#235 Devise and OmniAuth (revised)

Lets say I had an app on heroku, with omniauth configured to let users sign in with twitter. Would I need an SSL certificate on my site, or is it safe without one?

Thanks again, Ryan. You say that adding an authentications model is not always necessary to have users authenticate through multiple services. What is the alternative to an authentications model? If there is only one :provider and :uid field, how can you store provider ids and uids from multiple services in the user table?

Thanks.

Also, where do you define:

"TWITTER_CONSUMER_KEY" and "TWITTER_CONSUMER_SECRET"

??

I get the following error when I try this on Ubuntu 10.04. Does anyone have any suggestions?

OAuth::Unauthorized (401 Unauthorized):
oauth (0.4.6) lib/oauth/consumer.rb:216:in token_request'
oauth (0.4.6) lib/oauth/consumer.rb:136:inget_request_token'
.....

As all ways great episode!

It would be nice if you could make an episode on the topic of creating a oauth service with devise and doorkeeper.

Thanks Ryan, I have been waiting for this one for some time now.

Hi Ryan, great episode indeed, well worth $9 itself.

I'm pretty curious about how to implement authentication via multiple services too. Any episode taking that path soon?

normal registration form is also not showing the password field ..
how can I make sure its shown for users who want to register through site and not show the pass for user from oauth ..

Regards

in other words, please tell how to make it registrable + omniauthable

Great episode as always Ryan. +1 for a future episode that goes into setting up a separate model for managing identities (i.e. how to link multiple accounts to a local account and deal with the various edge cases). Keep up the great screencasts!

Great episode Ryan. The Devise Omniauth documentation isn't much detailed now and I was having trouble understanding the code samples.

In the episode, you mention that adding a separate Authentications model is 'a complexity that is not always needed'. If one requires to associate the user account with multiple providers, should we make a separate authentications model or add different keys to user model like twitter_uid, facebook_uid as Adam Sunderland mentions in an earlier comment?

Thanks for another great episode, Ryan!

How would you do it if you also wanted to use the :confirmable module in Devise? This sends an email for confirmation on user creation, but it fails in the scenario where you don't require an email address.

Is there an easy way of not requiring email and only confirm it if provided?

Answering myself, there is an easy way, you just need to override confirmation_required? like this:

class User < ActiveRecord::Base
  def confirmation_required?
    super && email.present?
  end
end

Devise is great :)

This is great! But I am having a bit of an issue. I can not seem to get it to bypass the password as easily as it should be.

I am allowing login via facebook using the information from this railscasts. My resource is :subscriber instead of :user, but the rest is pretty much the same.

class OmniauthCallbacksController < Devise::OmniauthCallbacksController
   def all
     subscriber = Subscriber.from_omniauth(request.env["omniauth.auth"])
     if subscriber.persisted?
       sign_in_and_redirect subscriber, notice: "Signed in!"
     else
        .....the rest of what you see in the railscasts

and my model contains:

   # populates db with information from omniauth'ed subscriber(facebook)                                         
   def self.from_omniauth(auth) 
     where(auth.slice(:provider, :uid)).first_or_create do |subscriber|                             
       subscriber.provider = auth.provider 
       subscriber.uid = auth.uid                                                                                 
       subscriber.email = auth.info.email 
       subscriber.firstname = auth.info.first_name                                            
       subscriber.lastname = auth.info.last_name 
     end 
   end   
         
   # persists subscriber information through the session 
   # when omniauth'ed subscriber (facebook)                                                                      
   def self.new_with_session(params, session) 
     if session["devise.subscriber_attributes"]                                                                  
       new(session["devise.subscriber_attributes"], without_protection: true) do |subscriber| 
         subscriber.attributes = params                                                   
         subscriber.valid? 
       end                                                                                     
     else 
       super                                                                                            
     end 
   end 
         
   def password_required?                                                                     
     super && provider.blank? 
   end 

When I run debugger and interject immediately before subscriber.persisted? I can see I have a provider and a uid for subscriber, but subscriber.persisted? returns false because subscriber.new_record? is true.

What am I missing?

What happens in the following cases?

• User registers normally, then tries to log in via Omniauth
• User registers via Omniauth, then tries to log in normally

Hi,
I am trying to do something different but I can't figure out what's wrong :

I want the user that are using facebook connect to create a password on my website when they first sign up using FB Connect,
So I what I did is let the error when there is no password and instead of redirecting to the new registration form I want them to be redirected to another form (new_facebook) that will let them enter their password, I want the form to be completely different so having another one seems to be the best how can I do that ?

Thanks,

Hi, I am having a problem when trying two different providers, Linkedin and Facebook. Hope you can help me.

