Live Q&A with Ilya Bodrov on Rails Authentication, 3rd September 8PM (PST)

Hi!

This thread was for our Q&A session with [Ilya Bodrov][1], which took place on September 3rd, 2015.

Ilya is a long time [SitePoint author][2] and recently a [SitePoint Premium teacher][3] with the release of his latest course [Getting Started with Backbone.JS][4]. Ilya loves all things web and regularly contributes to many open source projects [amongst other things][5], but he is most passionate about building web components and authentication in Rails. Just have a read of some of his articles:

  1. [Messaging with Rails and Mailboxer][6]
  2. [Steam-Powered DOTA on Rails][7]
  3. [Rails Authentication with Authlogic][8]
  4. [CanCanCan: The Rails Authorization Dance][9]

Itā€™s clear to see that Ilya knows his Rails!


Original message:

If you have been itching to ask him a question, or have a rails question youā€™d like answered then please come along and join us. He will be answering all of your Rails authentication questions for 30 minutes on this very page.

To ensure your question is answered, weā€™re accepting early submissions. Please feel free to pop in your question through this thread, Twitter (#askilyaSP) or [this form][10].

Want to join but are unsure about when it takes place in your timezone? [This link][11] will be able to assist. Not familiar with SitePoint? Really?! [Go have a look][12]. Not familiar with SitePoint Premium? [This][13] will will bring you up to speed.

See you here on the 3rd of September!


[1]: http://%20https://twitter.com/bodrovis
[2]: http://www.sitepoint.com/author/ibodrov/
[3]: https://www.sitepoint.com/premium/users/ilyabodrov
[4]: https://www.sitepoint.com/premium/courses/getting-started-with-backbone-js-2910
[5]: https://github.com/bodrovis
[6]: http://www.sitepoint.com/messaging-rails-mailboxer/
[7]: http://www.sitepoint.com/steam-powered-dota-on-rails/
[8]: http://www.sitepoint.com/rails-authentication-with-authlogic/
[9]: http://www.sitepoint.com/cancancan-rails-authorization-dance/
[10]: https://docs.google.com/a/sitepoint.com/forms/d/1MNqCchC8eNUmtTSo5sqmLLZ8KPwa7B5uAqVJsMN0KP8/viewform
[11]: http://www.timeanddate.com/worldclock/fixedtime.html?msg=Live+Q%26A+with+Ilya+Bodrov+on+Rails&iso=20150903T20&p1=137&am=30
[12]: http://www.sitepoint.com/
[13]: https://www.sitepoint.com/premium/

Hi Ilya and Angela! Thanks for organizing the Live Q&A on Rails Authentication this Thursday!

My question for Ilya, is whether there are any leading practices he would recommend with respect to implementing SSO (Single Sign-On) with Rails with LDAP/Active Directory (e.g. - a typical internal corporate user database, in a Windows environment) ā€“ or, alternately, ā€œgotchasā€ to be aware of.

Thanks in advance for any insights, experiences or wisdom he can share on the subject!

2 Likes

Iā€™m working on a PR to make rubygems.org an OAuth2 provider for authenticating users on other rubygems.org properties.

Would love some feedback on setting up Doorkeeper, whether rg users should each own an Application, or not, and how youā€™d test this. Weā€™re using the authentticated_client flow (not password) and use SSL, and also appreciate any thoughts on security.

Users must be signed in to rg to create or view Applications.

Have you used Doorkeeper, opro, or other provider libraries? Looked at Mozilla macaroons?

Link: https://github.com/rubygems/rubygems.org/pull/1010

1 Like

Welcome to todays Q&A with @bodrovis, a SitePoint author and SitePoint Premium teacher.

Today Ilya will be answering all your Rails authentication questions, in fact any question relating Rails and Ruby (his favourite topics). Feel free to ask him all of your questions on the forums. If youā€™re on twitter, you can tweet questions using #askIlyaSP and weā€™ll bring them into the discussion.

Happy chatting!

Hello and thank you for the question!

