# Role based authorization question

**URL:** <https://www.ruby-forum.com/t/role-based-authorization-question/66318>\
**Category:** Rails\
**Created:** [August 24, 2006, 7:32pm UTC](https://www.ruby-forum.com/t/role-based-authorization-question/66318 "2006-08-24T19:32:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hroberts](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/50afbb/32.png) [@hroberts](https://www.ruby-forum.com/u/hroberts)\
**Post date:** [August 24, 2006, 7:32pm UTC](https://www.ruby-forum.com/t/role-based-authorization-question/66318/1 "2006-08-24T19:32:40Z")

</div>

I am using the the authorization recipe outlined in Rails Recipes.Is it  
possible for one role, say ‘admin’, to have access to every action on  
every  
controller without explicitly having to create a Right for each?

I know this will not work as is, and to force it to do so would violate  
MVC,  
but is there some other way to accomplish having something like this in  
a  
controller:

loggedin=false;  
if session[:user]  
Applicant.find(session[:user]).roles.each{|r| loggedin=true if r.name==  
“admin”}  
end  
skip\_before\_filter :check\_authentication, :check\_authorization if  
loggedin

Thanks,  
Howard

---

<div class="post-metadata">

**Author:** ![hroberts](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/50afbb/32.png) [@hroberts](https://www.ruby-forum.com/u/hroberts)\
**Post date:** [August 24, 2006, 10:39pm UTC](https://www.ruby-forum.com/t/role-based-authorization-question/66318/2 "2006-08-24T22:39:14Z")

</div>

On 8/24/06, Howard R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Applicant.find(session[:user]).roles.each{|r| loggedin=true if  
> r.name==“admin”}  
> end  
> skip\_before\_filter :check\_authentication, :check\_authorization if loggedin
> 
> Thanks,  
> Howard

I store \* as a wildcard for the action/controller columns, and query  
for (rights.controller = controller\_name OR rights.controller = ‘\*’)  
AND in my authorized() method.

Isak

---

<div class="post-metadata">

**Author:** ![hroberts](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/50afbb/32.png) [@hroberts](https://www.ruby-forum.com/u/hroberts)\
**Post date:** [August 25, 2006, 12:03am UTC](https://www.ruby-forum.com/t/role-based-authorization-question/66318/3 "2006-08-25T00:03:22Z")

</div>

On 8/24/06, Isak H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I store \* as a wildcard for the action/controller columns, and query  
> for (rights.controller = controller\_name OR rights.controller = ‘\*’)  
> AND in my authorized() method.
> 
> Isak

Thanks Isak, It seemed so very obvious once I saw your suggestion. I  
works  
beautifully.

Thank You,  
Howard