cloudspokes/cs-website-cms — pull request #4 by parasquid (2012-12-03 14:18:54+00:00)
Title: add omniauth for devise with providers github, twitter, facebook, and go...

Deployment Guide (not sure where to put this in)

First thing's first, you'd need to create applications in Facebook, Twitter and Github:

https://developers.facebook.com/apps --> Create New App
https://dev.twitter.com/apps/new
https://github.com/settings/applications/new

Google OpenID doesn't need an application to be registered with

Callback url should be in the form of /users/auth/:action/callback (where :action is replaced by either facbeook twiitter github google)

The OAuth secrets and keys should reside in environment variables. This is more secure than committing the keys and secrets to the repository. See https://devcenter.heroku.com/articles/config-vars

Here's how to set them in heroku:

heroku config:set FB_KEY=asdfadsfadsfadsf
heroku config:set TWITTER_KEY=asdfadsfadsfadsf
heroku config:set GITHUB_KEY=asdfadsfadsfadsf
heroku config:set FB_SECRET=asdfadsfadsfadsf
heroku config:set TWITTER_SECRET=asdfadsfadsfadsf
heroku config:set GITHUB_SECRET=asdfadsfadsfadsf

I'd recommend to make a small script that sets these vars in development so that when you do rails s the environment vars will be set. Alternatively you can also use Foreman (which I haven't done due to lack of time) which does mostly the same thing. Some more ideas here: https://devcenter.heroku.com/articles/config-vars#local-setup

Issues:

This is a minimal omniauth devise integration and there are a few issues I can see. For example:

* Twitter and Github does not provide the email address in the OAuth response. For now I just created my own pseudo-email address consisting of the uid@provider.com -- this isn't ideal if we're to rely on the email to contact the user. We might need to either require a second screen to enforce filling in of email, or add the ability to edit the profile in the future.
* Users that have accounts in two or more oauth providers are currently created as separate users. Later on there should be a way to merge user accounts.
* The email column is created as unique, so in the case of Facebook and OpenID, if one signs up with Facebook, one cannot sign up with google openid anymore. Later on there should be code where it's possible to reauthenticate with either of these providers and link the accounts together. Perhaps by creating a separate authentications table we can mitigate this, but then the problem with twtter and github not providing email crops up. I'd prefer we solve first the twitter/github email requirement, then we can separate the authentication from the user account (with the assumption that the same email address means the same user account).