Skip to content

Commit 25d521b

Browse files
patch0patch0
authored
Use omniauth openid connect (#51)
## What's changed * Removed omniauth-rpi * Added omniauth_openid_connect * Added helper methods to RpiAuth::Configuration class to help set up the openid_connect client * Adjusted how the tests were run to make sure OmniAuth test mode was toggled correctly * Moved RpiAuthBypass + tests from omniauth-rpi to this gem * Fixed up dummy app to work for local development. ## Points for consideration I don't *think* any reconfiguration is necessary for clients to move from omniauth-rpi to omniauth_openid_connect thanks to the smoothing out performed in this gem. The RpiAuthBypass is a bit.. rustic. It has just been transplanted from omniauth-rpi, but I suspect the implementation could be refined to make it more useful, and less likely to breakage as Hydra / omniauth_openid_connect develop. Ideally we'd have a check to make sure the auth hash it returns doesn't have extra fields compared to what hydra returns in the id token, etc. This change allows us to use the JWKS client auth method, and more tightly verifies tokens returned by Hydra.
2 parents a2b809a + 9c8dd6e commit 25d521b

File tree

22 files changed

+573
-110
lines changed

22 files changed

+573
-110
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
### Changed
11+
12+
- Replaced usage of [omniauth-rpi](https://github.com/RaspberryPiFoundation/omniauth-rpi/) strategy with [omniauth_openid_connect](https://github.com/omniauth/omniauth_openid_connect/) (#51)
13+
1014
## [v2.0.0]
1115

1216
### Added

‎Gemfile.lock‎

Lines changed: 54 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ PATH
33
specs:
44
rpi_auth (2.0.0)
55
omniauth-rails_csrf_protection (~> 1.0.0)
6-
omniauth-rpi (~> 1.4.0)
6+
omniauth_openid_connect (~> 0.7.1)
77
rails (>= 6.1.4)
88

