ActiveAdmin with CanCanAdapter causes infinite redirection in control panel

Question

When using the CanCan adapter in ActiveAdmin 0.6.0. I have a resource working, and authorization is working. However, when I go to /admin , the root page of ActiveAdmin, it redirects to /admin and continues this forever.

Answer 1

If the user does not have access to the page, ActiveAdmin is redirected to the Personal Account. If the user does not have access to the control panel, this leads to an endless redirection.

The solution is to enable the user to read the dashboard page. Put this in the ability model object:

 can :read, ActiveAdmin::Page, :name => "Dashboard" 

This is mentioned in the adapter authorization documentation, but the infinite redirection seems to be caused by poor design in ActiveAdmin. It does not raise CanCan :: AccessDenied and does not display a message to the user. At the very least, it should display a message in development to help fix this problem. But this is currently not the case.

Answer 2

You can use the config.on_unauthorized_access config option as described here .

 # You can also specify a method to be called on unauthorized # access. This is necessary in order to prevent a redirect # loop that can happen if a user tries to access a page they # don't have permissions for # (see [#2081](https://github.com/gregbell/active_admin/issues/2081)). config.on_unauthorized_access = :render_403 

The access_denied method will be defined in application_controller.rb . Here is one example that redirects a user from a page on which they do not have access rights to the resource to which they have permission to access (in this case, the organization), and also displays an error message in the browser:

class ApplicationController <ActionController :: Base

  def access_denied(exception) redirect_to admin_organizations_path, :alert => exception.message end 

end

Answer 3

I had the same error and I have admin user:

 if user.admin? can :manage, :all end 

I just forgot to add the correct role to this user, so maybe someone will have the same endless redirection loop as I do with ActiveAdmin and Cancan.