Document Authentication

[afomera]

👋

Something that would be good to document is how applications can implement a level of authentication for Madmin. Out of the box we produce an unauthenticated view, this is obviously not production ready.

Because authentication can be different from app to app, we'd prefer to not roll our own and to instead allow Developers to use their existing models instead.

What we'd like to see is:

• Examples on how to use basic auth with Madmin
• Examples of how to use it with Devise / Example of how to override the Madmin Controller to plugin any other system

Let us know if there's more information needed!

[excid3]

I'd also like to see documentation on how to add masquerade button to users show view. It's a common use case and it'd be great to have documented.

[excid3]

Route authentication with Devise and separate AdminUser:

rails g devise AdminUser

# config/routes.rb
authenticated :admin_user do
  namespace :madmin do
    # madmin routes
  end
end

[excid3]

Route authentication with User and admin flag:

rails g devise User admin:boolean

# config/routes.rb
authenticated :user, lambda { |u| u.admin? } do
  namespace :madmin do
    # madmin routes
  end
end

[excid3]

Started this in: https://github.com/excid3/madmin/blob/master/docs/authentication.md

[etagwerker]

What would this look like if one wanted to use basic http authentication? 😄

I guess I would have to redefine this method:

madmin/test/dummy/app/controllers/madmin/application_controller.rb

Lines 5 to 10 in f3aa501

	def authenticate_admin_user
	# TODO: Add your authentication logic here
	# For example, we could redirect if the user isn't an admin
	# redirect_to "/", alert: "Not authorized." unless user_signed_in? && current_user.admin?
	end

[excid3]

I haven't tested it yet, but I left an example for http basic auth on line 20:

madmin/test/dummy/app/controllers/madmin/application_controller.rb

Line 20 in f3aa501

# http_basic_authenticate_with(name: Rails.application.credentials.admin_username, password: Rails.application.credentials.admin_password)