You can get back parameters from the authorization to indicate the user's intent by adding some parameters on the authorization URL.
For example:
- if devise_mapping.omniauthable?
- resource_class.omniauth_providers.each do |provider|
= link_to "Sign in with #{provider.to_s.titleize}", omniauth_authorize_path(resource_name, provider, {intent: :sign_in})
(This creates a URL like: http://whatevs.dev/users/auth/facebook?intent=sign_in)
Then, in the callbacks controller (whatever you name it):
class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
def facebook
if env["omniauth.params"]["intent"] == "sign_in"
# Don't create a new identity
else
# Normal flow, such as:
@user = User.from_omniauth(request.env["omniauth.auth"])
sign_in_and_redirect @user
end
end
end
ruby on rails - Devise/OmniAuth: different logic for for registration and login - Stack Overflow
ruby on rails - How does Devise and OmniAuth work together? - Stack Overflow
Rails, Devise & Omniauth - problems with setup - Stack Overflow
Help with Omniauth and devise (Rails 7)
Videos
You can get back parameters from the authorization to indicate the user's intent by adding some parameters on the authorization URL.
For example:
- if devise_mapping.omniauthable?
- resource_class.omniauth_providers.each do |provider|
= link_to "Sign in with #{provider.to_s.titleize}", omniauth_authorize_path(resource_name, provider, {intent: :sign_in})
(This creates a URL like: http://whatevs.dev/users/auth/facebook?intent=sign_in)
Then, in the callbacks controller (whatever you name it):
class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
def facebook
if env["omniauth.params"]["intent"] == "sign_in"
# Don't create a new identity
else
# Normal flow, such as:
@user = User.from_omniauth(request.env["omniauth.auth"])
sign_in_and_redirect @user
end
end
end
If a user clicks "Register with Facebook" and there's no account with their Facebook email, they want to go ahead and create an account with that email
This assumption is not valid since Facebook can be created with just a phone number. Even user has an email, extra permission is required to get the user email from Facebook. Your application should validate facebook_uid returned by Facebook API instead of email.
What's the cleanest way to pass the user's intent ('login' or 'register') into this callback method?
For OmniAuth there is no difference between the 'login' or 'register'. All it does is try to authenticate the user with the provided Facebook token. One clean way to differentiate is to separate on the controller level. If user tries to login in, call SessionsController#create, if user tries to sign up, call UsersController#create.
Well, Devise is an user management gem, so it will manage all your user sessions informations, password, password reset, confirmation .... Everything that is related to registrations and login will be handled by devise.
Now if you want to add omniauth login (Facebook,Twitter,....) you have to use omniauth to take care of the login using any provider like Facebook.
Basically Omniauth allows you to link facebook users to your app users but works perfectly well with Devise.
For example when a user is created using Facebook signup it's created in the User Tables which has both devise and omniauth information. So your user will also be able to login using his email and create a password afterwards.
Facebook provide a unique ID for each user which is stored in your database, so when one user is created with Facebook login it has both an email address to use with Devise and the Facebook ID to use with Omniauth to login.
You can use both together with the same user model and manage how you want to do it.
You can for example let user to create a password after omniauth login so that they can login afterwards with either omniauth or devise. Or you can also let existing user link their facebook account for future use.
I hope this is clear enough, if you have anymore questions let me know !
https://github.com/plataformatec/devise/wiki/OmniAuth:-Overview
Your user is your user. Omniauth provides an interface to your application which abstracts the whole Oauth protocol logic from you. But it's like this: your user signs in with his facebook account and gets a token. This token is bound to your user in your app, and that's how omniauth identifies him.
No, Omniauth is not the same as devise. Both try to address the same purpose (user authentication on your app), but while devise bundles the whole inner logic of identity provision in your app (creating an account, registering an account, registration emails, recovering an account, managing sessions, signing in, signing out...), Omniauth provides only an interface to link your user account to an authorized third-party account and access its information, and the rest you have to do yourself.
But they can work together (use devise to create accounts local to your app, use omniauth to link those accounts to third-party accounts and (maybe) fill some basic information for the user account based on his third party account, like facebook name, email, photo).
The sessions repository is independent of your users table, so there is no possibility of happening what you stated in the last paragraph.
Devise comes with an out of the box solution for integration with omniuth. You can checkout these urls: 1. https://www.digitalocean.com/community/tutorials/how-to-configure-devise-and-omniauth-for-your-rails-application This one shows integration with DigitalOcean but can be extended to others. 2. https://github.com/plataformatec/devise/wiki/OmniAuth%3A-Overview This one is from devise wiki
Hope it helps
There is a gem called dom that was made exclusively to manage Devise with multiple providers. It makes things deadly simple!
Also, I think you should read these articles. I'm sure you can solve all your questions with them:
- Devise OmniAuth: Overview
- OmniAuth Managing multiple provaders
Hey, I just tried to use Rails 7 with devise and omniauth-google-oauth2, but I'm running into problems when trying to authenticate via link_to tag.
I know it may be a problem with turbo links but Im not quite sure. I tried the same method(link_to) on Rails 6, and it worked:
<%= link_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(resource_name, provider), method: :post %><br />
In Rails 7 I tried the same approach, but instead of method: :post I used data: {turbo_method: :post}, like this
<%= link_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(resource_name, provider), data: {turbo_method: :post} %>
but when I click the link, the google console shows this
*Already added omniauth-rails_csrf_protection gem, but did not work
* I'm using a ngrok URI for the Authorized redirection URIs in the console.cloud.google