• How to create authentication and authorisation in Ruby on Rails.
• Furthermore, when a user signs up he is sent an email to which he must respond to activate his account.
• The IP address from which the user signs up is recorded. By default his creation date is also recorded.
• Use a globally unique ID for users, not the default integers starting at 1. I did this because the verification link in the email contains the user id. A mischievous user can reconstruct the link with a user id smaller than his, if the default integers were used, to see what mischief he can practise. Also, of course, when it comes to users/show it's easy to use integers to page through the users. A GUID does not allow either of these two scenarios.

Install Ruby and Rails

The Database and its Ruby Connector

The Application

1. Create a new user
2. Send e-mail to the new user
3. New user uses the e-mail to activate his account or delete himself from the database
4. New user can now log in
5. Once logged in the new user can change his password
6. User can log out
7. User can request a new password be sent to him using his e-mail address

1. A sign up form
2. A log in form
3. A change password form
4. A form to request a new password

To start your application, open a terminal window (Windows users, a command window) and migrate to where you want to build this project. Say /home/yourname/projects/ruby. Now enter
$ rails authenticate -d postgresql
If you are going to use Mysql enter mysql rather than postgresql. Things will scroll by on the term window and you will end up with a directory structure like this:

Your model

$ cd authenticate  #All the commands are going to be issued from this directory, from now on.
$ ruby script/generate model user login:string clearance:integer name:string surname:string email:string ip_address:string salt:string hashed_password:string activated:boolean
    exists  app/models/
    exists  test/unit/
    exists  test/fixtures/
    create  app/models/user.rb
    create  test/unit/user_test.rb
    create  test/fixtures/users.yml
    create  db/migrate
    create  db/migrate/20090707125413_create_users.rb
                

class CreateUsers < ActiveRecord::Migration
  def self.up
    create_table :users, :id => false do |t|   (1)
      t.string :id, :limit => 22                (2)
      t.string :login, :limit => 15
      t.integer :clearance
      t.string :name
      t.string :surname
      t.string :email
      t.string :ip_address
      t.string :salt
      t.string :hashed_password
      t.boolean :activated

      t.timestamps
    end
    execute "ALTER TABLE users ADD PRIMARY KEY (id)" (3)
  end

  def self.down
    drop_table :users
  end
end
                

$ rake db:migrate
(in /home/chris/projects/ruby/authenticate)
==  CreateUsers: migrating ====================================================
-- create_table(:users, {:id=>false})
   -> 0.0048s
-- execute("ALTER TABLE users ADD PRIMARY KEY (id)")
NOTICE:  ALTER TABLE / ADD PRIMARY KEY will create implicit index "users_pkey" for table "users"
   -> 0.0283s
==  CreateUsers: migrated (0.0334s) ===========================================
                

$ psql authenticate_development
Welcome to psql 8.3.7, the PostgreSQL interactive terminal.

authenticate_development=# \dt
 public | schema_migrations | table | chris
 public | users             | table | chris
                

authenticate_development=# \d users
 id              | character varying(22)       | not null
 login           | character varying(15)       |
 clearance       | integer                     |
 name            | character varying(255)      |
 surname         | character varying(255)      |
 email           | character varying(255)      |
 ip_address      | character varying(255)      |
 salt            | character varying(255)      |
 hashed_password | character varying(255)      |
 activated       | boolean                     |
 created_at      | timestamp without time zone |
 updated_at      | timestamp without time zone |
                

class User < ActiveRecord::Base
 include RFC822
 usesguid

  validates_length_of :login, :within => 5..40
  validates_length_of :password, :within => 5..40
  validates_presence_of :login, :email, :password, :password_confirmation, :name, :surname
  validates_uniqueness_of :login, :email
  validates_confirmation_of :password
  validates_format_of :email, :with => EmailAddress

  attr_protected :id, :salt

  attr_accessor :password, :password_confirmation

  def self.authenticate(login, pass)
  u=find(:first, :conditions=>["login = ?", login])
  return nil if u.nil?
  return u if User.encrypt(pass, u.salt)==u.hashed_password
  nil
 end

 def password=(pass)
  @password=pass
  self.salt = User.random_string(10) if !self.salt?
  self.hashed_password = User.encrypt(@password, self.salt)
 end

 def send_new_password
  new_pass = User.random_string(10)
  self.password = self.password_confirmation = new_pass
  self.save
  Notifications.deliver_forgot_password(self.email, self.login, new_pass)
 end

 def send_activate
  Notifications.deliver_activate(self.email, self.name, self.surname, self.id)
 end

 def activate?
  update_attribute('activated', true)
  if self.activated
    return true
  else
    return false
  end
 end

 protected

 def self.encrypt(pass, salt)
  Digest::SHA1.hexdigest(pass+salt)
 end

 def self.random_string(len)
  #generat a random password consisting of strings and digits
  chars = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a
  newpass = ""
  1.upto(len) { |i| newpass << chars[rand(chars.size-1)] }
  return newpass
 end
end
                

