Question

I have a rails app where I need to add authentication. The problem is that I have a legacy database with custom user and password fields (t_user and t_pass). Plus, t_pass is not encrypted.

What I’m looking for is something like http_basic, but where I can have methods like current_user, and probably with a better user interface. I don’t need validation, password reset, anything. Just a way to authenticate my way. I’d use restful_authentication but I’m on rails 3. I saw a fork that works with rails 3 but I was wondering if there is a better way to handle this situation?

Answer 1

It looks to me like you could probably do what you need using Devise and a bit of extra playing around. Specifically, you’ll want to:

• Make sure you create your user model table using your legacy auth table.
• Override valid_password? on this model to check against your t_pass field.
• Override self.find_for_database_authentication to find your model based on the t_user field.

If you want to support registration, you’ll probably need to write a new encryption strategy as well.

Just a word of warning though: Storing passwords in plain text is very bad practice. If you have any choice at all, I’d seriously consider doing a migration of existing users into Devise’s standard structure, with crypted passwords.