Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

multiple oauth providers won't work at the same time #1

Open
roman opened this issue Jun 7, 2010 · 1 comment
Open

multiple oauth providers won't work at the same time #1

roman opened this issue Jun 7, 2010 · 1 comment

Comments

@roman
Copy link
Owner

roman commented Jun 7, 2010

(As noted by Steven Parkes)

I'm using warden_oauth against both twitter and linkedin (in the context for devise, if that matters).

The problem I'm coming up against is that when I get the redirect back from the oauth provider, it again goes through all the strategies. The authenticate! for each strategy sees that it has the right URL parameter and goes on to do the find_user_by_access_token. But if the auth is through the second provider, this is wrong when checking the first provider, and it errors out because it's getting the wrong token.

Does that makes sense? The summary is that multiple oauth strategies have to be able to differentiate themselves.

Not sure the best way to do this. I could have different callback URLs, but that's getting overridden in #request_token right now.

I can hack it, but I'm wondering what you thought the best approach would be.

@roman
Copy link
Owner Author

roman commented Jun 7, 2010

As I see it, the authenticate! method of service A shouldn't be called at all when you are authenticating via the service B. This should be avoided on the valid? method.

As I see this is not being covered on the specs nor on the code. We will have to do this:

  1. Add a spec that has 2 services registered and check that each of them is being called successfully when using them.

The way we are going to do this is:

  1. Add an Application Parameter on the get_request_token and get_access_token invocations that identifies each strategy uniquely, so that the valid? method can check which service is being called.

Probably we could use the same warden_oauth_provider parameter and dish the oauth_token verification from the valid? method altogether.

Something like:

def valid?

(params.include?('warden_oauth_provider') && params['warden_oauth_provider'] == config.provider_name.to_s)

end

#...

def authenticate!
if params.include?('oauth_token')

load_request_token_from_session

#...

else

store_request_token_on_session

#...

end

#...

def request_token

host_with_port = Warden::OAuth::Utils.host_with_port(request)

@request_token ||= consumer.get_request_token({:oauth_callback => host_with_port}, :warden_oauth_provider => config.provider_name.to_s)

end

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant