GoogleIDToken

This code is from @timbray's awesome google-id-token codebase, with one minor tweak to handle a new token format (array vs hash).

Tim gives a great overview of id tokens here http://www.tbray.org/ongoing/When/201x/2013/04/04/ID-Tokens.

GoogleIDToken currently provides a single useful class "Validator", which provides a single method "#check", which parses and validates an ID Token allegedly generated by Google auth servers.

android

android cross client auth

Creating a new validator takes a single optional hash argument. If the hash has an entry for :x509_key, that value is taken to be a key as created by OpenSSL::X509::Certificate.new, and the token is validated using that key. If there is no such entry, the keys are fetched from the Google certs endpoint https://www.googleapis.com/oauth2/v1/certs.

  gem install google-id-token

  validator = GoogleIDToken::Validator.new
  jwt = validator.check(token, required_audience, required_client_id)
  if jwt
    email = jwt['email']
  else
    report "Cannot validate: #{validator.problem}"
  end

  cert = OpenSSL::X509::Certificate.new(File.read('my-cert.pem'))
  validator = GoogleIDToken::Validator.new(:x509_cert => cert)
  jwt = validator.check(token, required_audience, required_client_id)
  if jwt
    email = jwt['email']
  else
    report "Cannot validate: #{validator.problem}"
  end