# Ruby on Rails Authentication & Access Control **URL:** \ **Category:** Rails\ **Created:** [May 22, 2008, 9:27am UTC](https://www.ruby-forum.com/t/ruby-on-rails-authentication-access-control/138358 "2008-05-22T09:27:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Walter\_Lockhart](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba8739/32.png) [@Walter\_Lockhart](https://www.ruby-forum.com/u/Walter_Lockhart)\ **Post date:** [May 22, 2008, 9:27am UTC](https://www.ruby-forum.com/t/ruby-on-rails-authentication-access-control/138358/1 "2008-05-22T09:27:44Z")
Hi Forum, I hope someone can help me. I have a client who has asked me to develop a project status tracking application using Ruby on Rails which will enable various business partners to view the status of various projects that are currently in progress. Each business partner will have projects which they can view the status. There will be projects which some business partners cannot view the status. Would someone please direct me to a plug-in or tutorial or book which will enable me to setup this scenario in Ruby on Rails. I suppose what I’m really looking for is a facility to not only perform Authentication (i.e., registration, login, logout, etc.) but also Access Control to projects in this case (e.g., User A can view Projects A, B & C, but not Projects D, E & F, in fact, User A doesn’t even know that Projects D, E & F exist). I hope someone can provide direction. Thanks in advance. Kind Regards Walter ---
**Author:** ![Walter\_Lockhart](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba8739/32.png) [@Walter\_Lockhart](https://www.ruby-forum.com/u/Walter_Lockhart)\ **Post date:** [May 22, 2008, 10:22am UTC](https://www.ruby-forum.com/t/ruby-on-rails-authentication-access-control/138358/2 "2008-05-22T10:22:18Z")
Have a look at: [http://www.railsforum.com/viewtopic.php?id=14216](http://www.railsforum.com/viewtopic.php?id=14216) And particularly post #5, where the author explains about different “areas” of the application, selecting by the user role. Regards, Rey9999 ---
**Author:** ![Walter\_Lockhart](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba8739/32.png) [@Walter\_Lockhart](https://www.ruby-forum.com/u/Walter_Lockhart)\ **Post date:** [May 22, 2008, 10:27am UTC](https://www.ruby-forum.com/t/ruby-on-rails-authentication-access-control/138358/3 "2008-05-22T10:27:00Z")
i would probably start with good old faithful restful\_authentication plugin. This wil give you your basic login/registration pattern Next, I add acl\_system2 plugin, which allows me to lock down certain sections of the website programmatically by adding roles to users. Very easy. Next I would create my models controllers and views for the Projects Next I would use a polymorphic has\_many :through association to “attach” projects to users. By using polymorphism you allow the flexibillity to create other types of assets that users might be restricted in viewing Finally i would create a helper method within the User model that allowed me to check whether a project is viewable by a specific user e.g. current\_user.allowed?(project) e.g. user table id | login | hashed\_password | email roles table id | title roles\_users table user\_id | role\_id projects table id | name | description | created\_at | updated\_at assetables table (this is your polymorphic association table, where you assign projects to your users) id | user\_id | assetable\_id | assetable\_type I always get confused with the polymorphic association syntax. If you’re stuck, get hold of acts\_as\_taggable\_on\_steroids and copy the way they do it, or, just drop back to a has\_and\_belongs\_to\_many association until you really need to use polymorphism. BTW I find make\_resourceful invaluable when dealing with polymorphic resources, and, in fact all RESTful controllers. You might like to take a look too [mr.hamptoncaitlin.com](http://mr.hamptoncaitlin.com). Take a look inside the actions.rb file to see what it’s doing under the hood. Good luck Joe ---
**Author:** ![Walter\_Lockhart](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba8739/32.png) [@Walter\_Lockhart](https://www.ruby-forum.com/u/Walter_Lockhart)\ **Post date:** [May 22, 2008, 10:28am UTC](https://www.ruby-forum.com/t/ruby-on-rails-authentication-access-control/138358/4 "2008-05-22T10:28:45Z")
or… you could do it all yourself, like the post that just beat me! 😉 ---
**Author:** ![Walter\_Lockhart](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba8739/32.png) [@Walter\_Lockhart](https://www.ruby-forum.com/u/Walter_Lockhart)\ **Post date:** [May 24, 2008, 6:13am UTC](https://www.ruby-forum.com/t/ruby-on-rails-authentication-access-control/138358/5 "2008-05-24T06:13:12Z")
Or sign up for a corporate Basecamp account, spend some time setting up the users and project data, then spend the summer working on all those projects. ---
**Author:** ![Walter\_Lockhart](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba8739/32.png) [@Walter\_Lockhart](https://www.ruby-forum.com/u/Walter_Lockhart)\ **Post date:** [May 24, 2008, 10:40am UTC](https://www.ruby-forum.com/t/ruby-on-rails-authentication-access-control/138358/6 "2008-05-24T10:40:41Z")
Rey9999, Wildtangent & Cynthia. Thank you for your responses. You’ve given me a lot of information to review and consider. Thanks. Walter