Rails Google OAuth2 Tutorial

Google recently deprecated OpenID 2.0 authentication, which I used to authenticate users via Google Apps for internal projects like our Dashboard. In a couple of months, it will just stop working so I’ve been converting projects to use OAuth 2.0. Google login is pretty convenient, especially if your team is on Google Apps. The conversion process was very annoying so I hope this tutorial saves you time.

First, we’ll need to setup a new project in the Google Developers Console.

Google_Developers_Console

Next, enable the “Google+ API”:

google plus

Go to “APIS & AUTH > Credentials” and click “Create New Client ID”. You’ll need to configure the origins and redirect URIs for every domain you need. I’ve configured it for development and for Heroku so you can see a live demo.

client settings

You should now have a CLIENT ID and CLIENT SECRET. Let’s put them in your shell startup script so that your app can access them. We do it this way so that you don’t check in sensitive information into your source code.


~/.bash_profile

export GOOGLE_CLIENT_ID_TUTORIAL=<your CLIENT_ID>
export GOOGLE_CLIENT_SECRET_TUTORIAL=<your CLIENT_SECRET>

Now we can run the example:

source ~/.bash_profile
cd ~/Sites
git clone https://github.com/tuesy/google_oauth2_tutorial
cd google_oauth2_tutorial/
bundle install
bundle exec rake db:setup
bundle exec rails s

This loads your shell startup script, grabs the source code, setups up the database and starts the app. If all went well, you should be presented with the Google Login screen. After logging in and approving the app permissions, you should see “You are logged in via OAuth 2.0 as <your email>!”.

More Details

This tutorial uses the Omniauth gem, which makes it easier to provide multiple ways for users to authenticate into your app. You specify what you want your app to allow as individual “strategies”:

config/initializers/omniauth.rb

Rails.application.config.middleware.use OmniAuth::Builder do
provider :google_oauth2, ENV['GOOGLE_CLIENT_ID_TUTORIAL'], ENV['GOOGLE_CLIENT_SECRET_TUTORIAL'], {scope: 'email,profile'}
end

Tip: If you want to use this for your Google Apps domain, simple pass an additional parameter:

provider :google_oauth2, ENV['GOOGLE_CLIENT_ID_TUTORIAL'], ENV['GOOGLE_CLIENT_SECRET_TUTORIAL'], {hd: 'mydomain.io', scope: 'email,profile'}

The whole flow can be confusing so make sure you reference the Omniauth documentation before trying to troubleshoot. I found that if you don’t fully understand the flow, it will be very hard to debug your code. However, once you do, adding other strategies like Facebook or Twitter should be much easier.

Troubleshooting

If you’re seeing “invalid client_id”, your environment variables are probably not set correctly. You can use the “printenv” command to verify if the particular terminal tab you’re running the server in has the right variables. If not, source your shell startup script again. If you’re seeing API permission errors, you probably forgot to enable the Google+ API. Google’s documentation has more detailed information on specific errors that may help. If all else fails, clear your browser cookies for localhost.

Links

Startup Landscapes

Print

Diagrams like this one for the Crowdsourcing space can be very help for entrepreneurs. However, it’s frustrating when you can’t click on the company logos and you’re always wondering how out-of-date it is. That’s why I created a project called Startup Landscapes. You can click on each logo and the grouping is a little more organized so you can see it in a table view. I’ve played around with other visualizations like circle packing, but it’s more confusing then helpful at this point. I’ve only added a couple of the most popular diagrams out there. LUMA makes them for quite a few industries so check those out. Don’t miss the Robotics one.

Why I Chose iPad Mini Over iPad Air

IMG_0207

Most reviews start by telling you about specs. It’s more useful to understand personal behavior.

Watching Videos

When you’re lying in bed on your side, the weight of the iPad isn’t as big of an issue because most likely the edge is resting on the bed so you’re just keeping it from falling over. Like many people, I watch lots of videos—NBA highlights, game walkthroughs, movies, etc. I also have NBA League Pass so I watch full games on demand with scrubbing capability—it’s awesome. I found that the Full is too big for this position so I’m either extending my arms out uncomfortably or I’m in windowed mode. You do this because if you hold it too close, everything looks gigantic and your eyes get tired darting around the large field of view. With a Mini, I can go full screen and watch J-Lin slice through the lane at just the right distance.

