Giter Club home page Giter Club logo

azure-activedirectory-library-for-ruby's Introduction

Windows Azure Active Directory Authentication Library (ADAL) for Ruby

Build Status Code Climate

The ADAL for Ruby library makes it easy for Ruby applications to authenticate to AAD in order to access AAD protected web resources.

Installation

You can install the ADAL gem with Rubygems.

gem install adal

Alternatively, you can build the gem from scratch.

git clone [email protected]:AzureAD/azure-activedirectory-for-ruby.git
cd azure-activedirectory-for-ruby
gem build adal.gemspec
gem install adal

Samples

The samples folder contains several applications demonstrating different ways to authenticate. None of the samples will work out of the box, they require set-up and configuration through the Azure portal. Make sure to check out the README for each sample to get them running.

How to run tests

The tests in this repo use the RSpec framework for behavior-driven testing. RSpec can be invoked directly or as a Rake task. The preferred way to execute the test suite is

Checkout the repo

git clone [email protected]:AzureAD/azure-activedirectory-library-for-ruby

Install the dependencies

bundle install

Run the tests

bundle exec rake spec

How to run Rubocop

This gem abides by the Rubocop defaults. Rubocop is set up as a Rake task. The preferred way to execute Rubocop for this repo is

Checkout the repo

git clone [email protected]:AzureAD/azure-activedirectory-library-for-ruby

Install the dependencies

bundle install

Run Rubocop

bundle exec rake rubocop

Diagnostics

Logs, correlation ids and timestamps are required with all requests for help in debugging.

You can configure ADAL to generate log messages that you can use to help diagnose issues. The log outputs are standard to Ruby's built-in logger. An example ADAL log message looks like this:

I, [2015-08-18T06:58:12.767490 #9231]  INFO -- 969f3e30-8f42-4342-b135-f5c754a6b4a8: Multiple WS-Trust endpoints were found in the mex response. Only one was used.

The I is a shorthand for INFO that makes parsing logs easier. ADAL supports five different logging levels, VERBOSE, INFO, WARN, ERROR and FATAL. The timestamp is taken from the client machine. The GUID before the message is a correlation id that is used to track logs from the client to the server.

To set the lowest log level to output, include something like this in your configuration:

ADAL::Logging.log_level = ADAL::Logger::VERBOSE

By default, ADAL logs are printed to STDOUT. To change the log output, pass a Ruby IO object to ADAL like this in your configuration:

ADAL::Logging.log_output = File.open('/path/to/adal.logs', 'w')

Community Help and Support

We leverage Stack Overflow to work with the community on supporting Azure Active Directory and its SDKs, including this one! We highly recommend you ask your questions on Stack Overflow (we're all on there!) Also browse existing issues to see if someone has had your question before.

We recommend you use the "adal" tag so we can see it! Here is the latest Q&A on Stack Overflow for ADAL: http://stackoverflow.com/questions/tagged/adal

Security Reporting

If you find a security issue with our libraries or services please report it to [email protected] with as much detail as possible. Your submission may be eligible for a bounty through the Microsoft Bounty program. Please do not post security issues to GitHub Issues or any other public site. We will contact you shortly upon receiving the information. We encourage you to get notifications of when security incidents occur by visiting this page and subscribing to Security Advisory Alerts.

Contributing

All code is licensed under the MIT license and we triage actively on GitHub. We enthusiastically welcome contributions and feedback. You can fork the repo and start contributing now. More details about contributing.

License

Copyright (c) Microsoft Corporation. Licensed under the MIT License.

We Value and Adhere to the Microsoft Open Source Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

azure-activedirectory-library-for-ruby's People

Contributors

aj-michael avatar brandwe avatar cchar avatar omercs avatar rpangrle avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

azure-activedirectory-library-for-ruby's Issues

Is this library deprecated or is it dead?

Hi,

As an Azure customer, I need halfway decent automation options and most of our automation is in Ruby because everybody else, chiefly AWS, provides perfectly useful SDKs there without the build or cognitive overhead of other languages.

It's looking like, because of deficiencies in ADAL for Ruby, Azure can't say the same thing. The client assertion example doesn't work. The issues in this repository suggest that half of it is stale.

What's the status of this? Who owns this? How is Azure authentication going to be handled going forward if this isn't it?

-Ed

Configure Travis

I believe the repo will need to be made public before I can set this up.

mex_response.rb endpoints.sample?

This might be a dumb question, but in mes_response.rb there is the following line:

      MexResponse.new(endpoints.sample)

I am confused by the reference to 'sample'. What is that?

