Stake Ventures

Install the plugin

This plugin currently requires Rails 2. If someone would like to make it Rails 1.2 compatible. Please feel free to submit patches.

NEW First install the oauth gem:

sudo gem install oauth

Then install the plugin:

script/plugin install http://oauth-plugin.googlecode.com/svn/trunk/oauth_plugin

You also need an authentication plugin that is compatible with acts_as_authenticated, restful_authentication or restful_openid_authentication.

Lets create your provider

The generator is not very flexible at the moment. So it doesn’t really allow you to change names for models and controllers.

Type:

script/generate oauth_provider

This creates OauthController and a few different models.

Until I figure out how to do this automatically you need to enter the following into your routes.rb

map.oauth '/oauth',:controller=>'oauth',:action=>'index'
map.authorize '/oauth/authorize',:controller=>'oauth',:action=>'authorize'
map.request_token '/oauth/request_token',:controller=>'oauth',:action=>'request_token'
map.access_token '/oauth/access_token',:controller=>'oauth',:action=>'access_token'
map.test_request '/oauth/test_request',:controller=>'oauth',:action=>'test_request'

You also need to add a few associations to your user object:

has_many :client_applications
has_many :tokens, :class_name=>"OauthToken",:order=>"authorized_at desc",:include=>[:client_application]

Now run your migrations and start your server:

rake db:migrate
script/server

And your oauth provider is now up and running on http://localhost:3000/oauth to start registering a client application.

Protect your actions

I recommend that you think about what your users would want to provide access to and limit oauth for those only. For example in a CRUD controller you may think about if you want to let consumer applications do the create, update or delete actions. For your application this might make sense, but for others maybe not.

If you want to give oauth access to everything a registered user can do, just replace the filter you have in your controllers with:

before_filter :login_or_oauth_required

If you want to restrict consumers to the index and show methods of your controller do the following:

before_filter :login_required,:except=>[:show,:index]
before_filter :login_or_oauth_required,:only=>[:show,:index]

If you have an action you only want used via oauth:

before_filter :oauth_required

All of these places the tokens user in current_user as you would expect.

Please bear in mind this is still early days and their maybe some major bugs and or changes coming. But please help me test the code.

There are also 2 other implementations:

• Choon Keat’s OAuth4R which is a rails plugin for both creating providers and consumers. Choon and I are talking about how we can merge things.
• Blaine’s original OAuth. This is the original ruby library as used at Twitter. It is not very well documented at the time of writing and consists mainly of base ruby library instead of full Rails integration. Have a look at it, it may suit you.