Skip to content

Commit 8f9e62b

Browse files
cocojoecocojoe
authored
Release 3.4.0 (#357)
* Added RS256 JWT Support (Default for New Clients) * Add caching to JWKS fetching * Added Lock 11, Update SSO (#350) * Fixed Admin migration step in Setup Wizard * Added WP_Auth0_Api_Client::signup_user
1 parent 01fde4d commit 8f9e62b

27 files changed

+327
-318
lines changed

‎CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
# Change Log
22

3+
## [3.4.0](https://github.com/auth0/wp-auth0/tree/3.4.0) (2018-01-08)
4+
[Full Changelog](https://github.com/auth0/wp-auth0/compare/3.3.2...3.4.0)
5+
6+
**Added**
7+
- Added Lock 11 / Auth0 9.0, Updated SSO, JWT Algorithm Upgrade Fixes [\#350](https://github.com/auth0/wp-auth0/pull/350) ([cocojoe](https://github.com/cocojoe))
8+
- Add RS256 support [\#331](https://github.com/auth0/wp-auth0/pull/331) ([renrizzolo](https://github.com/renrizzolo))
9+
10+
**Fixed**
11+
- Switching wizard admin user creation to use /dbconnections/signup [\#356](https://github.com/auth0/wp-auth0/pull/356) ([joshcanhelp](https://github.com/joshcanhelp))
12+
313
## [3.3.2](https://github.com/auth0/wp-auth0/tree/3.3.2) (2017-10-05)
414
[Full Changelog](https://github.com/auth0/wp-auth0/compare/3.3.2...3.2.24)
515

‎README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,6 @@ And can be customized by adding the following parameters:
182182
* social_big_buttons: boolean
183183
* gravatar: boolean
184184
* username_style: string, "email" or "username"
185-
* remember_last_login: boolean
186185
* icon_url: string (valid url)
187186
* extra_conf: string, valid json
188187
* show_as_modal: boolean

‎WP_Auth0.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,16 @@
22
/**
33
* Plugin Name: PLUGIN_NAME
44
* Description: PLUGIN_DESCRIPTION
5-
* Version: 3.3.2
5+
* Version: 3.4.0
66
* Author: Auth0
77
* Author URI: https://auth0.com
88
*/
99
define( 'WPA0_PLUGIN_FILE', __FILE__ );
1010
define( 'WPA0_PLUGIN_DIR', trailingslashit( plugin_dir_path( __FILE__ ) ) );
1111
define( 'WPA0_PLUGIN_URL', trailingslashit( plugin_dir_url( __FILE__ ) ) );
1212
define( 'WPA0_LANG', 'wp-auth0' ); // deprecated; do not use for translations
13-
define( 'AUTH0_DB_VERSION', 14 );
14-
define( 'WPA0_VERSION', '3.3.2' );
13+
define( 'AUTH0_DB_VERSION', 15 );
14+
define( 'WPA0_VERSION', '3.4.0' );
1515

1616
/**
1717
* Main plugin class

‎lib/WP_Auth0_Api_Client.php‎

100644100755
Lines changed: 103 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -168,10 +168,9 @@ public static function create_user( $domain, $jwt, $data ) {
168168
$headers = self::get_info_headers();
169169

170170
$headers['Authorization'] = "Bearer $jwt";
171-
$headers['content-type'] = "application/json";
171+
$headers['content-type'] = 'application/json';
172172

173173
$response = wp_remote_post( $endpoint , array(
174-
'method' => 'POST',
175174
'headers' => $headers,
176175
'body' => json_encode( $data )
177176
) );
@@ -191,6 +190,34 @@ public static function create_user( $domain, $jwt, $data ) {
191190
return json_decode( $response['body'] );
192191
}
193192

193+
public static function signup_user( $domain, $data ) {
194+
195+
$endpoint = "https://$domain/dbconnections/signup";
196+
197+
$headers = self::get_info_headers();
198+
199+
$headers['content-type'] = 'application/json';
200+
201+
$response = wp_remote_post( $endpoint , array(
202+
'headers' => $headers,
203+
'body' => json_encode( $data )
204+
) );
205+
206+
if ( $response instanceof WP_Error ) {
207+
WP_Auth0_ErrorManager::insert_auth0_error( 'WP_Auth0_Api_Client::signup_user', $response );
208+
error_log( $response->get_error_message() );
209+
return false;
210+
}
211+
212+
if ( $response['response']['code'] !== 200 ) {
213+
WP_Auth0_ErrorManager::insert_auth0_error( 'WP_Auth0_Api_Client::signup_user', $response['body'] );
214+
error_log( $response['body'] );
215+
return false;
216+
}
217+
218+
return json_decode( $response['body'] );
219+
}
220+
194221
public static function get_required_scopes() {
195222
return array(
196223
'update:clients',
@@ -225,9 +252,14 @@ public static function create_client( $domain, $app_token, $name ) {
225252
home_url( '/wp-login.php' )
226253
),
227254
"allowed_origins"=>array(
228-
home_url( '/wp-login.php' ),
229-
admin_url( '/admin.php?page=wpa0-setup&step=2&profile=social' )
255+
home_url( '/wp-login.php' )
256+
),
257+
"jwt_configuration" => array(
258+
"alg" => "RS256"
230259
),
260+
"app_type" => "regular_web",
261+
"cross_origin_auth" => true,
262+
"cross_origin_loc" => home_url('/index.php?auth0fallback=1','https'),
231263
"allowed_logout_urls" => array(
232264
$logout_url
233265
),
@@ -246,7 +278,21 @@ public static function create_client( $domain, $app_token, $name ) {
246278
return false;
247279
}
248280