Reading

The Mini is a paperback and the Full is a hardcover. Honestly, I prefer reading on my iPhone 5S over the Full. I’m not sure if it’s the longer travel distance for my eyes from side to side or not being as easy to handle while shifting positions or just feeling self-conscious—people who read with a Full look silly, almost as silly as people who use iPads as video cameras. Whereas before I’d take one look at my Full and then turn on my phone to read, now I read a lot more and on the Mini. For reading, I would actually prefer something lighter and narrower (uh oh, starting to describe a Kindle) but it’s good enough.

Taking Notes

I take a lot of notes because my brain needs Evernote. I’ve been searching for a long time for a good way to get me past my laziness. I had a brick of a convertible Toshiba tablet with OneNote back in the day, I’ve used Penultimate with a Full plus stylus, I’ve even tried a real world Moleskin notebooks because they feel so good. In all these cases, I couldn’t reliably get typed text at the end of the day. Handwriting recognition is never perfect and transcribing real world notebooks is a pain in the arse. The Mini solves this problem. In meetings, bringing your laptop is bad for attention because you usually lose eye contact not to mention the disrespect. Thumbing away on your phone usually makes people think you’re playing Candy Crush. With the Mini, I feel like Data from TNG and all my ideas get recorded.

I should have bought this last year even without the retina display. It feels better when watching, reading, taking notes, sketching—mostly because this is the right size for me. Think about how you would use it…and then go buy a Mini either way. I guarantee you’ll understand your personal behavior before those 30 days are up.

Read the Bad Reviews and Ignore the Good Ones

nose sucker

 

The holiday shopping season has started so I wanted to share some advice to fellow buyers. This applies whether you’re buying a $5 toy or a $50k cars.

Good Reviews Are Bad for You

Beware of reviews like “great product” and “would totally buy again”. Most startups you work for will ask their employees give good ratings for their own products whether it’s electronics or iPad apps. That’s just common sense. Why wouldn’t you ask employees, friends, family, and the homeless guy on the street corner to give you a good rating? Every bit helps right? People tend to quietly accept this type of ethical transgression and not the other kind: writing a bad review for a competitor. You can get sued for libel right? Good reviews tend to be shorter as well because the marketing material already covered the bases so it’s hard to come up with something nuanced to rave about. For example, when looking for a “nose sucker” to remove boogers from my baby’s nose (true story), I found this useless 5-star review. The subject is “it works” and the user “HappyDays” admits that “we never tried other more traditional aspirators so I can’t compare it to those”. It’s reviews like this that helped create helpfulness ratings.

Bad Reviews Are Good for you

On the other hand, I love bad reviews. When I’m on Amazon, I look at reviews starting with the most scathing first. The longer and nastier the review the better. That’s because bad reviews tend to get to the heart of the problem. The customer likely ran into a shortcoming of the product and like stepping on dog poo, wanted to warn the rest of the us of the stinking pile. In many cases, I can quickly decide whether the negative review is warranted and whether it affects my decision. For the same product, I came across this 1-star review. Her complaint was that using this made her ill because you are basically sucking the germs into your mouth. I thought about this for a second and decided that I’d be fine with this outside risk since my germs are probably more dangerous to the baby than hers to me. Other times, the reasons are legitimate but it doesn’t apply to you. For example, another customer may not like the heating system of a car but you live in Las Vegas so you only care about the air conditioning.

What to Look For

Start by asking whether the problem is a legitimate concern to you. If the “defect” doesn’t apply to you, move on. If it does, be extra sensitive to it. For example, if a customer suggests that a baby crib’s construction is shoddy, take it as a red flag and look for similar reports in other reviews. You don’t want to take any chances. Next, try to determine whether the review was influenced by emotion. If someone is screaming in all caps, “OMG, THIS IS THE WORST PRODUCT IN THE WORLD”, it’s probably less credible than someone writing “this product doesn’t feel safe because pieces came off after daily use of 1-2 hours”. At the end of the day, bad reviews are harder to come by because you’re counting on people to do a solid for the community and it’s easiest to be lazy. There are also cases like Yelp’s where companies take bribes to remove or hide bad reviews (rumored). Just remember that all reviews are biased and that bad reviews are more likely to be helpful.

