Advice on HTTP authentication scheme (using request headers)

Question

I have a rails app hosted on Heroku that am restricting access to by using a proxy service. The external server acts as intermediary for all requests and handles user authentication. Once a user has authenticated, the server (I think LDAP) adds the user name to the request header and redirects them to my app.

I would like to use the username from the request header to authenticate users in my app. Basically if the user doesn't exist I would create a user with that username (no password required) and if not I would just log them in. I will be storing the users in my app's database.

How should I do this? Is it possible to use Devise for this purpose?

---

Edit: I got it working with Devise/custom Warden strategy like this:

# config/initializers/my_strategy.rb
Warden::Strategies.add(:my_strategy) do 
  def valid? 
    true
  end 

  def authenticate! 
    if !request.headers["my_key"]
      fail!("You are not authorized to view this site.")
      redirect!("proxy_url")
    else
      username = request.headers["my_key"]
      user = User.find_by_username(username)

      if user.nil?
        user = User.create(:username => username)
      end

      success!(user)
    end
  end
end

#config/initializers/devise.rb
config.warden do |manager|  
  manager.default_strategies(:scope => :user).unshift :my_strategy
end

I need to make this as bullet proof as possible. Are there other security measures can I take to make sure someone can't spoof the request header and access my site?

Answer 1

I think using devise can be a little more overkill, but you can. You just need define a warden strategie. in devise or use only warden in this purpose.