Your controllers

chris@oberon:~/projects/ruby/authenticate$ ruby script/generate controller users new delete activate new_password forgot_password
    exists  app/controllers/
    exists  app/helpers/
    create  app/views/users
    exists  test/functional/
    create  test/unit/helpers/
    create  app/controllers/users_controller.rb
    create  test/functional/users_controller_test.rb
    create  app/helpers/users_helper.rb
    create  test/unit/helpers/users_helper_test.rb
    create  app/views/users/new.html.erb
    create  app/views/users/delete.html.erb
    create  app/views/users/activate.html.erb
    create  app/views/users/new_password.html.erb
    create  app/views/users/forgot_password.html.erb
                

chris@oberon:~/projects/ruby/authenticate$ ruby script/generate controller logins login logout logged_in logged_out
    exists  app/controllers/
    exists  app/helpers/
    exists  app/views/logins
    exists  test/functional/
    exists  test/unit/helpers/
    create  app/controllers/logins_controller.rb
    create  test/functional/logins_controller_test.rb
    create  app/helpers/logins_helper.rb
    create  test/unit/helpers/logins_helper_test.rb
    create  app/views/logins/login.html.erb
    create  app/views/logins/logout.html.erb
    create  app/views/logins/logged_in.html.erb
    create  app/views/logins/logged_out.html.erb
                

class UsersController < ApplicationController
  before_filter :login_required, :only=> [:new_password, :delete]
  require 'web_mail_hosts'

  def new
  if request.post?
   @user = User.new(params[:user])
   @user.ip_address=ip_address
   @user.clearance = 0;
   if not_wanted?(@user.email.to_s)  # user submitted an email address from a web mail host
    flash[:warning] = "Your email address appears to be web based"
    render  :action => 'new'
   elsif @user.save
    @user.send_activate
    flash[:notice] = "Signup successful. Activation e-mail has been sent"
    redirect_to  :controller => 'logins', :action => 'login'
   else
    flash[:warning] = "Please try again - problems saving your details to the database"
    render :action => 'new'
   end
  end
  end

  def delete
  end

  def activate
  end

  def new_password
  end

  def forgot_password
  end

end

                

# Filters added to this controller apply to all controllers in the application.
 # Likewise, all the methods added will be available for all controllers.

 class ApplicationController < ActionController::Base
   helper :all # include all helpers, all the time

   before_filter :fetch_logged_in_user

   protect_from_forgery # See ActionController::RequestForgeryProtection for details

   protected
   def fetch_logged_in_user
    return unless session[:user_id]
    @current_user = User.find_by_id(session[:user_id])
   end

   def logged_in?
  ! @current_user.nil?
   end
   helper_method :logged_in?

   def clearance
  if logged_in?
    return @current_user.clearance
  else
    return nil
  end
   end
   helper_method :clearance

   def login_required
  return true if logged_in?
  session[:return_to] = request.request_uri
  flash[:notice]="You have to log in!"
  redirect_to :controller => 'logins', :action => 'login' and return false
   end

   def ip_address
  return request.remote_ip
   end

   # Scrub sensitive parameters from your log
   # filter_parameter_logging :password
 end
                

Your views

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
 <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
 <title>Authenticate Application</title>
 <%= stylesheet_link_tag 'black' %>
 <%= javascript_include_tag :defaults %>

  </head>
  <body>
 <div id="shell">
     <div id="toplinks">
      <% if !logged_in? %>
            <%= link_to 'Sign Up', '/users/new' %>
  <% end %>
  <% if logged_in? %>
            <%= link_to 'Change Password', '/users/change_password' %>
  <% end %>
   </div>
   <div id="login_logout">
   <% if @current_user %>
    Logged in as: <%= @current_user.login %>
    <em><%= link_to "(Logout)", '/logins/logout' %></em>
   <% else %>
    <em>Not logged in.</em>
    <%= link_to 'Login', '/logins/login' %>
   <% end %>
   </div>
   <div class="clear"></div>
   <% unless flash[:notice].blank? %>
  <div id="notification"><%= flash[:notice] %></div>
   <% end %>
   <% unless flash[:warning].blank? %>
  <div id="warning"><%= flash[:warning] %></div>
   <% end %>
   <%= yield %>
    </div>
  </body>
</html>
                