Honoring the Servant and Forgetting the Gift

Albert_Einstein_Head

“The intuitive mind is a sacred gift and the rational mind is a faithful servant. We have created a society that honors the servant and has forgotten the gift”

The quickening march of technology has made work more efficient but most of the time we’re just getting better at doing because doing is easier and more satisfying than thinking. Engineers tend to jump straight into writing code. We love the earlier part of the creative process where we are programming and tinkering. We’re less found of testing and scaling. That’s why there are so many Hackathons and Facebook is portrayed as Hacker Heaven. Entrepreneurs tend to jump straight into building a company. We love putting together an all-star team and picking out the perfect Palo Alto office. We’re less fond of raising capital and finding a product-market fit. That’s why there are so many startups working on yet another photo-sharing app.

Everyone should spend more time thinking and researching. We need to resist the temptation to jump in too early. Engineers should think things through before starting to write code, perhaps with TDD/BDD. Entrepreneurs should think things through before printing those business cards, perhaps by vetting your idea through at least 7 people and a good night’s sleep. In a time where there are inexpensive tools for software startups (AWS, web frameworks, SDKs, SaaS services, etc.), it’s more tempting than ever to short-change the intuitive mind in favor of the rational one. Recently, even the tools for hardware startups are becoming affordable: MakerBot has made 3D scanning and printing cheap enough for prototyping and Kickstarter has lowered the high hurdle of the initial manufacturing run.

Given that many barriers are going away and new tools are cheaper and more accessible, what will companies compete on in the future? Design. Strategy. Ideas. All different words to describe the realm of the intuitive mind. It’s already happening: Why Snapchat is Screwed. Snapchat is a successful mobile social network that is rumored to have passed on a $3Billion acquisition offer from Facebook (and possibly a bigger one from Google). The technology is easy to replicate, their users will likely leave if they introduce ads, and there is no compelling reason like personal data keeping users from moving to a competing product. Time to innovate?

 

Evernote is my Brain Upgrade

image

If you’re not using Evernote or something like it, you need to start. Lifehackers can tell you about how it can make you more productive than Iron Man but I want to stress the most profound benefit: not having to remember minutiae. Evernote is my brain upgrade. Like most people, I can’t hold onto more than about 7 things in short term memory. Sucks, but our hardware just isn’t optimized for that. We’re good at hand eye coordination and humor among other things but trying to remember phone numbers and shopping lists just makes us wonder if we really are doomed for idiocracy.

Not having to stress about the small stuff makes me more relaxed. I’m at peace instead of trying to remember that guy’s last name I met at the conference–luckily, I took a photo of his business card and Evernote allows me to search for his first name because it automatically parsed the text from the photo. Sexy. With my stylus and tablet, I hand-write notes in Penultimate, which is now part of Evernote. Oh, handwriting is also automatically parsed and indexed.

Evernote isn’t just an app, it’s an extension of my brain on my phone, my laptop, my tablet–eventually everywhere. It’s synced in the cloud and they’ve built or bought many different ways to get your brain connected to the digital world. It’s an impressive mission and a core tool in today’s ADHD world. So if you’re wondering how other people seem to get more done with less stress and in less time, it’s because we cheat. We upgraded our brains with free(mium) tools like this to let our brains chew on the important stuff or Candy Crush.

Last interview question you’ll ever need: Kobayashi Maru

Screen Shot 2013-11-16 at 12.58.53 AM

It’s becoming more and more difficult to assess candidates. People can easily google “interview questions” and get 833 Million results. Websites offer “smart answers to tough interview questions“. They can tell you exactly what questions were asked last week at Google. Sites go as far as coaching you on what emotions to show and what corny jokes to tell. It’s an interviewing arms race that has interviewers searching for more and more inane questions like “Why is a manhole round?” and interviewees feeling like they’re studying for a standardized test.

In Star Trek lore, there’s a test at starfleet academy called the Kobayashi Maru. It’s a no-win situation where either you let a Federation ship get destroyed or get yourself destroyed by attacking the Klingon fleet. The simulation is designed to see how cadets react to an impossible situation. I use this same strategy in my interviews. I present them with a scenario that is relevant to the particular job but let them explore and struggle through the simulation. I even play the evil computer program and change the assumptions as I go. No two interviews are the same. For example, for web developers the scenario is that having just programmed your app, you check it out in a browser and see a blank page. What do you do?

The nature of work is changing. The interview methods of the past don’t meet the needs of today’s jobs, which require more creative problem-solving and less memorization and assembly line widget-building. What you really want is to see how candidates think and handle new situations. It’s quite easy to tailor this test for your needs. Hiring a systems engineer? Put them in an outage situation and ask them what to do. You’ll find out within 5 minutes or less whether you want that person handling your servers. If you’re looking to get hired, impress me with your knowledge of the system. Bonus points for cheating.