# Role Based Authorization recipe implementation?

**URL:** <https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029>\
**Category:** Rails\
**Created:** [April 28, 2006, 12:44am UTC](https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029 "2006-04-28T00:44:13Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [April 28, 2006, 12:44am UTC](https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029/1 "2006-04-28T00:44:13Z")

</div>

i got the rails recipes book, i have now an auth system for users  
without problems, now i want to made a role based acces for my app, im  
following the “Role Based Authorization” recipe of the book but i cant  
make it to work even when the tables created and correctly added data  
manually definig the roles and rights. als i dont know how to define a  
right for use all the actions in a certain controller or define another  
that gives right to use a group of controllers.

If someone knows where to find an implementation of this, good  
references about this kind of auth system or willing to help with this  
will be excellent. 🙂

---

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [April 28, 2006, 1:04am UTC](https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029/2 "2006-04-28T01:04:34Z")

</div>

I implemented the RBAC from the recipes book it seems to work fine. I  
added  
synchronize\_with\_controllers to my rights model, taken from the  
user\_engine (which is a  
great resource to get ideas from), it automatically finds all  
controllers and actions  
and adds them to the rights table.

Then all you have to do is associate the relevant right with the  
relevant role.

I have an example view to do that which I’ll try to write up and post  
somewhere.

It is also helpful to have an override to get things setup initially,  
what I do is allow  
any used logged in with the name admin, to get rights to everything.  
basically add  
something like this to the authorized? method…

```
    # admin can do everything
    if user.login_name == 'admin'
        return true
    end

```

# this is the Rights model…

class Right \< ActiveRecord::Base  
has\_and\_belongs\_to\_many :roles  
validates\_presence\_of :controller, :action, :name  
validates\_uniqueness\_of :name

```
# Ensure that the table has one entry for each controller/action 

```

pair  
def self.synchronize\_with\_controllers  
# weird hack. otherwise ActiveRecord has no idea about the  
superclass of any  
# ActionController stuff…  
require RAILS\_ROOT + “/app/controllers/application”

```
    # Load all the controller files
    controller_files = Dir[RAILS_ROOT + 

```

“/app/controllers/\*\*/\*\_controller.rb”]

```
    # we need to load all the controllers...
    controller_files.each do |file_name|
        require file_name #if /_controller.rb$/ =~ file_name
    end

    # Find the actions in each of the controllers, and add them to 

```

the database  
subclasses\_of(ApplicationController).each do |controller|  
controller.public\_instance\_methods(false).each do |action|  
next if action =~  
/return\_to\_main|component\_update|component/  
if  
find\_all\_by\_controller\_and\_action(controller.controller\_path,  
action).empty?  
self.new(:name =\> “#{controller}.#{action}”,  
:controller =\>  
controller.controller\_path, :action =\> action).save!  
logger.info “added: #{controller} -  
#{controller.controller\_path},  
#{action}”  
end  
end  
end  
end  
end

---

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [April 28, 2006, 2:11am UTC](https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029/3 "2006-04-28T02:11:55Z")

</div>

I thinks thats far more complicated that what im trying to do, i have  
this data:

users id username  
15 ana

roles\_users role user\_id  
2 15

roles id name  
2 moderator

rights\_roles right\_id role\_id  
2 2

rights id name controller action  
2 see dashboard dashboard list

so it gives permission to the user ana to see the dashboard and its list  
action, but when i try to login i get “You are not authorized to view  
the page you requested” and shows again the login form.

Note: if i take of the check\_authorization action from the controller  
the authentication works perfect.

Here is my code:

#admin\_controller--------where auth takes place  
class Admin::AdminController \< ApplicationController  
before\_filter :check\_authentication, :check\_authorization,  
:except =\> [:signin\_form, :signin]

layout ‘admin/login\_form’  
def index  
redirect\_to :controller =\> ‘dashboard’  
end  
def check\_authentication  
unless session[:user]  
flash[:notice] = “caminaste”  
redirect\_to :controller =\> “admin”, :action =\> “signin\_form”  
end  
end

def check\_authorization  
user = session[:user].id  
unless user.roles.detect{|role|  
role.rights.detect{|right|  
right.action == action\_name && right.controller ==  
controller\_name  
}  
}  
flash[:notice] = “You are not authorized to view the page you  
requested”  
request.env[“HTTP\_REFERER”] ? (redirect\_to :back) : (redirect\_to  
:controller =\> ‘dashboard’)

```
return false
end

```

end

hope im a little more clear ☹

---

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [April 28, 2006, 9:11am UTC](https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029/4 "2006-04-28T09:11:37Z")

</div>

Without knowing what url you are trying to access I can take a guess.

The only controller/action that will not give this error is  
dashboard/list

Even dashboard/index will give the error, so maybe you are trying to  
access the index in  
which case it needs to be added as a right too.

Remember that every method that can be called in a controller needs to  
have a right  
associated with it, and the role needs to be associated with each right  
it my need to  
access.

But just to be a little clearer what url are you trying to access, and  
maybe an excerpt  
from the server log would help.

---

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [April 28, 2006, 12:19pm UTC](https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029/5 "2006-04-28T12:19:26Z")

</div>

Ana B. wrote:

> i get “You are not authorized to view  
> the page you requested” and shows again the login form.
> 
> Note: if i take of the check\_authorization action from the controller  
> the authentication works perfect.

I had the same problem with that recipe, never solved it so used this  
tutorial instead.

[http://d-haven.org/modules/news/article.php?storyid=28](http://d-haven.org/modules/news/article.php?storyid=28)

Seems to work to some degree but not as good as the recipe would have  
been if I could have made it work.

---

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [June 9, 2006, 12:07am UTC](https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029/6 "2006-06-09T00:07:06Z")

</div>

I have also started to work with this role based implementation, but  
when I try to have a check\_authorization,

def check\_authorization  
unless user.roles.detect{|role|  
role.rights.detect{|right|  
right.action == action\_name && right.controller ==

“adresse”  
}  
}  
flash[:notice] = “failed”  
request.env[“HTTP\_REFERER”] ? (redirect\_to :back) : (redirect\_to  
:action =\> “home”)  
return false  
end

I have this message

Mysql::Error: #42000You have an error in your SQL syntax; check the  
manual that corresponds to your MySQL server version for the right  
syntax to use near ‘right INNER JOIN right\_role ON right.id =  
right\_role.right\_id WHERE (right\_role’ at line 1: SELECT \* FROM right  
INNER JOIN right\_role ON right.id = right\_role.right\_id WHERE  
(right\_role.role\_id = 1 )

And I am sure I have correctly entered the data in the tables and join  
tables.

I wanted to know if it were the actions that caused trouble but it  
actually fails when I just enter :

def check\_authorization  
user = User.find(session[:user])  
user.roles.detect{|role|  
role.rights.detect{|right|  
}  
}  
end

Anyone has an idea of what I did wrong ?  
Thanks for the reply

---

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [June 9, 2006, 2:23am UTC](https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029/7 "2006-06-09T02:23:49Z")

</div>

i think it may have something to do with the fact that you’re using the  
word ‘right’.  
considering one can do left and right joins.  
try renaming your model.

d.

---

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [June 9, 2006, 2:27am UTC](https://www.ruby-forum.com/t/role-based-authorization-recipe-implementation/59029/8 "2006-06-09T02:27:12Z")

</div>

that is, rename your table name, this is a mysql thing.