<% if !logged_in? %>
  <h2>Sign up</h2>
<%= error_messages_for 'user' %>
<p>Please fill in all fields</p>
<p>Your user name and password must be between 5 and 40 alphanumeric characters.</p>
<p>Please do not submit web mail addresses, like <b>hotmail, gmail</b> and others. Use your e-mail address with your ISP.</p>
<p><strong>Your email address must be valid.</strong> We will send you an email which you must use to activate your account.
    You will not be able to log in or upload announcements until your account is activated.</p>
<% form_for(:user, @user, :url => {:action=> 'new'}) do |f| %>
<fieldset>
  <legend>New User Data</legend>
  <p>
 <label for='user_login'>Username</label><br/>
 <%= f.text_field :login, :size => 40 %>
  </p>
  <p>
 <label for='user_name'>First Name</label><br/>
 <%= f.text_field :name, :size => 40 %>
  </p>
  <p>
 <label for='user_surname'>Surname or Last Name</label><br/>
 <%= f.text_field :surname, :size => 40 %>
  </p>
  <p>
 <label for='user_password'>Password</label><br/>
 <%= f.password_field :password, :size => 40 %>
  </p>
  <p>
 <label for='user_password_confirmation'>Password Confirmation</label><br/>
 <%= f.password_field :password_confirmation, :size => 40 %><br/>
  </p>
  <p>
 <label for='user_email'>Email</label><br/>
 <%= f.text_field :email,  :size => 40 %><br/>
  </p>
  <%= submit_tag 'Signup' %>
</fieldset>
<% end %>
<% else %>
   <h2>You are already logged in and therefore signed up</h2>
<% end %>
                

Your mailers

• Messages asking the user who signed up to activate.
• Messages supplying a user who lost his password with a newly generated password

chris@oberon:~/projects/ruby/authenticate$ ruby script/generate mailer notifications forgot_password activate
    exists  app/models/
    create  app/views/notifications
    exists  test/unit/
    create  test/fixtures/notifications
    create  app/models/notifications.rb
    create  test/unit/notifications_test.rb
    create  app/views/notifications/forgot_password.erb
    create  test/fixtures/notifications/forgot_password
    create  app/views/notifications/activate.erb
    create  test/fixtures/notifications/activate
                

<html>
  <head>
 <title>Mail from Authenticate</title>
  </head>
  <body>
 <center>
 <table style="width: 555px; margin: 10px auto; border: 1px black solid;">
   <tr><td style="background: #dfdfdf; text-align: center;"><h2 style="margin: 8px auto 8px auto;">Activate Your Authenticate Account</h2></td></tr>
   <tr>
  <td style="text-align: left; padding: 5px 10px;">
    <p>Welcome to <strong>Authenticate</strong>, <strong><%= @name %> <%= @surname %></strong></p>
    <p><strong>Authenticate</strong> received a sign-up request using <%= @email %>.  If it is indeed from you
    and you wish to activate your account, click <a href="http://localhost:3000/users/activate?id=<%= @id %>">here.</a></p>
    <p>Should you wish to be completely removed from our database, click
    <a href="http://localhost:3000/users/delete?id=<%= @id %>">here.</a></p>
  </td>
   </tr>
 </table>
 </center>
  </body>
</html>
                

<html>
  <head>
 <title>Mail from Authenticate</title>
  </head>
  <body>
 <center>
 <table style="width: 555px; margin: 10px auto; border: 1px black solid;">
   <tr><td style="background: #dfdfdf; text-align: center;"><h2 style="margin: 8px auto 8px auto;">Your Lost Password</h2></td></tr>
   <tr>
  <td style="text-align: left; padding: 5px 10px;">
    <p><strong>Authenticate</strong> received a request for a password replacement from your e-mail address.  As your password is stored in a
    hashed format in our database, we cannot tell you what your password was.  We have generated a new, random password for you.  Please note
    that it is case sensitive.</p>
    <p>Your username is <em><%= @login %></em>. Your new password is <em><%= @pass %></em>. Please login and change it to something more memorable.</p>
    <p><a href="http://localhost:3000/logins/login">Click Here to Log In</a>
  </td>
   </tr>
 </table>
 </center>
  </body>
</html>
                

