Date post: | 19-Jan-2015 |
Category: |
Technology |
Upload: | paul-gallagher |
View: | 6,465 times |
Download: | 2 times |
NB: This presentation was delivered at the Singapore Ruby Brigade meetup 7-Oct-2009 (hosted at wego.com)
Some things should just be banned on the interwebs..
.. pointless social “applications” ..
.. pointless social “applications” ..
.. twitter celebs ..
.. twitter celebs ..
.. custom login screens!
.. custom login screens!
What’s so bad about that?Security– Proliferation of
credentials unavoidably leads to greater risks
– Do sites hash my password?
PITA– Redundant entry of
registration details– Validation emails..
aargh!– Code bloat:
reset/forgot password flows
– Site developer’s need to be (should be!) security experts
Enterprise clients– Ideally want your site to treat employees as “verified
employees” not just part of the madding crowd– Public sites: still in its infancy. Belief: before long, enterprises
will clue in to this, and be “exporting” corporate credentials for use on the web. If your site supports this, you can win big.
End of days for“own the user identity”?
Consumers: already have (multiple) “identities”– Hypothesis: these days a reasonable assumption– Why should I jump thru hoops to create another just
so I can try your site?
Businesses: don’t really want their employees creating new “identities” on your site if it is for business purposes
– Compliance – no control or visibility of what employees are doing or information they are creating
– Data ownership – what happens when the employee leaves?
Or
“Why authentication and identity management is still worth talking
about”
Authorisation Options
Internal(username / password)
Sometimes there’s no choice
– No internet access– Legacy accounts
Special purpose– Admin or test users
for example
LDAP/AD
Intranet applicationsLegacy directories
Supports many providers, which don’t need to be known ahead of timeConsumer adoption has been relatively slow, although many users now have an OpenID (via Yahoo or Google)
– even though they don’t know this!
Criticised for being a little too “technical” for the average web citizen(!)
OAuth
Must tie to a specific provider ahead of timeAlso used as the basis of OpenSocial signed requestsGreat if you just want to target a specific community (e.g. build a twitter app)
A single-sign-on solution for web sitesAbstracts the authentication provider – you can support as many as JanRain supportNormalizes profile settings across providers (i.e. “email” is always “email”)
RPX by JanRain
SAML – WS* security mainly enterprise use, but now gaining some attention via openSSO2FA/3FA solutions – provider specific or custom integrated
Many others..
Authentication options in RailsInternal
(username/password)LDAP/AD
RPX by JanRain Many others..OAuth
Acts_as_authenticated
Restful_authentication
Clearance
Twitter_oauth
Openid_authentication
ActiveLDAP
acts_as_ldpa_authenticated
Ruby Net-LDAP
Rpx_now …Ruby oauth
OpenID
Or Authlogic
Internal(username/password)
LDAP/AD
RPX by JanRain
Many others..OAuth
Authlogic-oauth
Authlogic-ldap
Authlogic-oid
Authlogic_rpx
Authlogic (base)
Authlogic plugin X
Or use Authlogic“unobtrusive authentication”
No generator crudSmells like ActiveRecord
Plugin architecture
Using Authlogic_RPX
RPX Request Model
Link to sign-in ..chatter..
..chatter..
Post:token
Verify:token
(returns:profile info)
Authlogic_RPX-on-a-page
Enabling Authlogic_RPX
See the Authlogic RPX README for full details. It walks you through the steps for enabling Authlogic RPX:
1. Enable RPX for your user model2. Add RPX configuration for the Authlogic session model3. Add custom user profile mapping (optional)4. Add application controller helpers: current_user,
current_user_session5. Setup the Authlogic session controller6. Setup the Authlogic user controller7. Use view helpers to provide login links8. Allow users to "Add RPX" to existing accounts (optional)
In this presentation, we’ll touch on some of the main points…
Register your RPX app
Register your application at http://rpxnow.com – set it’s name and be assigned an API key, and select/configure the authentication providers:
Note: max 6 providers
with the free RPX account
Configure your project
In config/environment.rb – Set the RPX app name and API key:
Configure gems:
$ rake gems:installOnce setup, using Authlogic_RPX is almost identical to standard Authlogic
Two MVCs: session and user
Minimal models:
Simple helpers you define and control:– current_user– require_user (e.g. for before_filter)
Controllers – clean and sweet
[:post] create – this is a user “signing in”
Session controller
All this is optional branching logic, which you can tailor specifically for your application
successful save means authentication OK!
[:delete] destroy – this is a user “signing out”
Session controller
Access controls:
Registration form (optional):
Save registration (optional):
Edit my profile:
Show my profile:
Save my profile:
User controller
Note: sample is a controller that only lets users access their own information, but you can just as easily adapt this so they can list and see the public profile information of other users too.
Auto registration
Authlogic_RPX will “register” new users by default. For users this is great: registration is no more difficult than logging in.
– You can disable this in the session model:
UserSession model – profile mapping
When users auto-register, profile data from RPX is available to be inserted in the user's record on your site.
– Authlogic_rpx will map the username and email fields by default.
If you have other fields you want to map, you can provide your own implementation of the map_rpx_data method in the UserSession model
UserSession model – profile mapping
UserSession model – profile mapping
WARNING: any fields you map should NOT have constraints enforced at the database level.
– Authlogic_rpx will optimistically attempt to save the user record during registration, and violating a db constraint will cause the authentication/ registration to fail.
– You can/should enforce any required validations at the model level. This will allow the auto-registration to proceed, and the user can be given a chance to rectify the validation errors on your user profile page
If it is not acceptable in your application to have user records created with potential validation errors in auto-populated fields, you will need to override map_rpx_data and implement whatever special handling makes sense in your case.
RPX – the catch (or: why you might want to buy their pro service)
Today I sign-in with Tomorrow I use
these aren’t thesame identities!
We need identity mapping!– RPX paid options support “identity mapping”, but this is
currently not supported in Authlogic_RPX
Authlogic_RPX 1.1.0+ includes an internal identity mapping solution (it is optional)
Try it outLive Demonstration Site:
rails-authlogic-rpx-sample.heroku.com
Demonstration site source repository:github.com/tardate/rails-authlogic-rpx-sample
Take-aways
Getting authentication right is critical for your site’s success
– Lower the barrier-to-entry for consumer/personal users. Eliminate the need to create redundant “identities”!
– Business sites – make it possible for employees to use business identities “exported” via OpenID (for example), without the need for a specific agreement and integration to be in place
3
Take-aways
Authlogic – leading authentication framework for rails (IMHO)
– Best even if you just want to do traditional username/password
– Unobtrusive– Makes it easy to switch or add
authentication options in future– One framework to learn – plugin the
most suitable authentication method for each specific project
2
Take-aways
Authlogic_RPX – takes away the pain– Support diverse identity providers– Standard Authlogic - nothing special to do
except plug in your API key– Can be used as “RPX only”, or co-exist
with standard Authlogic username/password
Use it for:– Public sites + you just need authentication
services + want to give users the best opportunity to use existing credentials.
1
Thank you!
Questions?
0
Some References
Authlogic: http://github.com/binarylogic/authlogic Authlogic_RPX: http://github.com/tardate/authlogic_rpx RPX: http://rpxnow.com OpenID: http://openid.net OAuth: http://oauth.net Singapore Ruby Brigade (SRB): http://groups.google.com/group/singapore-rb