Does not support non-database flow

[dorner]

Hi!

We're looking at supporting a flow where there is no user saved to the database at all - similar to the one shown here: https://4trabes.com/2012/10/31/remote-authentication-with-devise/

We've got this working with some overrides and implementation. Would this be something worth a PR? Or is it too far outside the scope of this gem and we should leave it in our own model?

[nbudin]

Hi @dorner! I'm not sure I fully understand the value of this flow. I do use database-backed user models alongside remote authentication in my apps, and it hasn't been a problem for me - in fact, it's been useful to have a local database model corresponding to a remote user because that way I can reference them in other models in the app (for example, to indicate that they're the owner of a local model). I'd love to understand more about your intended use case and why having a local user model is a problem for it.

That being said, I'm not really actively maintaining this gem anymore myself - it's basically in maintenance mode since I've switched to using OAuth2 for all my actively-maintained apps. For that reason, I wouldn't want to accept a new feature like this while I'm the only maintainer. If you'd be willing to become a maintainer on this gem, I'd be happy to accept a PR. Does that sound reasonable?

[dorner]

Hi!

We have a number of Rails microservices that all have fairly small domains. We don't have a single source of truth for users other than our CAS server, and we don't really have user-based permissions - essentially everyone has access to everything once they log in. So saving the user to the database doesn't really do anything for us.

I'm definitely down to taking on maintenance - from what I can see this is a pretty niche gem with very little activity, so since we would be using it a lot it probably makes sense for us to have the access rights.

[nbudin]

Ah, ok, that makes sense. Yeah, if you're willing to become a maintainer, I'd be glad to accept a patch for this. Thanks so much!

[dorner]

Hmm... actually, looking at the code I have that makes this work, I think it relies too much on our own workflow (e.g. we have a custom YAML file you can include which will bypass CAS in dev mode). It also only works with Rails (e.g. it needs to override the session storage/retrieval and needs to refer to the Rails logger).

What I can do is provide an example of how to make this work in the readme perhaps?

[nbudin]

What I can do is provide an example of how to make this work in the readme perhaps?

That'd be perfect. Thank you so much!