1

I want to build three example apps. One will be a sinatra oauth2 provider and second will be rails app with angular.js on frontend and rails on backend and third with sinatra on backend and angular.js on frontend.

Our Rails/Sinatra app will be authenticate users using satelizer and our custom provider.

These is our Oauth2 workflow right now.

  1. Using Satellizer we get the authorization code from provider. We send this code to our backend.
  2. In backend using this authorization code, secret key and other params, we send an request to provider to get an access token.
  3. Using this obtain access token we call '/me' action to get an uid, email and other user attributes from provider.
  4. In the same action we parse the response body and we find or create user based on uid.
  5. We are wondering about this step which should somehow set the user's authentication token.
    • store the provider access token in user database record.
    • generate new authentication token and change it on every request
  6. Generate JWToken with user uid and token and send it back to satellizer.
  7. Then on each request Satellizer include Bearer JWToken in header. After recive request our backend verify header token stored in database and call sing_in method in our case devise(sign_in, store: false) maybe in sinatra app we will use warden.

What do you think about this concept? Maybe we are missing something. These is our first oauth2 authentication implementation and we are worried about it.

tomekfranek
  • 6,852
  • 8
  • 45
  • 80
  • https://developers.box.com/oauth/ almost the same happend here – Bartek S Aug 24 '14 at 16:25
  • http://stackoverflow.com/a/13016081/766633 and here they use jwt token from google.... – Bartek S Aug 24 '14 at 16:31
  • https://developers.google.com/accounts/docs/OAuth2Login and google say that in bearer token we should send only auth_token and not all user info like name e-mail or others – Bartek S Aug 24 '14 at 16:40
  • Here is nice pictures with flow close to our https://developers.google.com/+/web/signin/server-side-flow – Bartek S Aug 24 '14 at 16:44
  • Hi, this is an interesting question... but sadly doesn't fit the stack overflow pattern :( Here we expect specific, technical questions with one right answer. In the past we allowed open-ended questions (like "what do you think about X") but these led to sometimes quite heated discussions/flame wars and they tore apart the community... so now we have very specific requirements. :( It's not that this is a bad question... just not a good fit for the main stack overflow site. – Taryn East Dec 14 '15 at 06:35

0 Answers0