CSC/ECE 517 Spring 2015/ch1b 23 MS - Revision history

Mdong3: /* Other Rails Authentication */

2015-02-19T02:06:21Z

Other Rails Authentication

← Older revision		Revision as of 02:06, 19 February 2015
Line 206:		Line 206:

	==Other Rails Authentication==		==Other Rails Authentication==
	OmniAuth~~<ref>"https://github.com/intridea/omniauth"</ref>~~: A generalized Rack framework for multiple-provider authentication.<br>		OmniAuth: A generalized Rack framework for multiple-provider authentication.<br>
	Authlogic<ref>https://github.com/binarylogic/authlogic</ref>: A clean, simple, and unobtrusive ruby authentication solution.<br>		Authlogic<ref>https://github.com/binarylogic/authlogic</ref>: A clean, simple, and unobtrusive ruby authentication solution.<br>
	Restful-authentication<ref>https://github.com/technoweenie/restful-authentication</ref>: Generates common user authentication code for Rails/Merb, with a full test/unit and rspec suite and optional Acts as State Machine support built-in.<br>		Restful-authentication<ref>https://github.com/technoweenie/restful-authentication</ref>: Generates common user authentication code for Rails/Merb, with a full test/unit and rspec suite and optional Acts as State Machine support built-in.<br>

Mdong3: /* Omniauthable */

2015-02-19T01:26:51Z

Omniauthable

← Older revision		Revision as of 01:26, 19 February 2015
Line 109:		Line 109:
	<b>Example:</b> <br><pre>User.find(1).valid_password?('password123') # returns true/false </pre>		<b>Example:</b> <br><pre>User.find(1).valid_password?('password123') # returns true/false </pre>
	===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Omniauthable Omniauthable]===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Omniauthable Omniauthable]===
	Adds OmniAuth (https://github.com/intridea/omniauth) support.<br>		Adds OmniAuth <ref>https://github.com/intridea/omniauth</ref> support.<br>

	===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Confirmable Confirmable]===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Confirmable Confirmable]===
	Sends confirmation emails to Users following successful registration. This is to prevent bot registrations. <br>		Sends confirmation emails to Users following successful registration. This is to prevent bot registrations. <br>

Savidhal: /* [ http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Timeoutable Timeoutable] */

2015-02-19T00:41:23Z

[ http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Timeoutable Timeoutable]

← Older revision		Revision as of 00:41, 19 February 2015
Line 142:		Line 142:
	===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Trackable Trackable]===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Trackable Trackable]===
	Tracks login details for a specific user using log in count, last log in, IP address. These details help Site admin to investigate any unusual activity.<br>		Tracks login details for a specific user using log in count, last log in, IP address. These details help Site admin to investigate any unusual activity.<br>
	===[ http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Timeoutable Timeoutable]===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Timeoutable Timeoutable]===
	Expires sessions that have not been active in a specified period of time.<br>		Expires sessions that have not been active in a specified period of time.<br>

	===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Validatable Validatable]===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Validatable Validatable]===
	Provides validations of email and password to make sure that the log in details follow a given format. These can be modified to have customized validations.<br>		Provides validations of email and password to make sure that the log in details follow a given format. These can be modified to have customized validations.<br>

Savidhal: /* Devise Modules */

2015-02-19T00:41:01Z

Devise Modules

← Older revision		Revision as of 00:41, 19 February 2015
Line 104:		Line 104:

