Question

I am working on a basic authentication system for a rails app. The authentication is verifying account information from Active Directory using a net-ldap class (this part is working fine).

Something seems to be wrong with my session_helper however. Even though ActiveDirectoryUser.authenticate is successful, the signed_in helper always returns false. After signing in, the script redirects to root_path (default_controller’s home) and then immediately redirects back to signin_path again– as a result of the signed_in helper returning false.

See the code below. What am I missing?

Thanks

application_controller.rb

class ApplicationController < ActionController::Base
  protect_from_forgery
  include SessionsHelper
end

default_controller.rb

class DefaultController < ApplicationController
  before_filter :signed_in_user

  def home
  end

  private
    def signed_in_user
      redirect_to signin_path, notice: "Please sign in." unless signed_in?
    end
end

sessions_helper.rb

module SessionsHelper
  def sign_in(user)
    @current_user = user
  end

  def current_user
    @current_user ||= nil
  end

  def signed_in?
    !@current_user.nil?
  end

  def sign_out
    @current_user = nil
  end
end

sessions_controller.rb

class SessionsController < ApplicationController
  def new
  end

  def create    
    user = ActiveDirectoryUser.authenticate(params[:session][:username],params[:session][:password])

    if user.nil?
      # authentication failed
      flash.now[:error] = 'Invalid email/password combination'
      render 'new'
    else
      # authentication succeeded
      sign_in @user
      flash[:error] = 'Great success'
      redirect_to root_path
    end
  end

  def destroy
    sign_out
    redirect_to root_path
  end
end

Answer 1

You should use session for to persist that kind of data (will be assessable for every request), it’s user data. But I highly recommend you to use something like the devise gem that do all that authentication things and more for you. Why reinvent the weel right?

I believe this would work for you.

module SessionsHelper
  def sign_in(user)
    session[:user_id] = user.id
  end

  def current_user
    ActiveDirectoryUser.find(session[:user_id]) ||= nil
  end

  def signed_in?
    !session[:user_id].nil?
  end

  def sign_out
    session[:user_id] = nil
  end
end