Restful Authentication with all the bells and whistles (new 9/05/08)
はじめに_
RestfulAuthenticationのチュートリアルを理解するためのメモ。
チュートリアル(意訳版)_
今回の前提_
チュートリアルの実施環境
% uname -a Linux pi 2.6.30-2-686 #1 SMP Fri Dec 4 00:53:20 UTC 2009 i686 GNU/Linux % more /proc/version Linux version 2.6.30-2-686 (Debian 2.6.30-8squeeze1) (dannf@debian.org) (gcc ver sion 4.3.4 (Debian 4.3.4-6) ) #1 SMP Fri Dec 4 00:53:20 UTC 2009 % ruby -v ruby 1.8.7 (2009-06-12 patchlevel 174) [i486-linux] % gem1.8 --version 1.3.5 % rails -v Rails 2.3.5 % sqlite3 --version 3.6.21
チュートリアルの目的_
アクティベーション、パスワードの変更、パスワード忘れの対処、ユーザーの凍結/凍結解除、役割、そして、OpenIDまでをこのチュートリアルではカバーする。
チュートリアル(OpenID前まで)_
restful authenticationのインストール_
まず、新しいプロジェクトを作成し、restful authenticationをインストールする。
% rails myproject % cd myproject % ruby script/plugin install http://svn.techno-weenie.net/projects/plugins/restful_authentication/
Pageリソースを生成する。その後、restful_authenticationプラグインで使うファイルを生成する。
% ruby script/generate scaffold Page title:string body:text % ruby script/generate authenticated user sessions --include-activation
上記コマンドでセッション用のコントローラーとビューができているはず。その後、application_controller.rbに"include AuthenticatedSystem"が付け加えられているかをチェックする。チェックすると付け加えられていないので付け加える。
メール送信設定_
次にconfig/initalizersにmail.rbを作成する。以下はチュートリアルの例。
mail.rb:
# Email settings ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = { :address => "mail.yourapplication.com", :port => 25, :domain => "yourapplication.com", :authentication => :login, :user_name => "mail@yourapplication.com", :password => "yourapplicationpassword" }
mail.rb(localhostのメールサーバーをポート番号25で使う場合)
# Email settings ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = { :address => "localhost", :port => 25 }
RAILS PRESS:Rails2.0ではActionMailer::Base.server_settingsは使えないにしたがえば、/usr/lib/sendmailを使ってもメールを送ることができる。その場合は、以下のようになる。
mail.rb:
# Email settings ActionMailer::Base.delivery_method = :sendmail ActionMailer::Base.sendmail_settings = { :location => "/usr/sbin/sendmail -t" }
次に、config/environment.rbの"Rails::Initializer.run do |config|"の後ろに以下の行を追加する。そうすると、このアプリケーションは、レジストレーションやアクティベーションなどの後にユーザーにメールを送るようになる(user_observer.rbとuser_mailer.rbはrestfulauthenticationによって、app/models以下に作られている)。
config.active_record.observers = :user_observer
次に、app/models以下にあるuser_mailer.rbを開き、思うように変更する。設定例は以下のとおり。
user_mailer.rb:
class UserMailer < ActionMailer::Base def signup_notification(user) setup_email(user) @subject += 'Please activate your new account' @body[:url] = "http://localhost:3000/activate/#{user.activation_code}" end def activation(user) setup_email(user) @subject += 'Your account has been activated!' @body[:url] = "http://localhost:3000/" end def forgot_password(user) setup_email(user) @subject += 'You have requested to change your password' @body[:url] = "http://localhost:3000/reset_password/#{user.password_reset_code}" end def reset_password(user) setup_email(user) @subject += 'Your password has been reset.' end protected def setup_email(user) @recipients = "#{user.email}" @from = "mail@yourapplication.com" @subject = "YourApplication - " @sent_on = Time.now @body[:user] = user end end
(訳者注)モデル内に直接URLを書くのは便利ではないので、定数として定義しそれを使うようにした方が良い。そうする場合は、config/environment.rbに定数を定義するか、config/environments/development.rb(開発用設定ファイル)かconfig/environments/development.rb(公開用設定ファイル)に書く。
具体的には、上記の設定ファイルのどれかに以下を追加する。
## For my application RootURL = 'http://localhost:3000/' MyMailAddress = 'mail@yourapplication.com'
そして、user_mailer.rbを以下のように変更する。
user_mailer.rb:
class UserMailer < ActionMailer::Base def signup_notification(user) setup_email(user) @subject += 'Please activate your new account' @body[:url] = "#{RootURL}activate/#{user.activation_code}" end def activation(user) setup_email(user) @subject += 'Your account has been activated!' @body[:url] = "#{RootURL}" end def forgot_password(user) setup_email(user) @subject += 'You have requested to change your password' @body[:url] = "#{RootURL}reset_password/#{user.password_reset_code}" end def reset_password(user) setup_email(user) @subject += 'Your password has been reset.' end protected def setup_email(user) @recipients = "#{user.email}" @from = "#{MyMailAddress}" @subject = "YourApplication - " @sent_on = Time.now @body[:user] = user end end
config以下のファイルを書き換えた場合は、WebRickを再起動すること。
そして、user_observer.rbにパスワードのリセットとパスワード忘れ機能を組み込む。
user_observer.rb:
class UserObserver < ActiveRecord::Observer def after_create(user) UserMailer.deliver_signup_notification(user) end def after_save(user) UserMailer.deliver_activation(user) if user.pending? UserMailer.deliver_forgot_password(user) if user.recently_forgot_password? UserMailer.deliver_reset_password(user) if user.recently_reset_password? end end
RolesとPermissionsの設定_
rolesとpermissionsを設定する。
% ruby script/generate scaffold Role rolename:string % ruby script/generate model Permission
