class OmniAuth::Strategies::Office365

Implements an OmniAuth strategy to get a Microsoft Graph compatible token from Azure AD

Constants

DEFAULT_SCOPE

Public Instance Methods

authorize_params() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/office365.rb, line 47
def authorize_params
  super.tap do |params|
    %w[display hd scope auth_type].each do |v|
      params[v.to_sym] = request.params[v] if request.params[v]
    end

    params[:scope] ||= DEFAULT_SCOPE
  end
end
callback_url() click to toggle source

Override callback URL OmniAuth by default passes the entire URL of the callback, including query parameters. Azure fails validation because that doesn't match the registered callback.

# File lib/omniauth/strategies/office365.rb, line 61
def callback_url
  options[:redirect_uri] || (full_host + script_name + callback_path)
end
raw_info() click to toggle source
# File lib/omniauth/strategies/office365.rb, line 41
def raw_info
  # Get user profile information from the /me endpoint
  @raw_info ||= verify_hd
  @raw_info
end

Private Instance Methods

avatar_file() click to toggle source
# File lib/omniauth/strategies/office365.rb, line 67
def avatar_file
  photo = access_token.get("https://graph.microsoft.com/v1.0/me/photo/$value")
  ext   = photo.content_type.sub("image/", "") # "image/jpeg" => "jpeg"

  Tempfile.new(["avatar", ".#{ext}"]).tap do |file|
    file.binmode
    file.write(photo.body)
    file.rewind
  end
rescue ::OAuth2::Error => e
  if e.response.status == 404
    nil
  elsif e.code['code'] == 'GetUserPhoto' && e.code['message'].match('not supported')
    nil
  else
    raise
  end
end
verify_hd() click to toggle source
# File lib/omniauth/strategies/office365.rb, line 86
def verify_hd
  token = access_token.get('https://graph.microsoft.com/v1.0/me').parsed

  return token unless options.hd

  email = token["mail"] || token["userPrincipalName"]

  current_host_domain = email.split("@")[1]

  unless options.hd.split(',').any?{ |hd| hd.casecmp(current_host_domain)==0 }
    raise CallbackError.new(:invalid_hd, "Invalid Hosted Domain - Received HD(#{current_host_domain}) - Allowed HD(#{options.hd})")
  end

  token
end