So you’re storing the role information in the database, then?

It seems that the biggest obstacle to caching the role information in the session properly is that declarative_authorization expects the roles to be defined in the User model but Authlogic doesn’t store the User instance in the session directly. Depending on your session storage mechanism, storing the User instance might be impractical.

Out of curiosity, which lower-level Ruby LDAP library are you using? My posts set up ActiveLdap with net-ldap but I’ve actually switched to ruby-ldap (ActiveLdap supports both!) because I was having an issue similar to yours with Active Directory where looking up an entry would fail after the connection had been idle for a while. If you’re using net-ldap, try switching to ruby-ldap and see if it works better for you.

it addresses my issue.

The user session ‘create’ code grabs user data, runs a check on the relevant domain security groups, and saves the highest level I care about as the user’s role. Whenever DA asks for ‘role_symbols’, it receives the user’s role put in array form.

## xxxxxxxxxxxxxx_add_role_to_users.rb
add_column :users, :role, :string, :null => false, :default => “Guest”

## user_sessions_controller.rb
def create
@user_session = UserSession.new(params[:user_session])
@groups = LdapUser.find(@user_session.login).groups.collect(&:cn.to_sym)

@curuser = User.find_by_login(@user_session.login)
if @groups.include?(“Inventory Admins”) then
@curuser.update_attribute(:role, “admin”)
elsif @groups.include?(“Inventory Users”) then
@curuser.update_attribute(:role, “user”)
else
@curuser.update_attribute(:role, “guest”)
end

if @user_session.save
flash[:notice] = “Login successful!”
redirect_back_or_default account_url
else
render :action => :new
end
end

## user.rb
def role_symbols
[ self.role.to_sym() ]
end

As far as I can tell, ‘session’ storage is only accessible through controllers, and models can’t access controller-level variables (such as current_user). Considering “declarative authorization” requires role_symbols in the model, I have been unable to figure out how to cache group membership properly.

But there’s a disadvantage to caching that information: if you accidentally gave a person a role they shouldn’t have and fix that by removing them from the group, you still have to wait for that person to log out (or the session to expire) before the change will take effect. But if you have a large number of users that might be your best option.