db/migrate以下にあるXXX_create_permissions.rbを編集する。
class CreatePermissions < ActiveRecord::Migration def self.up create_table :permissions do |t| t.integer :role_id, :user_id, :null => false t.timestamps end end def self.down drop_table :permissions end end
元のチュートリアルでは、XXX_create_permissions.rbファイルの中で初期データをセットしていたが、Rails 2.3.4からそれをやめるようになったらしい(情報元:ひげろぐ:Rails 2.3.4で追加されたseeds.rbについて)
db/seeds.rbを以下のように書く。
#Make sure the role migration file was generated first Role.create(:rolename => 'administrator') #Then, add default admin user #Be sure change the password later or in this migration file user = User.new user.login = "admin" user.email = "info@yourapplication.com" user.password = "admin" user.password_confirmation = "admin" user.save(false) user.send(:activate!) role = Role.find_by_rolename('administrator') user = User.find_by_login('admin') permission = Permission.new permission.role = role permission.user = user permission.save(false)
controllerを編集し始める前に、db/migrate以下にあるXXX_create_users.rbにenabledとpassword_reset_code を付け加える。
class CreateUsers < ActiveRecord::Migration def self.up create_table "users", :force => true do |t| t.column :login, :string t.column :email, :string t.column :crypted_password, :string, :limit => 40 t.column :salt, :string, :limit => 40 t.column :created_at, :datetime t.column :updated_at, :datetime t.column :remember_token, :string t.column :remember_token_expires_at, :datetime t.column :activation_code, :string, :limit => 40 t.column :activated_at, :datetime t.column :password_reset_code, :string, :limit => 40 t.column :enabled, :boolean, :default => true end end def self.down drop_table "users" end end
次に、app/models以下のファイルをいくつか変更しなければならない。 はじめに、rolesとusersの間の関係を定義する。rolesとusersは多対多の関係なので、has_many :through宣言で関係を示す。
role.rb:
class Role < ActiveRecord::Base has_many :permissions has_many :users, :through => :permissions end
permission.rb
class Permission < ActiveRecord::Base belongs_to :user belongs_to :role end
Userモデルの修正_
続いて、以下の変更をuser.rbに行なう。
- メールアドレスの長さチェックに関する変更
- userとrolesの間の関係
- あるユーザーがある役割をもっているかどうかを調べるチェック
- パスワード忘れに関する記述
- ユーザーアクティベートに関するいくつかの変更。
require 'digest/sha1' class User < ActiveRecord::Base # Virtual attribute for the unencrypted password attr_accessor :password validates_presence_of :login, :email validates_presence_of :password, :if => :password_required? validates_presence_of :password_confirmation, :if => :password_required? validates_length_of :password, :within => 4..40, :if => :password_required? validates_confirmation_of :password, :if => :password_required? validates_length_of :login, :within => 3..40 validates_length_of :email, :within => 6..100 validates_uniqueness_of :login, :email, :case_sensitive => false validates_format_of :email, :with => /(^([^@\s]+)@((?:[-_a-z0-9]+\.)+[a-z]{2,})$)|(^$)/i has_many :permissions has_many :roles, :through => :permissions before_save :encrypt_password before_create :make_activation_code # prevents a user from submitting a crafted form that bypasses activation # anything else you want your user to change should be added here. attr_accessible :login, :email, :password, :password_confirmation class ActivationCodeNotFound < StandardError; end class AlreadyActivated < StandardError attr_reader :user, :message; def initialize(user, message=nil) @message, @user = message, user end end # Finds the user with the corresponding activation code, activates their account and returns the user. # # Raises: # +User::ActivationCodeNotFound+ if there is no user with the corresponding activation code # +User::AlreadyActivated+ if the user with the corresponding activation code has already activated their account def self.find_and_activate!(activation_code) raise ArgumentError if activation_code.nil? user = find_by_activation_code(activation_code) raise ActivationCodeNotFound if !user raise AlreadyActivated.new(user) if user.active? user.send(:activate!) user end def active? # the presence of an activation date means they have activated !activated_at.nil? end # Returns true if the user has just been activated. def pending? @activated end # Authenticates a user by their login name and unencrypted password. Returns the user or nil. # Updated 2/20/08 def self.authenticate(login, password) u = find :first, :conditions => ['login = ?', login] # need to get the salt u && u.authenticated?(password) ? u : nil end # Encrypts some data with the salt. def self.encrypt(password, salt) Digest::SHA1.hexdigest("--#{salt}--#{password}--") end # Encrypts the password with the user salt def encrypt(password) self.class.encrypt(password, salt) end def authenticated?