If you want to get authlogic working in a fresh rails 3 project, it will take a bit more steps than devise. This has everything to do with vision: authlogic only claims to deliver you the backend, allowing itself to remain more stable and to easily replace other authentication libraries (even your home-brewn). That seems a great philosophy, but starting from scratch involves more steps. First you need to setup a clean rails3 project, as i described before.
As simple as adding the following line to your Gemfile : [ruby] gem "authlogic" gem "rails3-generators" [/ruby] (note: you need the rails3-generators to include the needed generators). Then run bundle install or bundle update.
[ruby] rails g authlogic:session UserSession [/ruby] This would be all, but in my installation it was not enough. Something inside rails3 broke the authlogic session. But the fix, luckily, is pretty easy: you have to add the to_key function. So your complete UserSession model will look as follows: [ruby] class UserSession < Authlogic::Session::Base def to_key new_record? ? nil : [self.send(self.class.primary_key)] end end [/ruby]
If you do not yet have a User model, and i am assuming you don't, you need to [ruby] rails g model User [/ruby] For now, this is an empty model. You will need to fill in your migration to create the model correctly. [ruby wraplines="false"] class CreateUsers < ActiveRecord::Migration def self.up create_table :users do |t| t.string :login, :null => false t.string :email, :null => false t.string :crypted_password, :null => false t.string :password_salt, :null => false t.string :persistence_token, :null => false #t.string :single_access_token, :null => false # optional, see Authlogic::Session::Params #t.string :perishable_token, :null => false # optional, see Authlogic::Session::Perishability # magic fields (all optional, see Authlogic::Session::MagicColumns) t.integer :login_count, :null => false, :default => 0 t.integer :failed_login_count, :null => false, :default => 0 t.datetime :last_request_at t.datetime :current_login_at t.datetime :last_login_at t.string :current_login_ip t.string :last_login_ip t.timestamps end add_index :users, ["login"], :name => "index_users_on_login", :unique => true add_index :users, ["email"], :name => "index_users_on_email", :unique => true add_index :users, ["persistence_token"], :name => "index_users_on_persistence_token", :unique => true end def self.down drop_table :users end end [/ruby] Now we still have to add some code to the User model : [ruby] class User < ActiveRecord::Base acts_as_authentic end [/ruby]
We need to add some generic code to our applicationcontroller to persist the sessions, to check whether a user is required and do the correct redirects when needed. [ruby] class ApplicationController < ActionController::Base protect_from_forgery helper_method :current_user_session, :current_user private def current_user_session logger.debug "ApplicationController::current_user_session" return @current_user_session if defined?(@current_user_session) @current_user_session = UserSession.find end def current_user logger.debug "ApplicationController::current_user" return @current_user if defined?(@current_user) @current_user = current_user_session && current_user_session.user end def require_user logger.debug "ApplicationController::require_user" unless current_user store_location flash[:notice] = "You must be logged in to access this page" redirect_to new_user_session_url return false end end def require_no_user logger.debug "ApplicationController::require_no_user" if current_user store_location flash[:notice] = "You must be logged out to access this page" redirect_to account_url return false end end def store_location session[:return_to] = request.request_uri end def redirect_back_or_default(default) redirect_to(session[:return_to] || default) session[:return_to] = nil end end [/ruby]
