Instead, I couldn't find much of anything.
So I delegated the task to someone else who I believe ended up implementing… Basic auth over TLS. ;)
I agree with the main thrust of the argument though. OAuth providers do not make it as easy as they should. The point about the buttons is spot on. I've had some good success with the buttons provided here:
There are very few good provider libraries out there, making it harder to stick to standards. People who want to provide an API shouldn't have to re-invent the wheel every time.
I started writing opro before DK was out in the wild. There were some things I had in opro that weren't in DK so I decided to keep developing it.
Last time I checked here are some differences:
- Deals with CSRF protected resources automatically
- Works with your login system (like devise), not around it. No special casing or configuration is needed
- Comes with built in docs.
- Comes with built in test controller
You can play around with it here: http://opro-demo.herokuapp.com/.
P.S. - it also took like six hours of banging my head against a wall for unrelated oauth-related problems, but not DK's fault.
Enjoy.
https://github.com/jaredhanson/oauthorize https://github.com/jaredhanson/oauth2orize
version 22 of oauth2 spec
I had a similar problem, so I started my own open OAuth provider implementation complete with built in documentation https://github.com/schneems/opro. If you're using Rails, you can have a working OAuth provider in production in under 5 minutes. Of course adding the API endpoints and writing application specific docs is still up to the user, but the authentication flow and logic are at least standardized.