249-
return json_decode( $response['body'] );
281+
$response = json_decode( $response['body'] );
282+
283+
// Workaround: Can't add `web_origin` on create
284+
$payload = array(
285+
"web_origins" => array(home_url())
286+
);
287+
$updateResponse = WP_Auth0_Api_Client::update_client($domain, $app_token, $response->client_id, false, $payload);
288+
289+
if ( $updateClient instanceof WP_Error ) {
290+
WP_Auth0_ErrorManager::insert_auth0_error( 'WP_Auth0_Api_Client::create_client', $updateResponse );
291+
error_log( $updateResponse->get_error_message() );
292+
return false;
293+
}
294+
295+
return $response;
250296
}
251297

252298
public static function search_clients( $domain, $app_token ) {
@@ -277,7 +323,7 @@ public static function search_clients( $domain, $app_token ) {
277323
return json_decode( $response['body'] );
278324
}
279325

280-
public static function update_client( $domain, $app_token, $client_id, $sso ) {
326+
public static function update_client( $domain, $app_token, $client_id, $sso, $payload = array() ) {
281327

282328
$endpoint = "https://$domain/api/v2/clients/$client_id";
283329

@@ -289,9 +335,7 @@ public static function update_client( $domain, $app_token, $client_id, $sso ) {
289335
$response = wp_remote_post( $endpoint , array(
290336
'method' => 'PATCH',
291337
'headers' => $headers,
292-
'body' => json_encode( array(
293-
'sso' => $sso,
294-
) )
338+
'body' => json_encode( array_merge(array( 'sso' => boolval($sso)), $payload) )
295339
) );
296340

297341
if ( $response instanceof WP_Error ) {
@@ -740,4 +784,53 @@ public static function update_guardian($domain, $app_token, $factor, $enabled) {
740784

741785
return json_decode($response['body']);
742786
}
743-
}
787+
788+
protected function convertCertToPem($cert) {
789+
return '-----BEGIN CERTIFICATE-----'.PHP_EOL
790+
.chunk_split($cert, 64, PHP_EOL)
791+
.'-----END CERTIFICATE-----'.PHP_EOL;
792+
}
793+
794+
public static function JWKfetch($domain) {
795+
796+
$a0_options = WP_Auth0_Options::Instance();
797+
798+
$endpoint = "https://$domain/.well-known/jwks.json";
799+
800+
$cache_expiration = $a0_options->get('cache_expiration');
801+
802+
if ( false === ($secret = get_transient('WP_Auth0_JWKS_cache') ) ) {
803+
804+
$secret = [];
805+
806+
$response = wp_remote_get( $endpoint, array() );
807+
808+
if ( $response instanceof WP_Error ) {
809+
WP_Auth0_ErrorManager::insert_auth0_error( 'WP_Auth0_Api_Client::JWK_fetch', $response );
810+
error_log( $response->get_error_message() );
811+
return false;
812+
}
813+
814+
if ( $response['response']['code'] != 200 ) {
815+
WP_Auth0_ErrorManager::insert_auth0_error( 'WP_Auth0_Api_Client::JWK_fetch', $response['body'] );
816+
error_log( $response['body'] );
817+
return false;
818+
}
819+
820+
if ( $response['response']['code'] >= 300 ) return false;
821+
822+
$jwks = json_decode($response['body'], true);
823+
824+
foreach ($jwks['keys'] as $key) {
825+
$secret[$key['kid']] = self::convertCertToPem($key['x5c'][0]);
826+
}
827+
828+
if ($cache_expiration !== 0) {
829+
set_transient( 'WP_Auth0_JWKS_cache', $secret, $cache_expiration * MINUTE_IN_SECONDS );
830+
}
831+
832+
}
833+
834+
return $secret;
835+
}
836+
}