[ruby] rails g controller UserSessions new [/ruby] and fill the controller with the correct code: [ruby] class UserSessionsController < ApplicationController before_filter :require_no_user, :only => [:new, :create] before_filter :require_user, :only => :destroy def new @user_session = UserSession.new end def create @user_session = UserSession.new(params[:user_session]) if @user_session.save flash[:notice] = "Login successful!" redirect_back_or_default users_url else render :action => :new end end def destroy current_user_session.destroy flash[:notice] = "Logout successful!" redirect_back_or_default new_user_session_url end end [/ruby] and of course that also needs a view, in new.html.haml[ruby] %h1 Login = form_for @user_session, :url => {:action => "create"} do |f| = f.error_messages %div = f.label :login = f.text_field :login %div = f.label :password = f.password_field :password %div = f.check_box :remember_me = f.label :remember_me %div = f.submit "Login" [/ruby] We want to use the f.error_message, but that is now removed from Rails3 and we need to install a plugin instead: [ruby] rails plugin install git://github.com/rails/dynamic_form.git [/ruby] We also need to define, inside config/routes.rb. You will see that the generator will have added the route get 'user_sessions/new', but that is not enough. You will have to add: [ruby] resources :user_sessions match 'login' => "user_sessions#new", :as => :login match 'logout' => "user_sessions#destroy", :as => :logout [/ruby]
Suppose you now have some other controller, e.g. HomeController, then restricting acces is straightforward: [ruby] rails g controller home index [/ruby] [ruby] class HomeController < ApplicationController before_filter :require_user def index end end [/ruby] The method require_user, defined in ApplicationController, will check if there is a user logged on, and if not redirect to the login-page. If we now delete the index.html inside your public folder, and we add the following at the bottom of config/routes.rb[ruby] root :to => 'home#index' [/ruby] Now we can start our application, and it should redirect to our login-page. But of course, since we have no users for now, we can't login just yet. To allow testing, you fire up your console: [bash] $ rails c Loading development environment (Rails 3.0.0.rc) ruby-1.9.2-p0 > User.create(:login => 'test', :email => 'test@tester.com', :password => 'test123', :password_confirmation => 'test123') => #<User id: 1, login: "test", email: "test@tester.com", crypted_password: "0129d9733b7912017e37a50263901488da90e127e6fd1ae6081...", password_salt: "ygufdflWkJQZGhbsGyia", persistence_token: "957788609b2067092dd3852b01613d53f96d0692ce5131174ca...", login_count: 0, failed_login_count: 0, last_request_at: nil, current_login_at: nil, last_login_at: nil, current_login_ip: nil, last_login_ip: nil, created_at: "2010-08-29 14:11:04", updated_at: "2010-08-29 14:11:04"> ruby-1.9.2-p0 > [/bash] Now you should be able to login using this user. For completeness, you should add some links to your application-view to allow logging in and out: [ruby] #user_nav - if current_user = "Signed in as #{current_user.email}. Not you?" = link_to "Sign out", logout_path - else = link_to "Sign in", new_user_session_path [/ruby] This would get your rails3 project started. The next steps would be to add some user management, or allowing users to sign up themselves, and maybe add some roles to limit certain users access if needed. Now, to contrast this with devise: i now have a bunch of code in my application that actually is not specific to my code, but is also completely not tested. I will provide example rspec tests for this later. Actually, the problem with this scenario as outlined, is it is one big bang. You should start little, declaring things you need to be able to do, and work in little steps to get there. But this scenario is intended as a draft to see how you could get there. Now, in your real application, you should start with the tests, and then from this example you now how you can implement it.If you want to get authlogic working in a fresh rails 3 project, it will take a bit more steps than devise. This has everything to do with vision: authlogic only claims to deliver you the backend, allowing itself to remain more stable and to easily replace other authentication libraries (even your home-brewn). That seems a great philosophy, but starting from scratch involves more steps. First you need to setup a clean rails3 project, as i described before.
As simple as adding the following line to your Gemfile : [ruby] gem "authlogic" [/ruby] and then run bundle install or bundle update.