Send and receive params on the AAD callback

Does someone know if it is possible and if it is how or where I can find how to do it?
The idea is to add some params on the AAD auth and receive them along side with the keys.

More specific error cases

As it stands currently, many errors that are thrown in other ADAL implementation result in NoMethodErrors or returning a nil value. These should be failed explicitly so that the developer can understand what went wrong and whether it is recoverable.

nexpected client assertion type

Hi there,

I'm trying to run client_assertation_certificate_example but stuck with below error. It seems I'm missing something in configuration but cannot find it. Any tip most welcome, thanks a lot.

V, [2017-04-09T14:46:55.995211 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: TokenRequest getting token for client for https://graph.microsoft.com/v1.0.
V, [2017-04-09T14:46:55.995686 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Creating self signed JWT payload. Expires: 2017-04-09 14:56:54 +0100. NotBefore: 2017-04-09 14:46:54 +0100.
V, [2017-04-09T14:46:55.995842 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Creating self signed JWT header with thumbprint: rWHKnQ53WQH79JiMnyGFarbTnSs=.
V, [2017-04-09T14:46:55.998631 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: TokenRequest checking cache #<ADAL::MemoryCache:0x007fdc0f0e9be0> for token.
V, [2017-04-09T14:46:55.998705 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Searching cache for tokens by keys: [:authority, :client_id].
V, [2017-04-09T14:46:55.998781 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Validating 0 possible cache matches.
V, [2017-04-09T14:46:55.998841 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Looking through 0 matching cache entries for resource https://graph.microsoft.com/v1.0.
V, [2017-04-09T14:46:55.998893 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Attempting to obtain access token for https://graph.microsoft.com/v1.0 by refreshing 1 of 0 matching MRRTs.
I, [2017-04-09T14:46:55.998931 #73458]  INFO -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Did not find token in cache.
V, [2017-04-09T14:46:55.999085 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Creating self signed JWT payload. Expires: 2017-04-09 14:56:54 +0100. NotBefore: 2017-04-09 14:46:54 +0100.
V, [2017-04-09T14:46:55.999177 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Creating self signed JWT header with thumbprint: rWHKnQ53WQH79JiMnyGFarbTnSs=.
V, [2017-04-09T14:46:56.001347 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Creating self signed JWT payload. Expires: 2017-04-09 14:56:55 +0100. NotBefore: 2017-04-09 14:46:55 +0100.
V, [2017-04-09T14:46:56.001411 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Creating self signed JWT header with thumbprint: rWHKnQ53WQH79JiMnyGFarbTnSs=.
V, [2017-04-09T14:46:56.003526 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Resorting to OAuth to fulfill token request.
V, [2017-04-09T14:46:56.201593 #73458] VERBOSE -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Attempting to create a TokenResponse from raw response.
E, [2017-04-09T14:46:56.201842 #73458] ERROR -- a2a72bbd-a2f9-4276-baf3-6362e13b3821: Parsed an ErrorResponse with error: invalid_request and error description: AADSTS90023: Unexpected client assertion type.
Trace ID: cffebcfe-402c-48bf-b90b-8a2b765e4200
Correlation ID: a2a72bbd-a2f9-4276-baf3-6362e13b3821
Timestamp: 2017-04-09 13:46:55Z.
Failed to authenticate with client credentials. Received error: invalid_request and error description: AADSTS90023: Unexpected client assertion type.
Trace ID: cffebcfe-402c-48bf-b90b-8a2b765e4200
Correlation ID: a2a72bbd-a2f9-4276-baf3-6362e13b3821
Timestamp: 2017-04-09 13:46:55Z.

Acquiring tokens for resources fails with consnet issues

Basically updating an app to talk to more resources ultimately breaks existing users that are already onboarded to the app. The workaround we have to this is to have users remove the app from their list of consented apps so that upon the next login Azure would ask for consent again.

Repro:

  1. Create an app in AAD
  2. User "Bob" logins in to app
  3. App is updated with perms to talk to another resource (say Graph or service ABC)
  4. Acquire delegation token for Graph or ABC
  5. It fails due to user consent.

The fix I think would be to capture the consent failure, generate a login url and append context &prompt=consent.

mex_response.rb remove namespaces

Obviously I am not a ruby expert, but in self.parse of this file the first line is:

      xml = Nokogiri::XML(response).remove_namespaces!