For example once I logged using facebook, and logout from the site, then try to login using linkedin I got an error.

Here's my code.

gem 'devise'
gem 'omniauth-facebook'
gem 'omniauth-linkedin'

config.omniauth :facebook, "CONSUMER_KEY","CONSUMER_SECRET"
config.omniauth :linkedin, "CONSUMER_KEY", "CONSUMER_SECRET" "

class OmniauthCallbacksController < Devise::OmniauthCallbacksController

        def facebook
              user = User.from_omniauth(request.env["omniauth.auth"])
            if user.persisted?
                    
              sign_in_and_redirect user
            else
              session["devise.user_attributes"] = user.attributes
              redirect_to new_user_registration_url
            end
          end

          def linkedin
            user = User.from_omniauth(request.env["omniauth.auth"])
            if user.persisted?
                    
              sign_in_and_redirect user
            else
              session["devise.user_attributes"] = user.attributes
              redirect_to new_user_registration_url
            end
          end


           alias_method :facebook, :linkedin
end

class User < ActiveRecord::Base
  
  devise :database_authenticatable, :registerable, :validatable,
         :recoverable, :rememberable, :trackable,  :omniauthable

  # Setup accessible (or protected) attributes for your model
  attr_accessible :email, :password, :password_confirmation, :remember_me, :username,
   :provider, :uid, :name, :oauth_token, :oauth_expires_at, :fname, :lname, :user_type, :username

 
 
   validates_presence_of :fname
   validates_presence_of :lname

    has_attached_file :photo,
        :default_url => '/assets/default1.gif'

        has_many :experiences

         def self.from_omniauth(auth)
          where(auth.slice(:provider, :uid)).first_or_create do |user|
            user.provider = auth.provider
            user.uid = auth.uid
                   user.email2 = auth.info.email
            user.fname = auth.info.first_name
            user.lname = auth.info.last_name
          end
        end


        def self.new_with_session(params, session)
                  if session["devise.user_attributes"]
                    new(session["devise.user_attributes"], without_protection: true) do |user|
                      user.attributes = params
                      user.valid?
                    end
                  else
                    super
                  end    
        end


        def password_required?
                  super && provider.blank?
        end

        def email_required?
                  super && provider.blank?
        end

end

ActiveRecord::RecordNotUnique in OmniauthCallbacksController#linkedin

PG::Error: ERROR:  duplicate key value violates unique constraint "index_users_on_email" 

Works great for me, but the cucumber test fails. I get “Password can't be blank” messages. I guess it is related with using “:without_protection => true” while creating new User.

def set_facebook_omniauth
 credentials = {:provider => :facebook, :uuid => '65', :info => {:email => 'machete@yourgarganta.mx', :name => 'Denny Trejo'}}
 OmniAuth.config.test_mode = true
 OmniAuth.config.mock_auth[:facebook] = OmniAuth::AuthHash.new({'uid' => credentials[:uuid], 'info' => {'email' => credentials[:info][:email], 'name' => credentials[:info][:name]}})
end

When /^I login with Facebook$/ do
 set_facebook_omniauth
 visit root_path
 click_link 'Login with Facebook'
end

Then /^I see a successful sign in message$/ do
 page.should have_content "Signed in successfully."
end

As I’m using mongoid I’ve changed a bit “from_omniauth” method.

 def self.from_omniauth(auth)
    where(auth.slice(:provider, :uid)).find_or_create_by do |user|
     user.provider = auth.provider
     user.uid = auth.uid
     user.name = auth.info.name
     user.email = auth.info.email
    end
 end

how could i use "Devise.friendly_token" instead of leaving a blank password?

Folks have asked about combining Devise and other service providers, and there are great turorials (if somewhat dated and/or buggy) out there: github.com/RailsAps

I used the example on rails3-mongoid-omniauth and combind with the railscasts to get Devise, omniauth-facebook and mongoid up and running for myself. Here's a pastebin devise, omniauth-facebood and mondoig

I only posted relivant parts in users.rb which required a deviation from Ryan's

def self.new_with_session(params, session)

method so things would work with mongoid.

The other area of change is in the authentication_controller.rb

def all

went through some changes so that we could allow username/password registrations and logins, registrations and logins via facebook and to allow account linkage of existing accounts with 3rd party providers.

Also had to add a method:

def create_new_omniauth_user(auth)

in the controller, again to appease the mongoid gods since the Authentication can't be saved before the user record.

I went about making a authentications "table" to store the different 3rd party credentials in so users could use multiple providers to login or sign up with, however the only one I've implemented is facebook, so there may be changes you'd need to do in the user.new_with_session method to work with the omniauth.auth hash data.

