# How do you manage Access Control? **URL:** \ **Category:** Rails\ **Created:** [September 9, 2008, 5:51pm UTC](https://www.ruby-forum.com/t/how-do-you-manage-access-control/148133 "2008-09-09T17:51:11Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\ **Post date:** [September 9, 2008, 5:51pm UTC](https://www.ruby-forum.com/t/how-do-you-manage-access-control/148133/1 "2008-09-09T17:51:11Z")
I’m working on a rather large app, where we have more than 7 user roles, each of which will have permission to access different parts of the application. Now the User/Admin system is falling short so I need to redefine the access control system. I am thinking of coding something like cakephp uses, with aro’s and aco’s but is rather unmantainable to have a table with every single possible route and grant access to roles. what is the best way to manage access control? how do you do it? Thank you. ---
**Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\ **Post date:** [September 9, 2008, 6:38pm UTC](https://www.ruby-forum.com/t/how-do-you-manage-access-control/148133/2 "2008-09-09T18:38:47Z")
Check out restful authentication plugin, and the role authentication plugin that works as an addition ---
**Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\ **Post date:** [September 9, 2008, 6:47pm UTC](https://www.ruby-forum.com/t/how-do-you-manage-access-control/148133/3 "2008-09-09T18:47:40Z")
> what is the best way to manage access control? how do you do it? I don’t, but you could try one of these: [http://agilewebdevelopment.com/plugins/search?search=acl](http://agilewebdevelopment.com/plugins/search?search=acl) ---
**Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\ **Post date:** [September 9, 2008, 7:49pm UTC](https://www.ruby-forum.com/t/how-do-you-manage-access-control/148133/4 "2008-09-09T19:49:49Z")
max wrote: > I am actually using the restful\_acl, and restul\_authentication > plugins, but they are really falling short Check out this tutorial on restful\_authentication, maybe it could give you some ideas on access control. [http://railsforum.com/viewtopic.php?id=14216](http://railsforum.com/viewtopic.php?id=14216) mike ---
**Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\ **Post date:** [September 9, 2008, 7:47pm UTC](https://www.ruby-forum.com/t/how-do-you-manage-access-control/148133/5 "2008-09-09T19:47:05Z")
I am actually using the restful\_acl, and restul\_authentication plugins, but they are really falling short ---
**Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\ **Post date:** [September 9, 2008, 10:07pm UTC](https://www.ruby-forum.com/t/how-do-you-manage-access-control/148133/6 "2008-09-09T22:07:28Z")
I had similar requirements. I ended up creating a new model “permited\_actions” where I have a list of all controllers/actions. I also created HABTM relationship between the roles and permited\_actions. Then assigned users to different roles. Finally, added a before\_filter on each controller to check\_action\_permission (I put that method in application.rb) On Sep 9, 12:49 pm, Michael Lavrisha \ **Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\ **Post date:** [September 10, 2008, 7:26am UTC](https://www.ruby-forum.com/t/how-do-you-manage-access-control/148133/7 "2008-09-10T07:26:26Z") tried this one? [http://agilewebdevelopment.com/plugins/show/807](http://agilewebdevelopment.com/plugins/show/807) ---
**Author:** ![max](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e5b9ba/32.png) [@max](https://www.ruby-forum.com/u/max)\ **Post date:** [October 13, 2008, 9:50pm UTC](https://www.ruby-forum.com/t/how-do-you-manage-access-control/148133/8 "2008-10-13T21:50:27Z")
On Sep 9, 12:56 pm, max [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I am actually using the restful\_acl, and restul\_authentication > plugins, but they are really falling short May I ask how? Can I help?