# Combining rails intrAnet and public site **URL:** \ **Category:** Rails\ **Created:** [October 14, 2009, 3:56pm UTC](https://www.ruby-forum.com/t/combining-rails-intranet-and-public-site/177288 "2009-10-14T15:56:52Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![paerez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5fc32e/32.png) [@paerez](https://www.ruby-forum.com/u/paerez)\ **Post date:** [October 14, 2009, 3:56pm UTC](https://www.ruby-forum.com/t/combining-rails-intranet-and-public-site/177288/1 "2009-10-14T15:56:52Z")
Hello, everyone! I was wondering if somebody has some insight on this issue. [h]A little background:[/h] I work for a midsize electronic manufacturing company with 2 people in IT dept - a network admin and a developer (me). We’ve been using rails to migrate from an old dBase and VB based system to build internal company IntrAnet that does things like label printing, invetory control, shipping, etc. [h]The Dilemma[/h] Right now we need to replace an old website that was done in Java, that would connect to our internal system for out clients to use. We want to be able to pull information like live inventory, order placement, account statements. [h]Actual Question[/h] Does anyone have any suggestion on how to accomplish this in a better way? Here are three options that I see: a) Build a separate Rails app on a web server, that will connect to the same DB that our internal app connects to. +++ Pluses: Live data - same thing that our internal apps see, i.e. orders are created in real time, inventory is depleted right away, — Minuses: Potential security risk, duplication of code - i.e. I need to duplicate all the controllers, models, views, etc. that deal with orders. b) Build a separate Rails app on a web server, that will connect to a different DB from our internal app. +++ Pluses: Less security exposure. — Minuses: Extra effort to sync web DB and internal DB, extra code to handle inventory depletion and order # creationg ,duplication of code - i.e. I need to duplicate all the controllers, models, views, etc. that deal with orders. c) Expose internal app to the web +++ Pluses: all the problems from above eliminated — Minuses: A lot more security headaches. Duplication of login systems - one for web - one for internal users using LDAP. So any thoughts? Anyone had similar problem to solve? ---
**Author:** ![paerez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5fc32e/32.png) [@paerez](https://www.ruby-forum.com/u/paerez)\ **Post date:** [October 15, 2009, 1:36pm UTC](https://www.ruby-forum.com/t/combining-rails-intranet-and-public-site/177288/2 "2009-10-15T13:36:41Z")
Hi nick ! We have been doing exactly that with zena for years (public visitor = anonymous login). I think your use case could be very interesting to try with the new zena as gem: 1. single login system 2. in all your current controllers before\_filter :check\_visitor\_rights def check\_visitor\_rights unless visitor.group\_ids.include?(INTRANET\_ID) raise ActiveRecord::RecordMissing end 1. You create some bridges between the public (zena) site to your intranet by creating “Proxy” models class Client\< Contact zafu\_context :inventory =\> [“Product”], :orders =\> [“Order”] def orders return nil unless client\_id = version.dyn[‘client\_id’] res = Order.find(:all, :conditions =\> [‘client\_id = ?’, client\_id]) res == [] ? nil : res end end NB: “Contact” is a native class in Zena. 1. Declare what can be seen from you existing “Order” class: class Order include RubyLess::SafeClass safe\_method :created\_at =\> Time, :shipping\_date =\> Time, :shipped =\> Boolean, :description =\> String end 2. In the templates for the site, you can customize the look of the site everywhere depending on the visitor or just the visitor’s “own” page: ----- Client.zafu \ \ - \Order shipped on \Order shipping due on \\ \ \ Final note: this has not been done before because zena needed to mature. Now that it’s a “config.gem” away, it would be a very interesting use case and I’d be very happy to help make this real. From what I see right now, there might be some name clashing and we might need to move all zena models into Zena:: scope (that would be a good thing anyway). Let me know what you think. Gaspard PS: zena’s website [http://zenadmin.org](http://zenadmin.org) > Hello, everyone! > > I was wondering if somebody has some insight on this issue. > > [h]A little background:[/h] > I work for a midsize electronic manufacturing company with 2 people in > IT dept - a network admin and a developer (me). > > We’ve been using rails to migrate from an old dBase and VB based system > to build internal company IntrAnet that does things like label printing, > invetory control, shipping, etc. > > [h]The Dilemma[/h] > Right now we need to replace an old website that was done in Java, that > would connect to our internal system for out clients to use. We want to > be able to pull information like live inventory, order placement, > account statements. > > [h]Actual Question[/h] > Does anyone have any suggestion on how to accomplish this in a better > way? > > Here are three options that I see: > a) Build a separate Rails app on a web server, that will connect to the > same DB that our internal app connects to. > +++ Pluses: > Live data - same thing that our internal apps see, i.e. > orders are created in real time, inventory is depleted right away, > — Minuses: > Potential security risk, duplication of code - i.e. I need to > duplicate all the controllers, models, views, etc. that deal with > orders. > b) Build a separate Rails app on a web server, that will connect to a > different DB from our internal app. > +++ Pluses: > Less security exposure. > — Minuses: > Extra effort to sync web DB and internal DB, extra code to > handle inventory depletion and order # creationg ,duplication of code - > i.e. I need to duplicate all the controllers, models, views, etc. that > deal with orders. > > c) Expose internal app to the web > +++ Pluses: > all the problems from above eliminated > — Minuses: > A lot more security headaches. Duplication of login systems - > one for web - one for internal users using LDAP. > > So any thoughts? Anyone had similar problem to solve? ---
