Google-api-ruby-client: Verify integrity of ID tokens?

[FranklinYu]

According to the documentation, it is recommended to validate Google ID token with library. Is it possible to do this in Ruby?

[120687]

Id line:rindupoma

[ihatov08]

@franklinyu

require 'google/apis/oauth2_v2'
oauth2 = Google::Apis::Oauth2V2::Oauth2Service.new
access_token = 'XXXXXXXX'
userinfo = oauth2.tokeninfo(access_token: access_token)

=> #<Google::Apis::Oauth2V2::Tokeninfo:0x00555c07f5c158
 @access_type="online",
 @audience="wwwwwwwwwwww.apps.googleusercontent.com",
 @email="[email protected]",
 @expires_in=1111,
 @issued_to="wwwwwwwwwwwwww.apps.googleusercontent.com",
 @scope="https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/plus.me",
 @user_id="111111111111111111",
 @verified_email=true>

[FranklinYu]

@ihatov08 Thank you very much. It is buried deep and the documentation can be improved.

Is #tokeninfo thread-save? If two threads share a Google::Apis::Oauth2V2::Oauth2Service instance and calls #tokeninfo concurrently, will there be race condition?

[yedhukrishnan]

@ihatov08 The code throws this error:

Error - #<Google::Apis::ClientError: Invalid request>

Any idea why?

[j1wilmot]

I had success using the above #tokeninfo call but passing a token_id param instead of an access_token.

The #tokeninfo call is a wrapper around a request to the /oauth2/v2/tokeninfo endpoint so it's easy enough to copy this functionality by making your own request. There is a v3 endpoint now, so it's probably best / easiest to send a request to the endpoint outside of this library.

E.G.
uri = URI 'https://www.googleapis.com/oauth2/v3/tokeninfo'
response = Net::HTTP.post_form uri, token_id: YOUR_TOKEN_ID

[baxang]

https://github.com/google/google-id-token seems to be another option.

[TheRoyalTnetennba]

Sorry for the delay. Looking into updating the documentation on this.

[ihatov08]

@franklinyu
#tokeninfo is thread-save.
I using this gem with Ruby on Rails, it work without problem.

[ihatov08]

@yedhukrishnan Please more information!

[tonycchung]

verifying id tokens via the v3 endpoint doesn't seem to be supported with this gem as tokeninfo hits v2 for access tokens and id tokens.

would it be recommended to use the google-id-token gem specifically for id tokens?

https://github.com/google/google-id-token

is there any real difference between using the v2 and v3 endpoints right now? the responses look the same anyhow

[fhinkel]

Greetings, we're closing this. Looks like the issue got resolved. Please let us know if the issue needs to be reopened.

[dazuma]

At this point, please use the Google:Auth::IDTokens class (in the googleauth gem) for ID token verification.

[nratter]

At this point, please use the Google:Auth::IDTokens class (in the googleauth gem) for ID token verification.

It says to specify a key_source. I don't see where this is described in the docs. Can you let me know what key_source should consist of?