4 ms·

Ever actually tried implementing an Oauth provider? It's surprisingly difficult to get 100% right. I had a similar problem, so I started my own open OAuth prov

Ever actually tried implementing an Oauth provider? It's surprisingly difficult to get 100% right. I had a similar problem, so I started my own open OAuth provider implementation complete with built in documentation https://github.com/schneems/opro https://github.com/schneems/opro. If you're using Rails, you can have a working OAuth provider in production in under 5 minutes. Of course adding the API endpoints and writing application specific docs is still up to the user, but the authentication flow and logic are at least standardized.

purephase 14y ago
I find with Devise and Omniauth it works like magic. rbates has some excellent Railscasts on the process as well. I agree with the main thrust of the argument though. OAuth providers do not make it as easy as they should. The point about the buttons is spot on. I've had some good success with the buttons provided here: http://nicolasgallagher.com/lab/css3-social-signin-buttons/ http://nicolasgallagher.com/lab/css3-social-signin-buttons/
- thinkbohemian 14y ago
  Omniauth is for implementing an OAuth client, and it's great... but, that's the other side of this coin. There are very few good provider libraries out there, making it harder to stick to standards. People who want to provide an API shouldn't have to re-invent the wheel every time.
  - Judson 14y ago
    I have found that doorkeeper[0] is pretty good and the setup is a breeze. [0]: https://github.com/applicake/doorkeeper/ https://github.com/applicake/doorkeeper/
    - thinkbohemian 14y ago
      I like doorkeeper as well. Opro doesn't currently support any other backends other than ActiveRecord, so if you're using mongo you would need to use doorkeeper. I started writing opro before DK was out in the wild. There were some things I had in opro that weren't in DK so I decided to keep developing it. Last time I checked here are some differences: - Deals with CSRF protected resources automatically - Works with your login system (like devise), not around it. No special casing or configuration is needed - Comes with built in docs. - Comes with built in test controller You can play around with it here: http://opro-demo.herokuapp.com/ http://opro-demo.herokuapp.com/.
    - knewter 14y ago
      <3 doorkeeper. Using it to make one of our open source apps - http://github.com/isotope11/xrono http://github.com/isotope11/xrono - an oauth provider to support an oauth sso flow inside of apps we've built for internal use regularly. It took an hour one night to build the provider, and maybe an hour to build the omniauth provider gem and integrate it into an app. P.S. - it also took like six hours of banging my head against a wall for unrelated oauth-related problems, but not DK's fault.
- bmelton 14y ago
  I've also open sourced a set of (incomplete) social buttons as well. Do as you would with them, they're MIT-licensed, and while the set is incomplete, the PSD is included. Enjoy. https://github.com/bmelton/Social-Login-Buttons https://github.com/bmelton/Social-Login-Buttons
mechanical_fish 14y ago
Thank you for this; I believe it fills a big hole in the ecosystem. I found myself wanting to implement an API endpoint about six months before your first commit to this project, so I hit Github expecting to find a couple of OAuth-provider Ruby libraries in competition; I'd pick one and do a day or two of work to get it integrated. Instead, I couldn't find much of anything. So I delegated the task to someone else who I believe ended up implementing… Basic auth over TLS. ;)
phillmv 14y ago
Awesome dude. I've been using oauth-plugin which just makes me shake with violent rage. Definitely gonna check this out.
ocharles 14y ago
Yea, I am currently implementing OAuth (https://github.com/ocharles/snaplet-oauth2 https://github.com/ocharles/snaplet-oauth2) and the specification is not entirely straight forward. There's a lot of edge-case type stuff that's important to get right.
steveh73 14y ago
Which version? There were 30 mutually incompatible draft versions of OAuth2 last time I checked
- aeturnum 14y ago
  Unless I misunderstand, this is talking about OAuth, not OAuth 2. While the latter does have a lot of versions, I believe the former is "finalized."
- thinkbohemian 14y ago
  http://opro-demo.herokuapp.com/oauth_docs/oauth http://opro-demo.herokuapp.com/oauth_docs/oauth version 22 of oauth2 spec
jaredhanson 14y ago
Agreed. It'd be great for interoperability to get a set of quality, conformant open source provider implementations in various languages. I've implemented OAuth 1.0 and OAuth 2.0 as middleware in Node.js, available here: https://github.com/jaredhanson/oauthorize https://github.com/jaredhanson/oauthorize https://github.com/jaredhanson/oauth2orize https://github.com/jaredhanson/oauth2orize

