OAuth, OpenID, and Rails - Oh My!
For work, I’m investigating some solutions to provide a consistent interface to a rather large and diverse collection of applications we’re running. All the applications require authentication and have different authorization levels. Many of these applications are Ruby on Rails Web applications. Others are written in ColdFusion. (And I’m sure there’s some PHP and J2EE apps floating around.)
We’d like to stick to developed standards as much as possible, mostly because rolling our own code and protocols would be risky and costly. (And, unless going our own way was the only option, it would also be stupid.) To that end, I’ve built a small proof-of-concept application suite that demonstrates integration of OpenID and OAuth. OpenID is used for authentication; OAuth is used to authorize Web services. The suite is built off the work of a lot of people:
In other words, I did pretty much zero work. Still, I haven’t seen something like this available on the Web, so I’m putting my stab at it up. Maybe someone will find it useful.
The code can be found at http://code.ninjawedding.org/oauth.git. (You’ll obviously need the git suite.) The OpenID + OAuth integration is in branch openid.
Like any quickly-produced demo, there’s a sequence of steps that one should follow to avoid hitting the dark corners of untested functionality. Be sure to read the WALKTHROUGH file in the source repository root.
Oh, and I welcome any comments on the sloppiness of this code. :P It was pretty hastily thrown together; although you can probably grok the basic concepts involved pretty quickly, I wouldn’t use this code in a production environment. (It was my first try. Always throw away the first try!)