# Role Based Access Control extension

**URL:** <https://www.ruby-forum.com/t/role-based-access-control-extension/128004>\
**Category:** Radiant CMS\
**Created:** [February 4, 2008, 5:37am UTC](https://www.ruby-forum.com/t/role-based-access-control-extension/128004 "2008-02-04T05:37:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jimgroom](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7cd45c/32.png) [@jimgroom](https://www.ruby-forum.com/u/jimgroom)\
**Post date:** [February 4, 2008, 5:37am UTC](https://www.ruby-forum.com/t/role-based-access-control-extension/128004/1 "2008-02-04T05:37:16Z")

</div>

Hot on the heels of our Featured Pages extension is an update to RBAC  
Base

SVN repo at [http://www.saturnflyer.com/svn/radiantP/rbac\_base/trunk](http://www.saturnflyer.com/svn/radiantP/rbac_base/trunk)

It was mentioned on the list months ago, but hadn’t received enough  
attention (internally) to warrant putting it on the  
[http://wiki.radiantcms.org/Thirdparty\_Extensions/](http://wiki.radiantcms.org/Thirdparty_Extensions/)  
but it is there now.

RBAC Base gives you the ability to grow beyond the standard roles in  
Radiant, allowing you to build extensions around your own roles.

It adds a roles table, a roles\_users table, and creates the  
has\_and\_belongs\_to\_many relationship between users and roles.

- The drag/drop for the users is a little quirky, but it works (and  
will be updated in the future).
- Does not yet provide a way to set the :visibility for your extensions
- Role deletions sit dangerously behind a GET method, so beware, but  
we’ll be fixing that too.

---

<div class="post-metadata">

**Author:** ![jimgroom](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7cd45c/32.png) [@jimgroom](https://www.ruby-forum.com/u/jimgroom)\
**Post date:** [February 4, 2008, 5:41am UTC](https://www.ruby-forum.com/t/role-based-access-control-extension/128004/2 "2008-02-04T05:41:58Z")

</div>

This sounds awesome!! Can’t wait to try it! 🙂

Cheers,  
Mohit.  
2/4/2008 | 12:41 PM.

---

<div class="post-metadata">

**Author:** ![jimgroom](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7cd45c/32.png) [@jimgroom](https://www.ruby-forum.com/u/jimgroom)\
**Post date:** [February 4, 2008, 8:19am UTC](https://www.ruby-forum.com/t/role-based-access-control-extension/128004/3 "2008-02-04T08:19:07Z")

</div>

Jim G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes:

> RBAC Base gives you the ability to grow beyond the standard roles in  
> Radiant, allowing you to build extensions around your own roles.

Interesting.

I’ve been wondering what other Radiant developers have been doing for  
general site users as opposed to admin users. If I’m reading the code  
right, this is still primarily aimed at users of the backend CMS.

I’ve been debating on re-using the existing users model versus  
creating a new ‘members’ model. If anyone has done something like  
this, I’d love to hear your thoughts.

–  
J Aaron F. [jadetower.com](http://jadetower.com) [US] +1 724-964-4515  
馮傑仁 [cubiclemuses.com](http://cubiclemuses.com) [HK] +852 8123-7905

---

<div class="post-metadata">

**Author:** ![jimgroom](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7cd45c/32.png) [@jimgroom](https://www.ruby-forum.com/u/jimgroom)\
**Post date:** [February 4, 2008, 9:14am UTC](https://www.ruby-forum.com/t/role-based-access-control-extension/128004/4 "2008-02-04T09:14:29Z")

</div>

Hi Jim,

> I’ve been debating on re-using the existing users model versus  
> creating a new ‘members’ model. If anyone has done something like  
> this, I’d love to hear your though

There is one thing I can recommend you NOT to do, and this make an  
inherited user model (i.e. “class Member \< User”). I tried that on a  
Radiant-based project, and it was a headache.

For another site I’ve reused the Radiant user model, adding fields to  
the users table as needed. There is, however, some things to be aware  
of:

1. You must seal of all admin controllers for ordinary users (non dev  
or admin) - I do it like this: [Parked at Loopia](http://pastie.caboo.se/147172)
2. You should code your own Users- and Session-controllers for  
registration and login to avoid mixing up with the Radiant admin pages.

It works for me, and I like not having to deal with two different  
models covering the same concept, but you have to do a bit of  
metaprogramming in your extension(s) to add stuff to existing Radiant  
code. You might find it easier to work with a seperate Member model,  
but feel that my approach is DRY’er.

Cheers,  
Casper F.  
[casperfabricius.com](http://casperfabricius.com)