我们公司使用带有java代码的jar文件来验证用户是否可以访问内部网站。到目前为止，我已经能够将该jar文件集成到允许用户登录的设计策略中。但是，当我运行代码时，我获得了成功的登录/重定向，然后是未经授权的/重定向登录。
Started POST "/login" for 0:0:0:0:0:0:0:1 at 2017-01-09 11:05:40 -0500
(7.0ms) SELECT name FROM sqlite_master WHERE type = 'table' AND name = "schema_migrations"
ActiveRecord::SchemaMigration Load (2.0ms) SELECT "schema_migrations".* FROM "schema_migrations"
Processing by Devise::SessionsController#create as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"WCrhgdRgZsQng2rgHdhnCBB7me5lAfhvDxwYrMpMUxfUdMN0fN/PjBHJPIUxMYiNjoJlaLsCIlQdN4WmbPlclg==", "user"=>{"email"=>"<valid email>", "password"=>"[FILTERED]"}, "commit"=>"Log in"}
Custom Authenticate
Authenticated=true
{:username=>"<valid un>", :firstname=>"", :lastname=>"", :fullname=>"", :email=>""}
(0.0ms) SELECT name FROM sqlite_master WHERE type = 'table' AND NOT name = 'sqlite_sequence'
Redirected to http://localhost:3000/ideas
Completed 302 Found in 825ms (ActiveRecord: 2.0ms)
Started GET "/ideas" for 0:0:0:0:0:0:0:1 at 2017-01-09 11:05:42 -0500
Processing by IdeasController#index as HTML
User Load (1.0ms) SELECT "users".* FROM "users" WHERE "users"."id" IS NULL ORDER BY "users"."id" ASC LIMIT 1
Completed 401 Unauthorized in 34ms (ActiveRecord: 1.0ms)
Started GET "/login" for 0:0:0:0:0:0:0:1 at 2017-01-09 11:05:42 -0500
Processing by Devise::SessionsController#new as HTML
Rendered /Users/un/.rbenv/versions/jruby-9.1.2.0/lib/ruby/gems/shared/gems/devise-4.2.0/app/views/devise/shared/_links.html.erb (6.0ms)
Rendered /Users/un/.rbenv/versions/jruby-9.1.2.0/lib/ruby/gems/shared/gems/devise-4.2.0/app/views/devise/sessions/new.html.erb within layouts/application (60.0ms)
Completed 200 OK in 1724ms (Views: 1684.7ms | ActiveRecord: 0.0ms)
我假设这是＆＃34;：database_authenticatable＆＃34;的一部分。我的user.rb中的行
User.rb：
class User < ActiveRecord::Base
#include ActiveModel::Model
# Include default devise modules. Others available are:
# :confirmable, :lockable, :timeoutable and :omniauthable
devise :database_authenticatable #, :registerable,
#:recoverable, :rememberable, :trackable, :validatable
attr_accessor :username
attr_accessor :firstname
attr_accessor :lastname
attr_accessor :fullname
attr_accessor :email
end
Custom_authenticatable策略
module Devise
module Strategies
class CustomAuthenticatable < Authenticatable
def authenticate!
puts "Custom Authenticate"
if password.present? && has_valid_credentials?
#puts "Username and password:" + password
puts authentication_hash[:email]
authorized = jar.authenticate(authentication_hash[:email], password);
puts "Authenticated=" + authorized
if authorized == false
return fail!
else
personInfo = jar.getPerson(username);
puts personInfo
personHash = {:username => personInfo.userName,
:firstname => personInfo.firstName,
:lastname => personInfo.lastName,
:fullname => personInfo.longName,
:email => personInfo.emailAddress}
puts personHash
return success! User.new(personHash)
end
else
fail(:unable_to_authenticate)
end
end
def has_valid_credentials?
true
end
end
end
end
但是，当我从：database_authenticatable更改为：custom_authenticatable时，我不再拥有用户/ sign_in路由。
路由为：database_authenticatable
Prefix Verb URI Pattern Controller#Action
ideas GET /ideas(.:format) ideas#index
POST /ideas(.:format) ideas#create
new_idea GET /ideas/new(.:format) ideas#new
edit_idea GET /ideas/:id/edit(.:format) ideas#edit
idea GET /ideas/:id(.:format) ideas#show
PATCH /ideas/:id(.:format) ideas#update
PUT /ideas/:id(.:format) ideas#update
DELETE /ideas/:id(.:format) ideas#destroy
new_user_session GET /login(.:format) devise/sessions#new
user_session POST /login(.:format) devise/sessions#create
destroy_user_session DELETE /logout(.:format) devise/sessions#destroy
root GET / redirect(301, /ideas)
路由为：custom_authenticatable
Prefix Verb URI Pattern Controller#Action
ideas GET /ideas(.:format) ideas#index
POST /ideas(.:format) ideas#create
new_idea GET /ideas/new(.:format) ideas#new
edit_idea GET /ideas/:id/edit(.:format) ideas#edit
idea GET /ideas/:id(.:format) ideas#show
PATCH /ideas/:id(.:format) ideas#update
PUT /ideas/:id(.:format) ideas#update
DELETE /ideas/:id(.:format) ideas#destroy
root GET / redirect(301, /ideas)
我对如何继续感到有点失落。我还发现OmniAuth可能允许我做同样的事情，虽然我不确定如何设置回调阶段。是否值得花时间继续沿着设计策略路径试图允许登录，或者我应该停止我正在做的事情并使用OmniAuth？
如果值得花时间继续设计路线，接下来的步骤是什么？
这是我第一次设置Devise，因为我过去的Rails体验过去都修改了现有的Rails应用程序。提前谢谢。
参考文献:(我会包含所有参考文献的链接，但我没有足够的声誉点来发布更多链接）
设计身份验证策略
如何使用设计和监护人创建自定义身份验证策略 https://www.ldstudios.co/blog/2016/06/15/how-to-create-custom-authentication-strategies-with-devise-and-warden.html
为OmniAuth编写非Gemified策略 http://www.polyglotprogramminginc.com/writing-a-non-gemified-strategy-for-omniauth/
编辑我实际上非常接近答案。我没有正确设置Devise并直接访问Warden，这是我能够＆＃34;登录＆＃34;然后立即退出我的申请。
config / initializers / devise.rb （错误的方式）
config.warden do |manager|
manager.strategies.add(:custom_authenticatable, Devise::Strategies::CustomAuthenticatable)
manager.default_strategies(:scope => :user).unshift :custom_authenticatable
end
这导致调用custom_authenticatatable代码，但仍在尝试为用户使用本地数据库。当我对devise.rb进行以下更改时（如ldstudios博客中所述），它开始按预期工作。
config / initializers / devise.rb （正确方法）
Devise.add_module(:custom_authenticatable, {
strategy: true,
controller: :sessions,
model: 'custom_auth',
route: :session
})