(password) crypted_password == encrypt(password) end def remember_token? remember_token_expires_at && Time.now.utc < remember_token_expires_at end # These create and unset the fields required for remembering users between browser closes def remember_me remember_me_for 2.weeks end def remember_me_for(time) remember_me_until time.from_now.utc end def remember_me_until(time) self.remember_token_expires_at = time self.remember_token = encrypt("#{email}--#{remember_token_expires_at}") save(false) end def forget_me self.remember_token_expires_at = nil self.remember_token = nil save(false) end def forgot_password @forgotten_password = true self.make_password_reset_code end def reset_password # First update the password_reset_code before setting the # reset_password flag to avoid duplicate email notifications. update_attribute(:password_reset_code, nil) @reset_password = true end #used in user_observer def recently_forgot_password? @forgotten_password end def recently_reset_password? @reset_password end def self.find_for_forget(email) find :first, :conditions => ['email = ? and activated_at IS NOT NULL', email] end def has_role?(rolename) self.roles.find_by_rolename(rolename) ? true : false end protected # before filter def encrypt_password return if password.blank? self.salt = Digest::SHA1.hexdigest("--#{Time.now.to_s}--#{login}--") if new_record? self.crypted_password = encrypt(password) end def password_required? crypted_password.blank? || !password.blank? end def make_activation_code self.activation_code = Digest::SHA1.hexdigest( Time.now.to_s.split(//).sort_by {rand}.join ) end def make_password_reset_code self.password_reset_code = Digest::SHA1.hexdigest( Time.now.to_s.split(//).sort_by {rand}.join ) end private def activate! @activated = true self.update_attribute(:activated_at, Time.now.utc) end end
authenticated_system.rbの編集_
チュートリアルでは、lib以下にあるauthenticated_system.rbの変更を勧めている。チュートリアルでは、not_logged_in_required, check_role, check_administrator_roleと permission_denied が付け加えられている。
module AuthenticatedSystem protected # Returns true or false if the user is logged in. # Preloads @current_user with the user model if they're logged in. def logged_in? current_user != :false end # Accesses the current user from the session. Set it to :false if login fails # so that future calls do not hit the database. def current_user @current_user ||= (login_from_session || login_from_basic_auth || login_from_cookie || :false) end # Store the given user id in the session. def current_user=(new_user) session[:user_id] = (new_user.nil? || new_user.is_a?(Symbol)) ? nil : new_user.id @current_user = new_user || :false end # Check if the user is authorized # # Override this method in your controllers if you want to restrict access # to only a few actions or if you want to check if the user # has the correct rights. # # Example: # # # only allow nonbobs # def authorized? # current_user.login != "bob" # end def authorized? logged_in? end # Filter method to enforce a login requirement. # # To require logins for all actions, use this in your controllers: # # before_filter :login_required # # To require logins for specific actions, use this in your controllers: # # before_filter :login_required, :only => [ :edit, :update ] # # To skip this in a subclassed controller: # # skip_before_filter :login_required # def login_required authorized? || access_denied end def not_logged_in_required !logged_in? || permission_denied end def check_role(role) unless logged_in? && @current_user.has_role?(role) if logged_in? permission_denied else store_referer access_denied end end end def check_administrator_role check_role('administrator') end # Redirect as appropriate when an access request fails. # # The default action is to redirect to the login screen. # # Override this method in your controllers if you want to have special # behavior in case the user is not authorized # to access the requested action. For example, a popup window might # simply close itself. def access_denied respond_to do |format| format.html do store_location flash[:error] = "You must be logged in to access this feature." redirect_to :controller => '/session', :action => 'new' end format.xml do request_http_basic_authentication 'Web Password' end end end def permission_denied respond_to do |format| format.html do #Put your domain name here ex. http://www.example.com domain_name = "http://localhost:3000" http_referer = session[:refer_to] if http_referer.nil? store_referer http_referer = ( session[:refer_to] || domain_name ) end flash[:error] = "You don't have permission to complete that action." #The [0..20] represents the 21 characters in http://localhost:3000 #You have to set that to the number of characters in your domain name if http_referer[0..20] != domain_name session[:refer_to] = nil redirect_to root_path else redirect_to_referer_or_default(root_path) end end format.xml do headers["Status"] = "Unauthorized" headers["WWW-Authenticate"] = %(Basic realm="Web