99
GEM
@@ -74,7 +74,10 @@ GEM
7474
i18n (>= 1.6, < 2)
7575
minitest (>= 5.1)
7676
tzinfo (~> 2.0)
77+
aes_key_wrap (1.1.0)
7778
ast (2.4.2)
79+
attr_required (1.0.1)
80+
bindata (2.4.15)
7881
builder (3.2.4)
7982
byebug (11.1.3)
8083
coderay (1.1.3)
@@ -86,6 +89,8 @@ GEM
8689
faraday (2.7.4)
8790
faraday-net_http (>= 2.0, < 3.1)
8891
ruby2_keywords (>= 0.0.4)
92+
faraday-follow_redirects (0.3.0)
93+
faraday (>= 1, < 3)
8994
faraday-net_http (3.0.2)
9095
ffi (1.15.5)
9196
globalid (1.1.0)
@@ -94,7 +99,12 @@ GEM
9499
i18n (1.13.0)
95100
concurrent-ruby (~> 1.0)
96101
json (2.6.2)
97-
jwt (2.2.3)
102+
json-jwt (1.16.3)
103+
activesupport (>= 4.2)
104+
aes_key_wrap
105+
bindata
106+
faraday (~> 2.0)
107+
faraday-follow_redirects
98108
listen (3.7.1)
99109
rb-fsevent (~> 0.10, >= 0.10.3)
100110
rb-inotify (~> 0.9, >= 0.9.10)
@@ -107,7 +117,6 @@ GEM
107117
method_source (1.0.0)
108118
mini_mime (1.1.2)
109119
minitest (5.18.0)
110-
multi_xml (0.6.0)
111120
net-imap (0.3.1)
112121
net-protocol
113122
net-pop (0.1.2)
@@ -121,27 +130,29 @@ GEM
121130
racc (~> 1.4)
122131
nokogiri (1.14.3-x86_64-linux)
123132
racc (~> 1.4)
124-
oauth2 (2.0.9)
125-
faraday (>= 0.17.3, < 3.0)
126-
jwt (>= 1.0, < 3.0)
127-
multi_xml (~> 0.5)
128-
rack (>= 1.2, < 4)
129-
snaky_hash (~> 2.0)
130-
version_gem (~> 1.1)
131133
omniauth (2.1.1)
132134
hashie (>= 3.4.6)
133135
rack (>= 2.2.3)
134136
rack-protection
135-
omniauth-oauth2 (1.8.0)
136-
oauth2 (>= 1.4, < 3)
137-
omniauth (~> 2.0)
138137
omniauth-rails_csrf_protection (1.0.1)
139138
actionpack (>= 4.2)
140139
omniauth (~> 2.0)
141-
omniauth-rpi (1.4.0)
142-
jwt (~> 2.2.3)
143-
omniauth (~> 2.0)
144-
omniauth-oauth2 (~> 1.4)
140+
omniauth_openid_connect (0.7.1)
141+
omniauth (>= 1.9, < 3)
142+
openid_connect (~> 2.2)
143+
openid_connect (2.2.0)
144+
activemodel
145+
attr_required (>= 1.0.0)
146+
faraday (~> 2.0)
147+
faraday-follow_redirects
148+
json-jwt (>= 1.16)
149+
net-smtp
150+
rack-oauth2 (~> 2.2)
151+
swd (~> 2.0)
152+
tzinfo
153+
validate_email
154+
validate_url
155+
webfinger (~> 2.0)
145156
parallel (1.22.1)
146157
parser (3.1.3.0)
147158
ast (~> 2.4.1)
@@ -151,8 +162,18 @@ GEM
151162
pry-byebug (3.10.1)
152163
byebug (~> 11.0)
153164
pry (>= 0.13, < 0.15)
165+
public_suffix (5.0.1)
166+
puma (6.2.2)
167+
nio4r (~> 2.0)
154168
racc (1.6.2)
155169
rack (2.2.7)
170+
rack-oauth2 (2.2.0)
171+
activesupport
172+
attr_required
173+
faraday (~> 2.0)
174+
faraday-follow_redirects
175+
json-jwt (>= 1.11.0)
176+
rack (>= 2.1.0)
156177
rack-protection (3.0.6)
157178
rack
158179
rack-test (2.0.2)
@@ -238,15 +259,26 @@ GEM
238259
simplecov_json_formatter (~> 0.1)
239260
simplecov-html (0.12.3)
240261
simplecov_json_formatter (0.1.4)
241-
snaky_hash (2.0.1)
242-
hashie
243-
version_gem (~> 1.1, >= 1.1.1)
262+
swd (2.0.2)
263+
activesupport (>= 3)
264+
attr_required (>= 0.0.5)
265+
faraday (~> 2.0)
266+
faraday-follow_redirects
244267
thor (1.2.1)
245268
timeout (0.3.0)
246269
tzinfo (2.0.6)
247270
concurrent-ruby (~> 1.0)
248271
unicode-display_width (2.3.0)
249-
version_gem (1.1.2)
272+
validate_email (0.1.6)
273+
activemodel (>= 3.0)
274+
mail (>= 2.2.5)
275+
validate_url (1.0.15)
276+
activemodel (>= 3.0.0)
277+
public_suffix
278+
webfinger (2.1.2)
279+
activesupport
280+
faraday (~> 2.0)
281+
faraday-follow_redirects
250282
websocket-driver (0.7.5)
251283
websocket-extensions (>= 0.1.0)
252284
websocket-extensions (0.1.5)
@@ -259,6 +291,7 @@ PLATFORMS
259291
DEPENDENCIES
260292
listen
261293
pry-byebug
294+
puma
262295
rails (~> 7.0)
263296
rpi_auth!
264297
rspec-rails

‎README.md‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# RpiAuth
22

3-
A gem to handle authenticating via Hydra for Raspberry Pi Foundation Rails applications.
3+
A gem to handle OpenID Connect authentication via Hydra for Raspberry Pi Foundation Rails applications.
44

55
## Usage
66

@@ -11,7 +11,7 @@ The Engine includes the [Rails CSRF protection gem](https://github.com/cookpad/o
1111
Add this line to your application's Gemfile:
1212

1313
```ruby
14-
gem 'rpi_auth', git: 'https://github.com/RaspberryPiFoundation/rpi-auth.git', tag: 'v1.3.0'
14+
gem 'rpi_auth', git: 'https://github.com/RaspberryPiFoundation/rpi-auth.git', tag: 'v2.0.0'
1515
```
1616