Is this doing what I think that it is doing? If so, why are we stripping namespaces?

uninitialized constant error

$HOME/.rbenv/versions/2.2.3/lib/ruby/gems/2.2.0/gems/bundler-1.12.5/lib/bundler/runtime.rb:89:in `rescue in block (2 levels) in require': There was an error while trying to load the gem 'adal'. (Bundler::GemRequireError)
Gem Load Error is: uninitialized constant ADAL::ClientAssertionCertificate::RequestParameters

constantly run into that error when using this gem fixed by modifying adal/client_assertion_certificate.rb with

require_relative 'request_parameters.rb'

or by ensuring the adal/client_assertion_certificate.rb loads after the request_parameters.rb

mv adal/{,requests_}client_assertion_certificate.rb

definitely seems to be some issue with the gem setup.

Error in running tests

What is the supported ruby version? It looks like nokogiri is failing for this Ruby version.

Environment: Ruby 2.2.2p95
Cmd: bundle exec rake spec

Related to: https://github.com/rb2k/viddl-rb/issues/129

c:/Ruby22-x64/bin/ruby.exe -I'c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib';'c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-support-3.3.0/lib' 'c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/exe/rspec' 'spec/adal/authentication_context_spec.rb' 'spec/adal/authentication_parameters_spec.rb' 'spec/adal/authority_spec.rb' 'spec/adal/cache_driver_spec.rb' 'spec/adal/cached_token_response_spec.rb' 'spec/adal/client_assertion_certificate_spec.rb' 'spec/adal/client_assertion_spec.rb' 'spec/adal/core_ext/hash_spec.rb' 'spec/adal/logging_spec.rb' 'spec/adal/memory_cache_spec.rb' 'spec/adal/mex_request_spec.rb' 'spec/adal/mex_response_spec.rb' 'spec/adal/self_signed_jwt_factory_spec.rb' 'spec/adal/token_request_spec.rb' 'spec/adal/token_response_spec.rb' 'spec/adal/user_credential_spec.rb' 'spec/adal/wstrust_request_spec.rb' 'spec/adal/wstrust_response_spec.rb' --format documentation
Coverage report generated for RSpec to c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/coverage. 288 / 583 LOC (49.4%) covered.
c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/nokogiri-1.6.6.2-x64-mingw32/lib/nokogiri.rb:29:in require': cannot load such file -- nokogiri/nokogiri (LoadError) from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/nokogiri-1.6.6.2-x64-mingw32/lib/nokogiri.rb:29:inrescue in <top (required)>'
from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/nokogiri-1.6.6.2-x64-mingw32/lib/nokogiri.rb:25:in <top (required)>' from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal/xml_namespaces.rb:18:inrequire'
from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal/xml_namespaces.rb:18:in <top (required)>' from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal/mex_response.rb:19:inrequire_relative'
from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal/mex_response.rb:19:in <top (required)>' from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal/mex_request.rb:18:inrequire_relative'
from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal/mex_request.rb:18:in <top (required)>' from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal.rb:19:inrequire_relative'
from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal.rb:19:in block in <top (required)>' from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal.rb:19:ineach'
from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/lib/adal.rb:19:in <top (required)>' from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/spec/spec_helper.rb:28:inrequire'
from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/spec/spec_helper.rb:28:in <top (required)>' from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/spec/adal/authentication_context_spec.rb:20:inrequire'
from c:/Users/omercan/workspace/azure-activedirectory-library-for-ruby/spec/adal/authentication_context_spec.rb:20:in <top (required)>' from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib/rspec/core/configuration.rb:1327:inload'
from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib/rspec/core/configuration.rb:1327:in block in load_spec_files' from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib/rspec/core/configuration.rb:1325:ineach'
from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib/rspec/core/configuration.rb:1325:in load_spec_files' from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib/rspec/core/runner.rb:102:insetup'
from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib/rspec/core/runner.rb:88:in run' from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib/rspec/core/runner.rb:73:inrun'
from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib/rspec/core/runner.rb:41:in invoke' from c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/exe/rspec:4:in

'
c:/Ruby22-x64/bin/ruby.exe -I'c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/lib';'c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-support-3.3.0/lib' 'c:/Ruby22-x64/lib/ruby/gems/2.2.0/gems/rspec-core-3.3.2/exe/rspec' 'spec/adal/authentication_context_spec.rb' 'spec/adal/authentication_parameters_spec.rb' 'spec/adal/authority_spec.rb' 'spec/adal/cache_driver_spec.rb' 'spec/adal/cached_token_response_spec.rb' 'spec/adal/client_assertion_certificate_spec.rb' 'spec/adal/client_assertion_spec.rb' 'spec/adal/core_ext/hash_spec.rb' 'spec/adal/logging_spec.rb' 'spec/adal/memory_cache_spec.rb' 'spec/adal/mex_request_spec.rb' 'spec/adal/mex_response_spec.rb' 'spec/adal/self_signed_jwt_factory_spec.rb' 'spec/adal/token_request_spec.rb' 'spec/adal/token_response_spec.rb' 'spec/adal/user_credential_spec.rb' 'spec/adal/wstrust_request_spec.rb' 'spec/adal/wstrust_response_spec.rb' --format documentation failed

