rodauth-oauth 1.7.0 has been released. rodauth-oauth is a rack-compatible toolkit for building OAuth 2.0 authorization servers, as well as OpenID Authentication Providers. rodauth-oauth is certified <https://openid.net/certification/>; for the following profiles of the OpenID Connect™ protocol: Basic OP, Implicit OP, Hybrid OP, Config OP, Dynamic OP, Form Post OP, 3rd Party Init OP Session Management OP, RP-Initiated Logout OP, Front-Channel OP, Back-Channel OP # as simple as rodauth do enable :oauth_authorization_code_grant # or enable :oidc end Among its features, it supports: * Authorization Code Grant * Refresh Token Grant * Implicit Grant * Client Credentials Grant * Device Code Grant * Token Revocation * Token Introspection * Auth Server Metadata * PKCE * Resource Indicators * JWT Access Tokens * mTLS Client Authentication * Assertion Framework * SAML 2.0 Bearer Assertion Grant * JWT Bearer Assertion Grant * JWT Secured authorization requests (JAR) * JWT Secured authorization response mode (JARM) * Pushed Authorization requests (PAR) * Demonstrating Proof-of-Possession at the Application Layer (DPoP) * Dynamic Client Registration * Client ID Metadata Document * OpenID * OpenID Discovery * OpenID Multiple Response types * OpenID Self Issued Tokens * OpenID Connect Dynamic Client Registration * OpenID Session Management * OpenID RP Initiated Logout * OpenID Frontchannel Logout * OpenID Backchannel Logout It can also be used with Rails (via the "rodauth-rails" gem). Website: rodauth-oauth · honeyryder <https://honeyryderchuck.gitlab.io/rodauth-oauth/> Documentation: Rodauth OAuth: OAuth 2.0 and OpenID for rodauth <https://honeyryderchuck.gitlab.io/rodauth-oauth/rdoc/> Wiki: Home · Wiki · OS / rodauth-oauth · GitLab <https://gitlab.com/honeyryderchuck/rodauth-oauth/wikis/home> CI: https://gitlab.com/honeyryderchuck/rodauth-oauth/pipeline These are the release notes since the last update: # 1.7.0 ## Features ### Client ID Metadata Document Support `rodauth-oauth` supports the Client ID Metadata Document Standard (also known as CIMD), via the `oauth_client_id_metadata_document` feature. In a nutshell, this provides a way by which a Client Application can identify itself to the authorization server, without prior dynamic client registration or other existing registration. More info about the feature [in the docs]( https://gitlab.com/os85/rodauth-oauth/-/wikis/Client-ID-Metadata-Document). ### 1.6.7 #### Improvements * Some new capabilities were built into `rodauth` recently, which `rodauth-oauth` now taps into: * plugins are now object shape friendly, by defining ivars using `rodauth`'s `:uses_instance_variables` auth method (introduced in v2.44) * `:oidc` plugin `get_oidc_param` and `get_additional_param` now have a default implementation, which raises an error (eliminates warnings). * `only_json?` auth method is no longer defined (unless the `:jwt` plugin is used). * some internal methods were now moved to private, instead of being needlessly exposed (eliminates security warnings). * a new auth method, `confidential?(oauth_application)`, was added to the `:oauth_base` plugin, which is now used internally to check in some key flows whether the OAuth client application is a public or a confidential client, as it's defined in the OAuth RFC: * when using the `:oauth_dynamic_client_registration` plugin, a client secret won't be generated for public clients (same logic will be applied for client registration management endpoints). * when using the `:oauth_application_management` plugin, default templates will include a client type column, and omit the client secret for public clients, where they would previously. #### Bugfixes * do not render null fields in the payload of the oauth server metadata endpoint (RFC 8414 section 2 requires omission of undefined values, so clients can apply the recommended defaults). * fixed regexp used for json requests (same fix as in [rodauth]( https://github.com/jeremyevans/rodauth/commit/3e0d7ab2d49a5733d1afcaaf1062b8... )) ### 1.6.6 #### Improvements * Authorization form params will now be exposed to the HTML rendering via the `rodauth.authorize_form_params`; this not only reduces the size of the bundled forms, but also makes it much easier to add or remove features with their own required authorize params. * `:oauth_jwt_base` feature: new `:oauth_jwt_iat_leeway` option (defaults to 30, as in seconds), is used now to make the JWT claim `iat` claim tolerant to clock skew. This option is used in both the `jwt` and `json/jwt` gem integrations. * `:oauth_pkce` feature: new `:oauth_pkce_allow_plain_method` option, which may disallow the usage of `"plain"` as a PKCE challenge method * defaults to `true` in order not to break backwards compatibility, but this is going to change in a future version, so you are recommended to set it explicitly in order not to break your application in a future upgrade. #### Bugfixes * (critical) `:oauth_dynamic_client_registration` feature: `PUT /register` was incorrectly authenticating the request (responding with 200 when secret didn't match), thereby allowing anyone (else) to update application parameters. * (critical) `:oauth_dynamic_client_registration` feature: `PUT /register` was not hashing the client secret when hashing on the client secret was enforced. * `:oauth_authorization_code_grant` feature: escape untrusted values in the authorize form (hidden request params, the `"state"` in the cancel link, the client application name), in the authorize form post POST response form, and in the device verification template. * token endpoint: enforce 4XX HTTP responses with JSON encoded body when there are errors (instead of making it rely on the "accept" HTTP header). * client authentication: fallback to `oauth_default_token_endpoint_auth_methods` when the application being authentication has no `token_endpoint_auth_method` set (instead of assuming it as "none"). * `:oauth_dynamic_client_registration` feature: client metadata which the server does not understand is now ignored (RFC 7591 section 3.1), instead of failing the registration with an `"invalid_client_metadata"` error. * `:oauth_dynamic_client_registration` feature: fix typo which was exposing `client_secret` in the registration response in cases where it shouldn't. * `:oauth_dynamic_client_registration` feature: emit `"client_id_issued_at"` as epoch seconds instead of an ISO8601 string, as per [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1). * `:oauth_dynamic_client_registration` feature: remove "registration_access_token" and "registration_client_uri" parameters from the payload (these are only valid for the OIDC counterpart). * `json/jwt`: decoding a JWT was bypassing claims verification. #### Security * Using `rodauth` `timing_safe_eql?` helper method, a string comparison function which is safe against timing attacks, in client secret matching and PKCE verification. ### 1.6.5 #### Bugfixes * `:oauth_dynamic_client_registration` feature: scoping to the client being updated, preventing thst the resulting database operations touch every row in the `"oauth_applications"` table. * `:json` feature: fixed implementation of `json_request?`. * `json-jwt` support: set explicit `:skip_verification` parameter when the jwt decoding algorithm is `"none"`. * rails generators: add missing uniqueness constraint to the index on the `"issuer"` column of the `"oauth_saml_settings"` table. * rails generators: remove the `"jti"` column entry from the `"oauth_dpop_proofs"` table (already made the pkey in the `create_table` instruction). * Make `password_hash` method public, which restores compatibility with `rodauth` v2.28 or more recent; `rodauth` **minimum supported version** becomes 2.28.0 as a result, which should not be perceived as a breaking change, as there are no other significant API changes, and ruby version support remains the same.