# ACL / authentication

**URL:** <https://www.ruby-forum.com/t/acl-authentication/77827>\
**Category:** Rails\
**Created:** [November 30, 2006, 9:36pm UTC](https://www.ruby-forum.com/t/acl-authentication/77827 "2006-11-30T21:36:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jwigal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/6a8cbe/32.png) [@jwigal](https://www.ruby-forum.com/u/jwigal)\
**Post date:** [November 30, 2006, 9:36pm UTC](https://www.ruby-forum.com/t/acl-authentication/77827/1 "2006-11-30T21:36:08Z")

</div>

I am trying to figure out the best way to set up the model for what  
could be a moderately complicated authentication / ACL issue. I am  
trying to set up a kind of “single sign-on” for a web application, where  
the end user could be assigned one or more roles through one or more  
customers. I’m also trying to figure out which of the authentication  
packages might work best for this setup.

A Customer represents a corporate entity that would pay to use a  
website. Each person represents an individual and has their own  
sign-on, and has one or more roles, either with a single customer or  
with multiple customers.

Tables:

PEOPLE  
id  
last\_name  
first\_name  
e\_mail

has\_many people\_roles

CUSTOMERS  
id  
customer\_name

ROLES  
id  
role\_name

PEOPLE\_ROLES  
person\_id  
customer\_id  
role\_id

For example:

Johnny has Security Clearance Level 1 for Customer A  
Jane has Level 2 and Level 3 for Customer B, and has Level 1 for  
Customer A

Thanks in advance–

-Jeff Wigal

---

<div class="post-metadata">

**Author:** ![jwigal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/6a8cbe/32.png) [@jwigal](https://www.ruby-forum.com/u/jwigal)\
**Post date:** [November 30, 2006, 10:13pm UTC](https://www.ruby-forum.com/t/acl-authentication/77827/2 "2006-11-30T22:13:30Z")

</div>

I would use Acts\_As\_Authenticated with ACL, if you goolge those two with  
“Ruby on Rails” you should be good to go.

As for the account, just make a user belong to a company or account  
model to get more differentiation.

Shai

---

<div class="post-metadata">

**Author:** ![jwigal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/6a8cbe/32.png) [@jwigal](https://www.ruby-forum.com/u/jwigal)\
**Post date:** [December 1, 2006, 1:34pm UTC](https://www.ruby-forum.com/t/acl-authentication/77827/3 "2006-12-01T13:34:11Z")

</div>

Shai S. wrote:

> As for the account, just make a user belong to a company or account  
> model to get more differentiation.

I’m not sure this will do what I’m looking for, since they could have  
one set of permissions within the context of one Customer, and another  
set of permissions with another customer.

Any other thoughts?

---

<div class="post-metadata">

**Author:** ![jwigal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/6a8cbe/32.png) [@jwigal](https://www.ruby-forum.com/u/jwigal)\
**Post date:** [December 1, 2006, 3:03pm UTC](https://www.ruby-forum.com/t/acl-authentication/77827/4 "2006-12-01T15:03:53Z")

</div>

Jeff Wigal wrote:

> Shai S. wrote:
> 
> > As for the account, just make a user belong to a company or account  
> > model to get more differentiation.
> 
> I’m not sure this will do what I’m looking for, since they could have  
> one set of permissions within the context of one Customer, and another  
> set of permissions with another customer.
> 
> Any other thoughts?

Oh, I think I get it… use AAA/ACL to control the “what you can do” and  
use a model to control what they see. Is that basically it?