class OmniAuth::Strategies::OIDC
Public Instance Methods
access_token()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 129 def access_token @access_token ||= client.access_token!( scope: options.scope, client_auth_method: options.client_auth_method ).tap do |access_token| decode_id_token(access_token.id_token).verify!( issuer: options.issuer, client_id: options.client_options.identifier, nonce: stored_nonce ) end end
callback_phase()
click to toggle source
Calls superclass method
# File lib/omniauth/strategies/oidc.rb, line 76 def callback_phase error = request.params['error_reason'] || request.params['error'] if error raise CallbackError.new(request.params['error'], request.params['error_description'] || request.params['error_reason'], request.params['error_uri']) elsif request.params['state'].to_s.empty? || request.params['state'] != stored_state return Rack::Response.new(['401 Unauthorized'], 401).finish else options.issuer = issuer if options.issuer.blank? discover! if options.discovery client.authorization_code = request.params[options.response_type.to_s] client.redirect_uri = options.client_options.redirect_uri access_token super end rescue CallbackError => e fail!(:invalid_credentials, e) rescue ::Timeout::Error, ::Errno::ETIMEDOUT => e fail!(:timeout, e) rescue ::SocketError => e fail!(:failed_to_connect, e) end
client()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 98 def client @client ||= OpenIDConnect::Client.new(options.client_options) end
config()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 102 def config @config ||= OpenIDConnect::Discovery::Provider::Config.discover!(options.issuer) end
decode_id_token(id_token)
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 142 def decode_id_token(id_token) OpenIDConnect::ResponseObject::IdToken.decode(id_token, config.jwks) end
discover!()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 106 def discover! options.client_options.authorization_endpoint = config.authorization_endpoint options.client_options.token_endpoint = config.token_endpoint options.client_options.userinfo_endpoint = config.userinfo_endpoint options.client_options.jwks_uri = config.jwks_uri end
generate_nonce()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 146 def generate_nonce session['omniauth.nonce'] = SecureRandom.hex[16] end
generate_state()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 154 def generate_state session['omniauth.state'] = SecureRandom.hex[16] end
request_phase()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 70 def request_phase options.issuer = issuer if options.issuer.blank? discover! if options.discovery redirect authorize_uri end
session()
click to toggle source
Calls superclass method
# File lib/omniauth/strategies/oidc.rb, line 162 def session @env.nil? ? {} : super end
stored_nonce()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 150 def stored_nonce session.delete('omniauth.nonce') end
stored_state()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 158 def stored_state session.delete('omniauth.state') end
user_info()
click to toggle source
# File lib/omniauth/strategies/oidc.rb, line 125 def user_info @user_info ||= access_token.userinfo! end