# Hanami Authentication
**URL:** https://discourse.hanakai.org/t/hanami-authentication/334
**Category:** proposals
**Created:** [April 20, 2017, 7:24pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334 "2017-04-20T19:24:48Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@cllns](https://discourse.hanakai.org/u/cllns)
#### Post date: [April 20, 2017, 7:24pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/1 "2017-04-20T19:24:48Z")
@davydovanton and I are going to be working on an authentication solution for Hanami. We want something that’s as easy to use as devise, but done in a Hanami way (with less magic).
Talking with @jodosha and @davydovanton, we think it’s good to start with session management. That is, the very first iteration will not have user sign up, only user log in / log out. From there we can iterate and add support for omniauth, and traditional in-app email sign up.
After that, other nice-to-have features, for me, would be confirmations & password resets. Do other agree?
What other features should we add? We want to keep it as lean as possible, and iterate quickly.
---
### Author:  [@davydovanton](https://discourse.hanakai.org/u/davydovanton)
#### Post date: [April 20, 2017, 7:37pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/2 "2017-04-20T19:37:41Z")
What I want to see in this lib
In general, I want to see hanami (CLI?) app wich will create files with all actions and view in auth application instead “magic” controllers like in devise.
### Generators
In general, I see something like this:
```auto
hanami g auth model # => account model with some methods
hanami g auth app # => new hanami auth app with config
hanami g auth base # => sessions#create, sessions#delete, etc
hanami g auth reset-password # => actions for this logic
hanami g auth oauth # => all for auth app
```
Also, we should generate specs **with tests** for each generated action.
#### Model
I think we need to set `account` as a default model.
Generated fields:
- password\_hash
- email (commented)
- login (commented)
* * *
Now I’m working on simple `Authentication` module with simple methods (`authenticate!`, `current_account`, etc).
@jodosha @cllns WDYT?
---
### Author:  [@sebastjan\_hribar](https://discourse.hanakai.org/u/sebastjan_hribar)
#### Post date: [April 20, 2017, 7:41pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/3 "2017-04-20T19:41:02Z")
Hi,
I’m trying to accomplish something similar with [Tachiban](https://github.com/sebastjan-hribar/tachiban).
I’m almost ready to release Auth and then move on with password reset and later on also Authorizations.
regards,
Seba
---
### Author:  [@davydovanton](https://discourse.hanakai.org/u/davydovanton)
#### Post date: [April 20, 2017, 7:43pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/4 "2017-04-20T19:43:46Z")
Hey, thanks for your comment! Do you have any example of usage this lib?
---
### Author:  [@sebastjan\_hribar](https://discourse.hanakai.org/u/sebastjan_hribar)
#### Post date: [April 20, 2017, 7:56pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/5 "2017-04-20T19:56:05Z")
Unfortunately I don’t have an example of Tachiban in action yet. I’m planning on using it right after I release it. Although the code in Tachiban was extracted and from an app in production and slightly expanded in some cases to be more flexible.
---
### Author:  [@jodosha](https://discourse.hanakai.org/u/jodosha)
#### Post date: [April 25, 2017, 11:24am UTC](https://discourse.hanakai.org/t/hanami-authentication/334/6 "2017-04-25T11:24:32Z")
> [@davydovanton](#):
>
> hanami g auth app # =\> new hanami auth app with config
Sorry, I don’t get what is this about. Does it adds auth code to an existing app, or does it does something else?
---
### Author:  [@sebastjan\_hribar](https://discourse.hanakai.org/u/sebastjan_hribar)
#### Post date: [April 26, 2017, 4:59am UTC](https://discourse.hanakai.org/t/hanami-authentication/334/7 "2017-04-26T04:59:59Z")
I’ve released Tachiban 0.3.0 and will test it in an app to be used as an example.
---
### Author:  [@radanskoric](https://discourse.hanakai.org/u/radanskoric)
#### Post date: [April 30, 2017, 8:11am UTC](https://discourse.hanakai.org/t/hanami-authentication/334/8 "2017-04-30T08:11:30Z")
Hi, I’ve recently developed an interest in hanami and decided to build a pet project in it. One of the first things I looked for was an authentication framework. Here is my 2cents.
Tachiban seems to currently be the only serious attempt, however I decided to skip it because it seems to be early in development and, more importantly, invents it’s own session management instead of leveraging warden gem ([https://github.com/hassox/warden](https://github.com/hassox/warden)). I decided to roll my own with warden and bcrypt since it’s very easy. I’ve even done it a few times in the past in rails apps, skipping over devise for simplicity.
I would just like to suggest that any auth framework really should leverage both warden and bcrypt since they are both very mature, battle tested and actively maintained gems that fit into hanami philosophy. I was considering extracting the authentication from my pet app into a gem once it’s finished but I’d be even happier to just contribute to an existing gem following the same philosophy.
---
### Author:  [@sebastjan\_hribar](https://discourse.hanakai.org/u/sebastjan_hribar)
#### Post date: [May 3, 2017, 7:49am UTC](https://discourse.hanakai.org/t/hanami-authentication/334/9 "2017-05-03T07:49:39Z")
FWIW I had no intention of reinventing the wheel or replacing any existing solutions, but rather to learn the concepts of authentication and authorization as well as any related subjects. For me, the best way was to try to do it myself as much as possible. In the process I ended up with Tachiban. Admittedly there’s a long road ahead since it’s still a WIP, but I’ll continue to work on it as much as my schedule permits it to complete the set goals.