Password") render :text => "You don't have permission to complete this action.", :status => '401 Unauthorized' end end end # Store the URI of the current request in the session. # # We can return to this location by calling #redirect_back_or_default. def store_location session[:return_to] = request.request_uri end def store_referer session[:refer_to] = request.env["HTTP_REFERER"] end # Redirect to the URI stored by the most recent store_location call or # to the passed default. def redirect_back_or_default(default) redirect_to(session[:return_to] || default) session[:return_to] = nil end def redirect_to_referer_or_default(default) redirect_to(session[:refer_to] || default) session[:refer_to] = nil end # Inclusion hook to make #current_user and #logged_in? # available as ActionView helper methods. def self.included(base) base.send :helper_method, :current_user, :logged_in? end # Called from #current_user. First attempt to login by the user id stored in the session. def login_from_session self.current_user = User.find(session[:user_id]) if session[:user_id] end # Called from #current_user. Now, attempt to login by basic authentication information. def login_from_basic_auth authenticate_with_http_basic do |username, password| self.current_user = User.authenticate(username, password) end end # Called from #current_user. Finaly, attempt to login by an expiring token in the cookie. def login_from_cookie user = cookies[:auth_token] && User.find_by_remember_token(cookies[:auth_token]) if user && user.remember_token? user.remember_me cookies[:auth_token] = { :value => user.remember_token, :expires => user.remember_token_expires_at } self.current_user = user end end end
チュートリアルの作者曰く。permission_deniedメソッドは改良の余地があるとのこと。このメソッドの働きは、あるリソースへのアクセス権限がない場合、一つ前に見ていたページに戻るというもの(ただし、自ドメインでない場合は、自ドメインのトップに戻る)。以下、チュートリアルの原文。 "The permission_denied method is definitly an area I feel needs improvement. Its just something I threw together so that users would be redirected properly if they tried to access a resource they didn't have permission for. Its designed to redirect back to the last page they were on, unless that page is on another site or has the same address as the resource they're trying to access. Please let me know if you have any suggested improvements for that method."
コントローラーの編集_
続いてcontrollerを編集する。チュートリアルでは、restful_authenticationによって生成された多くのactionをそれら自身のコントローラーに移している。目的は、restfulの振る舞いにできる限りそうようにするため。また、将来の拡張しやすいようにしておくため。
まず、users_controller.rbを編集する。
class UsersController < ApplicationController layout 'application' before_filter :not_logged_in_required, :only => [:new, :create] before_filter :login_required, :only => [:show, :edit, :update] before_filter :check_administrator_role, :only => [:index, :destroy, :enable] def index @users = User.find(:all) end #This show action only allows users to view their own profile def show @user = current_user end # render new.rhtml def new @user = User.new end def create cookies.delete :auth_token @user = User.new(params[:user]) @user.save! #Uncomment to have the user logged in after creating an account - Not Recommended #self.current_user = @user flash[:notice] = "Thanks for signing up! Please check your email to activate your account before logging in." redirect_to login_path rescue ActiveRecord::RecordInvalid flash[:error] = "There was a problem creating your account." render :action => 'new' end def edit @user = current_user end def update @user = User.find(current_user) if @user.update_attributes(params[:user]) flash[:notice] = "User updated" redirect_to :action => 'show', :id => current_user else render :action => 'edit' end end def destroy @user = User.find(params[:id]) if @user.update_attribute(:enabled, false) flash[:notice] = "User disabled" else flash[:error] = "There was a problem disabling this user." end redirect_to :action => 'index' end def enable @user = User.find(params[:id]) if @user.update_attribute(:enabled, true) flash[:notice] = "User enabled" else flash[:error] = "There was a problem enabling this user." end redirect_to :action => 'index' end end
次にsessions_controller.rbを編集する。 (この方法で設定すると、openid authenticationとの統合が簡単にできる)