If you're using an html5 compatible browser, you might encounter a javascript validation saying "Please enter an email address" for the username field around 8:33.

HTML5 compatible browsers will interpret the type="email" attribute of the username input field and perform the associated email validation:

  <div class="field"><%= f.label :username %><br />
  <%= f.email_field :username %></div>

You can update the username input field to remove this validation. Change the username field to:

  <div class="field"><%= f.label :username %><br />
  <%= f.text_field :username %></div>

You can do the same thing in the views/devise/registrations/edit.html.erb file.

Get the following error when I try to sign in with twitter:

NoMethodError in OmniauthCallbacksController#twitter

undefined method `username=' for #User:0x007fc48595d160

Any help would be awesome!

How can we modify the omniauth_callbacks_controller if we want to add facebook authentications as well ?

Thanks.

I first implemented this episode and it work. However, I am using simple_for in my project, so I switched from 'form_for' o 'simple_form_for' in the devise new registrations view.

When the user log in using Twitter, for example, they are redirected to the new registration form as eexpected, since I my project requires email and Twitter does not provide user email address.

The project is that the registration form is not pre-populated with the first and last name on first pass. However, when you lick on the 'log in with Twitter' link again, then the correct behaviour (pre-populating the first name and last name fields) happens.

My question is, how do I avoid having to click the link twice in order to get the correct behaviour?

Thnx.

Sorry to bother, but is there something wrong with this video? It doesn't load, and all the download links are 404s.

Thanks

works now

Could anyone let me know why I am receiving this error on postback?

Could not authenticate you from Twitter because "Invalid credentials".

remember this in user model

, :omniauth_providers => [:twitter]

I had to add a comma at the end of path_names in my routes.rb else the server kept giving me a syntax error at this point:

controllers: {

devise_for :users,  path_names: {sign_in: "login", sign_out: "logout"},
                    controllers: {omniauth_callbacks: "omniauth_callbacks"}

Great tutorial btw - thanks a ton!

I am getting a 404 not found on callback.

Heroku Logs

AbstractController::ActionNotFound (The action 'twitter' could not be found for Devise::OmniauthCallbacksController):

I have an application using devise for my authentication. How do I allow users to NOT have to input their current password every time they want to update their settings?

Hi Guys,

What happens if user signs up with facebook, then edits his password on the site? So now the user has a different password for facebook and the site. Doesn't that mean the password for facebook and the site will get out of sync and wouldn't be able to login?

I get this error when I try this tutorial:

undefined method `username=' for #User:0x40e1cb0

Hi all,

I tried with omniauth twitter but I am getting NoMethodError
undefined method `info' for nil:NilClass when click on "Sign in using Twitter" link. I have attached gist for Full trace of error.
Any idea, how to solve this problem.

AWESOME article ...worked like a charm except one change.

If you installed RoR using RailsInstaled make this SSL fix.
https://gist.github.com/fnichol/867550

I used the same pattern to allow sign in with LinkedIn

Use this gem "omniauth-linkedin-oauth2"

and use this provider :
config.omniauth :linkedin_oauth2, ENV["LINKEDIN_KEY"], ENV["LINKEDIN_SECRET"]

Also you can get the email address from the session so that the user will be automatically created.

In user.rb model class self.from_omniauth method add this line
user.email = auth.info.email

Nice Video.. I am having a problem with devise raising an error for the email can't be blank sign up. After removing the need for a email, I keep getting the error, ' ERROR: duplicate key value violates unique constraint "index_users_on_email" DETAIL: Key (email)=() already exists. : INSERT INTO "users" ("created_at", "provider", "uid", "updated_at", "username") VALUES ($1, $2, $3, $4, $5) RETURNING "id""
Thanks!!

Hi everyone, I got a question will trying to use omniauth-facebook with devise
I followed the video(just substitute twitter with facebook) and was able to get it work.
However, I would like to customize my routes a little bit, so this is what I did:

devise_for :users, path: 'accounts', 
           controllers: { omniauth_callbacks: "omniauth_callbacks" },
           path_names: { sign_in: "login", sign_out: "logout", sign_up: "signup" }

as I expected, in my url "users/..." was changed to "accounts/...", but when I tried to login via facebook, I got this error:
Routing Error
No route matches [GET] "/users/auth/facebook/callback"

after play around with it, I got around it by adding this line:

get '/users/auth/facebook/callback', to: redirect('/accounts/auth/facebook/callback')

It works fine now, but I think there must be better solution.
Is there any way to change the returned callback url from /users/auth/facebook/callback to /accounts/auth/facebook/callback ???

Thanks!

