OmniAuth: From the Ground Up
-
Upload
michael-bleigh -
Category
Technology
-
view
14.134 -
download
2
description
Transcript of OmniAuth: From the Ground Up
![Page 1: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/1.jpg)
OmniAuth: From the Ground Up
Michael Bleigh / Red Dirt Ruby Conf 2011
![Page 2: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/2.jpg)
Michael Bleigh
![Page 3: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/3.jpg)
@mbleigh
![Page 4: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/4.jpg)
@intridea
![Page 5: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/5.jpg)
OmniAuth!github.com/intridea/omniauth
![Page 6: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/6.jpg)
Not JUST RailsIt’s Rack, Baby!
![Page 7: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/7.jpg)
Login viaanything
![Page 8: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/8.jpg)
Past.Present.Future.
![Page 9: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/9.jpg)
Past!The why of OmniAuth
![Page 10: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/10.jpg)
Why are there so many Ruby authentication
solutions?
![Page 11: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/11.jpg)
Assumptions.
![Page 12: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/12.jpg)
I only need one User model.
Users will sign up and provide a password.
Only e-mail can validate users.
I only need one authentication method.
I’m only going to use Rails in my app.
I don’t want to customize anything.
![Page 13: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/13.jpg)
Magic in all the wrong places.
![Page 14: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/14.jpg)
Can we do better?
![Page 15: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/15.jpg)
I Need Auth
User Info
MAGIC!
![Page 16: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/16.jpg)
OmniAuth
![Page 17: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/17.jpg)
An expanding,normalized system
for external authentication.
![Page 18: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/18.jpg)
March 30, 2010 First Commit
October 1, 2010 0.1.0 (public release)
It takes a while to make easy things.
![Page 19: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/19.jpg)
0.1.010 providers,
3 contributors
![Page 20: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/20.jpg)
0.2.336 providers,
52 contributors
![Page 21: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/21.jpg)
37signals Bit.ly CAS DailyMile Doit.im Dopplr Evernote Facebook
Flickr Foursquare GitHub Goodreads Google Google Apps Gowalla Hyves Identi.ca Instagram Instapaper LDAP LinkedIn Meetup Miso Mixi Netflix
OpenID Salesforce SmugMug SoundCloud TeamBox TradeMe
TripIt Tumblr Twitter Vimeo Vkontakte YouTube
![Page 22: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/22.jpg)
Present!The how of OmniAuth
![Page 23: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/23.jpg)
Let’s kill the magic.
image via stopdropandrew.com
![Page 24: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/24.jpg)
The Guts
• OmniAuth is just middleware
• Each provider is a strategy
• Each strategy has three phases:
• Setup Phase
• Request Phase
• Callback Phase
![Page 25: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/25.jpg)
The User Info Hash{ “provider” => “friendface”, “uid” => “123456”, “user_info” => { “nickname” => “mbleigh”, “name” => “Michael Bleigh”, “email” => “[email protected]” }, “auth” => { “token” => “120942310491asfas-‐213-‐0123” }}
![Page 26: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/26.jpg)
The Bare Minimum
{ “provider” => “minimal”, “uid” => “123456”, “user_info” => { “name” => “Michael Bleigh” }}
![Page 27: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/27.jpg)
Setup Phase
• Optional (:setup => true)
• Calls through to app to allow:
• Dynamic provider credentials
• Runtime strategy modification
• Stuff I haven’t thought of
![Page 28: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/28.jpg)
Request Phase
• Requests information of the user
• For OAuth, redirects to provider
• For OpenID, requests URL
• For LDAP, requests user/pass
/auth/:provider
![Page 29: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/29.jpg)
Callback Phase
• Creates the user info hash
• For OAuth, grabs and uses access token to fetch user info
• For OpenID, parses the response
• For LDAP, retrieves directory info
/auth/:provider/callback
![Page 30: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/30.jpg)
Roll your own!
![Page 31: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/31.jpg)
Hell yeah!Lightning
Livecoding!
![Page 32: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/32.jpg)
Future!The what now of OmniAuth
![Page 33: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/33.jpg)
OmniAuth for internal auth?
![Page 34: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/34.jpg)
oa-identity
• Treat internal auth like an external provider
• Same flow (request, callback)
• Customizable user info
• Mission: RailsConf!
![Page 35: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/35.jpg)
Playing even nicer with others.
![Page 36: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/36.jpg)
RobusterRails integration.
![Page 37: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/37.jpg)
oa-rails
• Authentication model generator
• Convenience hooks for building your stable of providers
• An (optional) fully automatic engine-based auth flow
![Page 38: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/38.jpg)
Dev Friendliness
![Page 39: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/39.jpg)
[your idea here]
![Page 40: OmniAuth: From the Ground Up](https://reader035.fdocuments.net/reader035/viewer/2022081400/555930a4d8b42a543d8b48f9/html5/thumbnails/40.jpg)
Thanks!
@mbleigh @intrideagithub.com/intridea/omniauth
http://spkr8.com/t/7281