Gem for oAuth2 Consumer AND Provider functionality in Rails 2.3.5

Question

I'm struggling finding a usable gem which provides the following for a Rails 2.3.5 application:

• we want to protect out API with oAuth 2; therefore a Controller for creating access/request Tokens and the models (Client, Token,...) are required
• we want to consume oAuth2 Services like Facebook and Twitter

It would also be nice to have support for 3 legged and 2 legged authentication.

I found those gems, but they all have major drawbacks:

• oauth-ruby (github.com/oauth/oauth-ruby)
  • i'm not quite sure if it already implements oauth2 mechanisms
  • more like a basic lib for services on top

---

• oauth-plugin (github.com/pelle/oauth-plugin)
  • looks convenient BUT oauth2 only supported in rails3 branch :(

---

• oauth2 (github.com/intridea/oauth2)
  • only for oAuth2 Consumers / no Provider Functionality

---

• oauth2-ruby (github.com/aflatter/oauth2-ruby/tree/)
  • last Commit: 16.07.10 "DESCTRUCTIVE COMMIT" :(
  • based on oAuth2 Draft 00 (old!)

---

• oauth2-provider (github.com/ThoughtWorksStudios/oauth2_provider)
  • last Commit: 21.10.10 - good
  • only Provider functionality :(
  • based on oAuth2 Draft 09 (quite recent)

---

Did anybody achieve those requirenments with one or a combination of those gems? Could you please provide me a direction?

Any help is much appreciated!

Answer 1

I can't help with your search. But I'll just say that that's a pretty large number of implementations for a protocol that is still in very active development :)

See my pointers to the current OAuth 2.0 status, as of draft 11, at https://security.stackexchange.com/questions/1187/what-were-the-specific-security-flaws-with-oauth-1-0-how-are-they-being-addresse/1201#1201

(Can anyone characterize the degree of interoperability between the different drafts of 2.0?)

Answer 2

Wanted to add a couple more libraries that I've come across. I haven't used either, but I thought they should be on this post for people to compare:

• https://github.com/songkick/oauth2-provider
• https://github.com/flowtown/rack-oauth2-server