class OmniAuth::Strategies::OIDC

Public Instance Methods

access_token() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 129
def access_token
  @access_token ||= client.access_token!(
    scope: options.scope,
    client_auth_method: options.client_auth_method
  ).tap do |access_token|
    decode_id_token(access_token.id_token).verify!(
      issuer: options.issuer,
      client_id: options.client_options.identifier,
      nonce: stored_nonce
    )
  end
end
authorize_uri() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 113
def authorize_uri
  client.redirect_uri = options.client_options.redirect_uri
  client.authorization_uri({
      response_type: options.response_type,
      response_mode: options.response_mode,
      scope: options.scope,
      state: generate_state,
      nonce: generate_nonce,
      prompt: options.prompt
  })
end
callback_phase() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/oidc.rb, line 76
def callback_phase
  error = request.params['error_reason'] || request.params['error']
  if error
    raise CallbackError.new(request.params['error'], request.params['error_description'] || request.params['error_reason'], request.params['error_uri'])
  elsif request.params['state'].to_s.empty? || request.params['state'] != stored_state
    return Rack::Response.new(['401 Unauthorized'], 401).finish
  else
    options.issuer = issuer if options.issuer.blank?
    discover! if options.discovery
    client.authorization_code = request.params[options.response_type.to_s]
    client.redirect_uri = options.client_options.redirect_uri
    access_token
    super
  end
rescue CallbackError => e
  fail!(:invalid_credentials, e)
rescue ::Timeout::Error, ::Errno::ETIMEDOUT => e
  fail!(:timeout, e)
rescue ::SocketError => e
  fail!(:failed_to_connect, e)
end
client() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 98
def client
  @client ||= OpenIDConnect::Client.new(options.client_options)
end
config() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 102
def config
  @config ||= OpenIDConnect::Discovery::Provider::Config.discover!(options.issuer)
end
decode_id_token(id_token) click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 142
def decode_id_token(id_token)
  OpenIDConnect::ResponseObject::IdToken.decode(id_token, config.jwks)
end
discover!() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 106
def discover!
  options.client_options.authorization_endpoint = config.authorization_endpoint
  options.client_options.token_endpoint = config.token_endpoint
  options.client_options.userinfo_endpoint = config.userinfo_endpoint
  options.client_options.jwks_uri = config.jwks_uri
end
generate_nonce() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 146
def generate_nonce
  session['omniauth.nonce'] = SecureRandom.hex[16]
end
generate_state() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 154
def generate_state
  session['omniauth.state'] = SecureRandom.hex[16]
end
request_phase() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 70
def request_phase
  options.issuer = issuer if options.issuer.blank?
  discover! if options.discovery
  redirect authorize_uri
end
session() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/oidc.rb, line 162
def session
  @env.nil? ? {} : super
end
stored_nonce() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 150
def stored_nonce
  session.delete('omniauth.nonce')
end
stored_state() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 158
def stored_state
  session.delete('omniauth.state')
end
user_info() click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 125
def user_info
  @user_info ||= access_token.userinfo!
end