Class: WorkOS::SSO

Inherits:
Object
  • Object
show all
Defined in:
lib/workos/sso.rb

Instance Method Summary collapse

Constructor Details

#initialize(client) ⇒ SSO

Returns a new instance of SSO.



10
11
12
 
# File 'lib/workos/sso.rb', line 10

def initialize(client)
  @client = client
end

Instance Method Details

#authorize_logout(profile_id:, request_options: {}) ⇒ WorkOS::SSOLogoutAuthorizeResponse

Logout Authorize

Parameters:

  • profile_id (String) —

    The unique ID of the profile to log out.

  • request_options (Hash) (defaults to: {}) —

    (see WorkOS::Types::RequestOptions)

Returns:



182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
 
# File 'lib/workos/sso.rb', line 182

def authorize_logout(
  profile_id:,
  request_options: {}
)
  body = {
    "profile_id" => profile_id
  }
  response = @client.request(
    method: :post,
    path: "/sso/logout/authorize",
    auth: true,
    body: body,
    request_options: request_options
  )
  result = WorkOS::SSOLogoutAuthorizeResponse.new(response.body)
  result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
  result
end

#build_logout_url(token:) ⇒ Object

H17 — Build the SSO logout redirect URL (no HTTP call).



279
280
281
 
# File 'lib/workos/sso.rb', line 279

def build_logout_url(token:)
  build_url("/sso/logout", {"token" => token})
end

#delete_connection(id:, request_options: {}) ⇒ void

This method returns an undefined value.

Delete a Connection

Parameters:

  • id (String) —

    Unique identifier for the Connection.

  • request_options (Hash) (defaults to: {}) —

    (see WorkOS::Types::RequestOptions)



97
98
99
100
101
102
103
104
105
106
107
108
 
# File 'lib/workos/sso.rb', line 97

def delete_connection(
  id:,
  request_options: {}
)
  @client.request(
    method: :delete,
    path: "/connections/#{WorkOS::Util.encode_path(id)}",
    auth: true,
    request_options: request_options
  )
  nil
end

#get_authorization_url(redirect_uri:, provider_scopes: nil, provider_query_params: nil, client_id: nil, domain: nil, provider: nil, state: nil, connection: nil, organization: nil, domain_hint: nil, login_hint: nil, nonce: nil, prompt: nil) ⇒ String

Initiate SSO Builds the URL client-side; no HTTP request is made.

Parameters:

  • provider_scopes (Array<String>, nil) (defaults to: nil) —

    Additional scopes to request from the identity provider. Applicable when using OAuth or OpenID Connect connections.

  • provider_query_params (Hash{String => String}, nil) (defaults to: nil) —

    Key/value pairs of query parameters to pass to the OAuth provider. Only applicable when using OAuth connections.

  • client_id (String, nil) (defaults to: nil) —

    The unique identifier of the WorkOS environment client. Defaults to the client's configured client_id.

  • domain (String, nil) (defaults to: nil) —

    Deprecated. Use connection or organization instead. Used to initiate SSO for a connection by domain. The domain must be associated with a connection in your WorkOS environment.

  • provider (WorkOS::Types::SSOProvider, nil) (defaults to: nil) —

    Used to initiate OAuth authentication with various providers.

  • redirect_uri (String) —

    Where to redirect the user after they complete the authentication process. You must use one of the redirect URIs configured via the Redirects page on the dashboard.

  • state (String, nil) (defaults to: nil) —

    An optional parameter that can be used to encode arbitrary information to help restore application state between redirects. If included, the redirect URI received from WorkOS will contain the exact state that was passed.

  • connection (String, nil) (defaults to: nil) —

    Used to initiate SSO for a connection. The value should be a WorkOS connection ID. You can persist the WorkOS connection ID with application user or team identifiers. WorkOS will use the connection indicated by the connection parameter to direct the user to the corresponding IdP for authentication.

  • organization (String, nil) (defaults to: nil) —

    Used to initiate SSO for an organization. The value should be a WorkOS organization ID. You can persist the WorkOS organization ID with application user or team identifiers. WorkOS will use the organization ID to determine the appropriate connection and the IdP to direct the user to for authentication.

  • domain_hint (String, nil) (defaults to: nil) —

    Can be used to pre-fill the domain field when initiating authentication with Microsoft OAuth or with a Google SAML connection type.

