Semi-manual authentication

[Kevin Lynagh]

Hello everyone. I am trying to use Sandbar's authentication system
with an ajax post from the client. Using the (with-security)
middleware makes sense (and is awesome), but for one particular case I
think I may have to manually handle my login routes.
I have a (GET "/login") that must be accessible to everyone, and
serves a page that ajax posts information to (POST "/login").
In the POST I am manually calling my authentication function, and so I
need to manually set its results in that session so when the client
javascript redirects the session will be setup correctly:

(POST "/login" req
(let [res (authenticator req)]
(??? set results in session as if this route had been
wrapped with (with-security))
(if (:user res)
(json-response {:authenticated true})
(json-response {:authenticated false}))))

Is there a nice way to do this or some other method of authenticating
via ajax?

thanks,

Kevin

[Brenton]

Kevin,

Sandbar does not support "out of the box" AJAX authentication. You
will need to create your own route for this. This shouldn't be too
hard to do. Take a look at the code in form_authentication.clj for
ideas. The problem with using that code via AJAX is that it always
wants to redirect you.

I think you want to do something like this (untested code):

(POST "/login" req
(if-let [valid-user (authenticate-user req)]
(do (session-put! :current-user
{:name (:username valid-user)
:roles (:roles valid-user)})
(json-response {:authenticated true}))
(json-response {:authenticated false})))

where authenticate-user is a function that you write which would get
the user information from the request and then ensure this this is a
valid user with valid credentials. It would return nil if this is not
true. By storing :current-user in the session, the (with-security)
middleware will recognize that the user as been authenticated. Note
that in the :current-user map :name must be a string and :roles must
be a set of keywords.

This library will be extended in the future to make such things
easier. If you come up with good solution, let me know.

If you haven't already, check out this page in the wiki:
https://github.com/brentonashworth/sandbar/wiki/Authentication-and-Authorization

I hope you find this helpful.

Brenton

[Kevin Lynagh]

Brenton,

Thanks for the quick and comprehensive reply!

Yes, that was pretty much exactly what I was thinkig of doing; I just
wanted to ask and make sure there wasn't a clever way to hook into
sandbar without just duplicating the (session-put!) from the internal
session authentication function.

I implemented your suggestion and it works great.

Thanks again for the help (and the nice library =)

kevin

On Jan 25, 1:02 pm, Brenton <bashw...@gmail.com> wrote:
> Kevin,
>
> Sandbar does not support "out of the box" AJAX authentication. You
> will need to create your own route for this. This shouldn't be too
> hard to do. Take a look at the code in form_authentication.clj for
> ideas. The problem with using that code via AJAX is that it always
> wants to redirect you.
>
> I think you want to do something like this (untested code):
>
> (POST "/login" req
>       (if-let [valid-user (authenticate-user req)]
>         (do (session-put! :current-user
>                           {:name (:username valid-user)
>                            :roles (:roles valid-user)})
>             (json-response {:authenticated true}))
>         (json-response {:authenticated false})))
>
> where authenticate-user is a function that you write which would get
> the user information from the request and then ensure this this is a
> valid user with valid credentials. It would return nil if this is not
> true. By storing :current-user in the session, the (with-security)
> middleware will recognize that the user as been authenticated. Note
> that in the :current-user map :name must be a string and :roles must
> be a set of keywords.
>
> This library will be extended in the future to make such things
> easier. If you come up with good solution, let me know.
>

> If you haven't already, check out this page in the wiki:https://github.com/brentonashworth/sandbar/wiki/Authentication-and-Au...