Class: Google::Auth::IDTokens::Verifier

Inherits:
Object
  • Object
show all
Defined in:
lib/googleauth/id_tokens/verifier.rb

Overview

An object that can verify ID tokens.

A verifier maintains a set of default settings, including the key source and fields to verify. However, individual verification calls can override any of these settings.

Instance Method Summary collapse

Constructor Details

#initialize(key_source: nil, aud: nil, azp: nil, iss: nil) ⇒ Verifier

Create a verifier.

Parameters:

  • key_source (key source) (defaults to: nil) —

    The default key source to use. All verification calls must have a key source, so if no default key source is provided here, then calls to #verify must provide a key source.

  • aud (String, nil) (defaults to: nil) —

    The default audience (aud) check, or nil for no check.

  • azp (String, nil) (defaults to: nil) —

    The default authorized party (azp) check, or nil for no check.

  • iss (String, nil) (defaults to: nil) —

    The default issuer (iss) check, or nil for no check.



44
45
46
47
48
49
50
51
52
 
# File 'lib/googleauth/id_tokens/verifier.rb', line 44

def initialize key_source: nil,
               aud:        nil,
               azp:        nil,
               iss:        nil
  @key_source = key_source
  @aud = aud
  @azp = azp
  @iss = iss
end

Instance Method Details

#verify(token, key_source: :default, aud: :default, azp: :default, iss: :default) ⇒ Hash

Verify the given token.

Parameters:

  • token (String) —

    the ID token to verify.

  • key_source (key source) (defaults to: :default) —

    If given, override the key source.

  • aud (String, nil) (defaults to: :default) —

    If given, override the aud check.

  • azp (String, nil) (defaults to: :default) —

    If given, override the azp check.

  • iss (String, nil) (defaults to: :default) —

    If given, override the iss check.

Returns:

  • (Hash) —

    the decoded payload, if verification succeeded.

Raises:



67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
 
# File 'lib/googleauth/id_tokens/verifier.rb', line 67

def verify token,
           key_source: :default,
           aud:        :default,
           azp:        :default,
           iss:        :default
  key_source = @key_source if key_source == :default
  aud = @aud if aud == :default
  azp = @azp if azp == :default
  iss = @iss if iss == :default

  raise KeySourceError, "No key sources" unless key_source
  keys = key_source.current_keys
  payload = decode_token token, keys, aud, azp, iss
  unless payload
    keys = key_source.refresh_keys
    payload = decode_token token, keys, aud, azp, iss
  end
  raise SignatureError, "Token not verified as issued by Google" unless payload
  payload
end