# Devise, Authlogic, & Restful Authorization

**URL:** <https://www.ruby-forum.com/t/devise-authlogic-restful-authorization/181404>\
**Category:** Rails\
**Created:** [January 11, 2010, 2:17pm UTC](https://www.ruby-forum.com/t/devise-authlogic-restful-authorization/181404 "2010-01-11T14:17:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\
**Post date:** [January 11, 2010, 2:17pm UTC](https://www.ruby-forum.com/t/devise-authlogic-restful-authorization/181404/1 "2010-01-11T14:17:41Z")

</div>

This is not a question but a mini-report to others who might be in my  
boat.

My application needed/needs the ability to authenticate a login via  
email.

There are Restful Authorization examples that claim to do this … but I  
have not been able to successfully get it to work. I can get the email  
send out and the email responded to, but the sample code I trided to  
implement do not then “authorize” the user.

I also tried Authlogic. If there are hooks in there with the state  
machine such that an email could be sent out, I could not find it.

Finally I tried something call Devise … which sits on top of Warden.  
Sample Devise code (with a bit of smtp massaging) pretty much worked  
right out of the box. That sample can be found at  
[http://github.com/plataformatec/devise\_example](http://github.com/plataformatec/devise_example)

Note that the example uses a user’s email as a login id. Adding a login  
id and “hiding” the email when the user logs in is left as an exercise  
to the reader. I went through that exercise and it made me a bit  
familiar with the Devise internals. Some of the error messages are in  
the code … others are in yml files.

It takes some doing to get it all installed. Nonetheless, I recommend  
Devise.

Caution: I’m a newbie to RoR so take my recommendation with a brick of  
salt.

---

<div class="post-metadata">

**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\
**Post date:** [January 11, 2010, 2:44pm UTC](https://www.ruby-forum.com/t/devise-authlogic-restful-authorization/181404/2 "2010-01-11T14:44:47Z")

</div>

Ralph S. wrote:

> This is not a question but a mini-report to others who might be in my  
> boat.

…

I apologize to everyone for my spelling and grammar errors. I usually  
do a better job of proofreading.

Damn, I’ve been up too many hours.

---

<div class="post-metadata">

**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\
**Post date:** [January 11, 2010, 6:19pm UTC](https://www.ruby-forum.com/t/devise-authlogic-restful-authorization/181404/3 "2010-01-11T18:19:30Z")

</div>

Ralph S. wrote:

> This is not a question but a mini-report to others who might be in my  
> boat.
> 
> My application needed/needs the ability to authenticate a login via  
> email.
> 
> There are Restful Authorization examples that claim to do this … but I  
> have not been able to successfully get it to work. I can get the email  
> send out and the email responded to, but the sample code I trided to  
> implement do not then “authorize” the user.
> 
> I also tried Authlogic. If there are hooks in there with the state  
> machine such that an email could be sent out, I could not find it.

You can do this with Authlogic, and I don’t believe  
acts\_as\_state\_machine is necessary. See of the rdoc for the various  
Authlogic ::Config modules has anything useful. Or you might need to  
use perishable\_token.

> Finally I tried something call Devise … which sits on top of Warden.  
> Sample Devise code (with a bit of smtp massaging) pretty much worked  
> right out of the box. That sample can be found at  
> [http://github.com/plataformatec/devise\_example](http://github.com/plataformatec/devise_example)
> 
> Note that the example uses a user’s email as a login id. Adding a login  
> id and “hiding” the email when the user logs in is left as an exercise  
> to the reader. I went through that exercise and it made me a bit  
> familiar with the Devise internals. Some of the error messages are in  
> the code … others are in yml files.
> 
> It takes some doing to get it all installed. Nonetheless, I recommend  
> Devise.
> 
> Caution: I’m a newbie to RoR so take my recommendation with a brick of  
> salt.

Then why are you even making it?

Seriously, don’t give up on Authlogic. It’s what most people are using  
these days. Check out Railscast #160 if you need an overview.

Best,  
–Â  
Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid