search

tardate / authlogic_rpx

Authlogic plugin to provide RPX support NB: Rails 3.2+ support is becoming an issue and I am not actively trying to keep this project updated (in favour of devise-based authentication). If anyone wishes to rescuscitate this project for Rails 3.2 and beyond please let me know and perhaps we could discuss transferring project ownership
MIT License
74 stars 11 forks source link

need a more elegant way of handling database constraint violations during auto-registration #3

Closed tardate closed 14 years ago

tardate commented 14 years ago

Probably need a more elegant way of handling database constraint violations during auto-registration

e.g. if unique index on username field, and a duplicate username registration is attempted, will throw a fatal error during the auto-registration: acts_as_authentic/session_maintenance.rb:73

tardate commented 14 years ago

for 1.0.3: added general error trap, and documented this situation better.

Bottom line is database constraints on auto-registered fields is a bad idea; should fix this in design rather than get authlogic_rpx to compensate.

On a case-by-case basis, can take a more sophisticated approach by overriding map_rpx_data

trooster commented 14 years ago

yes, enforced validations with auto-registration is problematic with the current implementation. The user is presented with a validation error on the profile page, however the record is already created in the database!

tardate commented 14 years ago

hi trooster,

Yes, that's pretty much the unavoidable consequence of allowing auto-registration since there really is no control over what (if any) profile information is provided from the authentication provider.

It can result in user records in the db that contain "invalid" data (for any fields you prepopulate). This is really a result of authlogic_rpx staying tightly within the authlogic framework.

If this is unacceptable for a particular application there are two options: (1) don't prepopulate anything (2) override map_rpx_data to do something more sophisticated than just stuff the values into the user record - the rules at this point start to become quite application-specific (e.g. do a check for uniqueness before adding to the profile; automatically 'uniquify' certain fields like username; or write 'pending user confirmation' profile information to a different column/table specifically for the purpose)