mass assignment selecting childs of user, using Devise

I have a very si开发者_运维问答mple issue:

User model:

class User < ActiveRecord::Base
   devise :database_authenticatable,
         :recoverable, :rememberable, :trackable, :validatable 

  attr_accessible :id, :email, :password, :password_confirmation, :remember_me,
    :firstname, :lastname, :mobile_phone, :user_type, :department_id, :department_attributes

  belongs_to :department

  accepts_nested_attributes_for :department, :allow_destroy => false

Departments model:

class Department < ActiveRecord::Base

  has_many :users

  accepts_nested_attributes_for :users, :allow_destroy => true

I created a form to be able to select my departments member from my existing users using simple_form:

<%= simple_form_for @department, :validate => true  do |form| %>

    <%= form.error_messages %>
    <%= form.association :users, :prompt => 'assign a user', :label => 'User'%>
    <%= form.button :submit %>

<% end %>

Then I (try to) update my users via the department controller:

  def update
    @department = Department.find(params[:id])

    respond_to do |format|
      if @department.update_attributes(params[:department])
      ...

This generates following error:

WARNING: Can't mass-assign protected attributes: user_ids

My guess is that some devise settings generate this error but I don't know which ones.

Can you help? Thanks!

---

Add attr_accessible :user_ids to your Department model.