lib/omniauth/heart.rb
##
# Requests a new access token from the authorization server.
# 
# We have received the redirect callback from the authorization server with an 
# authorization code.  Now we issue another request to the authorization server 
# with that code to get an access token, this time with a JSON Web Token signed 
# with our private key.  We need the access token to retrieve information from 
# the protected resource server.
#
# Params:
#   +request_from_server+::   Request from auth server on authorization completion
#
# Returns:
#   +String+::                Access token if successful, otherwise nil
Requests a new access token from the authorization server.
We have received the redirect callback from the authorization server with an
authorization code.  Now we issue another request to the authorization server
with that code to get an access token, this time with a JSON Web Token signed
with our private key.  We need the access token to retrieve information from
the protected resource server.

+request_from_server+::   Request from auth server on authorization completion

+String+::                Access token if successful, otherwise nil
Requests a new access token from the authorization server . We have received the redirect callback from the authorization server with an authorization code . Now we issue another request to the authorization server with that code to get an access token this time with a JSON Web Token signed with our private key . We need the access token to retrieve information from the protected resource server . + request_from_server + :: Request from auth server on authorization completion + String + :: Access token if successful otherwise nil
def request_access_token(request_from_server)
        log :debug, "========= Entering AuthorizationServer::request_access_token ========="
        if valid_state?(request_from_server.params["state"])
          log :debug, "--------- State is valid ---------"
          response = auth_server.post(auth_server_config["token_endpoint"]) do |request|
            request.body = {
              "grant_type"                => "authorization_code",
              "code"                      => request_from_server.params["code"],
              "redirect_uri"              => generate_callback_path,
              "client_id"                 => client_options.client_id,
              "client_assertion_type"     => "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
              "client_assertion"          => jwt_token(token_endpoint_claims)
            }
            log :debug, "--------- request.headers = #{request.headers.inspect} ----------"
            log :debug, "--------- request.body = #{request.body.inspect} ---------"
          end
          log :debug, "--------- response.headers = #{response.headers.inspect} ----------"
          log :debug, "--------- response.body = #{response.body} ----------"
          log :debug, "--------- response.status = #{response.status} ----------"
          if OK == response.status
            parsed_response = JSON.parse(response.body)
            parsed_response["access_token"]
          else
            raise "Call to get access token from authorization server failed. #{response.inspect}"
          end
        else
          log :warn, "///////// State is invalid - possible CSRF attack /////////"
        end
      end
def request_access_token ( request_from_server ) log :debug , "========= Entering AuthorizationServer::request_access_token =========" if valid_state? ( request_from_server . params [ "state" ] ) log :debug , "--------- State is valid ---------" response = auth_server . post ( auth_server_config [ "token_endpoint" ] ) do | request | request . body = { "grant_type" => "authorization_code" , "code" => request_from_server . params [ "code" ] , "redirect_uri" => generate_callback_path , "client_id" => client_options . client_id , "client_assertion_type" => "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" , "client_assertion" => jwt_token ( token_endpoint_claims ) } log :debug , "--------- request.headers = #{request.headers.inspect} ----------" log :debug , "--------- request.body = #{request.body.inspect} ---------" end log :debug , "--------- response.headers = #{response.headers.inspect} ----------" log :debug , "--------- response.body = #{response.body} ----------" log :debug , "--------- response.status = #{response.status} ----------" if OK == response . status parsed_response = JSON . parse ( response . body ) parsed_response [ "access_token" ] else raise "Call to get access token from authorization server failed. #{response.inspect}" end else log :warn , "///////// State is invalid - possible CSRF attack /////////" end end
Requests a new access token from the authorization server.
Requests a new access token from the authorization server .
# Log, but ignore potential CSRF attacks
request_from_server