Hi all.
To manage users, instead of reinvent the wheel, we can use Ruby on Rails plugins. The web site Agile Web Development contains a complete list of plugins. In home page, in the “browse by tag” section, you can click on “authentication” and then select “Restful-authentication”.
The Restful-authentication plugin provides a foundation for managing user authentication:
* Login / logout
* Secure password handling
* Account activation by validating email
* Account approval / disabling by admin
* Rudimentary hooks for authorization and access control.
Ok, now we have to install the plugin:
- get the repository url from the plugin web page
- open a console and change the directory to the website directory
- type the command script/plugin install

When the command terminates you will find the plugin installed into the directory “vendors/plugins”

Open the previous console window and follow the below steps:
Run the generator
The generator sets up your controllers, model, views and observer as well as modify the routes.rb file (sets up session and users as resources). The session controller is used for signing in and out of the system while the user controller takes care of the rest. We also include the user account activation system.
ruby script/generate authenticated user sessions
Run the migration
The system also generated a migration file. Run the migration with:
rake db:migrate
Modify the routes file
Open up config/routes.rb and add to the named route section:
map.activate '/activate/:activation_code', :controller => 'users',
:action => 'activate'
While the routes file is still open, add more named routes (giving the user actions nice, friendly urls)
map.signup '/signup', :controller => 'users', :action => 'new'
map.login '/login', :controller => 'sessions', :action => 'new'
map.logout '/logout', :controller => 'sessions', :action => 'destroy'
Add an observer
Add an observer to config/enviroment.rb (within the Rails::Initializer.run block) :
config.active_record.observers = :user_observer
At this point, the basic system should be working. Start up your development server and go to http://localhost:3000/signup. Also try http://localhost:3000/login to confirm it’s fine.

Set up ActionMailer
The rails config/environment.rb file includes a Rails::Initializer.run block and prior to Rails 2, configuration code went in there.
With Rails 2, there’s now a directory (config/initializers) where seperate, discreet bits of configuration are placed in files of their own.
These are automatically loaded after plugins are loaded when Rails starts up.Create a new file called mail.rb in the config/initializers directory.
Place the following SMTP settings into the mail.rb file:
ActionMailer::Base.delivery_method = :smtp
ActionMailer::Base.smtp_settings = {
:address => "mail.example-domain.com",
:port => 25,
:domain => "www.example-domain.com",
:authentication => :login,
:user_name => "user@example-domain.com",
:password => "secret"
}
:address and :port – Determines the address and port of the SMTP server you’ll be using. These default to localhost and 25 , respectively.
:domain – The domain the mailer should use when identifying itself to the server (usually the top-level domain name of the machine sending the email).
:authentication – One of :plain, :login or :cram_md5. Should be omitted if the server does not require authentication. Also omit :username and :password options if you omit this parameter.
:username and :password – Mail account login credentials. Required if :authentication is set.
Note:
to test ActionMailer I used a private smtp server but it’s possible to use the smtp server of your email providere such as GMail (on the net there’s a lot of tutorials; e.g. try this one: http://guides.rubyonrails.org/action_mailer_basics.html#action-mailer-configuration-for-gmail).
How the registration process works
After the filling of the login form the system send to the user an email with an activation code.

Clicking on the link written in the email the activation process will be completed. This will be confirmed via email and the user will be redirected on the login page.

You can download the source developed till now clicking here.
In the next step we will see how to create pages accessible only to logged in users.