V2 - Installing and Using Authorisation Schema

Introduction

This pages includes tips and tricks for installing and using the V2 authorisation schema on Ruby on Rails Development by utilizing Declarative Authorization and Rolify.

Modules

Declarative Authorization

The Declarative Authorization plugin offers an authorization mechanism inspired by RBAC (Role Based Access Control):

Once the rdoc documentation is generated, it is available under:

It is worth to view this good railscast:

Rolify

Very simple Roles library without any authorization enforcement supporting scope on resource object:

Once the rdoc documentation is generated, it is available under:

Installation

  1. Add the gems to the Gemfile: 

    # Authorisation
gem 'declarative_authorization'
gem 'rolify'
  2. Install the gems 
    bundle install
  3. Generate rdoc documentation 
    su
gem rdoc --all --no-ri

  4. Create model Role and database table users_roles 

    rails generate rolify:role
rake db:migrate

Implementation

Requirements

  1. Change app/controllers/application_controller.rb to

    • provide current user in both controllers and models

    • catch all Permission Denied error 

      class ApplicationController < ActionController::Base
  protect_from_forgery

  before_filter :set_current_user       # for model security

  include SessionsHelper

  # Force signout to prevent CSRF attacks
  def handle_unverified_request
    sign_out
    super
  end

  # declarative_authorization callback on permission violation
  def permission_denied
    flash[:error] = "Sorry, you are not allowed to access that page."
    redirect_to root_url
  end

  protected

    # needed for access control in model for declarative_authorization
    def set_current_user
      Authorization.current_user = current_user
    end
end

  2. Change app/models/user.rb to

    • allow using add_role, remove_role, etc. of Rolify

    • provide method User.role_symbols for Declarative Authorization 
      class User < ActiveRecord::Base
  rolify       # Rolify gem: add_role, remove_role, etc.
  .
  has_and_belongs_to_many :roles, :join_table => :users_roles
  .
 # -- Roles for authorisation
 def role_symbols
   (roles || []).map {|r| r.name.underscore.to_sym}
 end
  .
  ,

Access Control in Controllers

Use filter_resource_access method in every controller, where access control required. No option is needed if no other actions are used as the 7 RESTFul ones. See options:

Filter records for list in similar way:

If the model-controller-database naming follows the standard Rails conventions, the lines reading the model based on params[:id] can be removed, filter_resource_access does it for us:

Access Control in Models

Use using_access_control method in every controller, where access control required. Generally no option is needed. See options:

Access Control in Views

Use permitted_to? method in every views, where access control required on instance or model basis. E.g. in app/views/documents/_revision_file_list_block.html.erb:

Use has_role_with_hierarchy? in every views, where access control required on role base. E.g. in app/views/layouts/_main_menu.html.erb:

Users & Roles

We are using the authorization not in the standard way of the couple Declarative Authorization - Rolify.

For the critical objects, as documents, revisions, tasks we are using folder based authorization. Therefore we utilize the resource context of Rolify for the Folder model.

V2 authorization model contains the following roles:

Some hints:

Example Configuration

The following commands in lib/tasks/sample_data.rake grants

The result in the database is self-explanatory:

Note that role names are not predefined anywhere. Any roles can be added by add_role.

Authorization Rules

See examples on github:

See reference guide of the DSL in rdoc:

V2P0 example:

Note the role hierarchy ( root->admin->login->guest ), the privilege hierarchy(manage->new,create,edit,update,destroy, etc.). Note also that everywhere where a role or a privilege is use in the configuration, also an array can be used.

Tests and System Preloading

It can be necessary to bypass the authorization in test scripts and system preloading. It can be done with the method without_access_control. E.g. in lib/tasks/sample_data.rake used by seed_fu:

Open points

V2Authorization (last edited 2013-08-07 10:03:40 by C3E483A5)

Copyright 2008-2014, SoftXS GmbH, Switzerland