title: assigning roles in devise/cancan/deviseldap/rolify and using ldap_param_value
body: <p>Bottom line up front:
     How can I assign a role from ldap right away when a user logs in.</p>
  
  <p>I am using devise/cancan/deviseldap/rolify to authenticate users and then hopefully assign a role.  I am close <em>i think</em> to getting this working.   What I have is a custom initializer that lets the user into the app only if they have a certain memberOf in their ldap entry.</p>
  
  <p>this works thanks to the gracious help from the person in this thread:</p>
  
  <p><a href="https://stackoverflow.com/questions/17257728/checking-groups-at-runtime-with-devise-and-devise-ldap-authenticatable/17281314?noredirect=1#comment25534199_17281314">checking groups at runtime with devise and devise_ldap_authenticatable</a></p>
  
  <p>So now it is time for me to assign roles, after trolling around on the net I figured maybe the best way was the after_create in user.rb from devise.  I had these memberOf's in the config/initializer but cannot get access to them later like in the <code>user.rb</code> as described by the following what I attempted in the <code>user.rb</code>:</p>
  
  <pre><code> class User &lt; ActiveRecord::Base
       after_create :assign_role
       ...
       ...
    private
    def assign_role
     puts "Assigning role!"
     member_of = self.ldap_param_value("memberOf")  #get array #i know self here is wrong
     member_of.each do |str|
     if str.include? 'Help Desk Admin'
        self.roles &lt;&lt; "admin"
     end
     if str.include? 'Password Manager'
        self.roles &lt;&lt; "password_manager"
     end
     if str.include? 'Security'
       self.roles &lt;&lt; "security"
     end
     if str.include? 'Help Desk'
       self.roles &lt;&lt; "help_desk"
     end
    end
  
   puts "roles assigned!"
   self.update
  end
  </code></pre>
  
  <p>The biggest problem (there are many I am still a ruby noobie) is that i have that call to a method ldap_param_value and I know calling it on self is not correct, I got this code working same line in the config/initializer/customdevise.rb (this is for my front gate catch all check): (I know i need the right object instantiated to get access to the ldap_param_value above, but not sure what it is).  I thought the self was: Devise::LdapAdapter, but I tried that above and it still didn't work:</p>
  
  <p><code>Devise::LdapAdapter.ldap_param_value(...)</code></p>
  
  <p>For completeness my <code>config/initializer/customedevise.rb</code></p>
  
  <pre><code>Devise::LdapAdapter::LdapConnect.class_eval do
    def user_group_test
    member_of = self.ldap_param_value("memberOf") #self works here...
    checkgroups member_of # your group test method  end
  
   def checkgroups(members)
    retVal = false
    members.each do |str|
      if str.include? 'Help Desk Admin' or str.include? 'Password Manager' or  str.include? 'Security' or str.include? 'Help Desk'
          retVal = true;
      end
    end
    return retVal
  end
  #    'CN=Password Manager'
  #    'CN=Help Desk'
  #    'CN=Help Desk Admin'
  #    'CN=Security'
  
  
  def authorized?
  DeviseLdapAuthenticatable::Logger.send("Authorizing user #{dn}")
    if !user_group_test
      DeviseLdapAuthenticatable::Logger.send("Not authorized because custom authentication failed.")
      return false
    elsif !authenticated?
      DeviseLdapAuthenticatable::Logger.send("Not authorized because not authenticated.")
      return false
    elsif !in_required_groups?
      DeviseLdapAuthenticatable::Logger.send("Not authorized because not in required groups.")
      return false
    elsif !has_required_attribute?
      DeviseLdapAuthenticatable::Logger.send("Not authorized because does not have required attribute.")
      return false
    else
      return true
    end
   end
  end
  </code></pre>
  
  <p>Note: Another flaw above is that devise does not know exactly why the authentication failed... I suffer with that and changed the <code>devise.en.yml</code> files <code>invalid:</code> to include more information:</p>
  
  <pre><code>en:
    devise:
     confirmations:
      confirmed: "Your account was successfully confirmed. You are now signed in."
      send_instructions: "You will receive an email with instructions about how to confirm your account in a few minutes."
      send_paranoid_instructions: "If your email address exists in our database, you will receive an email with instructions about how to confirm your account in a few minutes."
     failure:
       already_authenticated: "You are already signed in."
       inactive: "Your account was not activated yet."
       invalid: "Invalid email or password.  Or not a member of the correct group"
  
        ..etc...
  </code></pre>