# This controller handles the login/logout function of the site. class SessionsController < ApplicationController layout 'application' before_filter :login_required, :only => :destroy before_filter :not_logged_in_required, :only => [:new, :create] # render new.rhtml def new end def create password_authentication(params[:login], params[:password]) end def destroy self.current_user.forget_me if logged_in? cookies.delete :auth_token reset_session flash[:notice] = "You have been logged out." redirect_to login_path end protected # Updated 2/20/08 def password_authentication(login, password) user = User.authenticate(login, password) if user == nil failed_login("Your username or password is incorrect.") elsif user.activated_at.blank? failed_login("Your account is not active, please check your email for the activation code.") elsif user.enabled == false failed_login("Your account has been disabled.") else self.current_user = user successful_login end end private def failed_login(message) flash.now[:error] = message render :action => 'new' end def successful_login if params[:remember_me] == "1" self.current_user.remember_me cookies[:auth_token] = { :value => self.current_user.remember_token , :expires => self.current_user.remember_token_expires_at } end flash[:notice] = "Logged in successfully" return_to = session[:return_to] if return_to.nil? redirect_to user_path(self.current_user) else redirect_to return_to end end end
次にさらに二つのcontrollerを生成する。
% ruby script/generate controller Passwords edit new % ruby script/generate controller Accounts edit
passwords_controller.rbを編集する。
class PasswordsController < ApplicationController layout 'application' before_filter :not_logged_in_required, :only => [:new, :create] # Enter email address to recover password def new end # Forgot password action def create return unless request.post? if @user = User.find_for_forget(params[:email]) @user.forgot_password @user.save flash[:notice] = "A password reset link has been sent to your email address." redirect_to login_path else flash[:notice] = "Could not find a user with that email address." render :action => 'new' end end # Action triggered by clicking on the /reset_password/:id link recieved via email # Makes sure the id code is included # Checks that the id code matches a user in the database # Then if everything checks out, shows the password reset fields def edit if params[:id].nil? render :action => 'new' return end @user = User.find_by_password_reset_code(params[:id]) if params[:id] raise if @user.nil? rescue logger.error "Invalid Reset Code entered." flash[:notice] = "Sorry - That is an invalid password reset code. Please check your code and try again. (Perhaps your email client inserted a carriage return?)" #redirect_back_or_default('/') redirect_to new_user_path end # Reset password action /reset_password/:id # Checks once again that an id is included and makes sure that the password field isn't blank def update if params[:id].nil? render :action => 'new' return end if params[:password].blank? flash[:notice] = "Password field cannot be blank." render :action => 'edit', :id => params[:id] return end @user = User.find_by_password_reset_code(params[:id]) if params[:id] raise if @user.nil? return if @user unless params[:password] if (params[:password] == params[:password_confirmation]) #Uncomment and comment lines with @user to have the user logged in after reset - not recommended #self.current_user = @user #for the next two lines to work #current_user.password_confirmation = params[:password_confirmation] #current_user.password = params[:password] #@user.reset_password #flash[:notice] = current_user.save ? "Password reset" : "Password not reset" @user.password_confirmation = params[:password_confirmation] @user.password = params[:password] @user.reset_password flash[:notice] = @user.save ? "Password reset." : "Password not reset." else flash[:notice] = "Password mismatch." render :action => 'edit', :id => params[:id] return end redirect_to login_path rescue logger.error "Invalid Reset Code entered" flash[:notice] = "Sorry - That is an invalid password reset code. Please check your code and try again. (Perhaps your email client inserted a carriage return?)" redirect_to new_user_path end end
accounts_controller.rbを編集。
class AccountsController < ApplicationController layout 'application' before_filter :login_required, :except => :show before_filter :not_logged_in_required, :only => :show # Activate action def show # Uncomment and change paths to have user logged in after activation - not recommended #self.current_user = User.find_and_activate!(params[:id]) User.find_and_activate!(params[:id]) flash[:notice] = "Your account has been activated! You can now login." redirect_to login_path rescue User::ArgumentError flash[:notice] = 'Activation code not found. Please try creating a new account.' redirect_to new_user_path rescue User::ActivationCodeNotFound flash[:notice] = 'Activation code not found. Please try creating a new account.' redirect_to new_user_path rescue User::AlreadyActivated flash[:notice] = 'Your account has already been activated. You can log in below.' redirect_to login_path end def edit end # Change password action def update return unless request.post? if User.authenticate(current_user.login, params[:old_password]) if ((params[:password] == params[:password_confirmation]) && !params[:password_confirmation].blank?) current_user.password_confirmation = params[:password_confirmation] current_user.password = params[:password] if current_user.save flash[:notice] = "Password successfully updated." redirect_to root_path #profile_url(current_user.login) else flash[:error] = "An error occured, your password was not changed." render :action => 'edit' end else flash[:error] = "New password does not match the password confirmation." @old_password = params[:old_password] render :action => 'edit' end else flash[:error] = "Your old password is incorrect." render :action => 'edit' end end end
