NB: This presentation was delivered at the Singapore Ruby Brigade meetup 7-Oct-2009 (hosted at wego.com)

Some things should just be banned on the interwebs..

.. pointless social “applications” ..

.. pointless social “applications” ..

.. twitter celebs ..

.. twitter celebs ..

.. custom login screens!

.. custom login screens!

What’s so bad about that? Security Proliferation of credentials unavoidably leads to greater risks Do sites hash my password? PITA Redundant entry of registration details Validation emails.. aargh! Code bloat: reset/forgot password flows Site developer’s need to be (should be!) security experts Enterprise clients Ideally want your site to treat employees as “verified employees” not just part of the madding crowd Public sites: still in its infancy. Belief: before long, enterprises will clue in to this, and be “exporting” corporate credentials for use on the web. If your site supports this, you can win big.

Security

Proliferation of credentials unavoidably leads to greater risks

Do sites hash my password?

PITA

Redundant entry of registration details

Validation emails.. aargh!

Code bloat: reset/forgot password flows

Site developer’s need to be (should be!) security experts

Enterprise clients

Ideally want your site to treat employees as “verified employees” not just part of the madding crowd

Public sites: still in its infancy. Belief: before long, enterprises will clue in to this, and be “exporting” corporate credentials for use on the web. If your site supports this, you can win big.

End of days for “own the user identity”? Consumers: already have (multiple) “identities” Hypothesis: these days a reasonable assumption Why should I jump thru hoops to create another just so I can try your site? Businesses: don’t really want their employees creating new “identities” on your site if it is for business purposes Compliance – no control or visibility of what employees are doing or information they are creating Data ownership – what happens when the employee leaves?

Consumers: already have (multiple) “identities”

Hypothesis: these days a reasonable assumption

Why should I jump thru hoops to create another just so I can try your site?

Businesses: don’t really want their employees creating new “identities” on your site if it is for business purposes

Compliance – no control or visibility of what employees are doing or information they are creating

Data ownership – what happens when the employee leaves?

Or “Why authentication and identity management is still worth talking about”

Authorisation Options

Sometimes there’s no choice No internet access Legacy accounts Special purpose Admin or test users for example Internal (username / password)

Sometimes there’s no choice

No internet access

Legacy accounts

Special purpose

Admin or test users for example

LDAP/AD Intranet applications Legacy directories

Supports many providers , which don’t need to be known ahead of time Consumer adoption has been relatively slow, although many users now have an OpenID (via Yahoo or Google) even though they don’t know this! Criticised for being a little too “technical” for the average web citizen(!)

Supports many providers , which don’t need to be known ahead of time

Consumer adoption has been relatively slow, although many users now have an OpenID (via Yahoo or Google)

even though they don’t know this!

Criticised for being a little too “technical” for the average web citizen(!)

OAuth Must tie to a specific provider ahead of time Also used as the basis of OpenSocial signed requests Great if you just want to target a specific community (e.g. build a twitter app)

A single-sign-on solution for web sites Abstracts the authentication provider – you can support as many as JanRain support Normalizes profile settings across providers (i.e. “email” is always “email”) RPX by JanRain

SAML – WS* security mainly enterprise use, but now gaining some attention via openSSO 2FA/3FA solutions – provider specific or custom integrated Many others..

Authentication options in Rails Internal (username/password) LDAP/AD RPX by JanRain Many others.. OAuth Acts_as_authenticated Restful_authentication Clearance Twitter_oauth Openid_authentication ActiveLDAP acts_as_ldpa_authenticated Ruby Net-LDAP Rpx_now … Ruby oauth OpenID

Or Authlogic Internal (username/password) LDAP/AD RPX by JanRain Many others.. OAuth Authlogic-oauth Authlogic-ldap Authlogic-oid Authlogic_rpx Authlogic (base) Authlogic plugin X Or use Authlogic “ unobtrusive authentication” No generator crud Smells like ActiveRecord Plugin architecture

Using Authlogic_RPX

RPX Request Model Link to sign-in ..chatter.. ..chatter.. Post:token Verify:token (returns:profile info)

Authlogic_RPX-on-a-page

Enabling Authlogic_RPX See the Authlogic RPX README for full details. It walks you through the steps for enabling Authlogic RPX: Enable RPX for your user model Add RPX configuration for the Authlogic session model Add custom user profile mapping (optional) Add application controller helpers: current_user, current_user_session Setup the Authlogic session controller Setup the Authlogic user controller Use view helpers to provide login links Allow users to "Add RPX" to existing accounts (optional) In this presentation, we’ll touch on some of the main points…

See the Authlogic RPX README for full details. It walks you through the steps for enabling Authlogic RPX:

Enable RPX for your user model

Add RPX configuration for the Authlogic session model

Add custom user profile mapping (optional)

Add application controller helpers: current_user, current_user_session

Setup the Authlogic session controller

Setup the Authlogic user controller

Use view helpers to provide login links

Allow users to "Add RPX" to existing accounts (optional)

In this presentation, we’ll touch on some of the main points…

Register your RPX app Register your application at http://rpxnow.com – set it’s name and be assigned an API key, and select/configure the authentication providers: Note: max 6 providers with the free RPX account

Register your application at http://rpxnow.com – set it’s name and be assigned an API key, and select/configure the authentication providers:

Configure your project In config/environment.rb – Set the RPX app name and API key: Configure gems: $ rake gems:install Once setup, using Authlogic_RPX is almost identical to standard Authlogic

In config/environment.rb –

Set the RPX app name and API key:

Configure gems:

$ rake gems:install

Once setup, using Authlogic_RPX is almost identical to standard Authlogic

Two MVCs: session and user Minimal models: Simple helpers you define and control: current_user require_user (e.g. for before_filter)

Minimal models:

Simple helpers you define and control:

current_user

require_user (e.g. for before_filter)

Controllers – clean and sweet

[:post] create – this is a user “signing in” Session controller All this is optional branching logic, which you can tailor specifically for your application successful save means authentication OK!

