Rails 3.1 Web 服务中的两种不同授权方案
我正在使用 Rails 3.1 创建一个 Web 服务，该服务需要经过身份验证的用户帐户来创建/管理内容。它还需要一个用于访问内容的临时“用户”的授权方案 - 他们没有帐户，但只需提供在其请求中创建内容的用户提供给他们的密码。
我认为最好的策略是将两者分开，而不是为临时用户创建帐户，将它们表示为与内容关联的单独模型。
我的问题是，这是否是我应该从头开始构建的东西，或者我是否可以从现有的身份验证宝石之一中获得足够的杠杆作用。如果是后者，我将如何配置它来管理两种不同的策略。
I'm creating a web service with Rails 3.1 that requires authenticated user accounts for creating/managing content. It also requires an authorization scheme for transient 'users' accessing the content - they do not have accounts, but will simply provide a password furnished to them by the user who created the content in their requests.
I'm thinking the best strategy is to keep the two separate, not creating accounts for the transient users, representing them as a separate model associated with the content.
My question is whether this is something I should build from scratch, or whether I can get sufficient leverage from one of the existing authentication gems for it. And if the latter, how I would go about configuring it to manage two different strategies.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果理解正确，您将拥有常规帐户用户和用户生成的临时帐户，以共享对任何内容的访问权限。
我认为不存在用于此特定目的的东西。
我认为需要使用可靠且舒适的 Auth Manager gem 来保护用户和 tmp_account 访问的安全。
其余的，即管理用户-tmp_account 关系和管理 tmp_account 的生命周期+权限，可以轻松手动完成。
我个人用 gem Devise 构建了类似的东西。
If understand right, you will have regular account users and temporary account generated by users to share access to whatever.
I don't think something for this specific purpose exist.
My think using a solid and confortable Auth Manager gem will be require to secure both user and tmp_account access.
The reste, ie managing user-tmp_account relation and managing life time + right of the tmp_account, could be done without pain manually.
I personally build up something similar with the gem Devise.
事实证明我真的不需要认证宝石。虽然实现尚未完成，但 Rails 3.1 的 has_secure_password 和 CanCan 的组合似乎可以很好地工作为了这。
以下是 Ryan Bate 使用 has_secure_password 的教程： http://asciicasts.com/episodes /270-authentication-in-rails-3-1
这个想法是在用户和内容模型上使用 has_secure_password ，并实现current_user，以便在提供密码时创建一个临时用户，并在该临时用户上设置密码属性。然后 CanCan 的 Skill 类中 init 方法的实现将根据 can 块中的内容验证临时用户的密码。
Turns out I don't really need an authentication gem. While the implementation isn't finished, it appears a combination of Rails 3.1's has_secure_password and CanCan will work well for this.
Here's Ryan Bate's tutorial for using has_secure_password: http://asciicasts.com/episodes/270-authentication-in-rails-3-1
The idea is to use has_secure_password on both the User and Content models, and implement current_user such that it creates a transient User when the password is provided, setting a password property on that transient user.Then the implementation of the init method in CanCan's Ability class will verify the transient user's password against the content in a can block.