  • login_hint (String, nil) (defaults to: nil) —

    Can be used to pre-fill the username/email address field of the IdP sign-in page for the user, if you know their username ahead of time. Currently supported for OAuth, OpenID Connect, Okta, Entra ID, and custom SAML connections.

  • nonce (String, nil) (defaults to: nil) —

    A random string generated by the client that is used to mitigate replay attacks.

  • prompt (String, nil) (defaults to: nil) —

    If set to login, forces re-authentication at the identity provider. For supported SAML providers this sets ForceAuthn="true" in the SAML request; providers that don't support it are unaffected.

Returns:

  • (String) 


126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
 
# File 'lib/workos/sso.rb', line 126

def get_authorization_url(
  redirect_uri:,
  provider_scopes: nil,
  provider_query_params: nil,
  client_id: nil,
  domain: nil,
  provider: nil,
  state: nil,
  connection: nil,
  organization: nil,
  domain_hint: nil,
  login_hint: nil,
  nonce: nil,
  prompt: nil
)
  params = {
    "provider_scopes" => provider_scopes,
    "provider_query_params" => provider_query_params,
    "client_id" => client_id,
    "domain" => domain,
    "provider" => provider,
    "redirect_uri" => redirect_uri,
    "state" => state,
    "connection" => connection,
    "organization" => organization,
    "domain_hint" => domain_hint,
    "login_hint" => ,
    "nonce" => nonce,
    "prompt" => prompt
  }.compact
  params["provider_scopes"] = provider_scopes.join(",") unless provider_scopes.nil?
  params["provider_query_params"] = JSON.generate(provider_query_params) unless provider_query_params.nil?
  params["response_type"] = "code"
  params["client_id"] = @client.client_id if !params.key?("client_id") && !@client.client_id.nil?
  uri = URI.join(@client.base_url, "/sso/authorize")
  uri.query = URI.encode_www_form(params) unless params.empty?
  uri.to_s
end

#get_authorization_url_with_pkce(redirect_uri:, client_id: nil, **opts) ⇒ Object

H15 — SSO authorization URL with auto-generated PKCE pair + state. Returns [url, code_verifier, state].



250
251
252
253
254
255
256
257
258
259
260
261
 
# File 'lib/workos/sso.rb', line 250

def get_authorization_url_with_pkce(redirect_uri:, client_id: nil, **opts)
  pair = WorkOS::PKCE.generate_pair
  state = opts.delete(:state) || WorkOS::PKCE.generate_code_verifier
  url = get_authorization_url(
    redirect_uri: redirect_uri,
    client_id: client_id,
    state: state,
    **opts
  )
  url = append_query(url, {"code_challenge" => pair[:code_challenge], "code_challenge_method" => "S256"})
  [url, pair[:code_verifier], state]
end

#get_connection(id:, request_options: {}) ⇒ WorkOS::Connection

Get a Connection

Parameters:

  • id (String) —

    Unique identifier for the Connection.

  • request_options (Hash) (defaults to: {}) —

    (see WorkOS::Types::RequestOptions)

Returns:



78
79
80
81
82
83
84
85
86
87
88
89
90
91
 
# File 'lib/workos/sso.rb', line 78

def get_connection(
  id:,
  request_options: {}
)
  response = @client.request(
    method: :get,
    path: "/connections/#{WorkOS::Util.encode_path(id)}",
    auth: true,
    request_options: request_options
  )
  result = WorkOS::Connection.new(response.body)
  result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
  result
end

#get_logout_url(token:) ⇒ String

Logout Redirect Builds the URL client-side; no HTTP request is made.

Parameters:

  • token (String) —

    The logout token returned from the Logout Authorize endpoint.

Returns:

  • (String) 


169
170
171
172
173
174
175
176
 
# File 'lib/workos/sso.rb', line 169

def get_logout_url(token:)
  params = {
    "token" => token
  }
  uri = URI.join(@client.base_url, "/sso/logout")
  uri.query = URI.encode_www_form(params) unless params.empty?
  uri.to_s
end

#get_profile(request_options: {}) ⇒ WorkOS::Profile

Get a User Profile

Parameters:

  • request_options (Hash) (defaults to: {}) —

    (see WorkOS::Types::RequestOptions)

Returns:



204
205
206
207
208
209
210
211
212
213
214
 
# File 'lib/workos/sso.rb', line 204

def get_profile(request_options: {})
  response = @client.request(
    method: :get,
    path: "/sso/profile",
    auth: true,
    request_options: request_options
  )
  result = WorkOS::Profile.new(response.body)
  result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
  result
end

#get_profile_and_token(code:, request_options: {}) ⇒ WorkOS::SSOTokenResponse

Get a Profile and Token

Parameters:

  • code (String) —

    The authorization code received from the authorization callback.