roles_controller.rbを編集。
class RolesController < ApplicationController layout 'application' before_filter :check_administrator_role def index @user = User.find(params[:user_id]) @all_roles = Role.find(:all) end def update @user = User.find(params[:user_id]) @role = Role.find(params[:id]) unless @user.has_role?(@role.rolename) @user.roles << @role end redirect_to :action => 'index' end def destroy @user = User.find(params[:user_id]) @role = Role.find(params[:id]) if @user.has_role?(@role.rolename) @user.roles.delete(@role) end redirect_to :action => 'index' end end
ビューの編集_
次はビューの編集。まず、最初にこのアプリケーションのレイアウトを作成する。このレイアウトは少なくとも以下を含むこと。
app/view/layout/application.html.erb
<ul> <% if logged_in? %> <li>Logged in as:</li> <li><%= link_to h(current_user.login.capitalize), user_path(current_user) %></li> <ul> <li><%= link_to 'Edit Profile', edit_user_path(current_user) %></li> <li><%= link_to 'Change Password', change_password_path %></li> <li><%= link_to 'Log Out', logout_url %></li> </ul> <% if current_user.has_role?('administrator') %> <li><%= link_to 'Administer Users', users_path %></li> <% end %> <% else %> <li><%= link_to 'Log In', new_session_path %></li> <li><%= link_to 'Sign Up', new_user_path %></li> <li><%= link_to 'Forgot Password?', forgot_password_path %></li> <% end %> </ul>
私(このチュートリアル意訳の著者)は以下のようにファイルを用意した。
<html> <head> <meta http-equiv="content-type" content="text/html;charset=UTF-8" /> <title><%= h @title -%></title> <%= stylesheet_link_tag 'main' %> </head> <body> <ul> <% if logged_in? %> <li>Logged in as:</li> <li><%= link_to h(current_user.login.capitalize), user_path(current_user) %></li> <ul> <li><%= link_to 'Edit Profile', edit_user_path(current_user) %></li> <li><%= link_to 'Change Password', change_password_path %></li> <li><%= link_to 'Log Out', logout_url %></li> </ul> <% if current_user.has_role?('administrator') %> <li><%= link_to 'Administer Users', users_path %></li> <% end %> <% else %> <li><%= link_to 'Log In', new_session_path %></li> <li><%= link_to 'Sign Up', new_user_path %></li> <li><%= link_to 'Forgot Password?', forgot_password_path %></li> <% end %> </ul> <hr> <h1><%= h @title -%></h1> <p><%=h flash[:notice] -%></p> <%= yield %> </body> </html>
app/views/passwords/edit.html.erbの編集。
<% form_tag url_for(:action => "update", :id => params[:id]) do %> Password:<br /> <%= password_field_tag :password %><br /> Confirm Password:<br /> <%= password_field_tag :password_confirmation %><br /> <%= submit_tag "Reset Your Password" %> <% end %>
app/views/passwords/new.html.erbの編集。
<h2>Forgot Password</h2> <% form_tag url_for(:action => 'create') do %> What is the email address used to create your account?<br /> <%= text_field_tag :email, "", :size => 50 %><br /> <%= submit_tag 'Reset Password' %> <% end %>
app/views/accounts/edit.html.erbの編集。
<% form_tag url_for(:action => "update") do %> <p><label for="old_password" class="block">Old Password</label><br /> <%= password_field_tag 'old_password', @old_password, :size => 45 %></p> <p><label for="password" class="block">New Password</label><br /> <%= password_field_tag 'password', {}, :size => 45 %><br /> <small>Between 4 and 40 characters</small></p> <p><label for="password_confirmation" class="block">Confirm new password</label><br /> <%= password_field_tag 'password_confirmation', {}, :size => 45 %></p> <%= submit_tag 'Change password' %> <% end %>
app/views/roles/_role.html.erbの編集。
<li> <%= role.rolename %> <% if @user.has_role?(role.rolename) %> <%= link_to 'remove role', user_role_url(:id => role.id, :user_id => @user.id), :method => :delete %> <% else %> <%= link_to 'assign role', user_role_url(:id => role.id, :user_id => @user.id), :method => :put %> <% end %> </li>
app/views/roles/index.html.erb:
<h2>Roles for <%=h @user.login.capitalize %></h2> <h3>Roles assigned:</h3> <ul><%= render :partial => 'role', :collection => @user.roles %></ul> <h3>Roles available:</h3> <ul><%= render :partial => 'role', :collection => (@all_roles - @user.roles) %></ul>
他のapp/views/rolesのビューに関しては削除しても良いし、拡張してもよい。
app/views/sessions/new.html.erbの編集。