Mex parsing needs to support WS-Trust 2005

It turns out that the default configuration for ADFS doesn't support WS-Trust 1.3 which is the latest version. Instead, it supports an earlier draft version, WS-Trust 2005. We need to look for 1.3 and if it is not present in the MEX, look for WS-Trust 2005 and use that instead.

This only works if we are paying attention to namespaces, and I believe that we should be doing that.

Unable to access azure key vault secrets wih ADAL token

I am successfully able to retrieve a token using the gem and authenticate against Azure Service Management API. Using the same token, I can also use the Azure Key Vault REST API to retrieve my vault:

https://msdn.microsoft.com/en-us/library/azure/mt620026.aspx

However, when trying to retrieve a secret from my vault:

https://msdn.microsoft.com/en-us/library/azure/dn903633.aspx

This returns a 401 Unauthorized.

I recently found this stackoverflow post and it suggests that when making a token request, I need to pass a resource header:

When you make the request for the Bearer token, make sure that you include the "resource" header, and that it is set to "https://vault.azure.net". If you don't, you'll get a token, but you won't be able to access any vault data with it.

Error with headless auth

On the last example: /samples/user_credentials_example

I have updated the client Id and tenant, but I'm getting the following error:

$ ruby microsoft-test-headless.rb 
Username: [email protected]
Password: myPassword
V, [2016-02-29T15:43:25.147883 #6749] VERBOSE -- 0b3fa870-c4eb-4a86-81e0-6b62309eb299: TokenRequest getting token with user credential UserCredential[Username: [email protected], AccountType: Federated] and resource https://graph.windows.net.
V, [2016-02-29T15:43:25.148092 #6749] VERBOSE -- 0b3fa870-c4eb-4a86-81e0-6b62309eb299: Getting OAuth parameters for Federated [email protected].
/home/kaio/.rvm/rubies/ruby-2.2.3/lib/ruby/2.2.0/net/http/generic_request.rb:25:in `initialize': HTTP request path is empty (ArgumentError)
    from /home/kaio/.rvm/rubies/ruby-2.2.3/lib/ruby/2.2.0/net/http/request.rb:14:in `initialize'
    from /home/kaio/.rvm/gems/ruby-2.2.3/gems/adal-1.0.0/lib/adal/mex_request.rb:47:in `new'
    from /home/kaio/.rvm/gems/ruby-2.2.3/gems/adal-1.0.0/lib/adal/mex_request.rb:47:in `execute'
    from /home/kaio/.rvm/gems/ruby-2.2.3/gems/adal-1.0.0/lib/adal/user_credential.rb:143:in `mex_response'
    from /home/kaio/.rvm/gems/ruby-2.2.3/gems/adal-1.0.0/lib/adal/user_credential.rb:149:in `wstrust_request'
    from /home/kaio/.rvm/gems/ruby-2.2.3/gems/adal-1.0.0/lib/adal/user_credential.rb:121:in `federated_request_params'
    from /home/kaio/.rvm/gems/ruby-2.2.3/gems/adal-1.0.0/lib/adal/user_credential.rb:88:in `request_params'
    from /home/kaio/.rvm/gems/ruby-2.2.3/gems/adal-1.0.0/lib/adal/token_request.rb:147:in `get_with_user_credential'
    from /home/kaio/.rvm/gems/ruby-2.2.3/gems/adal-1.0.0/lib/adal/authentication_context.rb:150:in `acquire_token_for_user'

Does anyone know how to fix it?

Get error: AADSTS70002 - request body missing client_secret or client_assertion

The following error comes up when following examples are run:

  1. User credential
  2. On behalf of user

When code is executed, user is asked to put username and password after which error comes up:

ERROR -- 4420c0e4-8101-4319-9d0e-8368a660f888: Parsed an ErrorResponse with error: invalid_client and error description: AADSTS70002: The request body must contain the following parameter: 'client_secret or client_assertion'.
Trace ID: 63d3ea78-fbeb-4b36-8b97-e208adee0c00
Correlation ID: 4420c0e4-8101-4319-9d0e-8368a660f888
Timestamp: 2017-11-02 05:55:23Z.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.