Slide 1
Slide 1 text
Introductions
Slide 2
Slide 2 text
Twitter @lgleasain
Github lgleasain
www.lancegleason.com
www.polyglotprogrammincinc.com
[email protected]
Slide 3
Slide 3 text
No content
Slide 4
Slide 4 text
No content
Slide 5
Slide 5 text
No content
Slide 6
Slide 6 text
No content
Slide 7
Slide 7 text
No content
Slide 8
Slide 8 text
No content
Slide 9
Slide 9 text
No content
Slide 10
Slide 10 text
No content
Slide 11
Slide 11 text
No content
Slide 12
Slide 12 text
http://www.polyglotprogramminginc.com/purr-
programming-2-0/
Slide 13
Slide 13 text
No content
Slide 14
Slide 14 text
No content
Slide 15
Slide 15 text
No content
Slide 16
Slide 16 text
No content
Slide 17
Slide 17 text
What
Are
Services
Slide 18
Slide 18 text
No content
Slide 19
Slide 19 text
No content
Slide 20
Slide 20 text
No content
Slide 21
Slide 21 text
No content
Slide 22
Slide 22 text
No content
Slide 23
Slide 23 text
No content
Slide 24
Slide 24 text
No content
Slide 25
Slide 25 text
No content
Slide 26
Slide 26 text
Why
Services
Slide 27
Slide 27 text
No content
Slide 28
Slide 28 text
No content
Slide 29
Slide 29 text
No content
Slide 30
Slide 30 text
What is
Federation
Slide 31
Slide 31 text
No content
Slide 32
Slide 32 text
Single
Sign On
Slide 33
Slide 33 text
No content
Slide 34
Slide 34 text
No content
Slide 35
Slide 35 text
No content
Slide 36
Slide 36 text
No content
Slide 37
Slide 37 text
No content
Slide 38
Slide 38 text
No content
Slide 39
Slide 39 text
No content
Slide 40
Slide 40 text
XML
Slide 41
Slide 41 text
No content
Slide 42
Slide 42 text
No content
Slide 43
Slide 43 text
No content
Slide 44
Slide 44 text
No content
Slide 45
Slide 45 text
Authorization and
Authentication
Slide 46
Slide 46 text
Authentication
/Authorization
Slide 47
Slide 47 text
Single
Point of
Success
Slide 48
Slide 48 text
Bad For
Mixed
Use
Slide 49
Slide 49 text
Complex
Slide 50
Slide 50 text
Mostly
Read Only
Content
Slide 51
Slide 51 text
Half Requires
Authenication/
Authorizaztion
Slide 52
Slide 52 text
Needs To
Scale
Slide 53
Slide 53 text
No content
Slide 54
Slide 54 text
Bearer
Token
Slide 55
Slide 55 text
No content
Slide 56
Slide 56 text
No content
Slide 57
Slide 57 text
No content
Slide 58
Slide 58 text
No content
Slide 59
Slide 59 text
No content
Slide 60
Slide 60 text
No content
Slide 61
Slide 61 text
No content
Slide 62
Slide 62 text
Doorkeeper
Slide 63
Slide 63 text
gem 'doorkeeper'
rails generate doorkeeper:install
rails generate doorkeeper:migration
rake db:migrate
Slide 64
Slide 64 text
Every
Instance
Has To Have
a Datastore
Slide 65
Slide 65 text
No content
Slide 66
Slide 66 text
No content
Slide 67
Slide 67 text
No content
Slide 68
Slide 68 text
resource_owner_authenticator do
@user = env[:clearance].current_user
unless @user
session[:return_to] = request.fullpath
redirect_to(routes.sign_in_url)
end
@user
end
Slide 69
Slide 69 text
No content
Slide 70
Slide 70 text
resource_owner_authenticator do
#could be a call to a central
authentication service.
