2-Legged OAuth for auth instead of basic_auth?

[coneybeare]

I have a backend API which uses 2-Legged OAuth to handle authentication instead of basic http auth. Do you have any plans on adding support for OAuth to remotely?

[coneybeare]

For clarity sake, here is what I do to sign a request from rails c:

# Sign a request with 2-Legged OAuth
consumer = OAuth::Consumer.new("my_key", "my_secret", :site => "http://api.[REDACTED].dev")
req = consumer.create_signed_request(:post, "/api/v1/users.json", nil)
res = Net::HTTP.start("api.[REDACTED].dev") { |http| http.request(req) }
puts res.body

I am looking for a way to integrate this signing method with remotely instead of basic_auth.

[coneybeare]

When all is said and done, this process simply adds an Authorization header which is signed using a predefined OAuth key and secret:

OAuth oauth_consumer_key="my_key", oauth_nonce="[REDACTED]", oauth_signature="[REDACTED]", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1357254884", oauth_version="1.0"

... and it looks like Faraday allows for setting the Authorization header: https://github.com/lostisland/faraday/blob/master/lib/faraday/connection.rb so maybe making a thin remotely wrapper won't be that tough. Thoughts?

[mnoble]

Hey @coneybeare,

We didn't have any immediate plans just because we aren't using OAuth for anything yet; that's not to say we wouldn't want it.

#9 looks good, as far as pass-through options go. I think long-term we could just use Faraday's OAuth middleware.

[coneybeare]

I agree, there are too many flavors of OAuth to support it. I sign every request the way I need using an overridden self.before_request call in my models. That is where I end up setting the app.authorization value (which is determinant on the uri).

[mnoble]

Ahh yea, makes sense. I think Faraday should take care of signing each request appropriately (at far as I can tell at least). We should make it so you don't have to do any before_request hacks; I'm sure that's a pain in the ass haha.

[coneybeare]

By no means am I an OAuth expert, but for my 2-Legged authorization, the before_request method is only 3 lines that lives in a shared model subclass of Remotely::Model, not that big of a hack.

An another note, sorry for bombarding you with issues today. After doing some research into the best ActiveResource replacement and deciding on Remotely, these are just the issues popping up as I go full steam ahead.

[craigmcnamara]

You can use RequestStore to get that result. https://github.com/remiprev/her#authentication