**Author:** ![paerez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5fc32e/32.png) [@paerez](https://www.ruby-forum.com/u/paerez)\ **Post date:** [October 15, 2009, 9:33pm UTC](https://www.ruby-forum.com/t/combining-rails-intranet-and-public-site/177288/3 "2009-10-15T21:33:38Z")
Gaspard, thank you for a reply. I checked out zena before, and while it is a good CMS in it’s own right I don’t think I can use it as it would require me to rewrite a huge a existing application, or write api hooks. I was mostly looking for a “RAILS WAY” strategy to implement this. It looks like you are suggesting option #3. Which is what I got from a few other sources. Thank you for reply thou. ---
**Author:** ![paerez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5fc32e/32.png) [@paerez](https://www.ruby-forum.com/u/paerez)\ **Post date:** [October 15, 2009, 9:42pm UTC](https://www.ruby-forum.com/t/combining-rails-intranet-and-public-site/177288/4 "2009-10-15T21:42:29Z")
nick ger wrote: > Gaspard, > > thank you for a reply. > > I checked out zena before, and while it is a good CMS in it’s own right > I don’t think I can use it as it would require me to rewrite a huge a > existing application, or write api hooks. > > I was mostly looking for a “RAILS WAY” strategy to implement this. It > looks like you are suggesting option #3. Which is what I got from a few > other sources. > > Thank you for reply thou. No problem. And don’t worry too much about “exposing” your app. Putting a “before\_filter” in ApplicationController and a careful handling of the login system works good (I am migrating to authlogic). Just take care of two things: 1. no cache 😉 2. keep your clients happy ! Gaspard ---
**Author:** ![paerez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5fc32e/32.png) [@paerez](https://www.ruby-forum.com/u/paerez)\ **Post date:** [October 15, 2009, 11:36pm UTC](https://www.ruby-forum.com/t/combining-rails-intranet-and-public-site/177288/5 "2009-10-15T23:36:52Z")
nick ger wrote: > Gaspard, > while we are on the subject i was recently considering different > systems, and while right now I’m using restful\_authentication I looked > at authlogic as well. > > Any particular reason you prefer it over other rails authorization > systems? I’m not Gaspard, but my reasons for preferring Authlogic are many: - It’s easier to work with. - It doesn’t clutter your model files with framework code (I’m ripping restful\_auth out of Quorum [[http://quorum.sf.net](http://quorum.sf.net) ] at the moment, and the amount of framework-generated crap that I removed from user.rb is staggering). - You get more handy features for free. - Testing generally seems easier. The only downside is that Authlogic does slightly more magic. ## Best, Marnen Laibow-Koser [http://www.marnen.org](http://www.marnen.org) removed\_email\_address@domain.invalid ---
**Author:** ![paerez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5fc32e/32.png) [@paerez](https://www.ruby-forum.com/u/paerez)\ **Post date:** [October 16, 2009, 12:17am UTC](https://www.ruby-forum.com/t/combining-rails-intranet-and-public-site/177288/6 "2009-10-16T00:17:12Z")
Marnen Laibow-Koser wrote: > nick ger wrote: > > > Gaspard, > > while we are on the subject i was recently considering different > > systems, and while right now I’m using restful\_authentication I looked > > at authlogic as well. > > > > Any particular reason you prefer it over other rails authorization > > systems? > > I’m not Gaspard, but my reasons for preferring Authlogic are many: > > - It’s easier to work with. > - It doesn’t clutter your model files with framework code (I’m ripping > restful\_auth out of Quorum [[http://quorum.sf.net](http://quorum.sf.net) ] at the moment, and > the amount of framework-generated crap that I removed from user.rb is > staggering). > - You get more handy features for free. > - Testing generally seems easier. > > The only downside is that Authlogic does slightly more magic. > > ## Best, > > Marnen Laibow-Koser > [http://www.marnen.org](http://www.marnen.org) > removed\_email\_address@domain.invalid For all the reasons above and easy transitions from password hashing schemes: My current hashing method on passwords is not the best possible solution so I can write an ‘InitialCryptoProvider’ to hash and match my old passwords and write a single line in my User class to smoothly transition from one hashing scheme to another without stressing my users. acts\_as\_authentic :transition\_from\_crypto\_provider =\> Zena::BetaCryptoProvider, :crypto\_provider =\> Authlogic::CryptoProviders::BCrypt And authlogic makes it easy to support new authentications (ldap, openid, etc). G. ---
**Author:** ![paerez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5fc32e/32.png) [@paerez](https://www.ruby-forum.com/u/paerez)\ **Post date:** [October 15, 2009, 11:07pm UTC](https://www.ruby-forum.com/t/combining-rails-intranet-and-public-site/177288/7 "2009-10-15T23:07:55Z")
Gaspard, while we are on the subject i was recently considering different systems, and while right now I’m using restful\_authentication I looked at authlogic as well. Any particular reason you prefer it over other rails authorization systems?