[ruby] rails g authlogic:session UserSession [/ruby] This would be all, but in my installation it was not enough. Something inside rails3 broke the authlogic session. But the fix, luckily, is pretty easy: you have to add the to_key function. So your complete UserSession model will look as follows: [ruby] class UserSession < Authlogic::Session::Base def to_key new_record? ? nil : [self.send(self.class.primary_key)] end end [/ruby]
If you do not yet have a User model, and i am assuming you don't, you need to [ruby] rails g model User [/ruby] For now, this is an empty model. You will need to fill in your migration to create the model correctly. [ruby wraplines="false"] class CreateUsers < ActiveRecord::Migration def self.up create_table :users do |t| t.string :login, :null => false t.string :email, :null => false t.string :crypted_password, :null => false t.string :password_salt, :null => false t.string :persistence_token, :null => false #t.string :single_access_token, :null => false # optional, see Authlogic::Session::Params #t.string :perishable_token, :null => false # optional, see Authlogic::Session::Perishability # magic fields (all optional, see Authlogic::Session::MagicColumns) t.integer :login_count, :null => false, :default => 0 t.integer :failed_login_count, :null => false, :default => 0 t.datetime :last_request_at t.datetime :current_login_at t.datetime :last_login_at t.string :current_login_ip t.string :last_login_ip t.timestamps end add_index :users, ["login"], :name => "index_users_on_login", :unique => true add_index :users, ["email"], :name => "index_users_on_email", :unique => true add_index :users, ["persistence_token"], :name => "index_users_on_persistence_token", :unique => true end def self.down drop_table :users end end [/ruby] Now we still have to add some code to the User model : [ruby] class User < ActiveRecord::Base acts_as_authentic end [/ruby]
We need to add some generic code to our applicationcontroller to persist the sessions, to check whether a user is required and do the correct redirects when needed. [ruby] class ApplicationController < ActionController::Base protect_from_forgery helper_method :current_user_session, :current_user private def current_user_session logger.debug "ApplicationController::current_user_session" return @current_user_session if defined?(@current_user_session) @current_user_session = UserSession.find end def current_user logger.debug "ApplicationController::current_user" return @current_user if defined?(@current_user) @current_user = current_user_session && current_user_session.user end def require_user logger.debug "ApplicationController::require_user" unless current_user store_location flash[:notice] = "You must be logged in to access this page" redirect_to new_user_session_url return false end end def require_no_user logger.debug "ApplicationController::require_no_user" if current_user store_location flash[:notice] = "You must be logged out to access this page" redirect_to account_url return false end end def store_location session[:return_to] = request.request_uri end def redirect_back_or_default(default) redirect_to(session[:return_to] || default) session[:return_to] = nil end end [/ruby]
[ruby] rails g controller UserSessions new [/ruby] and fill the controller with the correct code: [ruby] class UserSessionsController < ApplicationController before_filter :require_no_user, :only => [:new, :create] before_filter :require_user, :only => :destroy def new @user_session = UserSession.new end def create @user_session = UserSession.new(params[:user_session]) if @user_session.save flash[:notice] = "Login successful!" redirect_back_or_default users_url else render :action => :new end end def destroy current_user_session.destroy flash[:notice] = "Logout successful!" redirect_back_or_default new_user_session_url end end [/ruby] and of course that also needs a view, in new.html.haml[ruby] %h1 Login = form_for @user_session, :url => {:action => "create"} do |f| = f.error_messages %div = f.label :login = f.text_field :login %div = f.label :password = f.password_field :password %div = f.check_box :remember_me = f.label :remember_me %div = f.submit "Login" [/ruby] We want to use the f.error_message, but that is now removed from Rails3 and we need to install a plugin instead: [ruby] rails plugin install git://github.com/rails/dynamic_form.git [/ruby] We also need to define, inside config/routes.rb. You will see that the generator will have added the route get 'user_sessions/new', but that is not enough. You will have to add: [ruby] resources :user_sessions match 'login' => "user_sessions#new", :as => :login match 'logout' => "user_sessions#destroy", :as => :logout [/ruby]
