module ExvoAuth::Controllers::Base

Public Instance Methods

auth_hash() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 85
def auth_hash
  request.env["omniauth.auth"]
end
authenticate_app_in_scope!(scope) click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 45
def authenticate_app_in_scope!(scope)
  raise("SSL not configured. Your api needs to be exposed using https protocol.") unless request.ssl? || Exvo::Helpers.auth_require_ssl == false

  send(basic_authentication_method_name) do |app_id, access_token|
    current_scopes = ExvoAuth::Autonomous::Provider.new(
      :app_id       => app_id,
      :access_token => access_token
    ).scopes

    @current_app_id = app_id

    current_scopes.include?(scope.to_s)
  end
end
authenticate_user!(opts = {}) click to toggle source

A before filter to protect your sensitive actions.

# File lib/exvo_auth/controllers/base.rb, line 3
def authenticate_user!(opts = {})
  unobtrusively_authenticate_user!

  if !signed_in?
    store_request!

    callback_value = params[callback_key]

    if callback_value
      redirect_to non_interactive_sign_in_path(callback_key => callback_value)
    else
      redirect_to opts[:redirect_to] || sign_in_path
    end
  end
end
callback_key() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 68
def callback_key
  "_callback"
end
current_app_id() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 77
def current_app_id
  @current_app_id
end
current_user() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 72
def current_user
  return @current_user unless @current_user.nil?
  @current_user = session[:user_uid] && find_or_create_user_by_uid(session[:user_uid])
end
handle_unverified_request() click to toggle source

CSRF protection for SSO (weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails/)

Calls superclass method
# File lib/exvo_auth/controllers/base.rb, line 90
def handle_unverified_request
  super
  sign_out_user
end
sign_in_and_redirect!() click to toggle source

Omniauth - Usually this method is called from your sessions#create.

# File lib/exvo_auth/controllers/base.rb, line 32
def sign_in_and_redirect!
  set_user_session_from_oauth
  set_user_cookie
  redirect_to session[:user_return_to] || "/"
end
sign_in_path() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 60
def sign_in_path
  "/auth/exvo"
end
sign_out_and_redirect!(return_to = "/") click to toggle source

Redirect to sign_out_url, signs out and redirects back to “/” (by default). Usuallly this method is called from your sessions#destroy.

# File lib/exvo_auth/controllers/base.rb, line 40
def sign_out_and_redirect!(return_to = "/")
  sign_out_user
  redirect_to sign_out_url(return_to)
end
sign_up_path() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 64
def sign_up_path
  "/auth/exvo?x_sign_up=true"
end
signed_in?() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 81
def signed_in?
  !!current_user
end
unobtrusively_authenticate_user!() click to toggle source

Single Sign On - Authenticate user from cookie if a cookie is present and delete local session if it’s not (this should prevent orphan session problem, when user signs out, but his session remains in one or more apps) unobtrusively means that there is no redirect to Exvo Auth if user is not logged in

# File lib/exvo_auth/controllers/base.rb, line 23
def unobtrusively_authenticate_user!
  if cookies[:user_uid]
    set_user_session_from_cookie
  else
    sign_out_user
  end
end

Protected Instance Methods

build_uri(prefix, params) click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 137
def build_uri(prefix, params)
  query = Rack::Utils.build_query(params)
  query.empty? ? prefix : "#{prefix}?#{query}"
end
find_or_create_user_by_uid(uid) click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 97
def find_or_create_user_by_uid(uid)
  raise "Implement find_or_create_user_by_uid in a controller"
end
non_interactive_sign_in_path(params = {}) click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 133
def non_interactive_sign_in_path(params = {})
  build_uri("/auth/exvo", params)
end
set_user_session_from_oauth() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 101
def set_user_session_from_oauth
  session[:user_uid] = auth_hash["uid"]
end
sign_out_url(return_to) click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 128
def sign_out_url(return_to)
  params = return_to ? { :return_to => return_to } : {}
  build_uri(Exvo::Helpers.auth_uri + "/users/sign_out", params)
end
sign_out_user() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 122
def sign_out_user
  session.delete(:user_uid)
  cookies.delete(:user_uid, :domain => Exvo::Helpers.sso_cookie_domain)
  remove_instance_variable(:@current_user) if instance_variable_defined?(:@current_user)
end
store_request!() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 142
def store_request!
  session[:user_return_to] = request.original_fullpath if request.get?
end
verifier() click to toggle source
# File lib/exvo_auth/controllers/base.rb, line 117
def verifier
  raise "ENV['SSO_COOKIE_SECRET'] is not set" if Exvo::Helpers.sso_cookie_secret.blank?
  @verifier ||= ActiveSupport::MessageVerifier.new(Exvo::Helpers.sso_cookie_secret)
end