Skip to content
Newer
Older
100644 140 lines (110 sloc) 6.11 KB
c6e8f8a @sferik Switch up Markdown syntax for headers [ci skip]
sferik authored Aug 19, 2011
1 # OmniAuth: Standardized Multi-Provider Authentication
aca30f3 Update README with 1.0 info
Michael Bleigh authored Sep 3, 2011
2
5d2c3de Update README
Michael Bleigh authored Oct 4, 2011
3 **NOTICE:** This documentation and code is for OmniAuth 1.0 in which
aca30f3 Update README with 1.0 info
Michael Bleigh authored Sep 4, 2011
4 each provider will become its own separate gem. If you're looking for
5 the current released version, please visit [OmniAuth 0.3 Stable
6 Branch](https://github.com/intridea/omniauth/tree/0-3-stable).
7
5d2c3de Update README
Michael Bleigh authored Oct 4, 2011
8 ## An Introduction
9
10 OmniAuth is a libary that standardizes multi-provider authentication for
11 web applications. It was created to be powerful, flexible, and do as
12 little as possible. Any developer can create **strategies** for OmniAuth
13 that can authenticate users via disparate systems. OmniAuth strategies
14 have been created for everything from Facebook to LDAP.
15
16 In order to use OmniAuth in your applications, you will need to leverage
17 one or more strategies. These strategies are generally released
18 individually as RubyGems, and you can see a [community maintained list](https://github.com/intridea/omniauth/wiki/List-of-Strategies)
19 on the wiki for this project.
20
78301c0 Add a bit of doc to Developer strategy.
Michael Bleigh authored Oct 16, 2011
21 One strategy, called `Developer`, is included with OmniAuth and provides
22 a completely unsecure, non-production-usable strategy that directly
23 prompts a user for authentication information and then passes it
da328e9 Bump to 1.0.0.beta1
Michael Bleigh authored Oct 18, 2011
24 straight through. You can use it as a placeholder when you start
25 development and easily swap in other strategies later.
78301c0 Add a bit of doc to Developer strategy.
Michael Bleigh authored Oct 16, 2011
26
27 ## Getting Started
5d2c3de Update README
Michael Bleigh authored Oct 4, 2011
28
29 Each OmniAuth strategy is a Rack Middleware. That means that you can use
30 it the same way that you use any other Rack middleware. For example, to
31 use the built-in Developer strategy in a Sinatra application I might do
32 this:
33
34 require 'sinatra'
35 require 'omniauth'
36
37 class MyApplication < Sinatra::Base
38 use Rack::Session
39 use OmniAuth::Strategies::Developer
40 end
41
42 Because OmniAuth is built for *multi-provider* authentication, I may
43 want to leave room to run multiple strategies. For this, the built-in
44 `OmniAuth::Builder` class gives you an easy way to specify multiple
45 strategies. Note that there is **no difference** between the following
46 code and using each strategy individually as middleware. This is an
47 example that you might put into a Rails initializer at
48 `config/initializers/omniauth.rb`:
49
50 Rails.application.config.middleware.use OmniAuth::Builder do
51 provider :developer unless Rails.env.production?
52 provider :twitter, ENV['TWITTER_KEY'], ENV['TWITTER_SECRET']
53 end
54
55 You should look to the documentation for each provider you use for
56 specific initialization requirements.
57
58 ## Integrating OmniAuth Into Your Application
59
60 OmniAuth is an extremely low-touch library. It is designed to be a
61 black box that you can send your application's users into when you need
62 authentication and then get information back. OmniAuth was intentionally
63 built not to automatically associate with a User model or make
64 assumptions about how many authentication methods you might want to use
65 or what you might want to do with the data once a user has
66 authenticated. This makes OmniAuth incredibly flexible. To use OmniAuth,
67 you need only to redirect users to `/auth/:provider`, where `:provider`
68 is the name of the strategy (for example, `developer` or `twitter`).
69 From there, OmniAuth will take over and take the user through the
70 necessary steps to authenticate them with the chosen strategy.
71
72 Once the user has authenticated, what do you do next? OmniAuth simply
73 sets a special hash called the Authentication Hash on the Rack
74 environment of a request to `/auth/:provider/callback`. This hash
75 contains as much information about the user as OmniAuth was able to
76 glean from the utilized strategy. You should set up an endpoint in your
77 application that matches to the callback URL and then performs whatever
78 steps are necessary for your application. For example, in a Rails app I
79 would add a line in my `routes.rb` file like this:
80
81 match '/auth/:provider/callback', to: 'sessions#create'
82
83 And I might then have a `SessionsController` with code that looks
84 something like this:
85
86 class SessionsController < ApplicationController
87 def create
b11bd38 Fix weird character in README
Michael Bleigh authored Oct 16, 2011
88 @user = User.find_or_create_from_auth_hash(auth_hash)
5d2c3de Update README
Michael Bleigh authored Oct 4, 2011
89 self.current_user = @user
90 redirect_to '/'
91 end
92
93 protected
94
95 def auth_hash
96 request.env['omniauth.auth']
97 end
98 end
99
100 The `omniauth.auth` key in the environment hash gives me my
101 Authentication Hash which will contain information about the just
102 authenticated user including a unique id, the strategy they just used
103 for authentication, and personal details such as name and email address
104 as available. For an in-depth description of what the authentication
105 hash might contain, see the [Auth Hash Schema wiki page](https://github.com/intridea/omniauth/wiki/Auth-Hash-Schema).
106
107 Note that OmniAuth does not perform any actions beyond setting some
108 environment information on the callback request. It is entirely up to
109 you how you want to implement the particulars of your application's
110 authentication flow.
111
112 ## Resources
113
114 The [OmniAuth Wiki](https://github.com/intridea/omniauth/wiki) has
115 actively maintained in-depth documentation for OmniAuth. It should be
116 your first stop if you are wondering about a more in-depth look at
117 OmniAuth, how it works, and how to use it.
118
119 ## License
120
121 Copyright (c) 2011 Intridea, Inc.
122
123 Permission is hereby granted, free of charge, to any person obtaining a
124 copy of this software and associated documentation files (the "Software"),
125 to deal in the Software without restriction, including without limitation
126 the rights to use, copy, modify, merge, publish, distribute, sublicense,
127 and/or sell copies of the Software, and to permit persons to whom the
128 Software is furnished to do so, subject to the following conditions:
129
130 The above copyright notice and this permission notice shall be included
131 in all copies or substantial portions of the Software.
132
133 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
134 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
135 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
136 THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
137 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
138 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
139 DEALINGS IN THE SOFTWARE.
Something went wrong with that request. Please try again.