title: Authentication & Authorization - Practices for today
body: <p>I am about to implement authentication &amp; authorization in my project, using devise, cancan, and most likely rolify. My question does not surround the implementation of these, but rather on a larger scale, how people actually accomplish a full authentication and authorization, role based access system in today's world.</p>
  
  <p>My questions:</p>
  
  <ol>
  <li>Do applications typically have one authentication model (User), with authorization role based access to a backend admin dashboard? i.e. If role = X, a link to the dashboard becomes available to you, all others are restricted access to this dashboard.</li>
  <li>If #1 is an ideal solution, how does one do such things where the application will require a more strict password for "Personnel" (with dashboard access) vs. a general "User"? I could easily accomplish this with 2 models, but then I'm deviating from the concept above.</li>
  </ol>
  
  <p>OR</p>
  
  <ol>
  <li>Do applications generally have 2 models, say Personnel and User, where there is a completely separate authentication model for Personnel (and a corresponding set of authorizations, i.e. Admin vs. SuperUser)?</li>
  <li>If this above is an ideal solution, do you require your "Personnel" to have two separate logins for interacting with the user-side of the application vs. the admin panel (dashboard)?</li>
  </ol>
  
  <p>Do admin panels for web applications even live on the web? Or do they sit on an intranet somewhere, with VPN access and all that?</p>
  
  <p>I am trying to get a sense of how this all works in today's world. Maybe I am over thinking this.</p>
  
  <p>Really appreciate the conceptual help here. Your input into your own process will definitely help with any explanation of why you may be able to give!</p>
  
  <p><strong>Update:</strong></p>
  
  <p>Let me change the scope of this question a bit. I realize I can use VPN to run public facing application servers vs. non-public servers. The admin panel would obviously live within the non-public facing front.</p>
  
  <p>Does anyone have any resourceful information on how I would configure the Rails application to have these tiered layers?  How about how to setup a passenger config file to have the admin section run on the non-public server?</p>