# Best authorization? **URL:** \ **Category:** Rails\ **Created:** [January 3, 2006, 10:47pm UTC](https://www.ruby-forum.com/t/best-authorization/56137 "2006-01-03T22:47:25Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![frank](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@frank](https://www.ruby-forum.com/u/frank)\ **Post date:** [January 3, 2006, 10:47pm UTC](https://www.ruby-forum.com/t/best-authorization/56137/1 "2006-01-03T22:47:25Z")
Hello, I want to allow some users to manage other user accounts, but do not want them to manage the admin account. I have tried auth\_generator, login\_engine and user\_engine I am having a hard time gettign this to work. Looking for advise and help. Thanks Frank ---
**Author:** ![frank](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@frank](https://www.ruby-forum.com/u/frank)\ **Post date:** [January 3, 2006, 11:33pm UTC](https://www.ruby-forum.com/t/best-authorization/56137/2 "2006-01-03T23:33:30Z")
Hi Frank, I’ve being messing with login\_engine for a day or two and it works nicely. Going from there, ik think what you want is not that hard to realise. If you create an extra field in the users table which is called e.g. maintained\_by. Then you can set up relations between what user-user can be maintained by what admin-user (admin-user being a user with privileges to manage other users). Or, if it needs to be ‘bigger’. An extra table with a many-to-many relationship if an enduser can be maintained by more then one admin-user. (but that seems like overkill. Regards, Gerard. On Tuesday 03 January 2006 22:44, Frank tried to type something like: > Thanks > Frank – “Who cares if it doesn’t do anything? It was made with our new Triple-Iso-Bifurcated-Krypton-Gate-MOS process …” My $Grtz =~ Gerard; ~ :wq! ---
**Author:** ![frank](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@frank](https://www.ruby-forum.com/u/frank)\ **Post date:** [January 4, 2006, 3:03am UTC](https://www.ruby-forum.com/t/best-authorization/56137/3 "2006-01-04T03:03:03Z")
Frank wrote: > Hello, > > I want to allow some users to manage other user accounts, but do not > want them to manage the admin account. > > I have tried auth\_generator, login\_engine and user\_engine > > I am having a hard time gettign this to work. > Looking for advise and help. > > Thanks > Frank The login/user engine combo supports multiple ‘roles’. There are two edit funcitons, one that edits the current user and one that edits a different one. It is a simple matter to assign the permission to use the one that edits other users to an ‘superadmin’ or ‘admin’ role. ---
**Author:** ![frank](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@frank](https://www.ruby-forum.com/u/frank)\ **Post date:** [January 4, 2006, 4:37am UTC](https://www.ruby-forum.com/t/best-authorization/56137/4 "2006-01-04T04:37:25Z")
I am having trouble understanding the user\_engine. It seems if I uncheck all user permissions for a role called supervisor. The user assigned to supervisor can still create a new user. Is there any better docs on loging\_engine and user\_engine? Frank ---
**Author:** ![frank](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@frank](https://www.ruby-forum.com/u/frank)\ **Post date:** [January 4, 2006, 11:00am UTC](https://www.ruby-forum.com/t/best-authorization/56137/5 "2006-01-04T11:00:23Z")
The administrator role (i.e. the one which the user engine has been told to use as admin) is ‘omnipotent’ - i.e. any users with this role will be able to perform all actions, no matter what the actual permissions set to it are. It’s basically a ‘root’ user. What you probably want to do is create a _new_ role for your supervisor - which will, of course, respect the permissions you assign to it. Aside from the RDoc in the code, there is no real documentation for the user engine (or the login engine I suppose). Obviously it would be great if there was more information, and I’ll work on that when I get the chance. However, docs will never be a substitute for reading (and hopefully understanding) the code… - james ---
**Author:** ![frank](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@frank](https://www.ruby-forum.com/u/frank)\ **Post date:** [January 4, 2006, 6:12pm UTC](https://www.ruby-forum.com/t/best-authorization/56137/6 "2006-01-04T18:12:41Z")
ok, I created a supervisor role and assigned delete\_user and edit\_user. This role is allowed to delete admin. I do not want admin to be changed or deleted by this role. What can I do? Frank ----- Original Message ----- From: “James A.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) To: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent: Wednesday, January 04, 2006 4:57 AM Subject: Re: [Rails] Re: best authorization? The administrator role (i.e. the one which the user engine has been told to use as admin) is ‘omnipotent’ - i.e. any users with this role will be able to perform all actions, no matter what the actual permissions set to it are. It’s basically a ‘root’ user. What you probably want to do is create a _new_ role for your supervisor - which will, of course, respect the permissions you assign to it. Aside from the RDoc in the code, there is no real documentation for the user engine (or the login engine I suppose). Obviously it would be great if there was more information, and I’ll work on that when I get the chance. However, docs will never be a substitute for reading (and hopefully understanding) the code… - james On 1/4/06, Frank R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > Frank wrote: > > > > > Thanks > > > Rails mailing list > > > removed\_email\_address@domain.invalid > > > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) > > * * * > > Rails mailing list > removed\_email\_address@domain.invalid > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) * * * Rails mailing list removed\_email\_address@domain.invalid [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) ---
**Author:** ![frank](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@frank](https://www.ruby-forum.com/u/frank)\ **Post date:** [January 4, 2006, 6:14pm UTC](https://www.ruby-forum.com/t/best-authorization/56137/7 "2006-01-04T18:14:32Z")
You want something that is beyond the scope of the user engine, i.e. access control over specific objects. The user engine only controls which actions a particular Role can execute. However, you can control which objects can be manipulated by providing different actions for manipulating each object type. The user engine’s own user-management actions will need to be overriden if you want to impose restrictions on which objects they can modify. - james ---
**Author:** ![frank](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@frank](https://www.ruby-forum.com/u/frank)\ **Post date:** [April 5, 2006, 10:00pm UTC](https://www.ruby-forum.com/t/best-authorization/56137/8 "2006-04-05T22:00:45Z")
How about using ActiveRBAC instead? I haven’t used it but it has very nice documentation, which I’ve read, and it seems it would do what you want. [https://activerbac.turingstudio.com/trac/wiki](https://activerbac.turingstudio.com/trac/wiki) (follow the link to the pdf documentation - its simple and clear) Has anyone tried this? How does it compare with other such plugins, engines, generators? What about this one - it seems more flexible still: [http://www.billkatz.com/authorization](http://www.billkatz.com/authorization) but which is more mature? Which one can I just plug in and run with?