Well, I personally have not implemented such scenarios, but did research the topic a bit. What Iā€™d recommend is using RubyCAS (https://github.com/rubycas/rubycas-server) to deploy a standalone SSO app. CAS, in contrast to OpenID, centralizes authentication - a pretty comprehensive comparasion is available here https://stackoverflow.com/questions/2033026/sso-with-cas-or-oauth/3181557#3181557 I canā€™t say that deploying RubyCAS is that simple, so be prepared to invest some time. Still, projectā€™s wiki does give information about getting started and customizing. I believe here is your scenario: https://github.com/rubycas/rubycas-server/wiki/Usage-Scenarios#scenario-1-company-intranet

Also, there is a plugin for Devise that supports CAS https://github.com/nbudin/devise_cas_authenticatable. Who knows, maybe one day Iā€™ll write an article about it as well.

Best of luck!

1 Like

Hello, Benjamin!

Thank you for the question. Iā€™d really love to help, however I havenā€™t used Doorkeeper that extensively. The only thing that you are discussing and I did use is Clearance (and my article on it is coming soon). Still, youā€™ve given me a lot to think of and research so hopefully in a couple of weeks Iā€™ll write about Doorkeeper and opro as well, so that other folks have some place to set off.

Also, thanks to everyone working on rubygems for all the hard work! :smile:

If youā€™re referring to my question about making RubyGems.org an OAuth provider, Iā€™m not sure how RubyCAS would help.

OT: isnā€™t OpenID super super dead?

p.s. this is just a chat on this page, right? No video or anything?

Oh, I am sorry, that was the answer to Methos. Iā€™ll edit the post and add a quote.

As far as I know, OpenID is pretty much dead.

No, just a good old chat :smile:

Hi @bodrovis,
We had a couple of questions come through social. This one is from @James_Hibbard:

Scenario 1: I have a Rails app with reasonable test coverage. I then decide to add user authentication with Devise. In itself, this is successful, however requiring users to be authenticated before accessing certain resources, causes many of my existing tests to fail.

Do you have any tips or resources you can point towards for handling this scenario?

@bodrovis Thanks for your reply. Do you have any experience with authentication providers? (as opposed to clients?). RubyGems.org already uses Clearance as you noted, but it, like Devise, AuthLogic, etc. are to OAuth was having a password-based login on my personal site to having a ā€˜Log in with GitHubā€™ button, no?

Unfortunately, I donā€™t quite get the idea. Why canā€™t you just set some fake session for the tests and pretend that a user is authenticated? As long as Devise uses Warden, it is totally possible. Sorry if I misunderstood you.

The google form is protected.

Adding in some test helpers to handle authentication is how we do it!

Thereā€™s a full page on it here

module RequestHelpers

  include Warden::Test::Helpers

  # Requests do not have a sign_in helper
  # Polyfill with login_as from Warden::Test::Helpers
  def sign_in(user)
    login_as(user)
  end

and then in our spec file

require 'spec_helper'

describe SomeRequest do
  let(:user) { create(:user) }
  describe "#index" do
    before do
      sign_in user
    end
    # tests etc
  end
end
2 Likes

@James_Hibbard Devise has test-helpers for login_in(@user) etc. that youā€™d often put in a before/setup block. Iā€™ll update this comment when I find a good example.

Me and my collegue did create a custom OAuth provider (on Sinatra) a couple of years ago and from what I can remember that was a huge pain. :confounded:

Absolutely true, Clearance is an email-password authentication solution.

Yeah, this is exactly what I was referring to! My thanks :smile:

Thank you!

Hi @bodrovis,

Hereā€™s another question from @James_Hibbard:
Scenario 2: Iā€™m planning on building a Rails app from scratch using TDD. I know in advance that the users will have to log in to use the app. Iā€™m using Devise for authentication and the cancancan gem for authorization.

Do you have any tips or resources you can point towards for handling this scenario? (i.e. where to start and the best order to do what)

@bodrovis Have you worked with having to authenticate using a SPA front end and a rails backend?

3 Likes