airhorns/trestle-omniauth

Protect a Trestle admin deployment with Omniauth authorization

Trestle::Omniauth

Adds stateless authentication for Trestle via omniauth providers. Similar to trestle-auth, but doesn't require extra models, and works good if you're already using an OAuth provider for authentication elsehwere.

Installation

Add this line to your application's Gemfile:

gem 'trestle-omniauth'

Add whichever OmniAuth strategies you will use for authentication to your Gemfile as well:

gem 'omniauth-google-oauth2'  # for example

And then run bundler to install your new gems:

$ bundle

Note: You don't need to mount this gem like you might with Trestle. It just plugs in to the existing way that Trestle is mounted in your app.

Usage

trestle-omniauth uses Omniauth providers unadulterated. To add providers, use the omniauth.provider method exposed on the trestle config the same way you'd use the OmniAuth::Builder#provider method.

In your config/initializers/trestle.rb, add providers like so:

# config/initializers/trestle.rb
Trestle.configure do |config|
# ...
# ...
  config.omniauth.provider :google_oauth2, ENV['GOOGLE_CLIENT_ID'], ENV['GOOGLE_CLIENT_SECRET']
end

You can also use Trestle's route helpers if you need to add more login/logout links:

# in a view somewhere
<%= link_to "Logout", trestle.logout_url %>

Notes

• trestle-omniauth doesn't do anything in particular to filter which users can authenticate with your application. If the authentication provider you configured authorizes a user, then they are able to use the whole of the admin. In the case of something like Google OAuth2, there's an option to create an Internal Only credential, which will disallow anyone outside the Google organization from logging in. See https://support.google.com/cloud/answer/6158849?hl=en for more details.
• Authentication can be skipped for certain controllers using Trestle's controller block to skip the before filter like so:

Trestle.resource(:resource) do
  # ...
  controller do
    skip_before_action :require_authenticated_user, only: [:dump]

    def dump
      render json: Resource.all
    end
  end
end

• Omniauth listens using the same path prefix that Trestle is set up with. So, if Trestle.config.path = "/admin", the auth URLs will be /admin/auth/:provider etc. This is implemented using Omniauth's :path_prefix provider option which is passed automatically.
• The developer Omniauth strategy does a direct POST without using Rails' form helpers, so it trigger's Rails CSRF protection and won't work by default. You can disable CSRF protection for your app to get it to work (definitely not recommended), or just use the same provider you'd use in production with a different client ID / client secret.

License

The gem is available as open source under the terms of the LGPLv3 License. All credit goes to trestle-auth of which this gem is a close derivative.