Q:

Authorization in Rails 4 app that has external data source

I am building an app that uses Salesforce as a backend for data storage. This means I have no models in my database other than User. I can't use traditional authorization solutions for rails because they require me to access rails models.
The app I'm building requires certain permissions surrounding the user. The user has two states:
User:unactivated
User:activated
I will be triggering the change in the users' states from Salesforce.
I have views that need to be protected based on the state of the user. I'm not sure if the most scalable way to handle this is a simple state column in the user model and just have <%= current_user.state == "activated" %> in my views or if there is a better solution?
Thank you

A:

You can use cancan (cancancan), there is an option which will let you make authorizations on the controller.
authorize_resource :class => false

You can read more about this on their wiki here is a start

A:

A new feature of Active Record, Enum, introduced in Rails 4.1, is the simplest way to implement your requirement. You can implement a very basic form of role-based authorization, with a single role "activated" that has two states.
Create a migration:
$ rails generate migration AddRoleToUsers role:integer

The migration will look like this:
class AddRoleToUsers < ActiveRecord::Migration
  def change
    add_column :users, :role, :integer
  end
end

Add code to your User model to implement the Enum:
class User < ActiveRecord::Base
  enum role: [:activated, :unactivated]
  after_initialize :set_default_role, :if => :new_record?

  def set_default_role
    self.role ||= :unactivated
  end

end

You define the names of the roles, and if necessary, can change the names as needed (the integer values stored with each user record remain unchanged). Active Record will restrict the assignment of the attribute to a collection of predefined values, so you don’t have to add any code to restrict the names of the roles to a defined set. Best of all, enums come with a set of convenience methods that allow you to directly query the role without any extra code. For an enum attribute named role, with the values activated, and unactivated, you can use these methods:
User.roles # => {"activated"=>0, "unactivated"=>1} # list all roles
user.activated! # make the user activated
user.activated? # => true # query if the user is activated
user.role # => "activated" # find out the user’s role
@users = User.activated # obtain an array of all users who are activated
user.role = 'foo' # ArgumentError: 'foo' is not a valid, we can’t set invalid roles

You can use the conditionals in a controller:
class UsersController < ApplicationController
  def index
    unless current_user.activated?
      redirect_to :back, :alert => "Access denied."
    end
    @users = User.all
  end
end

Or use it in a view:
<% if current_user.activated? %>
  <li><%= link_to 'Special Reports', some_path %></li>
<% end %>

In general, if access control adds a lot of code to a controller, you're well-advised to use  CanCanCan or Pundit, because you can move the complex authorization logic into a central location segregated from the controllers ("skinny controllers"). However, if your needs are as simple as you describe, role-based authorization in the controller is optimal.
I've written a Rails Pundit tutorial that compares both approaches and provides greater detail on simple role-based authorization as well as role-based authorization with Pundit.