Suppose you now have some other controller, e.g. HomeController, then restricting acces is straightforward: [ruby] rails g controller home index [/ruby] [ruby] class HomeController < ApplicationController before_filter :require_user def index end end [/ruby] The method require_user, defined in ApplicationController, will check if there is a user logged on, and if not redirect to the login-page. If we now delete the index.html inside your public folder, and we add the following at the bottom of config/routes.rb[ruby] root :to => 'home#index' [/ruby] Now we can start our application, and it should redirect to our login-page. But of course, since we have no users for now, we can't login just yet. To allow testing, you fire up your console: [bash] $ rails c Loading development environment (Rails 3.0.0.rc) ruby-1.9.2-p0 > User.create(:login => 'test', :email => 'test@tester.com', :password => 'test123', :password_confirmation => 'test123') => #<User id: 1, login: "test", email: "test@tester.com", crypted_password: "0129d9733b7912017e37a50263901488da90e127e6fd1ae6081...", password_salt: "ygufdflWkJQZGhbsGyia", persistence_token: "957788609b2067092dd3852b01613d53f96d0692ce5131174ca...", login_count: 0, failed_login_count: 0, last_request_at: nil, current_login_at: nil, last_login_at: nil, current_login_ip: nil, last_login_ip: nil, created_at: "2010-08-29 14:11:04", updated_at: "2010-08-29 14:11:04"> ruby-1.9.2-p0 > [/bash] Now you should be able to login using this user. For completeness, you should add some links to your application-view to allow logging in and out: [ruby] #user_nav - if current_user = "Signed in as #{current_user.email}. Not you?" = link_to "Sign out", logout_path - else = link_to "Sign in", new_user_session_path [/ruby] This would get your rails3 project started. The next steps would be to add some user management, or allowing users to sign up themselves, and maybe add some roles to limit certain users access if needed. Now, to contrast this with devise: i now have a bunch of code in my application that actually is not specific to my code, but is also completely not tested. I will provide example rspec tests for this later. Actually, the problem with this scenario as outlined, is it is one big bang. You should start little, declaring things you need to be able to do, and work in little steps to get there. But this scenario is intended as a draft to see how you could get there. Now, in your real application, you should start with the tests, and then from this example you now how you can implement it.
Comments
Thanks Nathan! I just 'dived' into rails & this is a great help setting things up&running! I used a different fork though: gem 'authlogic', :git => 'git://github.com/odorcicd/authlogic.git', :branch => 'rails3' in order to make it work. good luck with the blog! thanks for the post!
I could just use the gem, so i do not understand why you needed to use the different branch. But always glad to have been of help. If you started with a fresh, empty rails 3 project i would recommend using devise instead (as it is much easier and much cleaner: it is a real engine so everything is there to start with).
Thanks for posting this. I'm currently configuring AuthLogic with Rails 3 and this post helped me out. Btw, what version of Ruby and AuthLogic are you using?
I am using the latest gem-version, that is 2.1.6, and ruby ree 1.8.7
Great article! About devise vs authlogic:Except for everything "being there already" - and a bit more magic behind the scenes stuff - what are the benefits of Devise over Authlogic? I'm considering my options for a new project, and only just got a Authlogic sample app working. Haven't tried Devise yet. It seems as though there is no activity on the openid bit at Devise, so I might have to go with Authlogic anyhow..
Devise is using warden, a rack-middleware to do the authentication. That makes it a very clean solution, and very extendible. That is an extra feature. But indeed, the availability of the extensions could be an easy selector. For me it was OAuth (i needed v1 and didn't get Warden to do it). I think that Devise has the more modern/clean implementation and is bound to become the implementation of choice soon (where i believe up until now, and definitely for rails 2.3 it still is authlogic).
Thanks for your post. But for it progress break in the second line: rails g authlogic:session UserSession Result is: Could not find generator authlogic:session. Any ideas, why I got this result?
>rails g authlogic:session user_session Could not find generator authlogic:session.
I see that the generators are not included in authlogic itself, it is fixed by including a dependency to 'rails3-generators' gem. I am not sure if this is a recent change. I will update the post accordingly.
Thanks for Nathan
hello, i try this : Creer un compte user_session_path do |f| %> {:controller => :user_sessions, :method => :post} do |f| %> {:action => "create"} do |f| %> But i have this error : SyntaxError in User_sessions#create C:/kool/app/views/user_sessions/new.html.erb:19: syntax error, unexpected keyword_ensure, expecting keyword_end C:/kool/app/views/user_sessions/new.html.erb:21: syntax error, unexpected $end, expecting keyword_end
As far as i can tell, your code is nowhere near valid erb. Please lookup haml and conversion from erb (or just use haml).