	==Devise Modules==		==Devise Modules==
	===Database Authenticatable===		Devise is composed of 10 modules that help Devise in providing user management functionality:
			===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/DatabaseAuthenticatable Database Authenticatable]===
	Ensures that the user has entered the correct password and also to encrypt and stores the password in the database when the user registers for the first time. The authentication can be done both through POST requests or HTTP Basic Authentication.<br>		Ensures that the user has entered the correct password and also to encrypt and stores the password in the database when the user registers for the first time. The authentication can be done both through POST requests or HTTP Basic Authentication.<br>
	<b>Example:</b> <br><pre>User.find(1).valid_password?('password123') # returns true/false </pre>		<b>Example:</b> <br><pre>User.find(1).valid_password?('password123') # returns true/false </pre>
	===Omniauthable===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Omniauthable Omniauthable]===
	Adds OmniAuth (https://github.com/intridea/omniauth) support.<br>		Adds OmniAuth (https://github.com/intridea/omniauth) support.<br>
	===Confirmable===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Confirmable Confirmable]===
	Sends confirmation emails to Users following successful registration. This is to prevent bot registrations. <br>		Sends confirmation emails to Users following successful registration. This is to prevent bot registrations. <br>
	<b>Example:</b> <br><pre>User.find(1).confirm! # returns true unless it's already confirmed		<b>Example:</b> <br><pre>User.find(1).confirm! # returns true unless it's already confirmed
	User.find(1).confirmed? # true/false		User.find(1).confirmed? # true/false
	User.find(1).send_confirmation_instructions # manually send instructions</pre>		User.find(1).send_confirmation_instructions # manually send instructions</pre>
	===Recoverable===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Recoverable Recoverable]===
	Resets the user password and sends reset instructions.<br>		Resets the user password and sends reset instructions.<br>
	<b>Example:</b> <br><pre># resets the user password and save the record, true if valid passwords are given, otherwise false		<b>Example:</b> <br><pre># resets the user password and save the record, true if valid passwords are given, otherwise false
Line 125:		Line 126:
	# creates a new token and send it with instructions about how to reset the password		# creates a new token and send it with instructions about how to reset the password
	User.find(1).send_reset_password_instructions </pre>		User.find(1).send_reset_password_instructions </pre>
	===Registerable===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Registerable Registerable]===
	Handles signing up users through a registration process, also allowing them to edit and destroy their account.<br>		Handles signing up users through a registration process, also allowing them to edit and destroy their account.<br>
	Helps user to register themselves and also to make changes to their login credentials including deleting their account.		Helps user to register themselves and also to make changes to their login credentials including deleting their account.
	===Rememberable===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Rememberable Rememberable]===
	Cookie handling module to manage generating and clearing of tokens for remembering the user.<br>		Cookie handling module to manage generating and clearing of tokens for remembering the user.<br>
	<b>Example :</b><pre>User.find(1).remember_me! # regenerating the token		<b>Example :</b><pre>User.find(1).remember_me! # regenerating the token
Line 139:		Line 140:
	User.serialize_from_cookie(cookie_string)</pre>		User.serialize_from_cookie(cookie_string)</pre>

	===Trackable===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Trackable Trackable]===
	Tracks login details for a specific user using log in count, last log in, IP address. These details help Site admin to investigate any unusual activity.<br>		Tracks login details for a specific user using log in count, last log in, IP address. These details help Site admin to investigate any unusual activity.<br>
	===Timeoutable===		===[ http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Timeoutable Timeoutable]===
	Expires sessions that have not been active in a specified period of time.<br>		Expires sessions that have not been active in a specified period of time.<br>
	===Validatable===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Validatable Validatable]===
	Provides validations of email and password to make sure that the log in details follow a given format. These can be modified to have customized validations.<br>		Provides validations of email and password to make sure that the log in details follow a given format. These can be modified to have customized validations.<br>
	<b>Example :</b><pre>#email_required? ⇒ Boolean protected		<b>Example :</b><pre>#email_required? ⇒ Boolean protected
	#password_required? ⇒ Boolean protected</pre>		#password_required? ⇒ Boolean protected</pre>
	===Lockable===		===[http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Lockable Lockable]===
	Locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.		Locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
	<br>		<br>

Savidhal: /* Example application */

2015-02-19T00:29:11Z

Example application

← Older revision		Revision as of 00:29, 19 February 2015
Line 152:		Line 152:
	<br>		<br>

	== Example application ==		== Example application <ref>http://www.gotealeaf.com/blog/how-to-use-devise-in-rails-for-authentication</ref>==
	Consider an application that can be accessed by an end user and a site admin. Since the admin would have extra priviledges, partitioned access would be required. This can be implemented by representing both types of users as seperate models and having their respective controller with appropiate actions.		Consider an application that can be accessed by an end user and a site admin. Since the admin would have extra priviledges, partitioned access would be required. This can be implemented by representing both types of users as seperate models and having their respective controller with appropiate actions.
	<pre>		<pre>
Line 190:		Line 190:
	</pre>		</pre>
	With this way specific controllers can have private methods. In this case, the private method checks if the user is an admin or not. Only if the user is an admin, can they access <i>AdminController</i> actions		With this way specific controllers can have private methods. In this case, the private method checks if the user is an admin or not. Only if the user is an admin, can they access <i>AdminController</i> actions


