I have an app with authentication, which has been done with devise and used omniauth to sign in from various providers (including vk.com, google, twitter and so on). Everything seemed working well, except that I needed to include a separate gem for every provider.
Now I decided to make that authentication much lighter and add some logging, so I decided to move from devise to sorcery. But now I have a problem with external providers, 'cause the gem has only few (no vk.com or yahoo, which I do need).
I tried to understand the code of the externalproviders to add my own just alike, but it seems a little bit too complicated for me. Is there any easier way around?
Just in case someone finds this question while looking for a similar answer, Sorcery does now include External authentication for most major logins. See:
https://github.com/Sorcery/sorcery/wiki/External
In your rails app after installing the External module you'll have a file: config/initializers/sorcery.rb. In it there will be example code for most providers.
I don't think you're going to find an easy solution to this.
I ran into this problem on the last app I worked on. I ended up just going with both Sorcery and Omniauth. I integrated them together in the Users model and Sessions controller. Sorcery's external provider stuff doesn't seem to be kept up to date.
In the end though, if I had to do it again I'd probably just do the authentication from scratch. Sorcery is nice, but it doesn't seem like it provides enough to warrant an additional dependency.
If authentication from scratch is the way you end up going, you can check out these resources:
https://github.com/NoamB/sorcery/tree/master/lib
https://github.com/railscasts/250-authentication-from-scratch-revised
Related
I am looking for an authentication system for Ruby on Rails. However there seems no gem that supports both direct web authentication (e.g. like devise does) and API authentication (like devise_token_auth). The both I mentioned seem incompatible to each other (at least I got some errors after adding the devise_token_auth to a project with devise already set up). Devise used to have an API authenticable but it was removed (there's probably a good reason for that, however I couldn't find one online).
Is there any gem that can do both of those methods (web and api), or do I need to build some JavaScript based solution, like in the ng-token-auth Live Demo?
I won't reject a JavaScript solution as long as it doesn't dramatically increase load times or is hard to understand/customize. I just can't believe there is no solution to such a common problem.
I took a closer look at devise_token_auth and together with ng-token-auth it seems to solve my problem.
So it seems I'll need to learn working with AngularJS for that, but that should be fine.
I am creating a social networking site for my university and I'm wondering which gem I should use for the login process, or if there is any other more secure way to implement a login process. Is there document or sample code which can guide me?
I've heard about the Devise gem but I am not sure that it will be work for us, or how to use it.
Definitely recommend devise. It's written by one of the top contributors to rails Jose Valim. It's pretty easy to use, especially if you just stick with the defaults which are very reasonable. And it's kept up to date - currently only has 7 outstanding issues. For a project with 6.4k watchers that's pretty amazing.
There's a getting started guide with everything you need to get started.
There's also a devise wiki with a lot of examples. Here's just a few:
How To: Disallow previously used passwords
How To: Display a custom sign_in form anywhere in your app
How To: Do not redirect to login page after session timeout
It largely depends on what features you're looking for. If you require a full-featured authentication solution (Registration, Forgot Password, Remember Me, Login) then either devise or Authlogic is recommended.
If you're just looking for a simple way to authenticate users (via login and password for example), you can just use the Rails built-in authentication via has_secure_password. Ryan Bates did a RailsCast on it not too long ago.
Whatever method you decide to go with just remember that without SSL its not secure.
Devise is very nice. However, I'm partial to using NoamB's Sorcery gem. Its like a balance between rolling your own and Authlogic.
Check it out here:
https://github.com/NoamB/sorcery
Also nice railscast on it:
http://railscasts.com/episodes/283-authentication-with-sorcery
We need to have basic authentication in our Rails 3 app but the requirements are to also integrate with providers such as facebook, linked in, google apps, twitter, etc.
We are looking at:
Clearance
Divise
AuthLogic
... and others.
Any advice on which one to use that provides most of what we need?
OmniAuth is great for plugging in to third party authentication:
Code: https://github.com/intridea/omniauth
http://railscasts.com/episodes/235-omniauth-part-1
and
http://railscasts.com/episodes/236-omniauth-part-2
The above railscasts are great resources for a simple overview of using OmniAuth.
Devise is the current top dog, as it sets up sensible defaults, and makes it remarkably easy to override parts of the authentication system without affecting the rest.
It also has a branch and instructions to easily support OmniAuth for OAuth/OpenID authentication: https://github.com/plataformatec/devise/wiki/OmniAuth:-Overview
I'm not experienced with either of these gems but I came across this blog post that had some high level points comparing Devise and Authlogic. http://www.quora.com/Ruby-on-Rails/How-should-I-choose-an-authentication-gem
This one persuaded me to start with Authlogic:
When a user logs in I like to set a cookie that has the username so I can access it from JavaScript. I know how to do this with Authlogic: add a line of code to UserSessionsController#create. How do I do it with Devise? I can't see how. (I don't want to do it on every page request. Just when they authenticate.)
You can give a shot to Sorcery gem which nicely handle third party authentification.
I found it easy to learn and to implement, and it's well documented too.
I don't try the other gems but this one is growing very fast right now, despite the fact that it's not an very old project
Good luck!!!
Someone got a tip for a minimal rails auth script or gem? It should include just the following points:
authentication by email-address
registration with email-address and password
Look into devise gem: https://github.com/plataformatec/devise
It can do a lot more than that, but it is a very easy to use gem for such a purpose.
It handles the views and passwords resets too.
Yeah, devise is great! If those are truly your requirements then I would suggest that too. If, on the other hand, you are looking for the most minimal authentication system possible, I would encourage you to consider the omniauth gem: https://github.com/intridea/omniauth
It will allow you to totally offload authentication to a third party (facebook, google, twitter, etc). This is a great way to avoid writing any of that logic at all.
I am wondering how I can build the registration process like we have in Stack Overflow, where a user can login using one of several already existing accounts? I would prefer using Rails as a technology platform.
Are you looking for this?
http://testingauth.heroku.com/
I'm not sure this is exactly what you need, but the devise module, available on github, makes it very easy to build a authentication system in a rails application.
For authorization, another great module is called "cancan". You might need that too.
Check out OmniAuth. There are a few railscasts describing it.
You can use omniauth gem to implement openId auth. Also, it possible to extend your existing user auth systems. See great screencast about this at railscast: OmniAuth Part 1