Hello Nathan, great how-to you have here. I followed your how-to as accurate as I could but I have a little problem with Rails 3 throwing a NoMethodError in PeopleController#index: undefined method `login_field' for Object:Class The trace reads: app/controllers/application_controller.rb:33:in `current_session' app/controllers/application_controller.rb:39:in `current_user' app/controllers/application_controller.rb:44:in `require_user' Any idea what could I be doing wrong?
Mmmm in my how-to there is no PeopleController, in my ApplicationController there is no method current_session. A bit hard for me to help you then. But you seem to be calling a method 'login_field' inside your method 'current_session', which it claims doesn't exist. Seems a good place to go looking then.
Awesome article. Thanks for this. How do I tweak this so that different users have different permissions? For instance, restricting clients to some pages, non-logged in to none and admin to all.
Thanks for posting this - I had been struggling with getting Rails 3 and Authlogic to work and the patch solved the problem. I agree with you however, there seems to be a lot of activity around Devise and this seems to be the authentication solution of choice for Rails 3. Authlogic seems to have stalled and I was never happy with the testing side.
Hi thanks for this haven't been able to find a suitable guide for using AuthLogic, I have run in to a bit of an error. Im very new to rails but im slowly learning. The error I am getting is this --- undefined local variable or method `users_url' for # --- What is the var users_url referencing and where do I find it?
Thx for the tutorial - it helped me get one rails 3 application up and running w/ Authlogic - including account activation and password reset. However I started a new project and instead of the User model as you've described above, I called it Account (but with the same fields) and am getting the following error: NameError in User sessionsController#new uninitialized constant User Rails.root: D:/code/ROR/farr Application Trace | Framework Trace | Full Trace app/controllers/application_controller.rb:8:in `current_user_session' app/controllers/application_controller.rb:13:in `current_account' app/controllers/application_controller.rb:26:in `require_no_account' My ApplicationController class is almost exactly the same as you've provided above, except I've substituted 'account' for 'user' everywhere but the current_user_session. So, for example, 'require_user' method is now 'require_account' So, I'm wondering if Authlogic is expecting the 'acts_as_authentic' model to be named "User" - does anyone know if that's the case? or what else may be causing my problem?
This usres_url pblm occurs for me 2.. am using rails 3.0.3.( and i think thats is the problem..)
hi - regarding my last comment - I've solved the problem by getting rid of all the 'user' named classes. 'user_sessions' is 'account_sessions', etc...
Great post, Thanks ! I like the way you use rails-generator to bypass the lack of builtin generator in authlogic rails 3.
as for the issue with: "undefined local variable or method `users_url’ for # ..." to solve this problem I added "resources :users" to the routes.rb file. I am new to rails myself so I just wanted to post my solution to this problem for those who ran into the same issue.
This article was verry useful! (thanks to primordial too, I've had the same problem). But I've also got one question: I want to store the username in a hidden form field (in another model, e.g. posts or something like that), but how do I access it? There must be a value stored in the UserSession model but I have no idea how to access it. Thank you in advance. - apb
Thanks Nathan for the Authlogic write up. It's very helpful for looking at Authlogic in general. However, after developing software for over a decade, I strongly feel overwriting the to_key method is the responsibility of Authlogic. Better to extend the form_for View helper with Rails 3 attributes as discussed here: http://techoctave.com/c7/posts/37-authlogic-and-rails-3-0-solution It's simple and cleaner. Then just gem update to the latest Authlogic version once it's patched. Anything less is just adding technical debt to your project before it's even launched. Why would you do that?
@Adam Vana: indeed what you say is true. Ideally you would fork the project, fix it, and ask the original author to pull it back in. I did not want to do that, but indeed: the fix that is described in the post you mention is much cleaner and simple. The reason why i did it is quite obvious: i did not know the solution, and wanted to get it working ;) Anyway i heard that if you use the latest authlogic code from the git-source, it should all be working. I will test that out and update the code accordingly. But for any new rails project i would suggest using devise instead of authlogic.
