AshAuth OAuth redirect_uri with multiple host domains

lardcanoe · August 14, 2024, 11:25pm

My site is hosting multiple domains (example1.com, example2.com) and I am using ash_authentication google oauth strategy. I need it to support multiple redirect_uri’s based on which host the user is on.

I hacked up a way by setting a key with Process.put in a plug and getting it in the function that redirect_uri invokes (with the strategy name…) but this feels really hokey. There a better way?

Fyi, I did try using:

  defp set_host(conn, _opts) do
    Ash.PlugHelpers.set_context(conn, %{host: conn.host})
  end

and I can see my data in conn.private.ash.context after it is set, but opts passed into the redirect_uri function is empty. So maybe get_context isn’t working in lib/ash_authentication/strategies/oauth2/plug.ex?

zachdaniel · August 15, 2024, 12:19am

You can have multiple google strategies configured differently.

i.e

google :google_domain1 do

end

google :google_domain2 do

end

Would that solve it for you?

lardcanoe · August 15, 2024, 1:42am

Thanks for replying!

It’s one fly.io machine hosting multiple domains, so I need a way to choose the correct redirect_uri. If I had two google strategies like that, how would it know which to use per host? My router.ex simply has a call to auth_routes_for to create all the routes, I don’t have a way to tell that to use a certain google strategy for one host, and the other strategy for another host.

github.com

team-alembic/ash_authentication/blob/main/lib/ash_authentication/strategies/oauth2/plug.ex#L180


      
              {:ok, secret} ->
                {:ok, secret}
          
              _ ->
                {:error, Errors.MissingSecret.exception(path: path, resource: strategy.resource)}
            end
          end
          
          defp build_redirect_uri(strategy) do
            with {:ok, subject_name} <- Info.authentication_subject_name(strategy.resource),
                 {:ok, redirect_uri} <- fetch_secret(strategy, :redirect_uri),
                 {:ok, uri} <- URI.new(redirect_uri) do
              suffix = Path.join([to_string(subject_name), to_string(strategy.name), "callback"])
              # Don't append the path if the secret ends with the path already
              path =
                if String.ends_with?(uri.path, suffix) do
                  uri.path
                else
                  Path.join([uri.path || "/", suffix])
                end

Don’t put anymore thought into it I guess. I’ll stick with the Process approach.

zachdaniel · August 15, 2024, 10:37am

IIRC the strategy name is part of the route. So you could show a different button in your UI depending on which host the user is authenticating on and it will take them down the path with the different redirect uri.