<h2>Login with User ID and Password:</h2> <% form_tag session_path do %> <p><label for="login">Login</label><br/> <%= text_field_tag 'login' %></p> <p><label for="password">Password</label><br /> <%= password_field_tag 'password' %></p> <p><label for="remember_me">Remember me:</label> <%= check_box_tag 'remember_me' %></p> <p><%= submit_tag 'Log in' %><%= link_to "Sign Up", new_user_path %></p> <% end %>
app/views/user_mailer/activation.html.erbの編集。
<%=h @user.login %>, your account has been activated. To visit the site, follow the link below: <%= @url %>
app/views/user_mailer/forgot_password.html.erbの編集
<%=h @user.login %>, to reset your password, please visit <%= @url %>
app/views/user_mailer/reset_password.html.erbの編集
<%=h @user.login %>, Your password has been reset
app/views/user_mailer/signup_notification.html.erbの編集。
Your account has been created. Username: <%=h @user.login %> Visit this url to activate your account: <%= @url %>
app/views/users/_user.html.erbの編集。
<tr class="<%= cycle('odd', 'even') %>"> <td><%=h user.login %></td> <td><%=h user.email %></td> <td><%= user.enabled ? 'yes' : 'no' %> <% unless user == current_user %> <% if user.enabled %> <%= link_to('disable', user_path(user.id), :method => :delete) %> <% else %> <%= link_to('enable', enable_user_path(user.id), :method => :put) %> <% end %> <% end %> </td> <td><%= link_to 'edit roles', user_roles_path(user) %>]</td> </tr>
app/views/users/edit.html.erbの編集。
<h2>Edit Your Account</h2> <p><%= link_to 'Show Profile', user_path(@user) %> | <%= link_to 'Change Password', change_password_path %></p> <%= error_messages_for :user %> <% form_for :user, :url => user_url(@user), :html => { :method => :put } do |f| %> <p>Email:<br /><%= f.text_field :email, :size => 60 %></p> <%= submit_tag 'Save' %> <% end %>
app/views/users/index.html.erbの編集。
<h2>All Users</h2> <table> <tr> <th>Username</th> <th>Email</th> <th>Enabled?</th> <th>Roles</th> </tr> <%= render :partial => 'user', :collection => @users %> </table>
app/views/users/new.html.erbの編集。
<%= error_messages_for :user %> <% form_for :user, :url => users_path do |f| %> <p><label for="login">Login</label><br/> <%= f.text_field :login %></p> <p><label for="email">Email</label><br/> <%= f.text_field :email %></p> <p><label for="password">Password</label><br/> <%= f.password_field :password %></p> <p><label for="password_confirmation">Confirm Password</label><br/> <%= f.password_field :password_confirmation %></p> <p><%= submit_tag 'Sign up' %></p> <% end %>
app/views/users/show.html.erbの編集。
<h2>User: <%=h @user.login %></h2> <p>Joined on: <%= @user.created_at.to_s(:long) %></p>
routes.rbの編集_
最後にconfig/routes.rbを編集する。
ActionController::Routing::Routes.draw do |map| map.root :controller => "pages", :action => "index" map.signup '/signup', :controller => 'users', :action => 'new' map.login '/login', :controller => 'sessions', :action => 'new' map.logout '/logout', :controller => 'sessions', :action => 'destroy' map.activate '/activate/:id', :controller => 'accounts', :action => 'show' map.forgot_password '/forgot_password', :controller => 'passwords', :action => 'new' map.reset_password '/reset_password/:id', :controller => 'passwords', :action => 'edit' map.change_password '/change_password', :controller => 'accounts', :action => 'edit' # See how all your routes lay out with "rake routes" map.resources :pages map.resources :users, :member => { :enable => :put } do |users| users.resource :account users.resources :roles end map.resource :session map.resource :password # Install the default routes as the lowest priority. map.connect ':controller/:action/:id' map.connect ':controller/:action/:id.:format' end
public/index.htmlを削除するのをお忘れなく。
データベースマイグレーション_
サイトを立ち上げるために、データベースを作る必要があるので、マイグレーションを実行する。
(初めての場合)
rake db:migrate rake db:seed
(二回目以降)
rake db:migrate:reset rake db:seed あるいは rake db:reset
利用法_
サーバーを立ち上げると、あなたはユーザ認証システムを使えます。
app/controllers/pages_controller.rbにbofore_filterを付け加えるのを忘れないこと。具体的には、:login_required, :check_administrator_roleや:not_logged_in_required。
新しい、フィルターを付け加えるのも簡単。例えば、:check_moderator_roleというフィルターを付け加えたいときには、authenticated_system.rbに以下を付け加える。もちろん、moderatorという役割をテーブルに付け加えるのを忘れずに。
def check_moderator_role check_role('moderator') end
With OpenID_
Stop here if you don't want to use OpenID.
Now that the open_id_authentication plugin is being patched to work with verson 2+ of the ruby-openid gem, I have added this section on openid authentication to the tutorial:
To get started, install the latest version of the openid gem:
# Installs ruby-openid-2.0.4 gem install ruby-openid
To install the plugin, you can use the git repository at http://github.com/josh/open_id_authenti … y_openid_2 If you don't have or can't use git, you can download a rar file of it from http://rapidshare.com/files/93608377/op … n.rar.html Unrar it and copy the folder into vendor/plugins. I tried to put it on rubyforge so there would be SVN access but it takes 72 hours.