Hi and thank you for the post. I'm trying to make this work on rails 3, but I get undefined method `login' for # . Any ideas would be greatly appreciated :) I'm new to ruby & rails but I'm really trying to get on board
seems the blog ate up part of my comment the whole error is: undefined method `login' for #<UserSession: no credentials provided>
Thanks for the awesome tutorial. Fyi there is a glitch with the display of some of the code. It looks like Wordpress is substituting a smile icon for :o in :only. before_filter :require_no_user, nly => [:new, :create] 3 before_filter :require_user, nly => :destroy 4
thank, this was really helpful, especial the to_key method inside the model, it was really a pain trying to figure out why the new in user_sessions was failing on that method. By the way can you tell me the significance of that method. Thanks once again -Dhaval
In your UserSessionsContriller....you have "nly" in your first to lines..I think you mean :only
Thank you for your remark. It was a wordpress setting that too eagerly converted <pre>:o</pre> to a smiley. Fixed now.
add this line to your config/routes.rb resources :users to avoid users_url problem :)
hi i followed this article and developed login app its working fine but it always giving 1 error prohibited this user session from being saved There were problems with the following fields: * Password is not valid i used valid username and password as username:admin password:admin even though it is giving same problem can anybody help me in this pls its very urgent
Hi, Great article, was very useful. Can you let me know if it's possible to restrict users to editing their own account only. Right now, I can edit every user once logged in. Simon
Great site, thanks. I have run into an issue though. I am getting an error: uninitialized constant Authlogic I have read to overcome this I need to put config.gem 'Authlogic' in the environment.rb file. This is now giving me problems when I start the server: undefined local variable or method 'config' for main:Object(NameError) Any suggestions? Thanks,
@James: that recommendation is for rails 2.x, so that will definitely not work in rails 3. To me it seems that you do not have the <code>gem "authlogic"</code> line in your <code>Gemfile</code>.
Thanks for this tutorial, it really helped me get started with authlogic. I was starting from scratch and wish I had've used Devise now, but at least authlogic seems to be working :). I'll give devise a shot for my next app to see how it compares.
I tried d code you have put up bt im getting an error -"stack level too deep" on line session=Usersession.find. Im new to rails.
Hello Nathan, Nice guide! I am running into an issue however. Everything works as written up until people try to register. Even if they provide valid information, the app returns them to the form with this error: ["Email is too short (minimum is 6 characters)", "Email should look like an email address.", "Login is too short (minimum is 3 characters)", "Login should use only letters, numbers, spaces, and .-_@ please."] The form has both the email and the login. Any ideas?
Figured out the issue, you need to add attr_accessor to all the fields that you are using for registration.
Application controller def store_location session[:return_to] = request.request_uri end request.request_uri this line is error on this blog. how to solve it.
For latest comment : http://stackoverflow.com/questions/6805547/authlogic-rails-3-1 replace: request.request_uri by: request.url
The article is very great! I have searched this issue for long time. But I still have a question about the route.rb , Could you paste the route.rb for detail? My route.rb is below: Testauth::Application.routes.draw do get "home/index" # get "user_sessions/new" resources :user_sessions match 'login' => "user_sessions#new", :as => :login match 'logout' => "user_sessions#destroy", :as => :logout I meet a problem : No route matches {:action=>"show", :controller=>"user_sessions"}
I'm getting an error saying Could not find generator authlogic:session just before the error it shows Called from: /home/nithin/.rvm/gems/ruby-1.9.3-p362/gems/actionpack-3.2.3/lib/action_dispatch/middleware/session/abstract_store.rb:28:in `initialize'. any ideas how to get through this..
Hey Nathan, I am trying to convert a rails 2 project to rails 3 and i have authlogic already setup for my rails2 but it does not work for rails 3. This is what i get as result Error: uninitialized constant ApplicationController::UserSession Do you have any idea hoe can i get around this problem> thanks
Well, a bit hard to do without the code, but I can make some educated guesses :) I am guessing you get this error in the ApplicationController? And you are referring to the UserSession, but somehow that is not known there. So: where is your UserSession defined? how is that file named? It should be user_session.rb (or ruby/rails will not find it automatically).
Add comment