title: Rails 4 + Devise 3.0 - Authenticate using username and email
body: <p>I'm trying to allow users to sign in with either their username or their email address.</p>
  
  <p>as per here: <a href="https://github.com/plataformatec/devise/wiki/How-To:-Allow-users-to-sign-in-using-their-username-or-email-address" rel="nofollow noreferrer">https://github.com/plataformatec/devise/wiki/How-To:-Allow-users-to-sign-in-using-their-username-or-email-address</a></p>
  
  <p>When ever I try to sign in with either the email or the login this is logged:</p>
  
  <pre><code>Started POST "/users/sign_in" for 192.168.2.8 at 2013-11-22 10:11:50 +0800
  Processing by Devise::SessionsController#create as HTML
    Parameters: {"utf8"=&gt;"â", "authenticity_token"=&gt;"WVTOKWQ8yJAJSu3NmXi3skJ8UC8zXY7qGZj7qbM3cr0=", "user"=&gt;{"email"=&gt;"testuser", "password"=&gt;"password"}, "commit"=&gt;"Sign in"}
    User Load (3.3ms)  SELECT "users".* FROM "users" WHERE "users"."email" = 'testuser' ORDER BY "users"."id" ASC LIMIT 1
  Completed 401 Unauthorized in 20ms
  Processing by Devise::SessionsController#new as HTML
    Parameters: {"utf8"=&gt;"â", "authenticity_token"=&gt;"WVTOKWQ8yJAJSu3NmXi3skJ8UC8zXY7qGZj7qbM3cr0=", "user"=&gt;{"email"=&gt;"rtype", "password"=&gt;"password"}, "commit"=&gt;"Sign in"}
    Rendered devise/sessions/new.html.erb within layouts/application (6.4ms)
  Completed 200 OK in 80ms (Views: 62.6ms | ActiveRecord: 0.0ms)
  </code></pre>
  
  <p>its weird the sql isn't checking for the username, so maybe the call on the user is wrong, but its exactly from the devise documentation.</p>
  
  <p>I have read the following:</p>
  
  <p><a href="https://stackoverflow.com/questions/17537665/adding-username-to-devise-rails-4">Adding Username to devise rails 4</a>
  <a href="https://stackoverflow.com/questions/17992847/logging-in-with-username-using-devise-with-rails-4">Logging in with username using Devise with Rails 4</a></p>
  
  <p>I also reviewed the warden code and the devise code to try and discover if I'm overriding the wrong method in the user.</p>
  
  <p>Any ideas why it is not authenticating with username, when it does with email?</p>
  
  <p>ApplicationController.rb</p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
    protect_from_forgery
  
    before_filter :configure_permitted_parameters, if: :devise_controller?
  
    protected
      def configure_permitted_parameters
        devise_parameter_sanitizer.for(:sign_up) { |u| u.permit(:username, :email, :password, :password_confirmation) }
        devise_parameter_sanitizer.for(:sign_in) { |u| u.permit(:username, :email, :password, :remember_me) }
  
        # Need to add other user fields like gender etc.
        devise_parameter_sanitizer.for(:account_update) {|u| u.permit(:email, :password, :password_confirmation, :current_password)}
      end
  end
  </code></pre>
  
  <p>User.rb</p>
  
  <pre><code>class User &lt; ActiveRecord::Base
  
    devise :database_authenticatable, :registerable, :confirmable, :encryptable, :recoverable, :rememberable, :trackable, :validatable
  
    attr_accessor :login # This is used to add the login for allowing user to sign in with both email or username
  
    # Validations
    validates :username, presence: true, length: {maximum: 255}, uniqueness: { case_sensitive: false }, format: { with: /\A[a-zA-Z0-9]*\z/, message: "may only contain letters and numbers." }
  
    # Overwrite devise’s find_for_database_authentication method in user model
    def self.find_first_by_auth_conditions(warden_conditions)
      conditions = warden_conditions.dup
      if login = conditions.delete(:username)
        where(conditions).where(["lower(username) = :value OR lower(email) = :value", { :value =&gt; login.downcase }]).first
      else
        where(conditions).first
      end
    end
  end
  </code></pre>
  
  <p>new.html</p>
  
  <pre><code>&lt;fieldset&gt;
  &lt;%= form_for(resource, :as =&gt; resource_name, :url =&gt; session_path(resource_name),  :html =&gt; { :class =&gt; 'form-horizontal' }) do |f| %&gt;
    &lt;div class="control-group"&gt;
      &lt;%= f.label :login, "Email or Username" %&gt;
      &lt;div class="controls"&gt;&lt;%= f.text_field :login, :autofocus =&gt; true %&gt;&lt;/div&gt;
    &lt;/div&gt;
  
    &lt;div class="control-group"&gt;
      &lt;%= f.label :password %&gt;
      &lt;div class="controls"&gt;&lt;%= f.password_field :password %&gt;&lt;/div&gt;
    &lt;/div&gt;
  
    &lt;div class="form-actions"&gt;
      &lt;%= f.submit "Sign in", :class =&gt; "btn btn-primary", data: { disable_with: 'Working...' } %&gt;  &lt;%= link_to "Forgot password?", new_password_path(resource_name), :class =&gt; "btn" %&gt;
    &lt;/div&gt;
  &lt;% end %&gt;
  &lt;/fieldset&gt;
  </code></pre>
  
  <p>Devise.rb</p>
  
  <pre><code>config.secret_key = 'Omitted for security'
  config.mailer_sender = 'Omitted for security'
  config.case_insensitive_keys = [ :email ]
  config.strip_whitespace_keys = [ :email ]
  config.skip_session_storage = [:http_auth]
  config.stretches = Rails.env.test? ? 1 : 10
  config.reconfirmable = true
  config.password_length = 8..128
  config.reset_password_within = 6.hours
  config.encryptor = :sha512
  config.sign_out_via = :delete
  </code></pre>