# Using act\_as\_authenticated where two models require differen **URL:** \ **Category:** Rails\ **Created:** [April 23, 2007, 7:45am UTC](https://www.ruby-forum.com/t/using-act-as-authenticated-where-two-models-require-differen/92707 "2007-04-23T07:45:35Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![chris\_johnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac91a4/32.png) [@chris\_johnson](https://www.ruby-forum.com/u/chris_johnson)\ **Post date:** [April 23, 2007, 7:45am UTC](https://www.ruby-forum.com/t/using-act-as-authenticated-where-two-models-require-differen/92707/1 "2007-04-23T07:45:35Z")
Hi there. I am playing around with acts\_as\_authenticated as many recommend it for authentication. I have two relevant model: Worker and Company. Registration for both Workers and Companies should be pretty similar: username, email, password, email verification, etc. I thought of two possible solutions, both of which may be ood/bad ideas: I don’t know because I am too new to rails at this point 🙂 (1) Create a UserBase class that is the model created by the acts\_as\_authenticated generator. From there, I can use polymorphism and STI to derive Workers and Companies, each with their own unique properties, but sharing the common authentication stuff. (2) Trying to generate seperate models using the acts\_as\_auth generator. I really would appreciate some guidance here. Obviously, Workers and Companies should only be allowed to access the resources of the site permissible to each. However, using before\_filter :login\_required doesn’t seem to be able to specify which model requires authentication. Maybe acts\_as\_auth isn’t the best solution, but I have no idea. Maybe I should roll my own based on the example code from “Rails Recipes”, as I need both authentication and resource authorization; I just didn’t want to reinvent the wheel. Thanks for any suggestions. -Chris ---
**Author:** ![chris\_johnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac91a4/32.png) [@chris\_johnson](https://www.ruby-forum.com/u/chris_johnson)\ **Post date:** [April 23, 2007, 3:29pm UTC](https://www.ruby-forum.com/t/using-act-as-authenticated-where-two-models-require-differen/92707/2 "2007-04-23T15:29:08Z")
If Worker and Company have a fairly similar set of fields, then STI can certainly make sense. If they are fairly different, you could make sure they each have the required fields (login, password) and put the authentication code into a module that you include into each class. Remember that login\_required calls the authorized method as one of the last things it does to return whether the login was successful. So, in your different controllers you can create a custom authorized method that then checks some aspect of the object returned by current\_user (such as its class or whether it responds to a particular method). – Building an e-commerce site with Rails? [http://agilewebdevelopment.com/rails-ecommerce](http://agilewebdevelopment.com/rails-ecommerce) Meet up at RailsConf: [http://railsconf2007.conferencemeetup.com/](http://railsconf2007.conferencemeetup.com/) ---
**Author:** ![chris\_johnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac91a4/32.png) [@chris\_johnson](https://www.ruby-forum.com/u/chris_johnson)\ **Post date:** [May 2, 2007, 5:47am UTC](https://www.ruby-forum.com/t/using-act-as-authenticated-where-two-models-require-differen/92707/3 "2007-05-02T05:47:29Z")
Thanks for the reply. I am really stuck on this one. This will be trivial I am sure once I gain my rails legs, but for now, I don’t know where to start. I need to have workers and companies in my system. The worker can create an account with profile information, and only that worker should be allowed to edit his profile page (although it will be publicly viewable). Similarly, companies can create profile pages as well, and companies can only edit their infomation (as expected). The only real similarity between workers and companies (for now) is the account (username/password/email) creation process. As such, can anyone suggest a clean design? I was planning on using acts\_as\_authenticated (or restful\_authentication), generating separate worker/company model/controllers. I have seen a bit on “barn- raising”, in which a community helps a new rails dev get going; anyone want to help raise my barn? Cheers. ---
**Author:** ![chris\_johnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac91a4/32.png) [@chris\_johnson](https://www.ruby-forum.com/u/chris_johnson)\ **Post date:** [June 13, 2007, 5:49pm UTC](https://www.ruby-forum.com/t/using-act-as-authenticated-where-two-models-require-differen/92707/4 "2007-06-13T17:49:19Z")
Hi Chris, what about the following design: Have one model “User” whose responsibility is to authenticate. Additionally you have your two models “Worker” and “Company” which have both a foreign key to model “User” 1. The authorization stuff can easily be done with AAA with before\_filter 2. When the user is authorized you can query the models User and Company if they belong to the current\_user. Best regards Chris (G.) chris johnson wrote: > Thanks for the reply. > > I am really stuck on this one. This will be trivial I am sure once I > gain my rails legs, but for now, I don’t know where to start. > > I need to have workers and companies in my system. The worker can > create an account with profile information, and only that worker > should be allowed to edit his profile page (although it will be > publicly viewable). Similarly, companies can create profile pages as > well, and companies can only edit their infomation (as expected). The > only real similarity between workers and companies (for now) is the > account (username/password/email) creation process. > > As such, can anyone suggest a clean design? I was planning on using > acts\_as\_authenticated (or restful\_authentication), generating separate > worker/company model/controllers. I have seen a bit on “barn- > raising”, in which a community helps a new rails dev get going; anyone > want to help raise my barn? > > Cheers.