purephase 14y ago

I find with Devise and Omniauth it works like magic. rbates has some excellent Railscasts on the process as well. I agree with the main thrust of the argument though. OAuth providers do not make it as easy as they should. The point about the buttons is spot on. I've had some good success with the buttons provided here: http://nicolasgallagher.com/lab/css3-social-signin-buttons/ http://nicolasgallagher.com/lab/css3-social-signin-buttons/

thinkbohemian 14y ago
Omniauth is for implementing an OAuth client, and it's great... but, that's the other side of this coin. There are very few good provider libraries out there, making it harder to stick to standards. People who want to provide an API shouldn't have to re-invent the wheel every time.
- Judson 14y ago
  I have found that doorkeeper[0] is pretty good and the setup is a breeze. [0]: https://github.com/applicake/doorkeeper/ https://github.com/applicake/doorkeeper/
  - thinkbohemian 14y ago
    I like doorkeeper as well. Opro doesn't currently support any other backends other than ActiveRecord, so if you're using mongo you would need to use doorkeeper. I started writing opro before DK was out in the wild. There were some things I had in opro that weren't in DK so I decided to keep developing it. Last time I checked here are some differences: - Deals with CSRF protected resources automatically - Works with your login system (like devise), not around it. No special casing or configuration is needed - Comes with built in docs. - Comes with built in test controller You can play around with it here: http://opro-demo.herokuapp.com/ http://opro-demo.herokuapp.com/.
  - knewter 14y ago
    <3 doorkeeper. Using it to make one of our open source apps - http://github.com/isotope11/xrono http://github.com/isotope11/xrono - an oauth provider to support an oauth sso flow inside of apps we've built for internal use regularly. It took an hour one night to build the provider, and maybe an hour to build the omniauth provider gem and integrate it into an app. P.S. - it also took like six hours of banging my head against a wall for unrelated oauth-related problems, but not DK's fault.
bmelton 14y ago
I've also open sourced a set of (incomplete) social buttons as well. Do as you would with them, they're MIT-licensed, and while the set is incomplete, the PSD is included. Enjoy. https://github.com/bmelton/Social-Login-Buttons https://github.com/bmelton/Social-Login-Buttons

mechanical_fish 14y ago

Thank you for this; I believe it fills a big hole in the ecosystem. I found myself wanting to implement an API endpoint about six months before your first commit to this project, so I hit Github expecting to find a couple of OAuth-provider Ruby libraries in competition; I'd pick one and do a day or two of work to get it integrated. Instead, I couldn't find much of anything. So I delegated the task to someone else who I believe ended up implementing… Basic auth over TLS. ;)

phillmv 14y ago

Awesome dude. I've been using oauth-plugin which just makes me shake with violent rage. Definitely gonna check this out.

ocharles 14y ago

Yea, I am currently implementing OAuth (https://github.com/ocharles/snaplet-oauth2 https://github.com/ocharles/snaplet-oauth2) and the specification is not entirely straight forward. There's a lot of edge-case type stuff that's important to get right.

steveh73 14y ago

Which version? There were 30 mutually incompatible draft versions of OAuth2 last time I checked

aeturnum 14y ago
Unless I misunderstand, this is talking about OAuth, not OAuth 2. While the latter does have a lot of versions, I believe the former is "finalized."
thinkbohemian 14y ago
http://opro-demo.herokuapp.com/oauth_docs/oauth http://opro-demo.herokuapp.com/oauth_docs/oauth version 22 of oauth2 spec

jaredhanson 14y ago

Agreed. It'd be great for interoperability to get a set of quality, conformant open source provider implementations in various languages. I've implemented OAuth 1.0 and OAuth 2.0 as middleware in Node.js, available here: https://github.com/jaredhanson/oauthorize https://github.com/jaredhanson/oauthorize https://github.com/jaredhanson/oauth2orize https://github.com/jaredhanson/oauth2orize