# Rails Authorization plugins

**URL:** <https://www.ruby-forum.com/t/rails-authorization-plugins/187935>\
**Category:** Rails\
**Created:** [May 2, 2010, 3:13pm UTC](https://www.ruby-forum.com/t/rails-authorization-plugins/187935 "2010-05-02T15:13:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmamma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7feea3/32.png) [@jmamma](https://www.ruby-forum.com/u/jmamma)\
**Post date:** [May 2, 2010, 3:13pm UTC](https://www.ruby-forum.com/t/rails-authorization-plugins/187935/1 "2010-05-02T15:13:54Z")

</div>

We are evaluating authorization plugins for rails and I wanted to  
address the group for some feedback.

The two we are looking at are: cancan by Ryan B. and  
declarative\_authorization.

If anyone has used either of these and can give me some feedback on  
how they have worked out for you that would be great! We would be  
using one of these in conjunction with the restul\_auth plugin btw.

One monkey wrench our project throws in to the mix is that we have a  
multiple database  
per customer model so I’m aware we’ll need to make some changes to the  
plugin in order  
to make it fit. So if you have customized either of the plugins I  
would like how easy / difficult that was.

---

<div class="post-metadata">

**Author:** ![jmamma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7feea3/32.png) [@jmamma](https://www.ruby-forum.com/u/jmamma)\
**Post date:** [May 2, 2010, 4:15pm UTC](https://www.ruby-forum.com/t/rails-authorization-plugins/187935/2 "2010-05-02T16:15:57Z")

</div>

On Sunday 02 May 2010, jmamma wrote:

> The two we are looking at are: cancan by Ryan B. and  
> declarative\_authorization.

I had the same candidates recently and decided to use CanCan. I think  
that they are very similar in spirit, declarative\_authorization is far  
more elaborate and consequently more complex. CanCan is much simpler. As  
I don’t need more than CanCan provides, I went with it.

If you need model-based security over and above resource/controller-  
based checks, than declarative\_authorization is the way to go.

> We would be  
> using one of these in conjunction with the restul\_auth plugin btw.

Have you had a look at authlogic for comparison?

Michael

–  
Michael S.  
[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
[http://www.schuerig.de/michael/](http://www.schuerig.de/michael/)

---

<div class="post-metadata">

**Author:** ![jmamma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7feea3/32.png) [@jmamma](https://www.ruby-forum.com/u/jmamma)\
**Post date:** [May 2, 2010, 4:21pm UTC](https://www.ruby-forum.com/t/rails-authorization-plugins/187935/3 "2010-05-02T16:21:49Z")

</div>

On Sun, May 2, 2010 at 10:12 AM, jmamma [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> One monkey wrench our project throws in to the mix is that we have a  
> multiple database  
> per customer model so I’m aware we’ll need to make some changes to the  
> plugin in order  
> to make it fit. So if you have customized either of the plugins I  
> would like how easy / difficult that was.
> 
> –  
> I’m using declarative\_authorization and I like it a lot.  
> Also, +1 to authlogic instead of restful\_authentication.

–  
Leonardo M…  
There’s no place like ~

---

<div class="post-metadata">

**Author:** ![jmamma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7feea3/32.png) [@jmamma](https://www.ruby-forum.com/u/jmamma)\
**Post date:** [May 4, 2010, 8:51pm UTC](https://www.ruby-forum.com/t/rails-authorization-plugins/187935/4 "2010-05-04T20:51:27Z")

</div>

jmamma wrote:

> We are evaluating authorization plugins for rails and I wanted to  
> address the group for some feedback.
> 
> The two we are looking at are: cancan by Ryan B. and  
> declarative\_authorization.

I’ve never used either of these, but I’ve been working with DocSavage’s  
rails\_authorization plugin. It’s OK, but declarative\_authorization  
looks like the same thing done a little better IIRC.

> If anyone has used either of these and can give me some feedback on  
> how they have worked out for you that would be great! We would be  
> using one of these in conjunction with the restul\_auth plugin btw.

Please, please, _do not_ use restful\_auth. It may seem easier now, but  
in a month you’ll regret it as you will have a User model full of  
unmaintainable generated crap. I echo other posters who recommend  
Authlogic instead.

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid