James Anders In the lead role of janders223

Rails 3 with Devise Google, and Google Apps Authentication

About three years ago, my company switched from Lotus Notes to Google for email, and have since not been happier with email and all of  the things that come with Google. Maybe two years ago we started developing our own applications in Ruby on Rails applications. I have worked on them off and on for about the last year on a part time basis when I wasn't busy with other things. And now recently, I have been "promoted" into a full time development position as we have more and more projects and more and more maintenance on existing ones.

Naturally, with the advances of OAuth, one of the first requests that was posed to me was 'We need to do single sign on with our Google apps domain'. Cool, we already use Devise, and they allow OAuth authentication, so this should be easy right? Wrong. As usual, with any open source software, documentation and tutorials are rarely in sync and the developer is left to either monkey patch existing solutions, or find the right combinations of gems and solutions. For my solution, I had to do a little of both and am documenting it to help others and for future reference.

First we need to find the correct OAuth gem for our solution. For standard Google OAuth we will be using the omniauth-openid gem from Intridea, and for Google Apps we'll use the omniauth-google-apps gem. So in our Gemfile let's add:

1
2
3
4
5

# for Google Apps
gem 'omniauth-google-apps'
 
# for standard Google
gem 'omniauth-openid'

Don't forget to bundle install after updating your Gemfile.

Next up, we need to ensure that devise knows we want to use it's omniauthable model. Open up user.rb and add the module

Change this:

4

devise :database_authenticatable, :registerable, :recoverable, :rememberable, :trackable, :validatable

To this:

4

devise :database_authenticatable, :registerable, :recoverable, :rememberable, :trackable, :validatable, :omniauthable

Now let's tell Devise about our Omniauth strategy. In config/initializers/devise.rb add the following:

1
2
3
4
5
6
7
8
9
10

# Outside of the configuration block
require 'openid/store/filesystem'
 
# Inside the configuration block
 
# For Google Apps
config.omniauth :google_apps, :store => OpenID::Store::Filesystem.new('/tmp'), :domain => 'your-domain.com'
 
# For standard Google
config.omniauth :open_id, :store => OpenID::Store::Filesystem.new('/tmp'), :name => 'google', :identifier => 'https://www.google.com/accounts/o8/id', :require => 'omniauth-openid'

What's going on here? First we make sure we require openid/store/filesystem. This will ensure that openid has access to write the transfer data to the filesystem during the authentication process. Then in config.omniauth we specify either Google Apps or openid, and we also declare the :store to the /tmp directory. Note that if you plan to deploy to Heroku you don't have write access to the filesystem, except for the ./tmp directory and will need to substitute that instead. For Google Apps authentication you will need to declare your domain name to authenticate against. This will ensure that only users inside of your organization can sign in to your application with Google. For standard Google authentication we add :identifier, which points to Google's OAuth URL, we require omniauth-openid, and we specify a name that we'll use later in our OmniuathCallbacks controller.

With these building blocks in place, we're now ready to dive in and get all this working. Let's go back to the user model and add a couple of methods.

11
12
13
14
15
16
17
18
19

def self.find_for_open_id(access_token, signed_in_resource=nil)
  data = access_token['info']
 
  if user = User.where(:email => data['email']).first
    return user
  else
    User.create!(:email => data['email'], :password => Devise.friendly_token[0,20])
  end
end

Here we define a method to find a user for openid. We pass in all of the the data returned by Google as access_token and set signed_in_resource to nil. We then set a local data variable to hold the info from the access_token. Next we check to see if we have a user that matches the returned email address and if not we create a new one creating a generic password for them. We'll also add the following method to our user model:

21
22
23
24
25
26
27

def self.new_with_session(params, session)
  super.tap do |user|
    if data = session['devise.googleapps_data'] && session['devise.googleapps_data']['user_info']
      user.email = data['email']
    end
  end
end

Here we're checking to make sure that the data returned is Google Apps data and user info, then setting user.email to the email returned in the data. Now we'll override Devise's OmniauthCallbacks Controller to use our strategy. Let's create a new file app/controllers/callbacks_controller.rb and fill it with:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

class CallbacksController < Devise::OmniauthCallbacksController
 
  skip_before_filter :verify_authenticity_token, :only => [:google_apps]
 
  def google_apps
    @user = User.find_for_open_id(request.env["omniauth.auth"], current_user)
 
    if @user.persisted?
      flash[:notice] = I18n.t "devise.omniauth_callbacks.success", :kind => "Google"
      sign_in_and_redirect @user, :event => :authentication
    else
      session["devise.google_data"] = request.env["omniauth.auth"]
      redirect_to new_user_registration_url
    end
  end
end

First, we're skipping the before filter that verifies the authenticity token for our action. Our action will be based upon which authentication we use. For Google Apps we are using google_apps and standard Google we'll just use google. Then we check to see if the user has been persisted and sign them in if they are and create them if they aren't. No we have to tell Devise to use our new controller. Open routes.rb and modify our user resource:

3

devise_for :users, :controllers => { :omniauth_callbacks => "callbacks" }

And the final piece to tie all of this together is to provide the link for users to sign in inside of app/views/layout/application.html.erb :

16

link_to 'Sign in', user_omniauth_authorize_path(:google_apps)

And that's it! Now when users click 'Sign in' they will be passed either directly to Google or to your Google Apps domain for authentication! As an alternative solution, you can offer the standard Google authorization, and your users can then use their Google Apps account, however if you wish to limit then to your domain only, then use the Google Apps version. Full source code is available on Github.