# Authorization system recommendations

**URL:** <https://www.ruby-forum.com/t/authorization-system-recommendations/161599>\
**Category:** Rails\
**Created:** [February 27, 2009, 6:25pm UTC](https://www.ruby-forum.com/t/authorization-system-recommendations/161599 "2009-02-27T18:25:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![evan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/54ee81/32.png) [@evan](https://www.ruby-forum.com/u/evan)\
**Post date:** [February 27, 2009, 6:25pm UTC](https://www.ruby-forum.com/t/authorization-system-recommendations/161599/1 "2009-02-27T18:25:32Z")

</div>

Good morning.

Our application has grown to the point where a more robust  
authorization system is needed. What Rails plugins or Ruby gems do you  
recommend?

Our needs include:

- defining multiple user roles which can use parts of the application  
in different ways
- easy maintenance (preferably no generators or systems requiring  
manual code updating after initial install)

We are already using authlogic for authentication.

Thanks.

Evan

---

<div class="post-metadata">

**Author:** ![evan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/54ee81/32.png) [@evan](https://www.ruby-forum.com/u/evan)\
**Post date:** [February 27, 2009, 11:42pm UTC](https://www.ruby-forum.com/t/authorization-system-recommendations/161599/2 "2009-02-27T23:42:49Z")

</div>

Hello Evan,

I’ve posted a similar question few days ago (  
[http://groups.google.com/group/rubyonrails-talk/t/813041902727d8e0?hl=en](http://groups.google.com/group/rubyonrails-talk/t/813041902727d8e0?hl=en)  
). Unfortunately there weren’t any answers yet. So, by now I recommend  
you to take a look at the “rails-authorization-plugin” from  
Writertopia ( [writertopia](http://www.writertopia.com/developers/authorization) ),  
it can can supply your needs for sure.

Last but not least, I also suggest you to keep looking at Ben  
Johnson’s site where recently has been posted some exciting news about  
the future of Authlogic ([http://www.binarylogic.com/2009/2/25/the-](http://www.binarylogic.com/2009/2/25/the-)  
future-of-authlogic-add-ons). There you’ll see something about the add-  
on nr. 5. Maybe you can wait for its release. I confess I’m looking  
forward to it.

Regards,

Adriano

---

<div class="post-metadata">

**Author:** ![evan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/54ee81/32.png) [@evan](https://www.ruby-forum.com/u/evan)\
**Post date:** [February 28, 2009, 12:16am UTC](https://www.ruby-forum.com/t/authorization-system-recommendations/161599/3 "2009-02-28T00:16:49Z")

</div>

Adriano,

Thanks for pointing out your post. I’m looking at the Authorization  
plugin now.

After several more hours of research I’ve found a couple of resources  
that might help you, as well.

A good, comparative overview of lots of authorization plugins  
[http://steffenbartsch.com/blog/2008/08/rails-authorization-plugins/](http://steffenbartsch.com/blog/2008/08/rails-authorization-plugins/)

Declarative Authorization plugin – well-designed authorization system  
that abstracts authorization declarations from application code  
[http://github.com/stffn/declarative\_authorization/tree](http://github.com/stffn/declarative_authorization/tree)

Evan