Provide an OAuth implementation for native apps

[nicolas-besnard]

I think there's work to do on the omniauth implementation. Currently, the gem use a strange HTML page with a redirection.

Ok, this is working for AngularJS, but you can't t use this with iOs or Android application. I've tried, and it end up creating my own Omniauth Controller.

Moreover, there's a lot a issue created with Omniauth as a cause.

To conclude, I think we should think about refactoring the Omniauth part of this gem;

[c0mrade]

+1

I'm having issues with with devise mappings which might be related (#166). Btw. would you mind sharing your implementation on a gist or somewhere?

[lynndylanhurley]

@nicolas-besnard - how would you suggest going about this?

[nicolas-besnard]

You'll find my implementation here. This is what I'm currently using in production. Work so far.

This is a simple modification of the existing Omniauth controller which is just rendering JSON instead of redirecting.

[lynndylanhurley]

Thanks @nicolas-besnard - I'll look into this tonight.

[nicolas-besnard]

I'm not sure it's the proper way to do it, it was just convenient to do it
that way because I was looking for a quick fix.
On Tue 10 Mar 2015 at 20:11 Lynn Dylan Hurley [email protected]
wrote:

Thanks @nicolas-besnard https://github.com/nicolas-besnard - I'll look
into this tonight.

—
Reply to this email directly or view it on GitHub
#175 (comment)
.

[lynndylanhurley]

@nicolas-besnard - what is the best way to provide tests for this? Will we need to create iOS + Android apps for the test suite?

[nicolas-besnard]

I already done this for iOs if you want to take a look

[lynndylanhurley]

Oh that's great! Thx 👍

[c0mrade]

What would be a downside of having a http header provided by requester?

For instance if a client provides some header i.e respond-with with json value, so that the json is rendered like in this example here, and if no header is present just use the default behavior present now (redirect).

[lynndylanhurley]

@c0mrade - I'll probably end up doing something like that.

[nicolas-besnard]

I still don't understand why this redirection exists ...

On Tue, Mar 10, 2015 at 9:39 PM Lynn Dylan Hurley [email protected]
wrote:

@c0mrade https://github.com/c0mrade - I'll probably end up doing
something like that.

—
Reply to this email directly or view it on GitHub
#175 (comment)
.

[nicolas-besnard]

When you are logged-in with Facebook, you can fetch an "access_token" from Facebook. I send it back to : /auth/facebook_access_token/callback.

You'll have to use the gem omniauth-facebook-access-token.

[nicolas-besnard]

I'd to reimplement my own omniauth controller to make it works. Has I said
previously, this gem isn't working on mobile device out of the box.

On Tue, Mar 31, 2015 at 1:14 PM [email protected] wrote:

@nicolas-besnard https://github.com/nicolas-besnard I used the gem that
you mentioned and I tried passing the "access_token" to
/auth/facebook_access_token/callback but it's directly going to the
omniauth_success method without an Auth hash. I can't figure out what's
wrong from the gem's readme.

Do you have sample code that I can take a look at to figure out what to do
next?

—
Reply to this email directly or view it on GitHub
#175 (comment)
.

[nicolas-besnard]

Yes, it's the one !

[nicolas-besnard]

You'll need to configure the omniauth-facebook-access-token gem

On Tue, Mar 31, 2015 at 1:38 PM [email protected] wrote:

@nicolas-besnard https://github.com/nicolas-besnard Thanks for helping
me out!

So this is what happened: I tried your code but when I send a request it
said The action 'redirect_callbacks' could not be found for
DeviseTokenAuth::OmniauthCallbacksController.

So I copied the 'redirect_callbacks' method from the original controller,
but the error now is Could not find devise mapping for path.

—
Reply to this email directly or view it on GitHub
#175 (comment)
.

[oscarbc96]

Hi, I have implemented the metod described by @nicolas-besnard commented on 10 Mar.

status = :ok
status = :created if @is_new_user 
render json: { user: @resource.as_json.merge(is_new_user: @is_new_user) }, status: status

I modified to that:

render json: { user: @resource.as_json.merge(is_new_user: @is_new_user), expiry: @expiry, client_id: @client_id, auth_token: @token}, status: status

And I don't know how to return securely the acces token, uid, expiry and client to make a request.
@lynndylanhurley have you make any progress of the implementation for native apps?

[Menghongli]

@nicolas-besnard, have you work it out how to allow user to login via omniauth-facebook-access-token gem?

I have tried to use omniauth-facebook-access-token, and send access-token back to /omniauth/facebook-access-token/callback

But I got this error said that request.env['omniauth.params'] is nil, in DeviseTokenAuth::OmniauthCallbacksController#redirect_callbacks

[chirag7jain]

@lynndylanhurley would a solution (pull request) working around @nicolas-besnard gist work

[booleanbetrayal]

@chirag7jain - I'm actually working with @nbrustein on some PRs for devise_token_auth as well as ng-token-auth what should resolve all these inAppBrowser OAuth issues. To give you a sense of the changes, you can see the commit against the ng-token-auth client code here: lynndylanhurley/ng-token-auth@40a7f08

[chirag7jain]

@booleanbetrayal how far are you on these changes?

I can help if needed but not on "angular / js" end

[booleanbetrayal]

@nbrustein and I should be finishing up the devise_token_auth work today. We'll leave the two changesets in PRs in respective projects for comments before merging into master.

[booleanbetrayal]

This just got merged as #323 which allows for client-specified OAuth flows (inAppBrowser, sameWindow, newWindow). Going to go ahead and close this but feel free to open new issues if needed Pushed as v0.1.33 btw!