authlogic Rubygems

A simple model based ruby authentication solution.

= Authlogic


A code example can replace a thousand words…


class UserSession < Authlogic::Session::Base # specify configuration here, such as: # logout_on_timeout true # …many more options in the documentation end


UserSession.create(:login => “bjohnson”, :password => “my password”, :remember_me => true) session = => “bjohnson”, :password => “my password”, :remember_me => true); UserSession.create(:openid_identifier => “identifier”, :remember_me => true) # requires the authlogic-oid “add on” gem UserSession.create(my_user_object, true) # skip authentication and log the user in directly, the true means “remember me”


You can also log out / destroy the session:



session = UserSession.find


class User < ActiveRecord::Base acts_as_authentic do |c| c.my_config_option = my_value end # the configuration block is optional end






== Helpful links

Before contacting me directly, please read:


== Authlogic “add ons”


== Session bugs (please read if you are having issues with logging in / out)


== Documentation explanation

You can find anything you want about Authlogic in the {documentation}[], all that you need to do is understand the basic design behind it.





=== Authlogic::ActsAsAuthentic sub modules



=== Authlogic::Session sub modules



=== Miscellaneous modules



== Quick Rails example




class UserSessionsController < ApplicationController def new @user_session = end

def create
  @user_session =[:user_session])
    redirect_to account_url
    render :action => :new

def destroy
  redirect_to new_user_session_url



<% form_for @user_session do |f| %> <%= f.error_messages %> <%= f.label :login %>
<%= f.text_field :login %>

<%= f.label :password %>
<%= f.password_field :password %>

<%= f.submit “Login” %> <% end %>

Or how about persisting the session…

class ApplicationController helper_method :current_user_session, :current_user

  def current_user_session
    return @current_user_session if defined?(@current_user_session)
    @current_user_session = UserSession.find

  def current_user
    return @current_user if defined?(@current_user)
    @current_user = current_user_session && current_user_session.user


== Install & Use

Install the gem / plugin (recommended)

From rubyforge:

$ sudo gem install authlogic

Or from github:

$ sudo gem install binarylogic-authlogic

Now just add the gem dependency in your projects configuration.

Or you can install this as a plugin:

script/plugin install git://

== Detailed Setup Tutorial


== Testing

I think one of the best aspects of Authlogic is testing. For one, it cuts out a lot of redundant tests in your applications because Authlogic is already thoroughly tested for you. It doesn’t include a bunch of tests into your application, because it comes tested, just like any other library.

For example, think about ActiveRecord. You don’t test the internals of ActiveRecord, because the creators of ActiveRecord have already tested the internals for you. It wouldn’t make sense for ActiveRecord to copy it’s hundreds of tests into your applications. The same concept applies to Authlogic. You only need to test code you write that is specific to your application, just like everything else in your application.

That being said, testing your code that uses Authlogic is easy. Since everyone uses different testing suites, I created a helpful module called Authlogic::TestCase, which is basically a set of tools for testing code using Authlogic. I explain testing Authlogic thoroughly in the {Authlogic::TestCase section of the documentation}[]. It should answer any questions you have in regards to testing Authlogic.

== Tell me quickly how Authlogic works


== What sets Authlogic apart and why I created it

What inspired me to create Authlogic was the messiness of the current authentication solutions. Put simply, they just didn’t feel right, because the logic was not organized properly. As you may know, a common misconception with the MVC design pattern is that the model “M” is only for data access logic, which is wrong. A model is a place for domain logic. This is why the RESTful design pattern and the current authentication solutions don’t play nice. Authlogic solves this by placing the session maintenance logic into its own domain (aka “model”). Moving session maintenance into its own domain has its benefits:

  1. It’s cleaner. There are no generators in Authlogic. Authlogic provides a class that you can use, it’s plain and simple ruby. More importantly, the code in your app is code you write, written the way you want, nice and clean. It’s code that should be in your app and is specific to your app, not a redundant authentication pattern.
  4. No redundant tests. Because Authlogic doesn’t use generators, #1 also applies to tests. Authlogic is thoroughly tested for you. You don’t go and test the internals of ActiveRecord in each of your apps do you? So why do the same for Authlogic? Your application tests should be for application specific code. Get rid of the noise and make your tests focused and concise, no reason to copy tests from app to app.
  5. Framework agnostic. Authlogic can be used in any ruby framework you want: Rails, Merb, Sinatra, Mack, your own framework, whatever. It’s not tied down to Rails. It does this by abstracting itself from these framework’s controllers by using a controller adapter. Thanks to {Rack}[], there is a defined standard for controller structure, and that’s what Authlogic’s abstract adapter follows. So if your controller follows the rack standards, you don’t need to do anything. Any place it deviates from this is solved by a simple adapter for your framework that closes these gaps. For an example, checkout the Authlogic::ControllerAdapters::MerbAdapter.
  6. You are not restricted to a single session. Think about Apple’s, where they need you to authenticate a second time before changing your billing information. Why not just create a second session for this? It works just like your initial session. Then your billing controller can require an “ultra secure” session.

Copyright © 2009 {Ben Johnson of Binary Logic}[], released under the MIT license

Related Repositories



A simple ruby authentication solution. ...



Facebook Connect for Authlogic ...



Authlogic OAuth is an extension of the Authlogic library to add OAuth support. OAuth can be used to allow users to login with their Twitter credentials. ...



Youtube-like site written in Rails. Uses ffmpeg, flowplayer, attachment_fu, authlogic, acts_as_taggable_on_steroids ...



Authlogic, OpenID, Oauth, Rails 3, on Heroku ...

Top Contributors

binarylogic m4n jjb chewi radar ZenCocoon avit bcardarella dcrec1 josephruscio isomorphix nicolasblanco hardbap geku jeffrydegrande josh-m-sharpe levinalex Shadowfiend nbudin reinh shadowmaru vinibaggio ariejan jrallison mynyml theill


-   v2.1.6 zip tar
-   v2.1.5 zip tar
-   v2.1.4 zip tar
-   v2.1.3 zip tar
-   v2.1.2 zip tar
-   v2.1.1 zip tar
-   v2.1.0 zip tar
-   v2.0.14 zip tar
-   v2.0.13 zip tar
-   v2.0.12 zip tar
-   v2.0.11 zip tar
-   v2.0.10 zip tar
-   v2.0.9 zip tar
-   v2.0.8 zip tar
-   v2.0.7 zip tar
-   v2.0.6 zip tar
-   v2.0.5 zip tar
-   v2.0.4 zip tar
-   v2.0.3 zip tar
-   v2.0.2 zip tar
-   v2.0.1 zip tar
-   v2.0.0 zip tar
-   v2.0.0RC1 zip tar
-   v1.4.3 zip tar
-   v1.4.2 zip tar
-   v1.4.1 zip tar
-   v1.4.0 zip tar
-   v1.3.9 zip tar
-   v1.3.8 zip tar
-   v1.3.7 zip tar