1717
And then execute:
@@ -48,7 +48,7 @@ RpiAuth.configure do |config|
4848
config.auth_token_url = ENV.fetch('AUTH_TOKEN_URL', nil)
4949
config.auth_client_id = ENV.fetch('AUTH_CLIENT_ID', nil)
5050
config.auth_client_secret = ENV.fetch('AUTH_CLIENT_SECRET', nil)
51-
config.brand = 'brand-name'
51+
config.brand = 'raspberrypi-org'
5252
config.host_url = ENV.fetch('HOST_URL', nil)
5353
config.identity_url = ENV.fetch('IDENTITY_URL', nil)
5454
config.user_model = 'User'
@@ -96,7 +96,13 @@ link_to 'Log in', rpi_auth_login_path, method: :post
9696
button_to 'Log in', rpi_auth_login_path
9797
```
9898

99-
There is also a helper for the logout route:
99+
There is a helper for the sign-up buttons, which pushes the user through the sign-up flow.
100+
101+
```ruby
102+
button_to 'Sign up', rpi_auth_signup_path
103+
```
104+
105+
And there is also a helper for the logout route:
100106

101107
```ruby
102108
link_to 'Log out', rpi_auth_logout_path

‎config/routes.rb‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
# frozen_string_literal: true
22

33
Rails.application.routes.draw do
4-
# Dummy route. This route is never reached in the app, as Omniauth intercepts
5-
# it via Rack middleware before it reaches Rails, however adding this route
6-
# allows us to use rpi_auth_login_path helpers etc.
7-
post '/auth/rpi', as: :rpi_auth_login
4+
# Dummy routes. These routes are never reached in the app, as Omniauth
5+
# intercepts it via Rack middleware before it reaches Rails, however adding
6+
# them allows us to use rpi_auth_login_path helpers etc.
7+
post '/auth/rpi', as: :rpi_auth_login, params: { login_options: 'v1_signup' }
8+
post '/auth/rpi', as: :rpi_auth_signup, params: { login_options: 'force_signup,v1_signup' }
89

910
namespace 'rpi_auth' do
1011
get '/auth/callback', to: 'auth#callback', as: 'callback'

‎gemfiles/rails_6.1.gemfile.lock‎

Lines changed: 60 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
PATH
22
remote: ..
33
specs:
4-
rpi_auth (0.1.0)
4+
rpi_auth (2.0.0)
55
omniauth-rails_csrf_protection (~> 1.0.0)
6-
omniauth-rpi (~> 1.1)
6+
omniauth_openid_connect (~> 0.7.1)
77
rails (>= 6.1.4)
88