	==Rails-Devise-Pundit<ref>https://github.com/RailsApps/rails-devise-pundit</ref>==		==Rails-Devise-Pundit<ref>https://github.com/RailsApps/rails-devise-pundit</ref>==

Savidhal at 22:53, 18 February 2015

2015-02-18T22:53:48Z

← Older revision		Revision as of 22:53, 18 February 2015
Line 204:		Line 204:

	==Other Rails Authentication==		==Other Rails Authentication==
	OmniAuth<ref>["https://github.com/intridea/omniauth" ~~asd]~~</ref>: A generalized Rack framework for multiple-provider authentication.<br>		OmniAuth<ref>"https://github.com/intridea/omniauth"</ref>: A generalized Rack framework for multiple-provider authentication.<br>
	Authlogic<ref>https://github.com/binarylogic/authlogic</ref>: A clean, simple, and unobtrusive ruby authentication solution.<br>		Authlogic<ref>https://github.com/binarylogic/authlogic</ref>: A clean, simple, and unobtrusive ruby authentication solution.<br>
	Restful-authentication<ref>https://github.com/technoweenie/restful-authentication</ref>: Generates common user authentication code for Rails/Merb, with a full test/unit and rspec suite and optional Acts as State Machine support built-in.<br>		Restful-authentication<ref>https://github.com/technoweenie/restful-authentication</ref>: Generates common user authentication code for Rails/Merb, with a full test/unit and rspec suite and optional Acts as State Machine support built-in.<br>

Savidhal at 22:49, 18 February 2015

2015-02-18T22:49:01Z

Show changes

Mdong3: /* Omniauthable */

2015-02-18T22:04:52Z

Omniauthable

← Older revision		Revision as of 22:04, 18 February 2015
Line 91:		Line 91:
	<b>Example:</b> <br><pre>User.find(1).valid_password?('password123') # returns true/false </pre>		<b>Example:</b> <br><pre>User.find(1).valid_password?('password123') # returns true/false </pre>
	====Omniauthable====		====Omniauthable====
	Adds OmniAuth (https://github.com/intridea/omniauth) support.<br>		Adds OmniAuth <ref>https://github.com/intridea/omniauth</ref> support.<br>

	====Confirmable====		====Confirmable====
	Sends confirmation emails to Users following successful registration. This is to prevent bot registrations. <br>		Sends confirmation emails to Users following successful registration. This is to prevent bot registrations. <br>

Mdong3 at 22:03, 18 February 2015

2015-02-18T22:03:33Z

@@ Line 17: / Line 17: @@
 Logout: allow the user to sign out and set the authenticated userID in session file to nil.
-== Getting Started ==
+== Devise ==
-===Devise===
+===Devise introduction===
 Devise is a flexible authentication solution for Rails helping developers save  time and effort while implementing authentication mechanisms from start. User authentication is a major component of most of the web applications, primarily to determine if the user is in fact, who it is declared to be. Devise is based on Warden<ref>https://github.com/hassox/warden/wiki</ref>. (Customized [https://github.com/rack/rack Rack] middleware that provides authentication for rack applications). Rack can be considered a middleware between web server such as Mongreal, WEBrick and frameworks such as Rails, Sinatra. <br>
 Current Version: 3.4.1<br>
@@ Line 85: / Line 85: @@
 ====user_session====
 This method returns metadata regarding the logged in user.
 == Example applications ==

Mdong3: Created page with "Devise
'''Devise https://github.com/plataformatec/devise''' is a Rails gem used for authenticating and managing users. The topic wr..."

2015-02-17T16:53:06Z

Created page with "Devise '''Devise <ref>https://github.com/plataformatec/devise</ref>''' is a Rails gem used for authenticating and managing users. The topic wr..."

New page

Devise 

'''Devise <ref>https://github.com/plataformatec/devise</ref>''' is a Rails gem used for authenticating and managing users.

