# Xmlrpc authentication

**URL:** <https://www.ruby-forum.com/t/xmlrpc-authentication/68898>\
**Category:** Rails\
**Created:** [September 16, 2006, 12:56pm UTC](https://www.ruby-forum.com/t/xmlrpc-authentication/68898 "2006-09-16T12:56:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![m94asr](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/13edae/32.png) [@m94asr](https://www.ruby-forum.com/u/m94asr)\
**Post date:** [September 16, 2006, 12:56pm UTC](https://www.ruby-forum.com/t/xmlrpc-authentication/68898/1 "2006-09-16T12:56:17Z")

</div>

Hi all,

what is the recommended way to do user authentication for  
xmlrpc ruby on rails webservices?

Thanks,  
-Armin

---

<div class="post-metadata">

**Author:** ![m94asr](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/13edae/32.png) [@m94asr](https://www.ruby-forum.com/u/m94asr)\
**Post date:** [September 17, 2006, 1:09am UTC](https://www.ruby-forum.com/t/xmlrpc-authentication/68898/2 "2006-09-17T01:09:10Z")

</div>

On Sat, Sep 16, 2006 at 10:52:17AM -0000, m94asr wrote:

> Hi all,
> 
> what is the recommended way to do user authentication for  
> xmlrpc ruby on rails webservices?

Use http authentication. Put this into lib/http\_authentication.rb:

# From [Peak Obsession](http://wiki.rubyonrails.com/rails/pages/HowtoAuthenticateWithHTTP)

with a few

# minor fixes.

module HttpAuthentication

protected

def http\_authenticate(realm=@request.host + ’ Web Password’,  
errormessage=“Couldn’t authenticate you”)  
username, passwd = get\_http\_authentication\_data  
# Check authorization  
unless username  
send\_http\_authentication\_response(realm, errormessage) and return  
end  
user = User.authenticate(username, passwd)  
unless user && user.isremote?  
logger.info(“sending auth response”);  
send\_http\_authentication\_response(realm, errormessage) and return  
end  
# No session, so make this a class variable  
@user = user  
end

private

def send\_http\_authentication\_response(realm, errormessage)  
response.headers[“Status”] = “Unauthorized”  
response.headers[“WWW-Authenticate”] = “Basic realm="#{realm}"”  
render :text =\> errormessage, :status =\> 401  
end

def get\_http\_authentication\_data  
user, pass = ‘’, ‘’  
# extract authorisation credentials  
if request.env.has\_key? ‘X-HTTP\_AUTHORIZATION’  
# try to get it where mod\_rewrite might have put it  
authdata = request.env[‘X-HTTP\_AUTHORIZATION’].to\_s.split  
elsif request.env.has\_key? ‘Authorization’  
# for Apace/mod\_fastcgi with -pass-header Authorization  
authdata = request.env[‘Authorization’].to\_s.split  
elsif request.env.has\_key? ‘HTTP\_AUTHORIZATION’  
# this is the regular location  
authdata = request.env[‘HTTP\_AUTHORIZATION’].to\_s.split  
elsif request.env.has\_key? ‘Authorization’  
# this is the regular location, for Apache 2  
authdata = @request.env[‘Authorization’].to\_s.split  
end

```
# at the moment we only support basic authentication
if authdata and authdata[0] == 'Basic'
  user, pass = Base64.decode64(authdata[1]).split(':')[0..1]
end
return [user, pass]

```

end

end

Then in the controller for your web service:

require\_dependency “http\_authentication”

class RemoteController \< ApplicationController  
include HttpAuthentication  
wsdl\_service\_name ‘Remote’  
web\_service\_api ‘Remote’  
before\_filter :http\_authenticate  
session :off  
…  
end

The only thing you probably need to worry about is the  
“user = User.authenticate…” part in the http\_authenticate method. I  
use my regular user table, but with a type of “Remote”. Then only  
those remote users may be used to get to web services, and non-remote  
users may not be used.

## Michael

Michael Darrin Chaney  
removed\_email\_address@domain.invalid  
[http://www.michaelchaney.com/](http://www.michaelchaney.com/)