Dr. Dobb's Journal - October 2008 - (Page 44)

D10weis_p5db 8/15/08 9:40 AM Page 44 Core Technology OPENID SINGLE SIGN-ON where openid_url is the name recommended for the HTML form element where users enter their identity URI. (In Rails, the blank? method returns True for either a nil value or empty string.) The other check, for a blank params[:open_id_complete] value, is needed because identity providers redirect back to this action after authentication is done with this complete flag set, but without the openid_url parameter. The failed_login method (Example 3) adds the error message to the response and renders the login form: authenticate_with_open_id(@openid _url, :required => [:email], :optional => [:dob, :fullname] ) do |result, identity_url, registration| This method, authenticate_with_open_id, is provided by the open_id_authentication plug-in you installed earlier. Simply pass in the identity URI entered by users and specify any required or optional fields, as well as a Ruby block that handles the result. The plug-in does the heavy lifting—it takes care of all communication with the identity provider. The required and optional fields used in this example—e-mail, date of birth, and full name—are a subset of those defined by the Simple Registration (“sreg”) extension, which gets some basic, commonly used information about users from their identity providers. Other sreg attributes include nickname, language, timezone, postcode, gender, and country. The method passes a result object, a clean version of the identity URI, and a hash of sreg attributes into the block: if result.successful? user = User.find_by_identity_url (identity_url) A successful result indicates that users have been authenticated. Find the user in your database by his identity URI (taking advantage of that index you added earlier): if user.nil? user = User.new user.identity_url = identity_url unless assign_registration_attributes(user, registration) return failed_login "Your OpenID registration failed: " + user.errors.full_messages.to_sentence end end def successful_login redirect_to :controller => 'welcome' end Example 6: Handling a successful login. OpenID 30 %> "Logging in…" %> If you didn’t find a user with the authenticated identity URI, create a new User object, set the identity URI, and assign any sreg attributes that were returned. Example 4 shows the method assign_registration_attributes; note that it saves the new User object to the database, performing any validation defined in the model: self.current_user = user successful_login Example 7: Login form. Your OpenID identity URL is . Example 8: Welcome! At this point, you have a valid user (either found or created). The user should have a session so that the application knows who he is when he submits another HTTP request. A common approach is to manage a current_user object in ApplicationController (Example 5). Reward the user’s successful login by calling successful_login (Example 6), which simply redirects to WelcomeController#index. Authentication can be unsuccessful for a variety of reasons, including an ActionController::Routing::Routes.draw do |map| map.login 'login', :controller => 'session', :action => 'new' map.logout 'logout', :controller => 'session', :action => 'destroy' # You can have the root of your site routed with map.root -# just remember to delete public/index.html. map.root :controller => 'welcome', :action => 'index' map.open_id_complete 'session', :controller => 'session', :action => 'create', :requirements => { :method => :get } map.resource :session # Install the default route as the lowest priority. map.connect ':controller/:action/:id.:format' map.connect ':controller/:action/:id' end Example 9: Routes. Figure 1: Login form. 44 Dr. Dobb’s Journal l www.ddj.com l October 2008 http://www.ddj.com

Table of Contents Feed for the Digital Edition of Dr. Dobb's Journal - October 2008

Dr. Dobb's Journal - October 2008 Contents Friday Night Fish Fry Alia Vox Developer Diaries Developer’s Notebook Is Your Next Language COBOL? Conversations Safe Coding Practices Code Signing in Adobe AIR OpenID Single Sign-On The Book Cipher Algorithm Indexing and Searching Image files Extending Continuous Integration Into ALM The Agile Edge Effective Concurrency Swaine’s Flames

Dr. Dobb's Journal - October 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.