Auth* in Ember apps with Torii

The presentation I gave at Ember.js Amsterdam on 03/10/2016.

Transcript

1. Auth* in Ember apps with Torii 03/10/2016 – Ember.js Amsterdam
8. Balint Erdi @baaz balinterdi http://balinterdi.com
9. http://rockandrollwithemberjs.com
10. Authentication Authentication (from Greek: αὐθεντικός authentikos, "real, genuine," from αὐθέντης authentes, "author") is the act of confirming the truth of an attribute of a single piece of data (a datum) claimed true by an entity.
11. Single piece of data? I am Balint Erdi (or, more frequently balint.erdi@gmail.com)
12. Way of confirmation? I, and only I, know the secret.
13. Authorization Authorization is the function of specifying access rights to resources related to information security and computer security in general and to access control in particular.
14. Preconditions Authentication needs to precede authorization.
15. (Common) Example You are authorized to do as you please with your data.
16. Putting the two auths together After authenticating myself against the user database, I can do with my data as I please.
17. Putting the two auths together After authenticating yourself against your Twitter profile, you have authorized the Pocket app to post to your timeline.
18. OAuth 2.0
19. After authenticating yourself against your Twitter profile, you have authorized the Pocket app to post to your timeline. Resource owner Service provider Consumer Access scope
20. Implicit grant flow
21. User Service provider (Server) Consumer
22. User Ember app Google +
23. User Ember app Google + 1 visits
24. User Ember app Google + 1 who’s this guy? 2 visits
25. User Ember app Google + 1 who’s this guy? 2 visits who are you? 3
26. User Ember app Google + who are you? 1 who’s this guy? 2 visits 3 I’m Balint 4
27. User Ember app Google + who are you? 1 who’s this guy? 2 visits 3 I’m Balint 4 The app wants these things 5
28. User Ember app Google + who are you? 1 who’s this guy? 2 visits 3 I’m Balint 4 The app wants these things 5 I’m fine with that 6
29. User Ember app Google + I’m fine with that 6 Here, keep this safe 7
30. User Ember app Google + I’m fine with that 6 Thanks, dude. 8 Here, keep this safe 7
31. User Ember app Google + I’m fine with that 6 Thanks, dude. 8 Here, keep this safe 7 Is this token legit? 9
32. User Ember app Google + I’m fine with that 6 Thanks, dude. 8 Here, keep this safe 7 Is this token legit? 9 It sure is. 10
33. User Ember app Google + I’m fine with that 6 Thanks, dude. 8 Here, keep this safe 7 Is this token legit? 9 It sure is. 10 Come on in 11
34. Bearing a token
35. User Ember app Google + 1 Is this token still legit?
36. User Ember app Google + 1 Is this token still legit? Dude, you asked me 2 slides ago 2
37. User Ember app Google + 1 Is this token still legit? Dude, you asked me 2 slides ago 2 Come on in 3
39. Torii
40. https://github.com/Vestorly/torii
41. Makes it simple to obtain auth from 3rd party providers
42. Torii concepts • Providers • Adapters • Session
43. Providers • They provide authentication services (OAuth: service providers) • Some pre-defined ones in Torii • A single API method: open • Must return a promise
44. Adapters • They pass authorization data from providers to the session • open, fetch and close • All must return promises
45. Session • Stores current authentication state and data • Proxies all its methods to the specified adapter (for `open`, first to the provider) • Contains a state machine (isAuthenticated, isFetching, etc.) • Session management is opt-in
46. Router DSL • Calls `checkLogin` on the application route • => Initiates the session • For authenticated routes, triggers `accessDenied` if session is not authenticated
47. Real-world example (kind of)
48. Dankuvel!
49. Vragen?
50. References • Some surprising things about OAuth 2.0 • Torii on Github • Introduction to Torii – Cory Forsyth’s video presentation at the Global Ember meetup • Introduction to Torii – the slides from said presentation • Using OAuth 2.0 for Client-side Web Apps – With the Google Identity Platform