class Notifications < ActionMailer::Base

  def forgot_password(to, login, pass, sent_at = Time.now)
 @subject    = "Your lost password"
 @body['login']=login
 @body['pass']=pass
 @recipients = to
 @from = 'you@your_isp.com'
 @sent_on = sent_at
 @content_type = "text/html"
  end

  def activate(to, name, surname, id, sent_at = Time.now)
 @subject    = 'Account activation at Authenticate'
 @body['name']=name
 @body['surname']=surname
 @body['email']=to
 @body['id']=id
 @recipients = to
 @from = 'you@your_isp.com'
 @sent_on = sent_at
 @content_type = "text/html"
  end
end
                

Configuring your SMTP server

# The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
  # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}')]
  # config.i18n.default_locale = :de
  #ActionMailer settings
  config.action_mailer.delivery_method = :smtp
  config.action_mailer.smtp_settings = {
       :address   => 'localhost',
       :port   => 25,
       :domain   => 'your_isp.com'
 }
    config.action_mailer.raise_delivery_errors = true
    config.action_mailer.perform_deliveries = true
    config.action_mailer.default_charset = 'utf-8'
end
                

Finally...

Fire up your server by typing ruby script/server into your term window, open your browser and go tohttp://localhost:3000. You will see the sign up form. Fill it in and click the button. You should see the following:

def delete
  if request.get?
   u=User.find_by_id(session[:user_id].to_s)
   if u == nil
    flash[:warning] = "You must be logged in to delete yourself"
    redirect_to :controller => 'logins', :action => 'login'
   else
    session[:user_id] = nil #log out
    u.destroy
    flash[:notice] = "You were deleted from the database and logged out"
    redirect_to :controller => 'logins', :action => 'logged_out'
   end
  end
  end

  def activate
  if request.get?
   user=User.find_by_id(params[:id])
   puts user.name + ' ' + user.surname
   if user.activate?
    flash[:notice]="You have been activated and can now log in"
    redirect_to :controller => 'logins', :action => 'login'
   else
    flash[:warning]="We could not activate you.  Send us email."
    redirect_to :controller => 'logins', :action => 'login'
   end
  end
  end

  def new_password
  if request.post?
   @user=User.find_by_id(session[:user_id].to_s)
   if @user.update_attributes(:password=>params[:password], :password_confirmation => params[:password_confirmation])
    flash[:notice]="Password Changed"
    redirect_to :controller => 'logins', :action => 'logged_in'
   end
  end
  end

  def forgot_password
  if request.post?
   u= User.find_by_email(params[:email])
   if u
    if u.send_new_password
     flash[:notice]  = "A new password has been sent by email."
     redirect_to  :controller => 'logins',:action => 'login'
    else
     flash[:warning]  = "EMail address OK, but couldn't send password"
     render :action => 'forgot_password'
    end
   else
    flash[:warning] = "No such email address on record"
    render :action => 'forgot_password'
   end
  end
  end
                

Login functionality

<h2>Login</h2>
<% form_tag '/logins/login' do %>
  <fieldset>
 <legend>Please log in</legend>
 <p>
  <label>Username:</label><br />
  <%= text_field_tag :login %>
 </p>
 <p>
  <label>Password:</label><br />
  <%= password_field_tag :password %>
 </p>
 <p><%= submit_tag 'login' %></p>
  </fieldset>
<% end %>
<br />

   <%= link_to 'I forgot my password', :controller => 'users', :action => 'forgot_password' %><br /><br />
                

class LoginsController < ApplicationController

  def new
  end

  def login
   @current_user = User.authenticate(params[:login], params[:password])
   if @current_user
    if @current_user.activated
     session[:user_id] = @current_user.id
     flash[:notice]  = "Login successful"
     if session[:return_to]
      redirect_to session[:return_to]
      session[:return_to] = nil
     else
      redirect_to :action => 'logged_in'
     end
    else
     flash[:warning]="Your account is not activated"
     render :action => 'login'
    end
   else
    flash[:warning] = "No such user"
    render :action => 'login'
   end
  end

  def logout
   @current_user = session[:user_id] = nil
   flash[:notice] = 'Logged out'
   redirect_to :action => 'logged_out'
  end

   def logged_in
   end

   def logged_out
   end

 end