# One account several users with different privileges

**URL:** <https://www.ruby-forum.com/t/one-account-several-users-with-different-privileges/189509>\
**Category:** Rails\
**Created:** [June 2, 2010, 12:54am UTC](https://www.ruby-forum.com/t/one-account-several-users-with-different-privileges/189509 "2010-06-02T00:54:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dlucca](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/6a8cbe/32.png) [@dlucca](https://www.ruby-forum.com/u/dlucca)\
**Post date:** [June 2, 2010, 12:54am UTC](https://www.ruby-forum.com/t/one-account-several-users-with-different-privileges/189509/1 "2010-06-02T00:54:24Z")

</div>

My app needs to have an account with several users inputting tasks on  
the same account. Only one of the users (the one that opened the  
account) will have admin privileges.

I’m thinking on using Authlogic for authentication and CanCan for  
determining user privileges. The point is that I’d like the User that  
opened the Account to be admin by default being him the only one to be  
able to create other Users for his account with a different privileges.

---

<div class="post-metadata">

**Author:** ![dlucca](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/6a8cbe/32.png) [@dlucca](https://www.ruby-forum.com/u/dlucca)\
**Post date:** [June 2, 2010, 5:55pm UTC](https://www.ruby-forum.com/t/one-account-several-users-with-different-privileges/189509/2 "2010-06-02T17:55:32Z")

</div>

I’m working on something similar right now. I created a very simple  
login/authentication method and now I’m dealing with users privileges  
in the site.

In my case I have posts that belongs to companies so only users from  
the post’s company can view them. Also each user has roles (Admin) to  
edit, remove, etc and (Some Role) to view exclusive posts.

I’m taking a look to both CanCan and Canable ([http://github.com/](http://github.com/)  
jnunemaker/canable)

I’ll keep updating. Any preference on plugin or would it be better to  
write some custom code?

---

<div class="post-metadata">

**Author:** ![dlucca](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/6a8cbe/32.png) [@dlucca](https://www.ruby-forum.com/u/dlucca)\
**Post date:** [June 3, 2010, 1:39am UTC](https://www.ruby-forum.com/t/one-account-several-users-with-different-privileges/189509/3 "2010-06-03T01:39:28Z")

</div>

Carlos Cabrera wrote:

> I’m working on something similar right now. I created a very simple  
> login/authentication method and now I’m dealing with users privileges  
> in the site.
> 
> In my case I have posts that belongs to companies so only users from  
> the post’s company can view them. Also each user has roles (Admin) to  
> edit, remove, etc and (Some Role) to view exclusive posts.
> 
> I’m taking a look to both CanCan and Canable ([http://github.com/](http://github.com/)  
> jnunemaker/canable)
> 
> I’ll keep updating. Any preference on plugin or would it be better to  
> write some custom code?

My idea is when you sign up for an account you should fill up the  
account name (Company) and the first users data (First name, Last, etc)  
Being this first user the only Admin user.  
From there that Admin user will create new users capable of adding tasks  
to that account (company).  
How would you approach this?

---

<div class="post-metadata">

**Author:** ![dlucca](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/6a8cbe/32.png) [@dlucca](https://www.ruby-forum.com/u/dlucca)\
**Post date:** [June 3, 2010, 2:09am UTC](https://www.ruby-forum.com/t/one-account-several-users-with-different-privileges/189509/4 "2010-06-03T02:09:00Z")

</div>

We had a similar problem - we did it this way: set a global string  
ADMINCODE = “somethingImpossibleToGuess” and include a text field for  
this in the signup form. If the user can enter an admin code, then  
they get to be admin.