# Authentication differs per-environment

**URL:** <https://www.ruby-forum.com/t/authentication-differs-per-environment/114281>\
**Category:** Rails\
**Created:** [September 10, 2007, 10:11pm UTC](https://www.ruby-forum.com/t/authentication-differs-per-environment/114281 "2007-09-10T22:11:34Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ben\_Kimball](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/b5ac83/32.png) [@Ben\_Kimball](https://www.ruby-forum.com/u/Ben_Kimball)\
**Post date:** [September 10, 2007, 10:11pm UTC](https://www.ruby-forum.com/t/authentication-differs-per-environment/114281/1 "2007-09-10T22:11:34Z")

</div>

Hey everyone.

In my app, I use a before\_filter called ‘authorize’ to set up a User  
object @current\_user for the logged-in user (or reject the client if  
I can’t match their credentials). But depending on my environment,  
this filter needs to behave differently. In production, it needs to  
get the (already-authenticated, through a corporate SSO package)  
username from request.env[CUSTOM\_KEY]. In development and test, we  
can’t get to the SSO, so we just let the client pick a user account  
to masquerade as, and put the username into the session.

I found a simple way to do this, but it’s ugly:

(app/controllers/application.rb)  
private  
def authenticate  
if RAILS\_ENV == ‘production’  
@current\_user = User.find\_by\_eid(request.env[‘CUSTOM\_KEY’])  
unless @current\_user  
redirect\_to :controller =\> :login, :action =\> :unauthorized  
end  
else  
@current\_user = User.find\_by\_eid(session[:fake\_eid])  
unless @current\_user  
session[:original\_uri] = request.request\_uri  
flash[:notice] = “Please log in”  
redirect\_to(:controller =\> “login”, :action =\> “login”)  
end  
end  
end

I tried moving some of this code to config/environments/production.rb  
(for example), but of course when the configuration is happening,  
there is no request or session object, so I couldn’t do something like:

(config/environments/production.rb)  
CURRENT\_USER = request.env[‘CUSTOM\_KEY’]

Does anyone have any suggestions on a cleaner way to do this than the  
hardcoded RAILS\_ENV in ApplicationController.authenticate?

Many thanks,  
Ben

–  
Ben Kimball  
removed\_email\_address@domain.invalid