99
GEM
@@ -68,7 +68,10 @@ GEM
6868
minitest (>= 5.1)
6969
tzinfo (~> 2.0)
7070
zeitwerk (~> 2.3)
71+
aes_key_wrap (1.1.0)
7172
ast (2.4.2)
73+
attr_required (1.0.1)
74+
bindata (2.4.15)
7275
builder (3.2.4)
7376
byebug (11.1.3)
7477
coderay (1.1.3)
@@ -77,9 +80,11 @@ GEM
7780
diff-lcs (1.5.0)
7881
docile (1.4.0)
7982
erubi (1.11.0)
80-
faraday (2.7.1)
83+
faraday (2.7.4)
8184
faraday-net_http (>= 2.0, < 3.1)
8285
ruby2_keywords (>= 0.0.4)
86+
faraday-follow_redirects (0.3.0)
87+
faraday (>= 1, < 3)
8388
faraday-net_http (3.0.2)
8489
ffi (1.15.5)
8590
globalid (1.0.0)
@@ -88,7 +93,12 @@ GEM
8893
i18n (1.12.0)
8994
concurrent-ruby (~> 1.0)
9095
json (2.6.2)
91-
jwt (2.2.3)
96+
json-jwt (1.16.3)
97+
activesupport (>= 4.2)
98+
aes_key_wrap
99+
bindata
100+
faraday (~> 2.0)
101+
faraday-follow_redirects
92102
listen (3.7.1)
93103
rb-fsevent (~> 0.10, >= 0.10.3)
94104
rb-inotify (~> 0.9, >= 0.9.10)
@@ -101,33 +111,38 @@ GEM
101111
method_source (1.0.0)
102112
mini_mime (1.1.2)
103113
minitest (5.16.3)
104-
multi_xml (0.6.0)
114+
net-protocol (0.2.1)
115+
timeout
116+
net-smtp (0.3.3)
117+
net-protocol
105118
nio4r (2.5.8)
106119
nokogiri (1.13.9-arm64-darwin)
107120
racc (~> 1.4)
108121
nokogiri (1.13.9-x86_64-linux)
109122
racc (~> 1.4)
110-
oauth2 (2.0.9)
111-
faraday (>= 0.17.3, < 3.0)
112-
jwt (>= 1.0, < 3.0)
113-
multi_xml (~> 0.5)
114-
rack (>= 1.2, < 4)
115-
snaky_hash (~> 2.0)
116-
version_gem (~> 1.1)
117-
omniauth (2.1.0)
123+
omniauth (2.1.1)
118124
hashie (>= 3.4.6)
119125
rack (>= 2.2.3)
120126
rack-protection
121-
omniauth-oauth2 (1.8.0)
122-
oauth2 (>= 1.4, < 3)
123-
omniauth (~> 2.0)
124127
omniauth-rails_csrf_protection (1.0.1)
125128
actionpack (>= 4.2)
126129
omniauth (~> 2.0)
127-
omniauth-rpi (1.1.0)
128-
jwt (~> 2.2.3)
129-
omniauth (~> 2.0)
130-
omniauth-oauth2 (~> 1.4)
130+
omniauth_openid_connect (0.7.1)
131+
omniauth (>= 1.9, < 3)
132+
openid_connect (~> 2.2)
133+
openid_connect (2.2.0)
134+
activemodel
135+
attr_required (>= 1.0.0)
136+
faraday (~> 2.0)
137+
faraday-follow_redirects
138+
json-jwt (>= 1.16)
139+
net-smtp
140+
rack-oauth2 (~> 2.2)
141+
swd (~> 2.0)
142+
tzinfo
143+
validate_email
144+
validate_url
145+
webfinger (~> 2.0)
131146
parallel (1.22.1)
132147
parser (3.1.3.0)
133148
ast (~> 2.4.1)
@@ -137,9 +152,17 @@ GEM
137152
pry-byebug (3.10.1)
138153
byebug (~> 11.0)
139154
pry (>= 0.13, < 0.15)
155+
public_suffix (5.0.1)
140156
racc (1.6.0)
141157
rack (2.2.4)
142-
rack-protection (3.0.4)
158+
rack-oauth2 (2.2.0)
159+
activesupport
160+
attr_required
161+
faraday (~> 2.0)
162+
faraday-follow_redirects
163+
json-jwt (>= 1.11.0)
164+
rack (>= 2.1.0)
165+
rack-protection (3.0.6)
143166
rack
144167
rack-test (2.0.2)
145168
rack (>= 1.3)
@@ -224,21 +247,33 @@ GEM
224247
simplecov_json_formatter (~> 0.1)
225248
simplecov-html (0.12.3)
226249
simplecov_json_formatter (0.1.4)
227-
snaky_hash (2.0.1)
228-
hashie
229-
version_gem (~> 1.1, >= 1.1.1)
230250
sprockets (4.1.1)
231251
concurrent-ruby (~> 1.0)
232252
rack (> 1, < 3)
233253
sprockets-rails (3.4.2)
234254
actionpack (>= 5.2)
235255
activesupport (>= 5.2)
236256
sprockets (>= 3.0.0)
257+
swd (2.0.2)
258+
activesupport (>= 3)
259+
attr_required (>= 0.0.5)
260+
faraday (~> 2.0)
261+
faraday-follow_redirects
237262
thor (1.2.1)
263+
timeout (0.3.2)
238264
tzinfo (2.0.5)
239265
concurrent-ruby (~> 1.0)
240266
unicode-display_width (2.3.0)
241-
version_gem (1.1.1)
267+
validate_email (0.1.6)
268+
activemodel (>= 3.0)
269+
mail (>= 2.2.5)
270+
validate_url (1.0.15)
271+
activemodel (>= 3.0.0)
272+
public_suffix
273+
webfinger (2.1.2)
274+
activesupport
275+
faraday (~> 2.0)
276+
faraday-follow_redirects
242277
websocket-driver (0.7.5)
243278
websocket-extensions (>= 0.1.0)
244279
websocket-extensions (0.1.5)

0 commit comments

Comments
 (0)