API and Application authentication using Devise, Doorkeeper and OAuth2 token

Question

I have both a Desktop application and a mobile application. I want to use the same rails application for both "devices". In another word, I want the mobile application to request contents on the Desktop application.

I use Devise for authentications (email + password). I have implemented Doorkeeper on the Desktop app in order to generate an Oauth2 token for my mobile application.

Here are my questions:

I have before_filters sets in my desktop application controllers in order to secure them.

• I am not sure how the mobile application should share the OAuth2 token with Devise in order to be authenticated and access my protected controllers ?

In fact, right now, it is Doorkeeper who should check the mobile token in my controllers with the doorkeeper_for :all code. But to do that I have to unable the devise protection before_filter :authenticate_user!...

Should I save the oauth token in devise too ?

I am misunderstanding how mobile applications should authenticate with devise and OAuth2 protocole ?

Thx

Answer 1

This is old, but doesn't have an answer yet.

Essentially Devise and Doorkeeper are doing the same thing, Devise authenticates using sessions (or token auth if you have enabled that) while Doorkeeper authenticates with OAuth tokens sent in every request.

What you probably want to do is split your application into two access points, have a regular desktop access using Devise and an API that uses Doorkeeper. Enable Devise routes for only the regular desktop controllers and enable doorkeeper routes for only the api controllers.

In your API Application Controller, you can override current_user to be something like User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token. This will match the way Devise authenticates as well.

Alternatively, if your API doesn't have to use OAuth, you could use Devise's token_authenticable config, which provides similar features as OAuth's Bearer Tokens.