Model :

require "digest/sha1"
class User < ActiveRecord::Base
        attr_accessor :password
        attr_accessible :name, :password
        validates_uniqueness_of :name
        validates_presence_of :name , :password
        def before_create
                self.hashed_password = User.hash_password(self.password)
        end
        def after_create
                @password = nil
        end
        private
        def self.hash_password(password)
                Digest::SHA1.hexdigest(password)
        end
        def self.login(name, password)
                hashed_password = hash_password(password || "")
                find(:first,
                        :conditions => ["name = ? and hashed_password = ?",name, hashed_password])
        end
        def try_to_login
                User.login(self.name,self.password) ||
                User.find_by_name_and_hashed_password(name, "")
        end


controller :
class LoginController < ApplicationController
layout "admin"
  def add_user
        if request.get?
        @user = User.new
        else
        @user = User.new(params[:user])
        if @user.save
        redirect_to_index("User #{@user.name} created")
        end
        end
  end

  def login
        if request.get?
                session[:user_id] = nil
                @user = User.new
        else
                @user = User.new(params[:user])
                logged_in_user = @user.try_to_login
                if logged_in_user
                        session[:user_id] = logged_in_user.id
                        redirect_to(:action => index)
                else
                        flash[:notice] = "Nom d'utilisateur ou mot de passe invalide"
                end
        end
  end

  def index
  end

 def logout
  end

  def delete_user
  end

  def list_users
  end
end