Ueberauth: github nickname only; callback domain

aiwaiwa · May 16, 2023, 8:24pm

If I’m only interested in the username (nickname) at github, is there a way to achieve that? Basically I’m not interested in emails, I just need to verify that I’m dealing with a few administrators via github auth.

This is my current config:

config :ueberauth, Ueberauth,
  providers: [
    github:
      {Ueberauth.Strategy.Github,
       [
         default_scope: "user:email",
         callback_path: "/auth/github/callback"
       ]}
  ]

I also wonder if this callback_path could be somehow made relative to the current domain?

linusdm · May 17, 2023, 4:56pm

I’m not sure what you’re asking regarding your first point. I’d advice to do some trial and error, and see what the minimal scope is you can get away with, no?

Regarding your second point: I’m not sure how you could do this with Ueberauth, because of the way it needs to be configured in one of your config scripts. But I suggest to take a look at Assent instead. IMO it’s much easier to configure Assent. I used to depend on Ueberauth for OAuth integration, but I switched because I found Assent to be easier to configure and understand. The downside is that it requires you to wire up your own controller (but that doesn’t require much glue code anyway). Assent itself has a very simple API, and can be used independently from Pow (I don’t use Pow, but I do use Assent together with the phx.gen.auth code).

I have a simple demo repo online (phx_gen_auth_meetes_assent) that shows how to integrate Assent. See this specific line to see how you’d configure Assent to have the correct callback path, using verified routes:

github.com

linusdm/phx_gen_auth_meets_assent/blob/main/lib/my_app_web/controllers/auth_controller.ex#L32


      
          
          
      {:error, _} ->
                  conn
                  |> put_flash(:error, "Failed to authenticate.")
                  |> redirect(to: "/")
              end
            end
          
          
  defp config do
              Application.get_env(:my_app, __MODULE__)
              |> Assent.Config.put(:redirect_uri, url(~p"/oauth/keycloak/callback"))
            end
          
          
  def logout(conn, _params) do
              MyAppWeb.UserAuth.log_out_user(conn)
            end
          end

aiwaiwa · May 19, 2023, 3:20pm

Thank you for you reply! So it’s unusual to try not to fish for a user’s email and simply verify him by a nickname?

aiwaiwa · May 21, 2023, 4:28pm

Went ahead to report an issue/feature request. Minimum scope to only request a username (nickname) · Issue #77 · ueberauth/ueberauth_github · GitHub
Seeing this as a vital feature to simply authenticate a github user without email.

linusdm · May 21, 2023, 5:14pm

Although I do appreciate that you’re going for the minimal data of your logged in users, I’m not sure if that’s really a rabbit hole worth following. An email address is the identifier of your user. So if you don’t need that, then what do you need? A nickname can also be entered in an input field, without the whole OAuth dance. It won’t be unique anyway, and you won’t be guarding against identity-fraud or something, as anyone can choose any nickname they want. Are you sure you want OAuth integration at all?
I’m not even sure the consent dialog of Github will make the distinction when you omit the email address from the requested scope. If the users can’t even see the difference, then… meh Just don’t save the email address. It might be unfortunate that email addresses are being used for account identifiers, but that’s a given at this point.

I’ve recently learned from Chris McCord on slack that the livebeats sample app implements OAuth integration with Github from scratch. Look here for more inspiration: live_beats/github.ex at master · fly-apps/live_beats · GitHub (it’s being called from the OAuthCallbackController, which is very similar to how you’d use Ueberauth or Assent). It’s quite concise and elegant (but it does only github, no other IdP’s). It also fetches the email address, but you can strip that from the code, so it’s even more concise, if that’s your goal.