  • request_options (Hash) (defaults to: {}) —

    (see WorkOS::Types::RequestOptions)

Returns:



220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
 
# File 'lib/workos/sso.rb', line 220

def get_profile_and_token(
  code:,
  request_options: {}
)
  body = {
    "grant_type" => "authorization_code",
    "client_id" => request_options[:client_id] || @client.client_id,
    "client_secret" => request_options[:api_key] || @client.api_key,
    "code" => code
  }
  response = @client.request(
    method: :post,
    path: "/sso/token",
    auth: true,
    body: body,
    request_options: request_options
  )
  result = WorkOS::SSOTokenResponse.new(response.body)
  result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
  result
end

#get_profile_and_token_with_pkce(code:, code_verifier:, client_id: nil, request_options: {}) ⇒ Object

H16 — Exchange an SSO authorization code for a profile/token, with PKCE support for public clients (no client_secret).

Raises:

  • (ArgumentError) 


265
266
267
268
269
270
271
272
273
274
275
276
 
# File 'lib/workos/sso.rb', line 265

def get_profile_and_token_with_pkce(code:, code_verifier:, client_id: nil, request_options: {})
  cid = client_id || @client.client_id
  raise ArgumentError, "client_id is required" if cid.nil? || cid.empty?
  body = {
    "grant_type" => "authorization_code",
    "client_id" => cid,
    "code" => code,
    "code_verifier" => code_verifier
  }
  response = @client.request(method: :post, path: "/sso/token", auth: false, body: body, request_options: request_options)
  WorkOS::SSOTokenResponse.new(response.body)
end

#list_connections(before: nil, after: nil, limit: 10, order: "desc", connection_type: nil, domain: nil, organization_id: nil, search: nil, request_options: {}) ⇒ WorkOS::Types::ListStruct<WorkOS::Connection>

List Connections

Parameters:

  • before (String, nil) (defaults to: nil) —

    An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

  • after (String, nil) (defaults to: nil) —

    An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

  • limit (Integer, nil) (defaults to: 10) —

    Upper limit on the number of objects to return, between 1 and 100.

  • order (WorkOS::Types::PaginationOrder, nil) (defaults to: "desc") —

    Order the results by the creation time.

  • connection_type (WorkOS::Types::ConnectionsConnectionType, nil) (defaults to: nil) —

    Filter Connections by their type.

  • domain (String, nil) (defaults to: nil) —

    Filter Connections by their associated domain.

  • organization_id (String, nil) (defaults to: nil) —

    Filter Connections by their associated organization.

  • search (String, nil) (defaults to: nil) —

    Searchable text to match against Connection names.

  • request_options (Hash) (defaults to: {}) —

    (see WorkOS::Types::RequestOptions)

Returns:



25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
 
# File 'lib/workos/sso.rb', line 25

def list_connections(
  before: nil,
  after: nil,
  limit: 10,
  order: "desc",
  connection_type: nil,
  domain: nil,
  organization_id: nil,
  search: nil,
  request_options: {}
)
  params = {
    "before" => before,
    "after" => after,
    "limit" => limit,
    "order" => order,
    "connection_type" => connection_type,
    "domain" => domain,
    "organization_id" => organization_id,
    "search" => search
  }.compact
  response = @client.request(
    method: :get,
    path: "/connections",
    auth: true,
    params: params,
    request_options: request_options
  )
  fetch_next = ->(cursor) {
    list_connections(
      before: before,
      after: cursor,
      limit: limit,
      order: order,
      connection_type: connection_type,
      domain: domain,
      organization_id: organization_id,
      search: search,
      request_options: request_options
    )
  }
  WorkOS::Types::ListStruct.from_response(
    response,
    model: WorkOS::Connection,
    filters: {before: before, limit: limit, order: order, connection_type: connection_type, domain: domain, organization_id: organization_id, search: search},
    fetch_next: fetch_next
  )
end