0

I have an api only application (rails-api) and I'm looking to authorize a user on both email/password or 3rd party services like facebook or twitter etc, so I know I will have to use Oauth at some point.

My question is, can I solely use Oauth, or do I have to implement my own authentication (or something like Devise) to do the manual email auth. I don't understand Oauth well enough to know whether I can do manual authentication with my single endpoint, it seems like it only works with 2 endpoints (my server and a 3rd party service). I would much rather not use Devise is not built for an api and adds alot of overhead IMO.

Improve this question

1 Answer 1

Reset to default
0

You could build your own oauth provider to wrap the 'email/password'. You'd need to understand oauth, but it's not actually that hard to do.

In that case, you would have one service running somewhere on your network, even same host, as the oauth provider, and then your site. Your own oauth provider would act just like facbook, twitter, etc.

It's not clear that this would be ultimately easier / better than supporting oauth + 'local/classic authentication' but it's certainly possible.

A lot of times, you can get away with just oauth to facebook, etc. If you're already using oauth anyway, then the key question is most likely whether more or less all your users already have a Facebook/Twitter/etc. account and if there's any reason they'd like to hide that fact from you or not. If you expect everyone to have an account with a 3rd party on the list and not be secretive about it, then you can often drop local authentication altogether.

Improve this answer
3
  • So, does he have to use oAuth by itself? Can he implement both it AND a standalone authentication?
    – DougM
    Commented Jan 15, 2014 at 3:54
  • There's no fundamental incompatibility between oauth and standalone authentication. Two authentication mechanisms is more code to understand, write, test, and support. For a seasoned developer, incorporating both in an app correctly would be relatively straightforward. It's something a new developer could probably get through. But at any level, the simplest thing that works is best.
    – zanerock
    Commented Jan 15, 2014 at 4:45
  • Thanks for the reply, I think I will pursue this in the future but just do my own auth for now.
    – cbron
    Commented Jan 15, 2014 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.