I just pushed an update to the coherence phx-1.3 branch that has support for using the latest coherence with both legacy phoenix and the new phx project structures. The work is not done yet, but there should be enough functionality to get going.
This branch now supports, what I believe, is a good Gettext implementation that allows full localization of all Coherence messages using your app’s Gettext module.
Hi, I’ve read the description of the Coherence auth project and there are seems all features which I need for my project, specifically:
password restore
email confirmation
password bruteforce protection
I’d like to try it out. But if I get it correctly, Coherence comes with it’s own router with own views and templates. As my project is gonna be multilingual and I plan to take the approach similar to described in the article http://code.parent.co/practical-i18n-with-phoenix-and-elixir/ where each url if it is not localized (first chunk should replicate locale ie en, uk, es, fr etc…) is redirected to the localized in accordance with browser settings and configured list of allowed languages and fallback to default language if they don’t match.
As the phoenix 1.2 is currently the stable version I’m gonna be using this.
Most of the auth examples I’ve stambled upon don’t have localization in mind.
So, the question is how well will the Coherence play with multilinqual site like that. I need register, login, restore password pages to have localized pages (with gettext) as well as confirmation emails etc.. Is there an example how to do it, how many and what kind of tweaks should be done?
hello, talking about authentication with Phoenix/Elixir… there was a conference “Elixir Daze 2017” and The talk by João Moura was about what we can do to manage well this subject.
He has to attract the attention to the differences between coherence, uberauth, pot, guard and keeper (library that he is developing to work as Multi Factor Authentication), and the usage of Json Web Tokens.
here is the video link: ElixirDaze 2017- Tackling Authentication with Phoenix by João Maura
and his github repo: keeper
If it can help…
@igor I can’t see anything obvious why you should not be able to use Coherence with this approach. I would create a quick spike to to try it and flush out any potential issues.
Couple things to consider:
mix coherence.install task, not the mix coh.install task.If you do run into trouble, push your spike project to github so I can easily reproduce your issue.
I have tested the phx-1.3 branch with phoenix-1.3.0-rc with projects made with mix phoenix.new. I have not tested it on pre phoenix-1.3.0 projects however.
@smpallen99 I wanted to say thanks for your quick answer, it was a big help. I got the coherence v-1.3 working nicely with the localization and phoenix-1.3, which I finally have choosen for the project. To make it work there were only router settings needed to be a little customized. In case someone can find it usefull I will leave the router code here. May be there is some not necessary stuff, for example I’m not sure about this
# Add this block
scope "/" do
pipe_through :protected
coherence_routes :protected
end
part. It is never touched because of the locale plug which redirects user before the route gets called. But compiler seems won’t generate helper path functions without it.
In general, it’s important to pay attention to the order of scopes and their namespaces because coherence needs all it’s paths to be in scopes which are not namespaced and all protected paths to go after all public paths to work properly.
defmodule MyProject.Web.Router do
use MyProject.Web, :router
use Coherence.Router # Add this
pipeline :browser do
plug :accepts, ["html"]
plug :fetch_session
plug :fetch_flash
plug :protect_from_forgery
plug :put_secure_browser_headers
plug MyProject.Web.Plug.Locale, "en"
plug Coherence.Authentication.Session # Add this
end
pipeline :protected do
plug :accepts, ["html"]
plug :fetch_session
plug :fetch_flash
plug :protect_from_forgery
plug :put_secure_browser_headers
plug MyProject.Web.Plug.Locale, "en"
plug Coherence.Authentication.Session, protected: true # Add this
end
pipeline :api do
plug :accepts, ["json"]
end
# Add this block
scope "/" do
pipe_through :browser
coherence_routes()
scope "/", MyProject.Web do
get "/", PageController, :index
end
end
# Add this block
scope "/:locale", as: :locale do
pipe_through :browser
coherence_routes()
scope "/", MyProject.Web do
get "/", PageController, :index
end
end
# Add this block
scope "/" do
pipe_through :protected
coherence_routes :protected
end
# Add this block
scope "/:locale", as: :locale do
pipe_through :protected
coherence_routes :protected
scope "/", MyProject.Web do
# Add protected routes below
end
end
end
For now I have another question - what is the easyest way to provide the complex form for the anonimous user to register and at the same time create some content on the site which will be published after user confirms his account. Does the coherence provide the simple api function to be used in my controller to get the user registered and the confirmation email sent?
This block provides the routes for a logged in user. You can review the source in Coherence.Router for more specifics.
I’m not sure if you using your own controllers, or have generated the coherence controllers. You can view the coherence controllers. For example these two lines in the Session create action are responsible for logging in a user. they could be called from the Registration controller create action.
https://github.com/smpallen99/coherence/blob/phx-1.3/web/controllers/session_controller.ex#L118
Yeah, I see. But in my router locale plug comes to work first and redirects such paths to /:locale/… paths. For localized protected paths I have
scope "/:locale", as: :locale do
pipe_through :protected
coherence_routes :protected
scope "/", MyProject.Web do
# Add protected routes below
end
end
As for my second question about creating complex form for registering user and at the same time adding some content to my site, I’ve looked into coherence source, as you told me, particularly into RegistrationController and found that to register new user and send him a confirmation email there are two functions used, changeset and send_confirmation, both located in Coherence.ControllerHelpers, which do exactly what I need, thank you one more time!
Since it hasn’t been mentioned yet, how would OpenID fit into an Elixir / Phoenix Framework picture ?
There’s https://github.com/mustafaturan/shield/tree/ui that can be used as an identity provider. This could act as a separate process within an umbrella app, thus segregating user management concerns from the app’s domain.
there is also an erlang implementation of OpenID relying party https://github.com/indigo-dc/oidcc, which could be used (not sure if it’d had to be ported though ; being still a newbie in Elixir) to delegate login to a third party identity provider.
I understand this post is generic without implementation detail. What are your thoughts in terms of maintainability and security ?
And when everything is entirely untenable? I’ve been looking for an authentication solution for the app I want to build for 2 months now. To me, having to reinvent the wheel by building email confirmation, password reset emails, and all the little things that Devise provides in Rails is untenable. It seems like Coherence is the only solution for registration based authentication at the moment, tenable or not.
Exactly, those are useful for identity logins (which I am not using), but it would fit perfectly into, say, Ueberauth (which is an authentication framework, entirely pluggable, and coherence would fit inside it quite well).