If you are on Rails 4 and get a cryptic error message along the lines of ArgumentError in Devise::RegistrationsController#new wrong number of arguments (2 for 1), just remove the without_protection key in user.rb. Source: http://stackoverflow.com/questions/17105112/argumenterror-in-deviseregistrationscontrollernew-wrong-number-of-arguments

Hi, I'm encountering a redirect loop when logging in. Has anyone encountered this before? I'm using Rails 4 BTW. Thanks!

I'm getting a 500 error on my heroku site and a 401 error on my localhost. My site links to Twitter and allows log ins but returns a "Could not authenticate you from Twitter because "Invalid credentials"". I am 100% sure the keys are correct. Any advice?

Hey guys I'm getting an error out of the blue, but I'm not finding anything resembling it on the net.

I get an "undefined method `stringify_keys' for [:email, :current_password]:Array" error on this line "@user.update_without_password(devise_parameter_sanitizer.for(:account_update))" .

Only when I try to update user information. Anyone have any ideas?

I'm getting the same error Jonathan E. Emmett is getting. Three other developers, running (virtually) identical systems do NOT get the error. I have tracked it down (I think) to the fact that 'stringify_keys' is getting an array instead of a hash, but why is that happening? I'm running Ruby v. 1.9.3p392 Rails v. 4.0.0.

I document all of the challenges I worked through in this episode here: http://devetc.tumblr.com/post/64332554082/fumbling-my-way-through-devise-and-omniauth

In general they were

1) 401 issues related to OAuth
2) Issues with adding an extra option to a definition in the user.rb model file
3) Getting stuck at https://api.twitter.com/oauth/authenticate when trying to authenticate

Hi, are these instructions still current? Are they meant to work with Rails 4? I have devise, omniauth and have separate user and authentication models. I'm trying to follow along with this but am not getting the results being demonstrated. Is it possible that this is no longer current? Thank you, OH

Anybody managed to make this work for facebook? I'm getting an Invalid redirect_uri error in my production environment but works fine in dev
thx for your help

Hi, i'm having troubles with password_required and new_with_session

  def self.from_omniauth(auth)
    where(auth.slice(:provider, :uid)).first_or_create do |user|
      user.provider = auth.provider
      user.uid = auth.uid
      user.email = auth.info.email
    end
  end

  #persist user in session on validation error with omniauth
  def self.new_with_session(params, session)
    if session["devise.user_attributes"]
      new(session["devise.user_attributes"], without_protection: true) do |user|
        user.attributes = params
        user.valid?
      end
    else
      super
    end
  end

  #validation for password on omniauth
  def password_required?
    super && self.provider.blank?
  end

  #password for update if blank on omniauth
  def update_with_password(params, *options)
    if encrypted_password.blank?
      update_attributes(params, *options)
    else
      super
    end
  end

  def has_no_password?
    self.encrypted_password.blank?
  end

The session are always there, imagine this case, you sign up with twitter, the system asks you for a email, you regrets and want to use normal register, you can't because there isn't the password field and the provider info is still in cache, i need to know where to clear that session :/

Similar problem when you want to update the blank password with an error, it would f.object.encrypted_password.present? would return true in that case, so i add that has_no_password? method for that.

Put this in the for what it's worth category, for Postgresql, the
rails g migration add_omniauth_to_users provider uid should be
rails g migration add_omniauth_to_users provider uid:integer otherwise I was getting a
Error: operator does not exist: character varying = integer.

I had to put several casts together to get an API providing OAuth2, and a devise client to use it with Omniauth, but good job putting the important bits out there.

If you use a session, then doesn't that mean the default devise signup can no longer be used until that session is deleted? I don't see where the deletion is handled. Since using a provider uses the new user registration path, that means the new user registration path can no longer be used to default devise login. Even refreshing with cache clearing doesn't clear a session.

In rails 4, you now need to change the where() method parameters explicitly as hashes. This won't work

def self.from_omniauth(auth)
  where(auth.slice(:provider, :uid)).first_or_create do |user|
  # ...

You need to change it to

def self.from_omniauth(auth)
  where(provider: auth.provider, uid: auth.uid).first_or_create do |user|
  # ...

first_or_create does not execute the block code if it finds a record. I ending up doing this:

  def self.from_omniauth(auth)
    user = self.where(provider: auth.provider, uid: auth.uid).first

    user = User.new unless user

    self.grab_oauth_values(auth, user)   
  end

  private

    def self.grab_oauth_values(auth, user)
      user.provider = auth.provider
      user.uid = auth.uid
      user.name = auth.info.name
      user.email = auth.info.email
      user.image = auth.info.image
      user.oauth_token = auth.credentials.token
      user.oauth_expires_at = Time.at(auth.credentials.expires_at)
      user.save!
      user
    end