Rails Help, Please? (How to create a login/account system)

I hope some of you reading this are Ruby On Rails experts and have a moment to help me out …

The problem in a nutshell:

What Rails generator/plugin should I use to create a user account / login system, preferably with OpenID, in a new app?

The gory details:

I haven’t done any Rails work in quite a while. The app I was working on was circa Rails 1.0. I’ve now updated all my gems so I have Rails 2.0.2. Of course the app doesn’t work: it crashes and burns immediately with Ruby errors in the generated code. Not surprising since I’m sure a lot has changed since 1.0.

So I thought I’d start over by generating a fresh Rails app, and then start moving pieces of my app over. But I’m immediately stuck at the first step, setting up a user account/login system.

(Which is a hurdle every newbie runs into, right? Because nearly every web app needs this, but it’s strangely the one area where DHH, the Man With An Opinion On Everything, didn’t have enough of an opinion to settle on a standard account system. So instead, chaos reigns.)

What I’ve done so far is —

1. Looked in my brand new copy of The Rails Way. There’s a whole chapter on Login and Authentication, yay. They say that the best authentication plugin is Acts As Authenticated. (Actually they say there are two best ones, but then they never reveal what the other is.)

2. Typed “script/plugin install acts_as_authenticated” as it says in the book. And get an error, no such plugin.

3. Looked up Acts As Authenticated online. The readme on the author’s website starts with a big warning that it’s deprecated and not maintained. Huh? Why is my $50 hot-off-the-press Rails book pushing an obsolete library?

4. I really want OpenID support anyway. There’s an openid-login-generator gem, so I installed and ran that. All it did was create one (1) migration file, nothing else. WTF?

5. After much searching I found that the ruby-openid library, which I already have, contains in its examples subdirectory a Rails generator. I just have to copy it into the right place, and run the “generate” script. So I did that. It generated scaffolding and such. Hooray.

6. I tried to run my app and, as the directions say, went to /account/login. Blam. Ruby errors. First it complained about “end_form_tag”, which it turns out was deprecated in Rails 1.2 and removed in 2.0; I found out how to fix that, and next it died in the generated AccountController scaffolding itself, saying OpenID::FilesystemStore doesn’t exist. Which it doesn’t—looks like that class was renamed OpenID::Storage::Filesystem. So the example code isn’t even compatible with the library it’s part of! Looks like no one’s updated it in quite some time.

7. I look at the clock (11:30PM), sigh, and decide to give up and ask Teh Lazywebz for help. But my battery dies while I’m typing this, so I don’t actually post it till the next morning.

Previously: BLIP-Protocol mailing list
Next Post: BLIP news (Python! Detailed spec!)

By: Jens Alfke
On: May 30, 2008
at: 8:00 am
As: Web, Computers
See: 9 comments;
Add: your comment

About

This is the blog of Jens Alfke.

Introverted, intuitive, thinking, perceiving. I live to make things: most often software, sometimes designs or mixes or stories or photos. (I wish I could make music.)

Father, husband. My home is a nest of family. Outside is overrun with flowers and vines and shade trees, inside with books and CDs and kids’ drawings and game pieces and game cartridges.

Worker, dreamer. I’m driven by visions of things that could be.

Contact

Send friendly correspondence to thought-palace at this domain.

On Fri, May 30 at 8am,
toto said —

For authentication you would want to use the successor of acts_as_authenticted:
restful-authentication (http://github.com/technoweenie/restful-authentication/tree/master).

Because most Rails apps are using REST they went to restful-authentication. You should, by all means, not use the acts_as_authenticated plugin, because it contains a security bug, that allows unauthorized access.

On Fri, May 30 at 8am,
Sebastian said —

I second using restful-authentication, although I have heard complains that it doesn’t really do the new sexy migrations and doesn’t really work to well with 2.0.2… Haven’t really tested myself yet though so I can’t say that for sure! You could also write something from scratch, although reinventing the wheel doesn’t always make a lot of sense.

On Fri, May 30 at 8am,
Brian Deterling said —

I’m relatively new to Rails and I hit the same issue you did and ended up using restful-authentication as the previous commenter suggested. I didn’t have any problems with it.

On Fri, May 30 at 9am,
Ryan E said —

I think you’re going to see a unanimous verdict here: restful-authentication. Not too long ago I started a new Rails project on 2.0.1 (I think) and restful-authentication worked great. I’m probably also going to be retrofitting it onto a project that was started in Rails 1.2.x and upgraded to 2.0.2.

On Fri, May 30 at 9am,
Ivar Vasara said —

Hereis a great step-by-step tutorial on integrating restful authentication and openID.

On Fri, May 30 at 9am,
Milan Iliev said —

I recently implemented an authorization system using restful-authentication in Rails 2.0.2 in about six hours. +1.

On Fri, May 30 at 10am,
shanec said —

Railscasts.com has some great tutorials on restful authentication and OpenID authentication.

On Fri, May 30 at 10am,
Jens Alfke said —

Thanks a lot, everyone! It’s nice to see such unanimity … makes it easy for me to figure out what to do.

Special thanks to Ivar for the link to the great tutorial. There’s a lot of stuff to paste in, but I’m nearly done. (Someone should really package up that entire tutorial as a plugin, shouldn’t they?)

On Sat, Jul 12 at 10am,
Richard Henry said —

Do you mind if I pose a question for you Jens… is The Rails Way worth using? What’s your experience with the rest of it? I’m hunting for a decent Rails book, something that would help a guy interesting in moving from PHP, but a total Rails n00b…

Rails Help, Please? (How to create a login/account system)

The problem in a nutshell:

The gory details:

9 Comments:

About

Contact

Recently

Unread Comments

Categories