Question

I have the AuthLogic plugin installed in my RoR app. I not creating an app that needs to be high security. But I would like it if admins can log in as a particular user without having to know each and every one of their passwords.

I cannot find where AuthLogic actually validates the entered password upon login.

Anyone have any recommendations or advice as to the best method?

Answer 1

Validation happens in the Authlogic::Session::Password module.

If you wanted to override the default behavior, you would do the following:

class UserSession < Authlogic::Session::Base
  verify_password_method :my_verify_method
  private
    def my_verify_method
      if admin_user? # method that checks to see if the current user is an admin
        true
      else
        valid_password? # use default valid password method
      end
end