The topic write up for this page can be found [https://docs.google.com/a/ncsu.edu/document/d/1Ay5OOUkcLMC-FH61fAm3cNvB3Uyk2hJ09vHnRgqwL-k/edit here].

== Introduction ==
=== Security Background===
Web applications are relatively easy to attack, as they are simple to understand and manipulate. The Gartner Group estimates that 75% of attacks are at the web application layer, and found out "that out of 300 audited sites, 97% are vulnerable to attack"<ref>http://www.primeon.com/press/article001.php</ref>.Security depends on the people using the framework, and sometimes on the development method.
There are several ways to ensure security: Encryption, LDAP, Rails Authentication, Rails Authorization, Rails Captcha, Security Tools and Spam Detection. And devise is for Rails Authentication.

===User Authentication ===
how the user authentication process works.
Signup: create a new user. This user is going to register with a username, password (which will be encrypted in the database), email, etc.
Login: allow a user to sign in with her/his valid username and password. The authentication process happens by matching the username and password in the database, allowing the user access to the protected actions only if the given information matches the recorded values successfully. If not, the user will be redirected to the login page again.
Access Restriction: create a session to hold the authenticated user ID after login, so navigation through additional protected actions can be done easily by just checking the userID in the current session.
Logout: allow the user to sign out and set the authenticated userID in session file to nil.

== Getting Started ==
===Devise===
Devise is a flexible authentication solution for Rails helping developers save time and effort while implementing authentication mechanisms from start. User authentication is a major component of most of the web applications, primarily to determine if the user is in fact, who it is declared to be. Devise is based on Warden<ref>https://github.com/hassox/warden/wiki</ref>. (Customized [https://github.com/rack/rack Rack] middleware that provides authentication for rack applications). Rack can be considered a middleware between web server such as Mongreal, WEBrick and frameworks such as Rails, Sinatra. 
Current Version: 3.4.1 
First Release: 5 years ago 
===Setup Devise===
Once you have created a Rails app using the "rails new <app name>" command we first need to add a line to the "Gemfile" using the following command:
<pre>echo "gem 'devise'" >> Gemfile</pre> 
And then install the gem using:
<pre>bundle install</pre>
The Gem will be installed for your rails application. Then run the following commands:
<pre>
rails generate devise:install
</pre>
To create config files. 

<pre>
rails generate devise user
</pre>
To create model(User) class and routes and to also associate the 'User' model with 'Devise'. 
 
<pre>
rake db:migrate
</pre>
To run the migration and create the table with certain fields appropriate for user authentication. The result should be something like:
<pre>
== 20150217043439 DeviseCreateUsers: migrating ================================
-- create_table(:users)
-> 0.0178s
-- add_index(:users, :email, {:unique=>true})
-> 0.0010s
-- add_index(:users, :reset_password_token, {:unique=>true})
-> 0.0055s
== 20150217043439 DeviseCreateUsers: migrated (0.0255s) =======================
</pre>
 
<pre>
rails generate devise:views users
</pre>To create the directory /app/views/users with all the devise views, such as login form, registration form .
===Devise Methods===
Devise provides classes, models, views, controllers, views, helpers, routes. However, these functionality are exposed in only a small number of helper methods, not all of these components would be required to know. Some of the important Devise helper methods provided are:
 
====authenticate_user!====
The authenticate_user! method is a class method that can be called from a controller only. The method determines if the user has access to all or a specific set of controller actions. This method is invoked via a before_filter, for example: 
<pre>
class UsersController < ApplicationController
before_filter :authenticate_user!
end
</pre>
 to make make any exceptions for accessing any actions without authentications we can update the above statement as:
<pre>
before_action :authenticate_user!, except: [:show]
</pre>
In the above example, user authentication would be required to call any actions in the controller except the show action.
So if the root in the <pre>config/routes.rb</pre> field is set to obtain any view belonging to the UsersController in this case, the Sign in page will be loaded before any of the actions can be accessed. Once the user is authenticate, the required action is obtained.

====current_user====
The current_user method is used to return the model class to whom the signed in user belongs. The method returns nil if a user has not yet signed in.
The <authenticate_user!> will make sure that the current_user method would never return nil. 
====user_signed_in?====
Checks if the current_user method returns a non nil value. 