[:delete] destroy – this is a user “signing out” Session controller

Access controls: Registration form (optional): Save registration (optional): Edit my profile: Show my profile: Save my profile: User controller Note: sample is a controller that only lets users access their own information, but you can just as easily adapt this so they can list and see the public profile information of other users too.

Auto registration Authlogic_RPX will “register” new users by default. For users this is great: registration is no more difficult than logging in. You can disable this in the session model:

Authlogic_RPX will “register” new users by default.

For users this is great: registration is no more difficult than logging in.

You can disable this in the session model:

UserSession model – profile mapping When users auto-register, profile data from RPX is available to be inserted in the user's record on your site. Authlogic_rpx will map the username and email fields by default. If you have other fields you want to map, you can provide your own implementation of the map_rpx_data method in the UserSession model

When users auto-register, profile data from RPX is available to be inserted in the user's record on your site.

Authlogic_rpx will map the username and email fields by default.

If you have other fields you want to map, you can provide your own implementation of the map_rpx_data method in the UserSession model

UserSession model – profile mapping

UserSession model – profile mapping WARNING: any fields you map should NOT have constraints enforced at the database level. Authlogic_rpx will optimistically attempt to save the user record during registration, and violating a db constraint will cause the authentication/ registration to fail. You can/should enforce any required validations at the model level. This will allow the auto-registration to proceed, and the user can be given a chance to rectify the validation errors on your user profile page If it is not acceptable in your application to have user records created with potential validation errors in auto-populated fields, you will need to override map_rpx_data and implement whatever special handling makes sense in your case.

WARNING: any fields you map should NOT have constraints enforced at the database level.

Authlogic_rpx will optimistically attempt to save the user record during registration, and violating a db constraint will cause the authentication/ registration to fail.

You can/should enforce any required validations at the model level. This will allow the auto-registration to proceed, and the user can be given a chance to rectify the validation errors on your user profile page

If it is not acceptable in your application to have user records created with potential validation errors in auto-populated fields, you will need to override map_rpx_data and implement whatever special handling makes sense in your case.

RPX – the catch (or: why you might want to buy their pro service) Today I sign-in with Tomorrow I use these aren’t the same identities! Need identity mapping! Only RPX paid options support “identity mapping” Currently not implemented in Authlogic_RPX Note: RPX does try to “remember” the last service you used, but this is not guaranteed

Need identity mapping!

Only RPX paid options support “identity mapping”

Currently not implemented in Authlogic_RPX

Note: RPX does try to “remember” the last service you used, but this is not guaranteed

Try it out Live Demonstration Site: rails- authlogic-rpx-sample.heroku.com Demonstration site source repository: github.com/tardate/rails-authlogic-rpx-sample

Live Demonstration Site:

rails- authlogic-rpx-sample.heroku.com

Demonstration site source repository:

github.com/tardate/rails-authlogic-rpx-sample

Take-aways Getting authentication right is critical for your site’s success Lower the barrier-to-entry for consumer/personal users. Eliminate the need to create redundant “identities”! Business sites – make it possible for employees to use business identities “exported” via OpenID (for example), without the need for a specific agreement and integration to be in place 3

Getting authentication right is critical for your site’s success

Lower the barrier-to-entry for consumer/personal users. Eliminate the need to create redundant “identities”!

Business sites – make it possible for employees to use business identities “exported” via OpenID (for example), without the need for a specific agreement and integration to be in place

Take-aways Authlogic – leading authentication framework for rails (IMHO) Best even if you just want to do traditional username/password Unobtrusive Makes it easy to switch or add authentication options in future One framework to learn – plugin the most suitable authentication method for each specific project 2

Authlogic – leading authentication framework for rails (IMHO)

Best even if you just want to do traditional username/password

Unobtrusive

Makes it easy to switch or add authentication options in future

One framework to learn – plugin the most suitable authentication method for each specific project

Take-aways Authlogic_RPX – takes away the pain Support diverse identity providers Standard Authlogic - nothing special to do except plug in your API key Can be used as “RPX only”, or co-exist with standard Authlogic username/password Use it for: Public sites + you just need authentication services + want to give users the best opportunity to use existing credentials. 1

Authlogic_RPX – takes away the pain

Support diverse identity providers

Standard Authlogic - nothing special to do except plug in your API key

Can be used as “RPX only”, or co-exist with standard Authlogic username/password

Use it for:

Public sites + you just need authentication services + want to give users the best opportunity to use existing credentials.

Thank you! Questions? 0

Questions?

Some References Authlogic: http://github.com/binarylogic/authlogic Authlogic_RPX: http://github.com/tardate/authlogic_rpx RPX: http:// rpxnow.com OpenID: http://openid.net OAuth: http://oauth.net Singapore Ruby Brigade (SRB): http://groups.google.com/group/singapore-rb

Authlogic: http://github.com/binarylogic/authlogic

Authlogic_RPX: http://github.com/tardate/authlogic_rpx

RPX: http:// rpxnow.com

OpenID: http://openid.net

OAuth: http://oauth.net

Singapore Ruby Brigade (SRB): http://groups.google.com/group/singapore-rb