# Authentication design/ideas

**URL:** <https://www.ruby-forum.com/t/authentication-design-ideas/99788>\
**Category:** Rails\
**Created:** [July 25, 2006, 3:54pm UTC](https://www.ruby-forum.com/t/authentication-design-ideas/99788 "2006-07-25T15:54:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jordelver](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/9dc877/32.png) [@jordelver](https://www.ruby-forum.com/u/jordelver)\
**Post date:** [July 25, 2006, 3:54pm UTC](https://www.ruby-forum.com/t/authentication-design-ideas/99788/1 "2006-07-25T15:54:41Z")

</div>

Hi all,  
I’m using acts\_as\_authenticated for the front end facing part of my  
site. I have a model called Customer. I now want to protect the admin  
sides of things. I am thinking of using Ezra’s acl plugin  
([http://opensvn.csie.org/ezra/rails/plugins/dev/acl\_system2/README](http://opensvn.csie.org/ezra/rails/plugins/dev/acl_system2/README))  
for this. My only problem is that I don’t want the model for admin  
users to be called Customer, I’d rather it be called User or something  
(call me pedantic 🙂

So, I could rename my Customer model to User and implement the above  
plugin which will give me the authorization I want. But then I lose  
the ability to do:

```
@order.customer.fullname

```

Instead it will be:

```
@order.user.fullname

```

Also, for admin users, I just want to store their username and  
password, not all the other associated data that goes with a customer.

Is this a use for STI? Can I somehow alias the User model so that it  
can be accessed as Customer as well? Shall I just forget this and live  
with the name User? 🙂

How do others approach the frontend/backend authorization scenario? I  
would imagine it’s pretty common.

Many thanks,  
Jord

---

<div class="post-metadata">

**Author:** ![jordelver](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/9dc877/32.png) [@jordelver](https://www.ruby-forum.com/u/jordelver)\
**Post date:** [July 25, 2006, 11:19pm UTC](https://www.ruby-forum.com/t/authentication-design-ideas/99788/2 "2006-07-25T23:19:22Z")

</div>

Hello Jord,

2006/7/25, Jordan E. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> Is this a use for STI? Can I somehow alias the User model so that it  
> can be accessed as Customer as well? Shall I just forget this and live  
> with the name User? 🙂

Nothing prevents you from doing:

class Order \< ActiveRecord::Base  
belongs\_to :customer, :class\_name =\> ‘User’, :foreign\_key =\>  
:customer\_id  
end

class User \< ActiveRecord::Base  
has\_many :orders, :foreign\_key =\> :customer\_id  
end

That takes care of one problem. Secondly, your admin users. Yes,  
this is a use for STI. You can do this:

class User \< ActiveRecord::Base  
validates\_presence\_of :login, :password  
end

class Customer \< User  
validates\_presence\_of :address, :phone  
has\_many :orders, :foreign\_key =\> :customer\_id, :order =\> :order\_no  
end

class Order \< ActiveRecord::Base  
belongs\_to :customer, :foreign\_key =\> :customer\_id  
validates\_presence\_of :customer\_id  
end

Hope that helps !

---

<div class="post-metadata">

**Author:** ![jordelver](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/9dc877/32.png) [@jordelver](https://www.ruby-forum.com/u/jordelver)\
**Post date:** [July 27, 2006, 1:18pm UTC](https://www.ruby-forum.com/t/authentication-design-ideas/99788/3 "2006-07-27T13:18:50Z")

</div>

Hi Francois,

> Nothing prevents you from doing:
> 
> class Order \< ActiveRecord::Base  
> belongs\_to :customer, :class\_name =\> ‘User’, :foreign\_key =\> :customer\_id  
> end
> 
> class User \< ActiveRecord::Base  
> has\_many :orders, :foreign\_key =\> :customer\_id  
> end

That’s great to know. I always assumed that the association had to be  
the name of the table. Very useful, thanks.

> end
> 
> class Order \< ActiveRecord::Base  
> belongs\_to :customer, :foreign\_key =\> :customer\_id  
> validates\_presence\_of :customer\_id  
> end
> 
> Hope that helps !

It does, greatly. Thank you very much 🙂

I can’t help thinking that this is too much. I only need to password  
protect a controller with one or two usernames and I wanted to keep  
the acts\_as\_authenticated code as DRY as possible, which is why I’ve  
gone for this idea. Do you think it’s a good idea to mix customers and  
internal users into the same table? What do you think?

Cheers,  
Jord