‎lib/WP_Auth0_Configure_JWTAUTH.php‎

100644100755
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ public function setupjwt() {
5454
JWT_AUTH_Options::set( 'aud', $this->a0_options->get( 'client_id' ) );
5555
JWT_AUTH_Options::set( 'secret', $this->a0_options->get( 'client_secret' ) );
5656
JWT_AUTH_Options::set( 'secret_base64_encoded', $this->a0_options->get( 'client_secret_b64_encoded' ) );
57+
JWT_AUTH_Options::set( 'signing_algorithm', $this->a0_options->get( 'client_signing_algorithm' ) );
58+
JWT_AUTH_Options::set( 'domain', $this->a0_options->get( 'domain' ) );
59+
JWT_AUTH_Options::set( 'cache_expiration', $this->a0_options->get( 'cache_expiration' ) );
5760
JWT_AUTH_Options::set( 'override_user_repo', 'WP_Auth0_UsersRepo' );
5861
$this->a0_options->set( 'jwt_auth_integration', true );
5962
}
@@ -76,6 +79,9 @@ public static function is_jwt_configured() {
7679
JWT_AUTH_Options::get( 'aud' ) === $options->get( 'client_id' ) &&
7780
JWT_AUTH_Options::get( 'secret' ) === $options->get( 'client_secret' ) &&
7881
JWT_AUTH_Options::get( 'secret_base64_encoded' ) === $options->get( 'client_secret_b64_encoded' ) &&
82+
JWT_AUTH_Options::get( 'signing_algorithm' ) === $options->get( 'client_signing_algorithm' ) &&
83+
JWT_AUTH_Options::get( 'domain' ) === $options->get( 'domain' ) &&
84+
JWT_AUTH_Options::get( 'cache_expiration' ) === $options->get( 'cache_expiration' ) &&
7985
$options->get( 'jwt_auth_integration' ) &&
8086
JWT_AUTH_Options::get( 'jwt_attribute' ) === 'sub'
8187
);

‎lib/WP_Auth0_DBManager.php‎

Lines changed: 21 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -35,28 +35,6 @@ public function install_db() {
3535

3636
$cdn_url = $options->get( 'cdn_url' );
3737

38-
if ( strpos( $cdn_url, 'auth0-widget-5' ) !== false || strpos( $cdn_url, 'lock-6' ) !== false ) {
39-
$options->set( 'cdn_url', '//cdn.auth0.com/js/lock-9.1.min.js' );
40-
}
41-
if ( strpos( $cdn_url, 'auth0-widget-5' ) !== false || strpos( $cdn_url, 'lock-8' ) !== false ) {
42-
$options->set( 'cdn_url', '//cdn.auth0.com/js/lock-9.1.min.js' );
43-
}
44-
if ( strpos( $cdn_url, 'auth0-widget-5' ) !== false || strpos( $cdn_url, 'lock-9.0' ) !== false ) {
45-
$options->set( 'cdn_url', '//cdn.auth0.com/js/lock-9.1.min.js' );
46-
}
47-
if ( strpos( $cdn_url, 'auth0-widget-5' ) !== false || strpos( $cdn_url, 'lock-9.1' ) !== false ) {
48-
$options->set( 'cdn_url', '//cdn.auth0.com/js/lock-9.2.min.js' );
49-
}
50-
if ( strpos( $cdn_url, '10.0' ) !== false ) {
51-
$options->set( 'cdn_url', '//cdn.auth0.com/js/lock/10.3/lock.min.js' );
52-
}
53-
if ( strpos( $cdn_url, '10.1' ) !== false ) {
54-
$options->set( 'cdn_url', '//cdn.auth0.com/js/lock/10.3/lock.min.js' );
55-
}
56-
if ( strpos( $cdn_url, '10.2' ) !== false ) {
57-
$options->set( 'cdn_url', '//cdn.auth0.com/js/lock/10.3/lock.min.js' );
58-
}
59-
6038
if ( $this->current_db_version <= 7 ) {
6139
if ( $options->get( 'db_connection_enabled' ) ) {
6240

@@ -141,6 +119,27 @@ public function install_db() {
141119
}
142120
}
143121

122+
if ( $this->current_db_version < 15 ) {
123+
$options->set('use_lock_10', true);
124+
$options->set('cdn_url', '//cdn.auth0.com/js/lock/11.0.0/lock.min.js');
125+
$options->set('auth0js-cdn', '//cdn.auth0.com/js/auth0/9.0.0/auth0.min.js');
126+
$options->set('cache_expiration', 1440);
127+
128+
// Update Client
129+
$client_id = $options->get( 'client_id' );
130+
$domain = $options->get( 'domain' );
131+
if (!empty($client_id) && !empty($domain)) {
132+
$app_token = $options->get( 'auth0_app_token' );
133+
$sso = $options->get( 'sso' );
134+
$payload = array(
135+
"cross_origin_auth" => true,
136+
"cross_origin_loc" => home_url('/index.php?auth0fallback=1','https'),
137+
"web_origins" => array(home_url())
138+
);
139+
$updateClient = WP_Auth0_Api_Client::update_client($domain, $app_token, $client_id, $sso, $payload);
140+
$options->set('client_signing_algorithm', 'HS256');
141+
}
142+
}
144143
$this->current_db_version = AUTH0_DB_VERSION;
145144
update_option( 'auth0_db_version', AUTH0_DB_VERSION );
146145
}

