Restful Authentication with all the bells and whistles (new 9/05/08) (Page 1 of 20)

Thanks for the tutorial - looks very good and complete....

One thing that has me a bit confused with these Authentication examples is how to set one up for a public site ( i.e. a social networking site ) and setting one up for a private admin part of a site.

Could you give me a few tips on what the key differences would be.

Thanks - Dave Porter

Great tutorial makes me want to look at how I'm handle user management in my blog. Thanks for taking the time to post it.

DaveP you may want to look into something like role requirement to handle who can do what. I use it in the blog script that I posted for you to look at. I used the multiple roles for multiple users way but you can also do it where each user only has one role. May be worth looking into.
You can get it at http://code.google.com/p/rolerequirement/

Hey there!

Great tutorial! Is it possible that you can upload all of the files somewhere?

Thank you so much!

Yep, this is Rails 2 specific...

With 1.2.X you have to go back to the style of migrations used then.

regards, DaveP

Also I was wondering why you've nested the password resource inside the user resource?

Surely you need to know the user ID to do this? Which you won't have due to the user not knowing their password?

Hope that makes sense. I could be wrong.

Here are the password views, I'll add them above as well.

app/views/passwords/edit.html.erb

<% form_tag url_for(:action => "update", :id => params[:id]) do %>
    Password:<br />
    <%= password_field_tag :password %><br />
    Confirm Password:<br />
    <%= password_field_tag :password_confirmation %><br />
    <%= submit_tag "Reset Your Password" %>
<% end %>

<h2>Forgot Password</h2>
<% form_tag url_for(:action => 'create') do %>
    What is the email address used to create your account?<br />
    <%= text_field_tag :email, "", :size => 50 %><br />
    <%= submit_tag 'Reset Password' %>
<% end %>

@jstad: Can you post the error message you're getting?

I keep getting errors about the methods in authenticated_system.rb. Any idea why? I went through the tutorial twice and am getting the same errors. How does rails reference that file in /lib/?

Super Tutorial. Thanks, this is great!  One thing you may want to consider adding which I did was a simple method for forgot_login which would just send the user.login of the specified email to the given email.  Also I had to add:

<% if flash[:notice] %><div class="notice"><%= flash[:notice] %></div><% end %>
<% if flash[:error] %><div class="error"><%= flash[:error] %></div><% end %>

to the sessions/new.html.erb and passwords/* in order to recieve proper error messages, not sure if that is standard or not but only way I could get notice and error messgaes.

I had one small problem with the forgot_password method. Was able to get everything to work except when a user clicked the reset_password link from the email to reset, then submitted a new password, the controller seemed to think the reset token was invalid but actually did reset the password.  Any idea on this?

One other thing I'm not clear on is the usage of .erb files.  Seems using these as standard .rhtml files works fine but not sure the difference or if this is just 2.0 specific. Can anyone shed any light on that?  Thanks --ken

Last edited by kschroed (2008-01-12 21:08:40)

Thanks for this awesome walkthrough!
My question is, shouldnt this:

class Role < ActiveRecord::Base
  has_many :permissions
  has_many :roles, :through => :permissions
end

have the 3rd line changed to
has_many :users, :through => :permissions
?
not sure how the roles-to-roles relationship benefits anyone.