Workbench authentication process » History » Version 7
Peter Amstutz, 11/15/2014 02:16 PM
1 | 1 | Peter Amstutz | h1. Workbench authentication process |
---|---|---|---|
2 | |||
3 | 4 | Peter Amstutz | # When the user goes to workbench, it checks for a session or @?api_token=xxx@ in the URL for the API token. If no API token is found, the user is directed to the workbench "welcome" page. |
4 | 1 | Peter Amstutz | # The "welcome" page has a "log in" button that directs the user to the API server login URL, with a @?return_to=xxx@ link embedded in the URL. |
5 | # The 'login' endpoint goes to @UserSessionsController#login@ in the API server. This redirects to @/auth/joshid?return_to=xxx@ |
||
6 | 5 | Peter Amstutz | # @/auth/joshid@ is intercepted by the "OmniAuth":https://github.com/intridea/omniauth Rack middleware and invokes the @josh_id@ OmniAuth strategy. |
7 | 2 | Peter Amstutz | ** The @josh_id@ OmniAuth strategy is implemented in @arvados/services/api/lib/josh_id.rb@ and is a subclass of @OmniAuth::Strategies::OAuth2@ |
8 | 1 | Peter Amstutz | # OmniAuth starts the "request_phase" of @OmniAuth::Strategies::OAuth2@. This redirects to @#{options[:custom_provider_url]}/auth/josh_id/authorize@ using CUSTOM_PROVIDER_URL defined in @arvados/services/api/config/initializers/omniauth.rb@ |
9 | 5 | Peter Amstutz | # In the sso-provider, @/auth/josh_id@ is routed to @AuthController#authorize@, and is intercepted by @before_filter :authenticate_user!@ (part of the "devise gem":https://github.com/plataformatec/devise) |
10 | 4 | Peter Amstutz | ** devise is configured at @sso-provider/config/initializers/devise.rb@ |
11 | 5 | Peter Amstutz | ** @authenticate_user!@ is not explicitly defined but instead monkey patched into the controller in @devise/lib/devise/controllers/helper.rb@ |
12 | 6 | Peter Amstutz | ** @authenticate_user!@ calls @warden.authenticate!@ where "warden":https://github.com/hassox/warden is yet another Rack authentication gem |
13 | ** @devise :omniauthable, :omniauth_providers => [:google]@ configures @sso-provider/app/models/user.rb@ |
||
14 | 7 | Peter Amstutz | # @AuthController#authorize@ creates an AccessGrant |
15 | 1 | Peter Amstutz | |
16 | h2. Questions |
||
17 | |||
18 | * What is workbench's "secret_token" for? |