---
### Author:  [@jodosha](https://discourse.hanakai.org/u/jodosha)
#### Post date: [May 4, 2017, 8:22am UTC](https://discourse.hanakai.org/t/hanami-authentication/334/10 "2017-05-04T08:22:30Z")
> [@radanskoric](#):
>
> they are both very mature, battle tested and actively maintained gems
Is warden maintained? I don’t see too much activity, hence my question.
> [@radanskoric](#):
>
> I’d be even happier to just contribute to an existing gem following the same philosophy.
Your help is welcome! Please talk with @cllns
---
### Author:  [@radanskoric](https://discourse.hanakai.org/u/radanskoric)
#### Post date: [May 5, 2017, 7:25pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/11 "2017-05-05T19:25:15Z")
Yes, warden is very much maintained. It’s just a very mature and stable library with little need for modifications which is why there is not much activity. Also, since it’s a pure rack implementation it doesn’t get affected by new releases of Rails. Besides, Devise depends on it so it will stay live for at least as long as Devise itself is live.
---
### Author:  [@jodosha](https://discourse.hanakai.org/u/jodosha)
#### Post date: [May 7, 2017, 8:57am UTC](https://discourse.hanakai.org/t/hanami-authentication/334/12 "2017-05-07T08:57:32Z")
Thanks for the clarification. 👍
@cllns @davydovanton Let’s start with `warden` then, wdyt?
---
### Author:  [@radanskoric](https://discourse.hanakai.org/u/radanskoric)
#### Post date: [May 7, 2017, 10:45am UTC](https://discourse.hanakai.org/t/hanami-authentication/334/13 "2017-05-07T10:45:17Z")
I’ve got user registration, log in and log out nearly working in my pet app with bcrypt and warden. It’s going a bit slowly since I’m basically learning Hanami along the way 🙂 but I’m almost done with the first version. After that I’ll extract just the authentication into a separate project so you can see it. It might be useful as an example app to play around in.
One of the benefits of basing it on warden is, of course, the existing ecosystem. I.e. omniauth was mentioned which should be pretty easy to add through warden: [https://github.com/hassox/warden\_omniauth](https://github.com/hassox/warden_omniauth).
---
### Author:  [@radanskoric](https://discourse.hanakai.org/u/radanskoric)
#### Post date: [May 7, 2017, 10:50am UTC](https://discourse.hanakai.org/t/hanami-authentication/334/14 "2017-05-07T10:50:24Z")
> FWIW I had no intention of reinventing the wheel or replacing any existing solutions, but rather to learn the concepts of authentication and authorization as well as any related subjects. For me, the best way was to try to do it myself as much as possible. In the process I ended up with Tachiban. Admittedly there’s a long road ahead since it’s still a WIP, but I’ll continue to work on it as much as my schedule permits it to complete the set goals.
You’re definitely right, doing things from scratch is the best way to learn, I often do that as well. However, when I’m done, if there is a better existing solution that satisfies all requirements I also often delete my code and switch to the existing solution. 🙂 Of course, if you have plans for implementing a different feature set not supported by existing solutions then it also makes sense to build from scratch.
---
### Author:  [@radanskoric](https://discourse.hanakai.org/u/radanskoric)
#### Post date: [May 14, 2017, 9:14pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/15 "2017-05-14T21:14:10Z")
Hi all, I’ve wrapped up the first version of authentication based on warden and bcrypt and extracted it into a sample application: [https://github.com/radanskoric/hanami\_auth\_sample](https://github.com/radanskoric/hanami_auth_sample)
The key parts related to warden are:
- implementation of [the auth strategy](https://github.com/radanskoric/hanami_auth_sample/blob/master/lib/rack/warden.rb)
- setting up [the middleware](https://github.com/radanskoric/hanami_auth_sample/blob/master/apps/web/application.rb#L90) (the way failure app is handled here is just one way, there are different approaches)
- its usage in [user creation](https://github.com/radanskoric/hanami_auth_sample/blob/master/apps/web/controllers/users/create.rb), [session creation](https://github.com/radanskoric/hanami_auth_sample/blob/master/apps/web/controllers/session/create.rb) and [session destruction](https://github.com/radanskoric/hanami_auth_sample/blob/master/apps/web/controllers/session/destroy.rb)
---
### Author:  [@leemour](https://discourse.hanakai.org/u/leemour)
#### Post date: [May 4, 2019, 9:42pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/16 "2019-05-04T21:42:46Z")
Hi all, It’s been 2 years, any progress on authentication library development? I’d be happy to help with an existing project if there is one (all seem to be abandoned) for such a popular feature.
---
### Author:  [@sebastjan\_hribar](https://discourse.hanakai.org/u/sebastjan_hribar)
#### Post date: [May 5, 2019, 4:00pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/17 "2019-05-05T16:00:52Z")
Hi,
if you are interested, you’re welcome to help with [Tachiban](https://github.com/sebastjan-hribar/tachiban). I was pressed for time with other projects up until now, but I plan to continue with it as of now since we’re using it in our next application. There is a dedicated channel on gitter.
regards,
seba
---
### Author:  [@janko](https://discourse.hanakai.org/u/janko)
#### Post date: [July 6, 2019, 4:49pm UTC](https://discourse.hanakai.org/t/hanami-authentication/334/18 "2019-07-06T16:49:50Z")
[Rodauth](https://github.com/jeremyevans/rodauth) by Jeremy Evans looks super advanced and flexible enough that it should integrate well into any Rack-based web framework, including Hanami.
I would first give that a decent try before creating a Hanami-specific solution, especially because being web framework agnostic means Rubyists using different frameworks can focus on a single solution.