Forum: Ruby on Rails Oauth2 workflow for sinatra + angular.js app

Announcement (2017-05-07): www.ruby-forum.com is now read-only since I unfortunately do not have the time to support and maintain the forum any more. Please see rubyonrails.org/community and ruby-lang.org/en/community for other Rails- und Ruby-related community platforms.
B39eadf04a0382f9d9ebd715669e53aa?d=identicon&s=25 Darek F. (darek_f)
on 2014-08-22 22:55
We want to build three example apps.

 1. sinatra oauth2 provider
 2. rails app with angular.js on frontend auhenticated through 1 app
 3. sinatra on backend and angular.js on frontend auhenticated through 1
app

Our Rails/Sinatra app will be authenticate users using [satelizer][1]
and our custom provider.

These is our **Oauth2** workflow right now.

1. Using Satellizer we get the authorization code from provider. We
send this code to our backend.

2. In backend using this authorization code, secret key and other
params, we send an request to provider to get an access token.
3. Using this obtain access token we call '/me' action to get an
uid,
email and other user attributes from provider.
 4. In the same action we parse the response body and we find or create
user based on uid.
 5. We are wondering about this step which should somehow set the user's
authentication token.
  - store the provider access token in user database record.
  - generate new authentication token and change it on every request
 6. Generate JWToken with user uid and token and send it back to
satellizer.
 7. Then on each request Satellizer include Bearer JWToken in header.
After recive request our backend verify header token stored in database
and call sing_in method in our case devise(sign_in, store: false) maybe
in sinatra app we will use warden.

What do you think about this concept? Maybe we are missing something.
These is our first **Oauth2** authentication implementation and we are
worried about it.

  [1]: https://github.com/sahat/satellizer
Fde839db701c9efdfb1b30823b9a2cc8?d=identicon&s=25 Robby O'Connor (Guest)
on 2014-08-22 22:59
(Received via mailing list)
Why not devise+omniauth?
B39eadf04a0382f9d9ebd715669e53aa?d=identicon&s=25 Darek F. (darek_f)
on 2014-08-22 23:00
I am not talking about tools but workflow. I want to understand what is
going on behind the scene.
This topic is locked and can not be replied to.