External User Authentication with OAuth and Rails

Talk for Omaha Emerging Developers' first meetup.

Transcript

1. USER SIGN IN WITH OAUTH @halfghaninNE
2. Why you might use external User Authentication • Customer experience • Leverage data from the external service @halfghaninNE
3. OAuth • Protocol for authorizing a user for one site using their existing authentication on another • HTTP requests to a third-party API • Language-blind (a web app written in Rails can make the request of a site written in PHP) • Return tokens can be binary, JSON, or SAML @halfghaninNE
4. USING OAUTH IN YOUR RAILS APP @halfghaninNE
5. Omniauth • Ruby "wrapper" for the OAuth process • Library that standardized multi-provider authentication • Facebook, GitHub, Twitter... even LinkedIn and Foursquare if that's your thing • List of services with Omniauth strategies @halfghaninNE
6. WHERE WE'LL BE WORKING @halfghaninNE
7. Gemfile .env.local * config/ initializers/omniauth.rb * routes.rb @halfghaninNE
8. app/ controllers/ sessions_controller.rb * application_controller.rb models/ user.rb views/ layouts/application.html.erb (a lil' bit) @halfghaninNE
9. LET'S DO IT! (SitePoint: Rails Authentication with OAuth 2.0 and OmniAuth) @halfghaninNE
10. Install your gem(s)! In your Gemfile gem 'omniauth-github' # or whatever provider you are using gem 'dotenv-rails' @halfghaninNE
11. Get some super exclusive tokens @halfghaninNE
12. @halfghaninNE
13. In a new file, .env.local GITHUB_KEY=12345999 GITHUB_SECRET=55555jjjjj1111pppp @halfghaninNE
14. Initialize with your credentials In a new file, config/initializers/omniauth.rb Rails.application.config.middleware.use OmniAuth::Builder do provider :github, ENV['GITHUB_KEY'], ENV['GITHUB_SECRET'] end @halfghaninNE
15. app/views/layouts/application.html.erb <%= link_to 'Login with GitHub', '/auth/github' %> # <a href="/auth/github">Login with Github</a> @halfghaninNE
16. Catch callback from the third-party service @halfghaninNE
17. config/routes.rb (Remember that callback we provided to the third-party app registration? It goes here.) get '/auth/:provider/callback', to: 'sessions#create' @halfghaninNE
18. Write the thing that happens! @halfghaninNE
19. In a new file, app/controllers/sessions_controller.rb def create render text: request.env['omniauth.auth'].to_yaml end @halfghaninNE
20. @halfghaninNE
21. @halfghaninNE
22. STORE USER DATA @halfghaninNE
23. sessions_controller.rb def create # render text: request.env['omniauth.auth'].to_yaml begin @user = User.from_omniauth(request.env['omniauth.auth']) session[:user_id] = @user.id flash[:success] = "Welcome, #{@user.name}!" rescue flash[:warning] = "There was an error :( " end redirect_to root_path end @halfghaninNE
24. Uhh...wut even is that from_omniauth business? @halfghaninNE
25. It doesn't exist yet! LET'S MAKE IT. @halfghaninNE
26. app/models/user.rb def class.from_omniauth(auth_hash) user = find_or_create_by( github_username: auth_hash['info']['nickname'], provider: auth_hash['provider']) user.image_url = auth_hash['info']['image'] user.save! user end @halfghaninNE
27. LOGOUT @halfghaninNE
28. app/controllers/application_controller.rb private def current_user @current_user ||= User.find_by(id: session[:user_id]) end helper_method :current_user NOTE: helper_method is handy-dandy way that Rails makes this value available to our view files. @halfghaninNE
29. app/views/layouts/application.html.erb <% if current_user %> <ul> <%= image_tag current_user.image_url, alt: current_user.name %> <li><%= link_to 'Log Out', logout_path, method: :delete %></li> </ul> <% else %> <li><%= link_to 'Login with GitHub', '/auth/github' %></li> <% end %> NOTE: Rails RESTful routing is helping us out here. @halfghaninNE
30. config/routes.rb delete '/logout', to: 'sessions#destroy' sessions_controller.rb def destroy if current_user session.delete(:user_id) flash[:success] = 'See you!' end redirect_to root_path end @halfghaninNE
31. DIVE DEEPER @halfghaninNE
32. API Documentation Twitter Facebook Github @halfghaninNE
33. THANKS! @halfghaninNE