class OmniAuth::Strategies::Realme
Constants
- MAX_LENGTH_OF_RELAY_STATE
The SAML spec says the maximum length of the RelayState is 80 bytes. See section 3.4.3 of docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf
- RCMS_LAT_NAME
Public Instance Methods
callback_phase()
click to toggle source
Calls superclass method
# File lib/omniauth/strategies/realme.rb, line 72 def callback_phase # rubocop:disable Metrics/PerceivedComplexity, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/AbcSize response = ::OneLogin::RubySaml::Response.new(request.params['SAMLResponse'], settings: saml_settings, allowed_clock_drift: allowed_clock_drift) ## # `RelayState` is an arbitrary string (length < 80 characters). If we # sent it to Realme with the SAMLRequest then Realme will return it unaltered. # # If we receive any relay state then we save it. # @relay_state = request.params['RelayState'] if request.params['RelayState'] # If the Realme Context Mapping Service (RCMS) is enabled in Realme # for our app then we will get a RCMS Login Access Token in the # SAMLResponse. # # We save the token if it exists. See # https://developers.realme.govt.nz/how-realme-works/whats-realme-rcms/ # if response.is_valid? @realme_cms_lat = response.attributes[RCMS_LAT_NAME] if response.attributes[RCMS_LAT_NAME] end if legacy_rails_session_behaviour_enabled? OmniAuth.logger.info "Deprecation: omniauth-realme will stop putting values via Rails `session` in a future version. Use request.env['omniauth.auth'] instead." # rubocop:disable Layout/LineLength if response.is_valid? session[:uid] = response.nameid else session[:realme_error] = { error: response.errors.join[/=> (\S+) ->/, 1], message: default_error_messages_for_rails_session(response.errors.join) } end else if response.is_valid? # rubocop:disable Style/IfInsideElse @uid = response.nameid else msg = response.status_message ? response.status_message.strip : '' ex = create_exception_for(status_code: response.status_code, message: msg) # fail!() returns a rack response which this callback must also # return if OmniAuth error handling is to work correctly. return fail!(create_label_for(ex), ex) end end super end
request_phase()
click to toggle source
# File lib/omniauth/strategies/realme.rb, line 44 def request_phase req_options = { 'SigAlg' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' } ## # If we recieved a `relay_state` param e.g. we were invoked like: # # redirect_to user_realme_omniauth_authorize_path(relay_state: 'some_value') # # then we pass it to Realme (via RubySaml). Realme (as a SAML IdP) # should return that value unaltered when it redirects back to this # application and `#callback_phase` below is executed. # if request.params['relay_state'] if request.params['relay_state'].length > MAX_LENGTH_OF_RELAY_STATE ex = RelayStateTooLongError.new('RelayState exceeds SAML spec max length of 80 bytes') # fail!() returns a rack response which this callback must also # return if OmniAuth error handling is to work correctly. return fail!(create_label_for(ex), ex) end req_options['RelayState'] = request.params['relay_state'] end req = OneLogin::RubySaml::Authrequest.new redirect req.create(saml_settings, req_options) end
unknown()
click to toggle source
The `credentials` Hash will be placed within the `request` Hash that `OmniAuth::Strategy` builds. See github.com/omniauth/omniauth/wiki/Auth-Hash-Schema
`credentials` contains any extra credentials information about the user that we received from the authentication service (Realme
) e.g. an RCMS token if it exists.
# File lib/omniauth/strategies/realme.rb, line 132 credentials do output = {}