Question

I have 3 web apps – A, B and C. App A contains the user database. If accessing App B and App C, I would like the user to be redirected to App A to be authenticated, and then be returned back to whichever app they tried to access. At the same time, they should be logged in to all apps. Unless anyone has a better solution, I have gone with an OmniAuth/Devise combo solution as described in this blog post.

I have forked and updated to Rais 3.1.2 a sample App A and a sample app B/C.

App A – Provider – https://github.com/RobZolkos/sso-devise-omniauth-provider

App B/C – Client – https://github.com/RobZolkos/sso-devise-omniauth-client

These sample apps work, and I am get redirected to the Provider App to authenticate however it doesn’t seem to authenticate. I have attached the log here. The provider seems to go through the motions, but then on line 26 of the log you can see that there seems to be an authentication issue.

Am I missing something simple to make these sample apps work?

Answer 1

I’ve found two issues:

1. Since 0.2.1 version omniauth has changed auth parameter name from access_token to oauth_token while fetching access (POST /oauth/token request).
2. Since 0.3.0 version omniauth has changed method of passing oauth_token in auth request (GET /auth/josh_id/user.json). Prior 0.3.0 token have been passed through request parameter oauth_token, but since 0.3.0 it become passed through HTTP_AUTHORIZATION header.

I don’t know how to nicely get token from header (I think it can be fetched by devise), so I ugly hack client for sending oauth_token through GET parameter like this (in lib/josh_id.rb):

def raw_info
  @raw_info ||= access_token.get("/auth/josh_id/user.json?oauth_token=#{access_token.token}").parsed
end

You can find fully workable code in our github repos:

• https://github.com/openteam/sso-devise-omniauth-client
• https://github.com/openteam/sso-devise-omniauth-provider