‎lib/WP_Auth0_Lock10_Options.php‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -156,10 +156,6 @@ protected function build_settings( $settings ) {
156156
if ( $this->_is_valid( $settings, 'username_style' ) ) {
157157
$options_obj['usernameStyle'] = $settings['username_style'];
158158
}
159-
if ( $this->_is_valid( $settings, 'remember_last_login' ) ) {
160-
$options_obj['rememberLastLogin'] = $this->_get_boolean( $settings['remember_last_login'] );
161-
}
162-
163159
if ( $this->_is_valid( $settings, 'sso' ) ) {
164160
$options_obj['auth']['sso'] = $this->_get_boolean( $settings['sso'] );
165161
}

‎lib/WP_Auth0_Lock_Options.php‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -155,9 +155,6 @@ protected function build_settings( $settings ) {
155155
if ( $this->_is_valid( $settings, 'username_style' ) ) {
156156
$options_obj['usernameStyle'] = $settings['username_style'];
157157
}
158-
if ( $this->_is_valid( $settings, 'remember_last_login' ) ) {
159-
$options_obj['rememberLastLogin'] = $this->_get_boolean( $settings['remember_last_login'] );
160-
}
161158
if ( $this->_is_valid( $settings, 'sso' ) ) {
162159
$options_obj['sso'] = $this->_get_boolean( $settings['sso'] );
163160
}

‎lib/WP_Auth0_LoginManager.php‎

100644100755
Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ public function init() {
2626
add_action( 'wp_login', array( $this, 'end_session' ) );
2727
add_action( 'login_init', array( $this, 'login_auto' ) );
2828
add_action( 'template_redirect', array( $this, 'init_auth0' ), 1 );
29-
add_action( 'wp_footer', array( $this, 'auth0_sso_footer' ) );
29+
//add_action( 'wp_footer', array( $this, 'auth0_sso_footer' ) );
3030
add_action( 'wp_footer', array( $this, 'auth0_singlelogout_footer' ) );
3131
add_filter( 'login_message', array( $this, 'auth0_sso_footer' ) );
3232
}
@@ -73,6 +73,7 @@ public function auth0_singlelogout_footer( $previous_html ) {
7373
return;
7474
}
7575

76+
$lock_options = new WP_Auth0_Lock10_Options();
7677
$cdn = $this->a0_options->get('auth0js-cdn');
7778
$client_id = $this->a0_options->get( 'client_id' );
7879
$domain = $this->a0_options->get( 'domain' );
@@ -250,7 +251,7 @@ public function redirect_login() {
250251
} else {
251252
try {
252253
// grab the user ID from the id_token to call get_user
253-
$decodedToken = JWT::decode( $data->id_token, $this->a0_options->get_client_secret_as_key(), array( 'HS256' ) );
254+
$decodedToken = JWT::decode( $data->id_token, $this->a0_options->get_client_secret_as_key(), array( $this->a0_options->get_client_signing_algorithm() ) );
254255
} catch (Exception $e) {
255256
WP_Auth0_ErrorManager::insert_auth0_error('redirect_login/decode', $e->getMessage());
256257
throw new WP_Auth0_LoginFlowValidationException(__('Error: There was an issue decoding the token, please review the Auth0 Plugin Error Log.', 'wp-auth0'));
@@ -327,7 +328,7 @@ public function implicit_login() {
327328

328329
try {
329330
// Decode the user
330-
$decodedToken = JWT::decode( $token, $secret, array( 'HS256' ) );
331+
$decodedToken = JWT::decode( $token, $secret, array( $this->a0_options->get_client_signing_algorithm() ) );
331332

332333
// validate that this JWT was made for us
333334
if ( $this->a0_options->get( 'client_id' ) !== $decodedToken->aud ) {
@@ -523,7 +524,7 @@ public function login_with_credentials( $username, $password, $connection="Usern
523524

524525
try {
525526
// Decode the user
526-
$decodedToken = JWT::decode( $response->id_token, $secret, array( 'HS256' ) );
527+
$decodedToken = JWT::decode( $response->id_token, $secret, array( $this->a0_options->get_client_signing_algorithm() ) );
527528

528529
// validate that this JWT was made for us
529530
if ( $this->a0_options->get( 'client_id' ) !== $decodedToken->aud ) {
@@ -553,4 +554,4 @@ protected function query_vars( $key ) {
553554
return null;
554555
}
555556

556-
}
557+
}

0 commit comments

Comments
 (0)