OmniAuth::OpenIDConnect

Originally was omniauth-openid-connect

I've forked this repository and launch as separate gem because maintaining of original was dropped.

Installation

Add this line to your application's Gemfile:

gem 'omniauth_openid_connect'

And then execute:

$ bundle

Or install it yourself as:

$ gem install omniauth_openid_connect

Supported Ruby Versions

OmniAuth::OpenIDConnect is tested under 2.7, 3.0, 3.1, 3.2, 3.3, 3.4

Usage

Example configuration

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :openid_connect, {
    name: :my_provider,
    scope: [:openid, :email, :profile, :address],
    response_type: :code,
    uid_field: "preferred_username",
    client_options: {
      port: 443,
      scheme: "https",
      host: "myprovider.com",
      identifier: ENV["OP_CLIENT_ID"],
      secret: ENV["OP_SECRET_KEY"],
      redirect_uri: "http://myapp.com/users/auth/openid_connect/callback",
    },
  }
end

with Devise

Devise.setup do |config|
  config.omniauth :openid_connect, {
    name: :my_provider,
    scope: [:openid, :email, :profile, :address],
    response_type: :code,
    uid_field: "preferred_username",
    client_options: {
      port: 443,
      scheme: "https",
      host: "myprovider.com",
      identifier: ENV["OP_CLIENT_ID"],
      secret: ENV["OP_SECRET_KEY"],
      redirect_uri: "http://myapp.com/users/auth/openid_connect/callback",
    },
  }
end

Options Overview

Client Config Options

These are the configuration options for the client_options hash of the configuration.

Additional Configuration Notes

• name is arbitrary, I recommend using the name of your provider. The name configuration exists because you could be using multiple OpenID Connect providers in a single app.

NOTE: if you use this gem with Devise you should use :openid_connect name, or Devise would route to 'users/auth/:provider' rather than 'users/auth/openid_connect'

• response_type tells the authorization server which grant type the application wants to use, currently, only :code (Authorization Code grant) and :id_token (Implicit grant) are valid.
• If you want to pass state parameter by yourself. You can set Proc Object. e.g. state: Proc.new { SecureRandom.hex(32) }
• nonce is optional. If don't want to pass "nonce" parameter to provider, You should specify false to send_nonce option. (default true)
• Support for other client authentication methods. If don't specified :client_auth_method option, automatically set :basic.
• Use "OpenID Connect Discovery", You should specify true to discovery option. (default false)
• In "OpenID Connect Discovery", generally provider should have Webfinger endpoint. If provider does not have Webfinger endpoint, You can specify "Issuer" to option. e.g. issuer: "https://myprovider.com" It means to get configuration from "https://myprovider.com/.well-known/openid-configuration".
• The uid is by default using the sub value from the user_info response, which in some applications is not the expected value. To avoid such limitations, the uid label can be configured by providing the omniauth uid_field option to a different label (i.e. preferred_username) that appears in the user_info details.
• The issuer property should exactly match the provider's issuer link.
• The response_mode option is optional and specifies how the result of the authorization request is formatted.
• Some OpenID Connect providers require the scope attribute in requests to the token endpoint, even if this is not in the protocol specifications. In those cases, the send_scope_to_token_endpoint property can be used to add the attribute to the token request. Initial value is true, which means that the scope attribute is included by default.

Additional notes

• In some cases, you may want to go straight to the callback phase - e.g. when requested by a stateless client, like a mobile app. In such example, the session is empty, so you have to forward certain parameters received from the client. Currently supported ones are code_verifier and nonce - simply provide them as the /callback request parameters.

For the full low down on OpenID Connect, please check out the spec.

Contributing

1. Fork it ( http://github.com/omniauth/omniauth_openid_connect/fork )
2. Create your feature branch (git checkout -b my-new-feature)
3. Cover your changes with tests and make sure they're green (bundle install && bundle exec rake test)
4. Commit your changes (git commit -am 'Add some feature')
5. Push to the branch (git push origin my-new-feature)
6. Create new Pull Request