Add support for client assertion signing key authentication

[kaczowkad]

Changes

The omniauth-auth0 gem only supports client secret authentication. Auth0 documentation states:

To ​​improve your security posture, we recommend using the Private Key JWT authentication method.

Opened issue #199 on 2024-11-07 to inquire about adding support for private key JWT authentication. We created a workaround to support private key JWT authentication in our application using the omniauth-auth0 gem. Opening this PR to get feedback on adding support for private key JWT added to the gem.

This PR adds two optional parameters to the config:

• client_assertion_signing_key - the private key
• client_assertion_signing_algorithm - algorithm defaults to RS256

The current interface is preserved. Client secret authentication can be used without changing the interface.

Client secret authentication:

AUTH0_CONFIG = Rails.application.config_for(:auth0)

Rails.application.config.middleware.use OmniAuth::Builder do
  provider(
    :auth0,
    AUTH0_CONFIG['auth0_client_id'],
    AUTH0_CONFIG['auth0_client_secret'],
    AUTH0_CONFIG['auth0_domain'],
    callback_path: '/auth/auth0/callback',
    authorize_params: {
      scope: 'openid profile'
    }
  )
end

Client assertion signing key:

AUTH0_CONFIG = Rails.application.config_for(:auth0)

Rails.application.config.middleware.use OmniAuth::Builder do
  provider(
    :auth0,
    AUTH0_CONFIG['auth0_client_id'],
    nil,
    AUTH0_CONFIG['auth0_domain'],
    callback_path: '/auth/auth0/callback',
    authorize_params: {
      scope: 'openid profile'
    }
    client_assertion_signing_key: AUTH0_CONFIG[:auth0_client_assertion_signing_key],
    client_assertion_signing_algorithm: AUTH0_CONFIG[:auth0_client_assertion_signing_algorithm]}
  )
end

The existing code has rubocop violations which were not addressed because it was outside the scope of these changes. No new rubocop violations were introduced.

References

Please include relevant links supporting this change such as a:

• issue Private Key JWT support in OmniAuth::Strategies::Auth0 #199
• form post https://community.auth0.com/t/ruby-on-rails-with-private-key-jwt/150744 which didn't address the omniauth-auth0 gem

Testing

Duplicated all the specs in spec/omniauth/strategies/auth0_spec.rb for client assertion signing key. The existing specs were scoped to 'client secret authentication'. All specs passed.

Testing with Auth0 requires an application setup for private key JWT authentication. The public key must be uploaded to the application in Auth0.

• This change adds unit test coverage
• This change has been tested on the latest version of the platform/language or why not
  Tested with ruby 3.2.2. Built the gem and client assertion signing key authentication with a Ruby on Rails application.

Checklist

• I have read the Auth0 contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors
• All code quality tools/guidelines in the CONTRIBUTING documentation have been run/followed