@user = env[:clearance].current_user
unless @user
session[:return_to] = request.fullpath
redirect_to(routes.sign_in_url)
end
@user
end
Slide 71
Slide 71 text
No content
Slide 72
Slide 72 text
No content
Slide 73
Slide 73 text
module OmniAuth
module Strategies
autoload :VulcanService, Rails.root.join('lib', 'strategies',
'vulcan_service')
autoload :KlingonManager, Rails.root.join('lib', 'strategies',
'klingon_manager')
autoload :Bieber, Rails.root.join('lib', 'strategies', 'beiber')
end
end
Rails.application.config.middleware.use OmniAuth::Builder do
provider :Vulcan, "#{APP_CONFIG['vulcan_url']}/login"
provider :KlingonService, "#{APP_CONFIG['klingon_service_url']}/login"
provider :BeiberManager, "#{APP_CONFIG['beiber_manager_url']}/login"
provider :developer
end
Slide 74
Slide 74 text
require 'strategies/common'
module OmniAuth
module Strategies
class VulcanService
include Common
include OmniAuth::Strategy
args [:authentication_url]
def request_phase
# some request code to authenticate
# live long and prosper
end
#todo: add checks to make sure the values returned here are valid
def callback_phase
request = Rack::Request.new env
cookies = request.cookies
response = Rack::Response.new
cookie_monster = VulcanCookieMonster.new cookies
common_vulcan_callback cookie_monster: cookie_monster, response: response,
cookies: cookies
end
private
def strategy_id
'comcast_tve'
end
end
end
end
Slide 75
Slide 75 text
No content
Slide 76
Slide 76 text
No content
Slide 77
Slide 77 text
No content
Slide 78
Slide 78 text
Delegation
Slide 79
Slide 79 text
No content
Slide 80
Slide 80 text
class ApplicationController < ActionController::API
def check_authorization
authorization = request.headers[‘Authorization']
if authorization
party_response = HTTParty.get("#{APP_CONFIG['doorkeeper_service_url']}:#{ENV[DOORKEEPER_SERVICE_PORT']}/
check_key.json",
query: {'signature' => Hancock.sign, 'oauth_token' => authorization})
parsed_response = party_response.parsed_response
if parsed_response['user_key']
expires = Marshal.load(parsed_response['expires_at'].force_encoding('UTF-8')).to_json
@user = { 'user_id' => parsed_response['user_id'], 'user_key' => parsed_response['user_key'],
'email' => parsed_response['email'], 'expires_at' => expires }
else
response.status = 401
render json: {authorized: false} and return
end
end
else
response.status = 401
render json: {authorized: false} and return
end
end
end
Slide 81
Slide 81 text
Single
Point of
Success
Slide 82
Slide 82 text
Under
Load
Slide 83
Slide 83 text
Cached
Delegation
Slide 84
Slide 84 text
No content
Slide 85
Slide 85 text
No content
Slide 86
Slide 86 text
require 'redis'
class ApplicationController < ActionController::API
def check_authorization
authorization = request.headers['Authorization']
if authorization
redis = Redis.new(:host => ENV['REDIS_HOST'], :port => ENV['REDIS_PORT'])
redis_user = redis.get(authorization)
if redis_user != nil
@user = JSON.parse(redis_user)
expires_at = DateTime.parse(@user['expires_at'])
end
if !@user or expires_at < DateTime.now
party_response =
HTTParty.get("#{APP_CONFIG['doorkeeper_service_url']}:#{ENV['DOORKEEPER_SERVICE_PORT']}/check_key.json",
query: {'signature' => Hancock.sign, 'oauth_token' => authorization})
parsed_response = party_response.parsed_response
if parsed_response['user_key']
expires = Marshal.load(parsed_response['expires_at'].force_encoding('UTF-8')).to_json
@user = { 'user_id' => parsed_response['user_id'], 'user_key' => parsed_response['user_key'],
'email' => parsed_response['email'], 'expires_at' => expires }
redis.set authorization, @user.to_json
else
response.status = 401
render json: {authorized: false} and return
end
end
else
response.status = 401
render json: {authorized: false} and return
end
end
end
Slide 87
Slide 87 text
No content
Slide 88
Slide 88 text
No content
Slide 89
Slide 89 text
Oauth
Sucks
Slide 90
Slide 90 text
Yeah
But….
Slide 91
Slide 91 text
It’s a
Standard
Slide 92
Slide 92 text
Roll Your
Own Is
Less Secure
Slide 93
Slide 93 text
JWT’s Are
Roll Your
Own
Slide 94
Slide 94 text
Default
Doorkeeper
is Too
Slide 95
Slide 95 text
No content
Slide 96
Slide 96 text
No content
Slide 97
Slide 97 text
97
Slide 98
Slide 98 text
Twitter @lgleasain
Github lgleasain
www.lancegleason.com
www.polyglotprogrammincinc.com
[email protected]