rubycas/rubycas-server — pull request #155 by atyndall (2012-12-19 06:13:24+00:00)
Title: Add authenticator for a remote devise installation

I'm currently working on a project that requires a user to be able to authenticate to various Rails applications with the same credentials, and have a variety of account attributes be available globally.

The setup I initially came up with was:
* one Rails application with [Devise](https://github.com/plataformatec/devise) that acted as the "global user manager" -- It is there users can sign up for accounts, and edit their global account preferences, like their name, email address and avatar.
* a rubycas-server that used CASServer::Authenticators::SQLBcrypt -- It authenticated against the database managed by the "global user manager".
* Several "satellite" Rails apps using [devise_cas_authenticatable](https://github.com/nbudin/devise_cas_authenticatable) to point to the rubycas-server above.

This approach was fairly good, however it had its share of problems:
* It was a requirement of my "global user manager" Devise installation that users had to confirm their email address before they could login. Because the CAS server only verified that a user's password was correct, they would be able to successfully authenticate against the installation despite their email not being activated.
* The "global user manager" Devise installation also had incorrect password lockouts (i.e. entering the password wrong X amount of times would cause a lockout). The CAS server, again, was blind to this.
* Database entries tracking a user's last login time and last login IP would not be updated.

All of these problems were brought about by the fact that available CAS authenticators were too "dumb", authenticating against the database at too low a level.

Thus I present CASServer::Authenticators::RemoteDevise as a solution to this problem, based on the code in CASServer::Authenticators::Google.

This authenticator uses Devise's built in JSON login API to attempt to authenticate a user, and then pass back Devise's response to their login. This may very well be an "Invalid password" message, but it could also be a "You need to verify your account", "Your account has been locked out" or other message, depending on the configuration of the Devise installation in question.

This is a much more flexible approach than the currently available options, as it ensures that the login is passed through the Devise framework as any local login would be. It also has the advantage of not requiring database access, thus allowing the Devise installation to be at a remote location, accessible with HTTP or HTTPS. If for some reason the remote server isn't contactable, the end user will receive an error message saying "The remote login server is unavailable. (specific error details here)".

That, coupled with a couple of login template modifications with links like "Forgotten your password?", or "Didn't receive your confirmation email?" appropriate to the developer's specific needs, would make the CAS installation more seamless and user friendly in my situation.

Considering how I found none of rubycas-server's current approaches ideal in my situation, I though this authenticator might be worth including in the main distribution.