: (new_nonce if options.send_nonce),
    hd: options.hd,
    acr_values: options.acr_values,
  }
  client.authorization_uri(opts.reject { |_k, v| v.nil? })
end

#callback_phase ⇒ Object 



108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 108

def callback_phase
  error = params['error_reason'] || params['error']
  error_description = params['error_description'] || params['error_reason']
  invalid_state = params['state'].to_s.empty? || params['state'] != stored_state

  raise CallbackError.new(params['error'], error_description, params['error_uri']) if error
  raise CallbackError, 'Invalid state parameter' if invalid_state

  return unless valid_response_type?

  options.issuer = issuer if options.issuer.nil? || options.issuer.empty?

  verify_id_token!
  discover!
  client.redirect_uri = redirect_uri

  return id_token_callback_phase if configured_response_type == 'id_token'

  client.authorization_code = authorization_code
  access_token
  super
rescue CallbackError, ::Rack::OAuth2::Client::Error => e
  fail!(:invalid_credentials, e)
rescue ::Timeout::Error, ::Errno::ETIMEDOUT => e
  fail!(:timeout, e)
rescue ::SocketError => e
  fail!(:failed_to_connect, e)
end

#client ⇒ Object 



94
95
96
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 94

def client
  @client ||= ::OpenIDConnect::Client.new(client_options)
end

#config ⇒ Object 



98
99
100
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 98

def config
  @config ||= ::OpenIDConnect::Discovery::Provider::Config.discover!(options.issuer)
end

#end_session_uri ⇒ Object 



150
151
152
153
154
155
156
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 150

def end_session_uri
  return unless end_session_endpoint_is_valid?

  end_session_uri = URI(client_options.end_session_endpoint)
  end_session_uri.query = encoded_post_logout_redirect_uri
  end_session_uri.to_s
end

#other_phase ⇒ Object 



137
138
139
140
141
142
143
144
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 137

def other_phase
  if logout_path_pattern.match?(current_path)
    options.issuer = issuer if options.issuer.to_s.empty?
    discover!
    return redirect(end_session_uri) if end_session_uri
  end
  call_app!
end

#public_key ⇒ Object 



176
177
178
179
180
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 176

def public_key
  return config.jwks if options.discovery

  key_or_secret
end

#request_phase ⇒ Object 



102
103
104
105
106
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 102

def request_phase
  options.issuer = issuer if options.issuer.to_s.empty?
  discover!
  redirect authorize_uri
end

#uid ⇒ Object 



59
60
61
62
63
64
 
# File 'lib/omniauth/strategies/openid_connect.rb', line 59

def uid
  .public_send(options.uid_field.to_s)
rescue NoMethodError
  log :warn, "User sub:#{.sub} missing info field: #{options.uid_field}"
  .sub
end