====sign_in(@user) and sign_out(@user)====
The sign_in(@user) and the sign_out(@user) are useful to login or logout a newly created user.
 

====user_session====
This method returns metadata regarding the logged in user.

== Example applications ==
=== Devise and Rails<ref>https://github.com/RailsApps/rails-devise/</ref> ===
Rails 4.2 starter app with Devise for authentication.
====What is implemented====
• Home page 
• Navigation bar 
• Sign up (create account) 
• Login 
• “Forgot password?” feature 
• “Remember me” (stay logged in) feature 
• Edit account (edit user profile) 
• List of users 
==== Installing ====
To build the example application, run:
<pre>rails new rails-devise -m https://raw.github.com/RailsApps/rails-composer/master/composer.rb</pre>
This will create a Rails app named <code>rails-devise</code>. 
Then, select “Build a RailsApps example application”. After that, select”6) rails-devise”. 
As for additional preferences: 
• If you plan to deploy to Heroku, select “Unicorn" as your production web server. 
• Use “SQLite" for development on Mac or Linux. If you plan to deploy to Heroku, use “PostgreSQL" 
• The example application uses the default “ERB” Rails template engine. 
• If you are a beginner, for test framework, select “None”. 
• if you choose either “Foundation" or “Bootstrap", it will automatically install Devise views with attractive styling. 
• “Gmail" is for development if you have one. if your site will be heavily used, then choose “SendGrid" or “Mandrill" for production. 
• The example uses "Devise with default modules". 

===Devise and Pundit and Rails<ref>https://github.com/RailsApps/rails-devise-pundit</ref>===
It extends the rails-devise example application to add authorization with Pundit.
====What is implemented====
It adds authorization with Pundit, showing how to implement user roles, and limit access to pages based on user role. 
• an admin can see a list of users 
• an admin can change a user’s role 
• an ordinary user can’t see a list of users 
• an ordinary user can’t change their role 
• an ordinary user can’t see (or edit) another user’s profile 
• an ordinary user can see (and edit) their own user profile 

====Installing====
To build the example application, run:
<pre>rails new rails-devise-pundit -m https://raw.github.com/RailsApps/rails-composer/master/composer.rb</pre>
This will create a new Rails app named <code>rails-devise-pundit</code>. 
Then, select “Build a RailsApps example application”. After that, select ”8) rails-devise-pundit”. 
The following steps are the same as Devise and Rails.

==other Rails Authentication==
OmniAuth<ref>https://github.com/intridea/omniauth</ref>: A generalized Rack framework for multiple-provider authentication. 
Authlogic<ref>https://github.com/binarylogic/authlogic</ref>: A clean, simple, and unobtrusive ruby authentication solution. 
Restful-authentication<ref>https://github.com/technoweenie/restful-authentication</ref>: Generates common user authentication code for Rails/Merb, with a full test/unit and rspec suite and optional Acts as State Machine support built-in. 

==Conclusion==
Devise is the most popular Rails Authentication tools. It provides a full gamut of features, and can be configured to meet most requirements. Devise often interacts with Warden which does not provide helper methods, controller classes, views, configuration options and log in failure handling. All of these things are what Devise supplies. So if you need to extend or augment Devise, you may need to implement a customized Strategy class for your own.
== References ==
<references/>

CSC/ECE 517 Spring 2015/ch1b 23 MS - Revision history

Mdong3: /* Other Rails Authentication */

Mdong3: /* Omniauthable */

Savidhal: /* [ http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Timeoutable Timeoutable] */

Savidhal: /* Devise Modules */

Savidhal: /* Example application */

Savidhal at 22:53, 18 February 2015

Savidhal at 22:49, 18 February 2015

Mdong3: /* Omniauthable */

Mdong3 at 22:03, 18 February 2015

Mdong3: Created page with "Devise '''Devise https://github.com/plataformatec/devise''' is a Rails gem used for authenticating and managing users. The topic wr..."

Mdong3: Created page with "Devise
'''Devise https://github.com/plataformatec/devise''' is a Rails gem used for authenticating and managing users. The topic wr..."