# Rails and user authentification

**URL:** <https://www.ruby-forum.com/t/rails-and-user-authentification/61865>\
**Category:** Rails\
**Created:** [May 29, 2006, 4:26am UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865 "2006-05-29T04:26:30Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![alain](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@alain](https://www.ruby-forum.com/u/alain)\
**Post date:** [May 29, 2006, 4:26am UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865/1 "2006-05-29T04:26:30Z")

</div>

I am a the point now where I have to add user authentification to my  
application.

Anyone can point me toward an easy to use / secure library? I know about  
ActiveRBAC and was wondering if there is anything else that I should  
consider.

Thanks!

---

<div class="post-metadata">

**Author:** ![alain](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@alain](https://www.ruby-forum.com/u/alain)\
**Post date:** [May 29, 2006, 5:29am UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865/2 "2006-05-29T05:29:36Z")

</div>

What are you requirements?

---

<div class="post-metadata">

**Author:** ![alain](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@alain](https://www.ruby-forum.com/u/alain)\
**Post date:** [May 29, 2006, 6:31am UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865/3 "2006-05-29T06:31:23Z")

</div>

I like to keep it simple, so check out the rails recipe book for really  
simple, or  
acts\_as\_authenticated for the next step up in complexity, but less  
complex than most of  
the others.

---

<div class="post-metadata">

**Author:** ![alain](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@alain](https://www.ruby-forum.com/u/alain)\
**Post date:** [May 29, 2006, 1:37pm UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865/4 "2006-05-29T13:37:24Z")

</div>

Hi,

I am doing a ASP kind of application. I havent figured out the hosting  
server, but it will probably be a Linux box.

I need to be able to manage roles/permission/groups. People are going to  
pay for the service, so it has to be very secure. Its my first time  
developping a “seriously” secure application. Hence the reason I want to  
use a popular framework.

Any other things I need to consider?

Thanks

---

<div class="post-metadata">

**Author:** ![alain](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@alain](https://www.ruby-forum.com/u/alain)\
**Post date:** [May 29, 2006, 9:06pm UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865/5 "2006-05-29T21:06:06Z")

</div>

I tend to agree with Jim. I usually roll my own (authentication that  
is) and I’ve also used acts\_as\_authenticated, which “just works” and  
is straightforward.

There’s a ton of options out there, you’ll just have to evaluate them  
and see if they match up to your requirements.

Michael

---

<div class="post-metadata">

**Author:** ![alain](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@alain](https://www.ruby-forum.com/u/alain)\
**Post date:** [May 29, 2006, 10:00pm UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865/6 "2006-05-29T22:00:35Z")

</div>

I found that this one was pretty easy/straightforward to implement.  
[http://penso.info/rails/auth\_generator/](http://penso.info/rails/auth_generator/)

---

<div class="post-metadata">

**Author:** ![alain](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@alain](https://www.ruby-forum.com/u/alain)\
**Post date:** [May 29, 2006, 10:41pm UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865/7 "2006-05-29T22:41:37Z")

</div>

The rails recipe book also has an RBAC that is very simple to implement,  
I slipped that  
into my app on top of acts\_as\_authenticated in a few hours.

I also like Bill K.'s approach, although I have not implemented it  
([http://www.billkatz.com/authorization](http://www.billkatz.com/authorization)).

I have posted a recipe for an admin page for managing Rights and Roles  
on my blog,  
[http://blog.wolfman.com/articles/2006/05/20/role-based-authentication-admin-page](http://blog.wolfman.com/articles/2006/05/20/role-based-authentication-admin-page)

---

<div class="post-metadata">

**Author:** ![alain](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@alain](https://www.ruby-forum.com/u/alain)\
**Post date:** [May 30, 2006, 11:54am UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865/8 "2006-05-30T11:54:41Z")

</div>

I prefer to write it for each application. I just did a writeup on basic  
user authentication. It covers some of the patterns that I’ve been using  
for  
authentication:

[http://www.aidanf.net/rails\_user\_authentication\_tutorial](http://www.aidanf.net/rails_user_authentication_tutorial)

cheers,

AF

---

<div class="post-metadata">

**Author:** ![alain](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@alain](https://www.ruby-forum.com/u/alain)\
**Post date:** [May 30, 2006, 10:16am UTC](https://www.ruby-forum.com/t/rails-and-user-authentification/61865/9 "2006-05-30T10:16:42Z")

</div>

Sorry my blog link was not working (I changed the date which changed the  
link!) It now  
works and is  
[http://blog.wolfman.com/articles/2006/05/20/role-based-authentication-admin-page](http://blog.wolfman.com/articles/2006/05/20/role-based-authentication-admin-page)