# What features in login system? **URL:** \ **Category:** Rails\ **Created:** [November 12, 2005, 12:50pm UTC](https://www.ruby-forum.com/t/what-features-in-login-system/47692 "2005-11-12T12:50:09Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![petermichaux](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/46a35a/32.png) [@petermichaux](https://www.ruby-forum.com/u/petermichaux)\ **Post date:** [November 12, 2005, 12:50pm UTC](https://www.ruby-forum.com/t/what-features-in-login-system/47692/1 "2005-11-12T12:50:09Z")
Hi, I’ve been following the discussions about roll-your-own, generators, plugins and engines with interest. I wonder how much peoples needs really vary when it comes to a login system. Right now the Rails wiki is not so helpful with a discussion of authentication in general and I would like to see the wiki improve. Perhaps the best way to start is with a list of authentication features people actually would like to have. Maybe the list will be long but if the lists exists it will make it easier for someone new to roll their own if that is the best way to go. Also the list could be fleshed out with more wiki pages describing strategies for each item. I would like to have - forgotten password emails - user roles What features do you need? Peter ---
**Author:** ![petermichaux](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/46a35a/32.png) [@petermichaux](https://www.ruby-forum.com/u/petermichaux)\ **Post date:** [November 12, 2005, 12:50pm UTC](https://www.ruby-forum.com/t/what-features-in-login-system/47692/2 "2005-11-12T12:50:09Z")
I’ve only checked out Model Security and things I didn’t like about it: - appears to only use HTTP authentication, rather than HTML forms. - MySQL specific. Though porting to PostgreSQL et al should be trivial. - Waaay complex - lots of libs, helpers, models, views, controllers, etc. Other than that, it appears to be well done and quite capable. But I’ll probably end up using pieces of it to suit my needs. csn — Peter M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > improve. Perhaps the best way to start is with a * * * Yahoo! FareChase: Search multiple travel sites in one click. [http://farechase.yahoo.com](http://farechase.yahoo.com) ---
**Author:** ![petermichaux](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/46a35a/32.png) [@petermichaux](https://www.ruby-forum.com/u/petermichaux)\ **Post date:** [November 12, 2005, 12:50pm UTC](https://www.ruby-forum.com/t/what-features-in-login-system/47692/3 "2005-11-12T12:50:12Z")
The model security can use html forms… Just click on cancel when the box comes up from the HTTP auth. I think it’s a great idea to set up a list of desired features I think that in addition to the forgotton password email and user roles, there is also a need to have the ability to either extend, or dynamically assign associations and fields to the user model without overwriting/modifying the code for the system. I want to be able to associate users with other objects in the app without changing the user.rbfile in the login system. Login Engine does this presently. Also a feature to allow certain roles to perform certain actions on the user (or a sub-set of users) via a config option. This option may mean that a seperate Admin interface is not required. Not sure how this would work though, especially if your an admin, and therefore you can access every user, but the manager role option below is read first and so limits your options… ie. config :allow\_user\_actions :actions =\>[‘list’,‘edit’,‘show’], :required\_role =\> [‘Manager’], :on\_users =\> “department = #{curren\_user.department}” config :allow\_user\_actions :actions =\>[:all], :required\_role =\> ['Admin], :on\_users =\> :all A filter for the a controller that sets the role required for actions. Of course whatever system is put up, they should agree on the basic method names and where each of these methods is available and applied… current\_user login\_required role\_required roles\_allowed (maybe multiple roles should have access to the list of actions) has\_role etc Just a couple of thoughts… ---
**Author:** ![petermichaux](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/46a35a/32.png) [@petermichaux](https://www.ruby-forum.com/u/petermichaux)\ **Post date:** [November 12, 2005, 12:50pm UTC](https://www.ruby-forum.com/t/what-features-in-login-system/47692/4 "2005-11-12T12:50:14Z")
If you remove the On 11/12/05, CSN [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > csn In that case then you need to modify the User controller. remove line 108 (and any others that you can find…) http\_authorize I think this should do it. ---
**Author:** ![petermichaux](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/46a35a/32.png) [@petermichaux](https://www.ruby-forum.com/u/petermichaux)\ **Post date:** [November 12, 2005, 12:50pm UTC](https://www.ruby-forum.com/t/what-features-in-login-system/47692/5 "2005-11-12T12:50:12Z")
— Liquid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > The model security can use html forms… Just click > on cancel when the box > comes up from the HTTP auth. I don’t want it to come up _at all_. csn * * * Yahoo! FareChase: Search multiple travel sites in one click. [http://farechase.yahoo.com](http://farechase.yahoo.com)