Using Devise to auto login a user on a multi tenancy site with subdomains

问题

In my app a customer registers on mysite.com. Once registration is complete, they are given a site such as customer.mysite.com. I'm using Devise and would like to log the customer into their site immediately. I'm using multitenancy as explained in the RailsCast here. I'm not quite sure how to go about this. The standard solution of adding sign_in to an after_sign_up_path_for def isn't working. I'm assuming it's trying to log the customer into mysite.com, not customer.mysite.com. I'm including my after_sign_up_path_for def so you can see what I'm trying with no success. The resource in my Devise implementation is User and a user has a Site.

RegistrationsController:

  def after_sign_up_path_for(resource)
    # Site.current_id = resource.site.id
    sign_in resource, bypass: true
    "http://#{resource.site.host}.#{ENV['BASE_HOST']}/sites/#{resource.site.id}/edit"
    # edit_site_url
  end

Any help is appreciated.

回答1:

I had the same issue and solved it the following way:

Create a new model (I called it LoginKey) that contains the user_id and a random SHA1 key. When the user is authenticated at the parent domain (for example: mydomain.com/users/sign_in), a new LoginKey is created and the user is redirected to the corresponding subdomain to an action that I called login_with_key (for example: user_subdomain.mydomain.com/users/login_with_key?key=f6bb001ca50709efb22ba9b897d928086cb5d755322a3278f69be4d4daf54bbb) Automatically log the user in with the key provided:

key = LoginKey.find_by_login_key(params[:key])

sign_in(key.user) unless key.nil?

Destroy the key:

key.destroy

I didn't like this solution 100%, I tried out a lot of different approaches that do not require a db record to be created, but always faced security concerns, and I think this one is safe.

来源：https://stackoverflow.com/questions/23318870/using-devise-to-auto-login-a-user-on-a-multi-tenancy-site-with-subdomains

标签

ruby-on-rails

devise