Phoenix and Rails Authentication

How does one introduce a Phoenix Authentication API into a side project? By doing whatever it takes to learn, and doing the simple things.

Transcript

1. Phoenix and Rails Authentication Introducing Phoenix Auth APIs to a diverse ecosystem.
2. Hi! I'm Andrew. I work here.
3. I'm a bike commuter A while ago I built a bunch of little tools to track where I was going on my bike.
4. Sooo many different things It's kind of a mess: GPS track ingestion in Node and JS, Mongo Visualization in Ruby on Rails Storage in PostgreSQL Authentication & identity in... TBD
5. What the app is
6. I know, I'll use Elixir! Idea: What if I introduced Elixir into my project as an identity service? Responsibilities: Authentication Authorization (TBD)
7. Fell in love!
8. Desired architecture Introduce an identity system, which will store the list of users and their tokens - and manage sessions, too!
9. Step 1: Phoenix app from scratch Played with Ueberauth Wrote a plugin: ueberauth_strava Wrote it inside my Elixir app, then extracted into its own hex package. Ueberauth is kind of like OmniAuth
10. Demo See: Ueberauth code
11. Step 1, done: At this point, the app can log you in (SSO) with Strava, and find (or create) a user account. It also stores a token.
12. Step 2: Research authentication Ueberauth is closely aligned with Guardian, which pushes you to use JWT (JSON Web Tokens) as an auth and session mechanism.
13. JWT, briefly. www.jwt.io JSON object that stores: Claims (authorizations, permissions) Signatures, tokens Expiry times Store it in: Cookie? Local Storage?
14. Step 2, findings: Hm, that might not be for me. Why not? Session expirations complicated Complex implementation Overkill - this is just a side project! "Stop Using JWT For Sessions"
15. Step 3: Rails and Phoenix session sharing! Rails and Phoenix share parallel implementations of the Rails session serialization and deserialization code. Stored in a cookie.
16. Step 3: Rails and Phoenix session sharing! Rails and Phoenix share parallel implementations of the Rails session serialization and deserialization code. Stored in a cookie. I wrote a blog post on this: Rails, Meet Phoenix
17. How to do this: Set up Phoenix and Rails with the same: SECRET_KEY cookie name prefix cookie salt (encrypted, and signing salt) Then add a plug library PlugRailsCookieSessionStore
18. Tada!
19. Finally: open a Users API Internal apps can access it to get a list of users and their tokens. GET /users Simple Bearer-Token auth, protected over SSL.
20. Soooooo...
21. Which brings us here... cyclecity.io
22. Takeaways Get started with Elixir however you can. Just because it's shiny.. doesn't mean you have to use it!
23. Thanks! Track your rides! cyclecity.io Me: andrew@carbonfive.com twitter.com/@andrewhao github.com/andrewhao