# Unsure how to Model this problem

**URL:** <https://www.ruby-forum.com/t/unsure-how-to-model-this-problem/109171>\
**Category:** Rails\
**Created:** [July 12, 2007, 4:04am UTC](https://www.ruby-forum.com/t/unsure-how-to-model-this-problem/109171 "2007-07-12T04:04:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [July 12, 2007, 4:04am UTC](https://www.ruby-forum.com/t/unsure-how-to-model-this-problem/109171/1 "2007-07-12T04:04:12Z")

</div>

I’m working on a management interface for a Single Login  
authentication system.  
We have server web apps, each app can have different installs (same  
code base different database connection), and available user rights  
are identical on all instances of a particular web app. They would  
also like basic support for rolls, with default right sets that can be  
applied to users.

What I have been trying for the last day is to make this work

Software  
Has Many rights and instances  
Rights  
Belongs to software  
Instances  
Belongs to software

I’m pulling my hair out trying to figure out how to tie a user into  
that relationship so that a user on a specific instance has a set of  
rights that are not shared across all instances.

The other applications are not rails based; most are classic asp, in  
many ways this is part of a push to try to update some older  
nightmarish software as well.

Any advice or suggestions are appreciated.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [July 19, 2007, 6:04pm UTC](https://www.ruby-forum.com/t/unsure-how-to-model-this-problem/109171/2 "2007-07-19T18:04:11Z")

</div>

Ok, I guess my question is a little to broad, our DB designer ended up  
giving us a database that we have to use.

I’m running into a problem where I’m not sure how to make the model  
connections

I have the following tables/models  
Users  
Instances  
Rights  
Instances\_Users  
Instances\_Rights\_Users

I would like to be able to find out what rights a user has on a given  
instance.  
Can you do  
has\_many :instances\_rights  
has\_many :instances\_rights\_users, :through =\> :instances\_rights  
has\_many :rights, :through =\> instance\_rights\_users

or for this three way relationship am I better off finding by SQL?

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [July 19, 2007, 6:34pm UTC](https://www.ruby-forum.com/t/unsure-how-to-model-this-problem/109171/3 "2007-07-19T18:34:29Z")

</div>

Take a look at this plugin :  
[http://agilewebdevelopment.com/plugins/nested\_has\_many\_through](http://agilewebdevelopment.com/plugins/nested_has_many_through)  
There are some examples

I love it 🙂

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [July 19, 2007, 6:57pm UTC](https://www.ruby-forum.com/t/unsure-how-to-model-this-problem/109171/4 "2007-07-19T18:57:25Z")

</div>

Thank You!  
You are my Hero!

On Jul 19, 9:34 am, Stijn P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [July 19, 2007, 7:24pm UTC](https://www.ruby-forum.com/t/unsure-how-to-model-this-problem/109171/5 "2007-07-19T19:24:28Z")

</div>

A much better solution would be to use a single sign on model where  
authentication is done in one place and authorization stays with the  
application.

[http://www.ja-sig.org/products/cas/](http://www.ja-sig.org/products/cas/)

The protocol is actually quite simple. I implemented a cas server and  
client in a day.

Chris