Class: OpenIDTokenProxy::Token

Inherits:
Object
  • Object
show all
Defined in:
lib/openid_token_proxy/token.rb,
lib/openid_token_proxy/token/expired.rb,
lib/openid_token_proxy/token/refresh.rb,
lib/openid_token_proxy/token/required.rb,
lib/openid_token_proxy/token/malformed.rb,
lib/openid_token_proxy/token/authentication.rb,
lib/openid_token_proxy/token/invalid_issuer.rb,
lib/openid_token_proxy/token/invalid_audience.rb,
lib/openid_token_proxy/token/unverifiable_signature.rb

Defined Under Namespace

Modules: Authentication, Refresh Classes: Expired, InvalidAudience, InvalidIssuer, Malformed, Required, UnverifiableSignature

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(access_token, id_token = nil, refresh_token = nil) ⇒ Token

Returns a new instance of Token.



12
13
14
15
16
17
18
19
 
# File 'lib/openid_token_proxy/token.rb', line 12

def initialize(access_token, id_token = nil, refresh_token = nil)
  @access_token = access_token
  if id_token.is_a? Hash
    id_token = OpenIDConnect::ResponseObject::IdToken.new(id_token)
  end
  @id_token = id_token
  @refresh_token = refresh_token
end

Instance Attribute Details

#access_token ⇒ Object

Returns the value of attribute access_token.



10
11
12
 
# File 'lib/openid_token_proxy/token.rb', line 10

def access_token
  @access_token
end

#id_token ⇒ Object

Returns the value of attribute id_token.



10
11
12
 
# File 'lib/openid_token_proxy/token.rb', line 10

def id_token
  @id_token
end

#refresh_token ⇒ Object

Returns the value of attribute refresh_token.



10
11
12
 
# File 'lib/openid_token_proxy/token.rb', line 10

def refresh_token
  @refresh_token
end

Class Method Details

.decode!(access_token, keys = OpenIDTokenProxy.config.public_keys) ⇒ Object

Decodes given access token and validates its signature by public key(s) Use :skip_verification as second argument to skip signature validation

Raises:



66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
 
# File 'lib/openid_token_proxy/token.rb', line 66

def self.decode!(access_token, keys = OpenIDTokenProxy.config.public_keys)
  raise Required if access_token.blank?

  Array(keys).each do |key|
    begin
      object = OpenIDConnect::RequestObject.decode(access_token, key)
    rescue JSON::JWT::InvalidFormat => e
      raise Malformed.new(e.message)
    rescue JSON::JWT::VerificationFailed
      # Iterate through remaining public keys (if any)
      # Raises UnverifiableSignature if none applied (see below)

      # A failure in Certificate#verify leaves messages on the error queue,
      # which can lead to errors in SSL communication down the road.
      # See: https://bugs.ruby-lang.org/issues/7215
      OpenSSL.errors.clear
    else
      return Token.new(access_token, object.raw_attributes)
    end
  end

  raise UnverifiableSignature
end

Instance Method Details

#[](key) ⇒ Object

Retrieves data from identity attributes



26
27
28
 
# File 'lib/openid_token_proxy/token.rb', line 26

def [](key)
  id_token.raw_attributes[key]
end

#expired? ⇒ Boolean

Returns:

  • (Boolean) 


60
61
62
 
# File 'lib/openid_token_proxy/token.rb', line 60

def expired?
  id_token.exp.to_i <= Time.now.to_i
end

#expiry_time ⇒ Object 



56
57
58
 
# File 'lib/openid_token_proxy/token.rb', line 56

def expiry_time
  Time.at(id_token.exp.to_i).utc
end

#to_s ⇒ Object 



21
22
23
 
# File 'lib/openid_token_proxy/token.rb', line 21

def to_s
  @access_token
end

#valid?(assertions = {}) ⇒ Boolean

Whether this token is valid

Returns:

  • (Boolean) 


50
51
52
53
54
 
# File 'lib/openid_token_proxy/token.rb', line 50

def valid?(assertions = {})
  validate!(assertions)
rescue OpenIDTokenProxy::Error
  false
end

#validate!(assertions = {}) ⇒ Object

Validates this token’s expiration state, application, audience and issuer

Raises:



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/openid_token_proxy/token.rb', line 31

def validate!(assertions = {})
  raise Expired if expired?

  # TODO: Nonce validation

  if assertions[:audience]
    audiences = Array(id_token.aud)
    raise InvalidAudience unless audiences.include? assertions[:audience]
  end

  if assertions[:issuer]
    issuer = id_token.iss
    raise InvalidIssuer unless issuer == assertions[:issuer]
  end

  true
end