class OmniAuth::Strategies::Realme

Constants

MAX_LENGTH_OF_RELAY_STATE

The SAML spec says the maximum length of the RelayState is 80 bytes. See section 3.4.3 of docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf

RCMS_LAT_NAME

Public Instance Methods

callback_phase() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/realme.rb, line 72
def callback_phase # rubocop:disable Metrics/PerceivedComplexity, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/AbcSize
  response = ::OneLogin::RubySaml::Response.new(request.params['SAMLResponse'],
                                                settings: saml_settings,
                                                allowed_clock_drift: allowed_clock_drift)

  ##
  # `RelayState` is an arbitrary string (length < 80 characters). If we
  # sent it to Realme with the SAMLRequest then Realme will return it unaltered.
  #
  # If we receive any relay state then we save it.
  #
  @relay_state = request.params['RelayState'] if request.params['RelayState']

  # If the Realme Context Mapping Service (RCMS) is enabled in Realme
  # for our app then we will get a RCMS Login Access Token in the
  # SAMLResponse.
  #
  # We save the token if it exists. See
  # https://developers.realme.govt.nz/how-realme-works/whats-realme-rcms/
  #
  if response.is_valid?
    @realme_cms_lat = response.attributes[RCMS_LAT_NAME] if response.attributes[RCMS_LAT_NAME]
  end

  if legacy_rails_session_behaviour_enabled?
    OmniAuth.logger.info "Deprecation: omniauth-realme will stop putting values via Rails `session` in a future version. Use request.env['omniauth.auth'] instead." # rubocop:disable Layout/LineLength

    if response.is_valid?
      session[:uid] = response.nameid
    else
      session[:realme_error] = {
        error: response.errors.join[/=> (\S+) ->/, 1],
        message: default_error_messages_for_rails_session(response.errors.join)
      }
    end
  else
    if response.is_valid? # rubocop:disable Style/IfInsideElse
      @uid = response.nameid
    else
      msg = response.status_message ? response.status_message.strip : ''
      ex = create_exception_for(status_code: response.status_code, message: msg)

      # fail!() returns a rack response which this callback must also
      # return if OmniAuth error handling is to work correctly.
      return fail!(create_label_for(ex), ex)
    end
  end

  super
end
request_phase() click to toggle source
# File lib/omniauth/strategies/realme.rb, line 44
def request_phase
  req_options = { 'SigAlg' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' }

  ##
  # If we recieved a `relay_state` param e.g. we were invoked like:
  #
  #   redirect_to user_realme_omniauth_authorize_path(relay_state: 'some_value')
  #
  # then we pass it to Realme (via RubySaml). Realme (as a SAML IdP)
  # should return that value unaltered when it redirects back to this
  # application and `#callback_phase` below is executed.
  #
  if request.params['relay_state']
    if request.params['relay_state'].length > MAX_LENGTH_OF_RELAY_STATE
      ex = RelayStateTooLongError.new('RelayState exceeds SAML spec max length of 80 bytes')

      # fail!() returns a rack response which this callback must also
      # return if OmniAuth error handling is to work correctly.
      return fail!(create_label_for(ex), ex)
    end

    req_options['RelayState'] = request.params['relay_state']
  end

  req = OneLogin::RubySaml::Authrequest.new
  redirect req.create(saml_settings, req_options)
end
unknown() click to toggle source

The `credentials` Hash will be placed within the `request` Hash that `OmniAuth::Strategy` builds. See github.com/omniauth/omniauth/wiki/Auth-Hash-Schema

`credentials` contains any extra credentials information about the user that we received from the authentication service (Realme) e.g. an RCMS token if it exists.

# File lib/omniauth/strategies/realme.rb, line 132
credentials do
  output = {}