Run the migration for the open id authentication tables:
rake open_id_authentication:db:create
Open the migration file XXX_add_open_id_authentication, and add a column for the OpenID url in your users table:
add_column :users, :identity_url, :string
So that your migration file now looks like:
class AddOpenIdAuthenticationTables < ActiveRecord::Migration def self.up create_table :open_id_authentication_associations, :force => true do |t| t.integer :issued, :lifetime t.string :handle, :assoc_type t.binary :server_url, :secret end create_table :open_id_authentication_nonces, :force => true do |t| t.integer :timestamp, :null => false t.string :server_url, :null => true t.string :salt, :null => false end add_column :users, :identity_url, :string end def self.down remove_column :users, :identity_url drop_table :open_id_authentication_associations drop_table :open_id_authentication_nonces end end
Run the migration:
rake db:migrate
Add the route for OpenID authentication to your routes file:
map.open_id_complete 'session', :controller => "sessions", :action => "create", :requirements => { :method => :get }
so that your routes.rb file looks like:
ActionController::Routing::Routes.draw do |map| map.root :controller => "pages", :action => "index" map.signup '/signup', :controller => 'users', :action => 'new' map.login '/login', :controller => 'sessions', :action => 'new' map.logout '/logout', :controller => 'sessions', :action => 'destroy' map.activate '/activate/:id', :controller => 'accounts', :action => 'show' map.forgot_password '/forgot_password', :controller => 'passwords', :action => 'new' map.reset_password '/reset_password/:id', :controller => 'passwords', :action => 'edit' map.change_password '/change_password', :controller => 'accounts', :action => 'edit' map.open_id_complete 'session', :controller => "sessions", :action => "create", :requirements => { :method => :get } # See how all your routes lay out with "rake routes" map.resources :pages map.resources :users, :member => { :enable => :put } do |users| users.resource :account users.resources :roles end map.resource :session map.resource :password # Install the default routes as the lowest priority. map.connect ':controller/:action/:id' map.connect ':controller/:action/:id.:format' end
Modify the attr_accesible line in your User model so that your users can set and change their OpenID:
attr_accessible :login, :email, :password, :password_confirmation, :identity_url
You also need to modify the password_required? method in the User model:
def password_required? not_openid? && (crypted_password.blank? || !password.blank?) end
and add below it:
def not_openid? identity_url.blank? end
Edit the New sessions view at sessions/new.html.erb to include an option for an OpenID login:
<h2>Login with User ID and Password:</h2> <% form_tag session_path do -%> <p><label for="login">Login</label><br/> <%= text_field_tag 'login' %></p> <p><label for="password">Password</label><br/> <%= password_field_tag 'password' %><br /> <label for="remember_me">Remember me:</label> <%= check_box_tag 'remember_me' %></p> <p><br /><label for="openid_url">Optional - use your OpenID url:</label><br /> <%= text_field_tag "openid_url" %></p> <p><%= submit_tag 'Log In' %> or <%= link_to "Sign Up", new_user_path %></p> <% end -%>
If you want the OpenID logo used in this form field, add the following code to your CSS file:
input#openid_url { background: url(http://openid.net/login-bg.gif) no-repeat; background-color: #fff; background-position: 0 50%; color: #000; padding-left: 18px; }
Next, modify the Sessions Controller to include OpenID authentication. Here we have added if using_open_id? and the methods open_id_authentication and create_open_id_user:
class SessionsController < ApplicationController layout 'application' before_filter :login_required, :only => :destroy before_filter :not_logged_in_required, :only => [:new, :create] # render new.rhtml def new end def create if using_open_id? open_id_authentication(params[:openid_url]) else password_authentication(params[:login], params[:password]) end end def destroy self.current_user.forget_me if logged_in? cookies.delete :auth_token reset_session flash[:notice] = "You have been logged out." redirect_to login_path #redirect_back_or_default('/') end protected def open_id_authentication(openid_url) authenticate_with_open_id(openid_url, :required => [:nickname, :email]) do |result, identity_url, registration| if result.successful? @user = User.find_or_initialize_by_identity_url(identity_url) if @user.new_record? if !registration['nickname'].blank? && !registration['email'].blank? @user.login = registration['nickname'] @user.email = registration['email'] create_open_id_user(@user) else flash[:error] = "Your persona must include at a minimum a nickname and valid email address to use OpenID on this site." render :action => 'new' end else if @user.activated_at.blank? failed_login("Your account is not active, please check your email for the activation code.") elsif @user.enabled == false failed_login("Your account has been disabled.") else self.current_user = @user successful_login end end else failed_login result.message end end end def create_open_id_user(user) user.save! flash[:notice] = "Thanks for signing up! Please check your email to activate your account before logging in." redirect_to login_path rescue ActiveRecord::RecordInvalid flash[:error] = "Someone has signed up with that nickname or email address. Please create another persona for this site." render :action => 'new' end def password_authentication(login, password) user = User.authenticate(login, password) if user == nil failed_login("Your username or password is incorrect.") elsif user.activated_at.blank? failed_login("Your account is not active, please check your email for the activation code.") elsif user.enabled == false failed_login("Your account has been disabled.") else self.current_user = user successful_login end end private def failed_login(message) flash.now[:error] = message render :action => 'new' end def successful_login if params[:remember_me] == "1" self.current_user.remember_me cookies[:auth_token] = { :value => self.current_user.remember_token , :expires => self.current_user.remember_token_expires_at } end flash[:notice] = "Logged in successfully" return_to = session[:return_to] if return_to.nil? redirect_to user_path(self.current_user) else redirect_to return_to end end end
Even though nickname and email are listed as required openid fields, the application was still allowing a new user to be created without them, so I had to !registration['nickname'].blank? && !registration['email'].blank? validation to make sure they were actually present. If anyone knows any more about this let me know. Also, I couldn't get the remember me checkbox to work with openid authentication because of the redirect to your openid provider. Please let me know if anyone has a fix for this as well.
References / Additional Resources: