Sunday, March 27, 2016

CakePHP 3 Role Authorization for controllers and methods

Hello Everyone,

I'm a beginner CakePHP 3 developer. I learned fairly quick for my skill level. 
I'm currently working on a management system for a school, where there will be a couple of roles that will only access specific controller functions. (Student, Instructor, Supervisor, Administrator)
HOWEVER, each user has a user state that I must validate and set permission temporarily for users
Example:

Active User
LoginEnter code here...
Redirected to their role controller, with only access to those methods in that controller

Inactive User (used for setup)
Login
Confirm Account Information
only aloud to access that setup() action
once confirmed, it will set the user active and log them out

Disabled User
Is disabled, unauthorized user. Already have that configured


My login function looks like:
public function login()
{
$this->viewBuilder()->layout('login');
if($this->Auth->user()){
return $this->redirect(['controller'=>'Users','action'=>'index']); //index redirect for now
} else {
if($this->request->is('post')){
$user = $this->Auth->identify();
$login_error=null;
if($user){
$session = $this->request->session(); 
switch($user['user_status']){
case '1': //Active - Normal Login
unset($user['created'], $user['expiration'], $user['user_status'], $user['security_question_answer'], $user['security_question_id'], $user['modified']);
$userid=$user['id'];
//$user= array_merge($user, array('Roles' => $this->Users->Roles->find('list', ['order' => ['Roles.role_id' => 'ASC']])->matching('Users', function ($q) use ($userid) {return $q->where(['Users.id' => $userid]);})->toArray()));
$user = array_merge($user, array('role'=>key($this->Users->Roles->find('list', ['order' => ['Roles.role_id' => 'ASC']])->select(['Roles.role_id'])->matching('Users', function ($q) use ($userid) { return $q->where(['Users.id' => $userid]);})->limit(1)->toArray())));
$user = array_merge($user, array('user_status' => 1));
$this->Auth->setUser($user);
return $this->redirect($this->Auth->redirectUrl('/users/index'));
break;
case '2': //Disabled 
$login_error=1;
$this->set(compact('login_error'));
break;
case '3': //Inactive - Redirect to setup method
unset($user['created'], $user['expiration'], $user['user_status'], $user['security_question_answer'], $user['security_question_id'], $user['modified']);
$userid=$user['id'];
//$user= array_merge($user, array('roles' => $this->Users->Roles->find('list', ['order' => ['Roles.role_id' => 'ASC']])->matching('Users', function ($q) use ($userid) {return $q->where(['Users.id' => $userid]);})->toArray()));
$user = array_merge($user, array('role'=>key($this->Users->Roles->find('list', ['order' => ['Roles.role_id' => 'ASC']])->select(['Roles.role_id'])->matching('Users', function ($q) use ($userid) { return $q->where(['Users.id' => $userid]);})->limit(1)->toArray()), 'status' => 3));
$this->Auth->setUser($user); //Auth Role to only allow inactive user privilage to login, recovery and setup?
/*this isnt right*/ return $this->redirect($this->Auth->redirectUrl('/users/setup'));
break;
}
if($login_error!=1){
$login_error=0;
};
$this->set(compact('login_error'));
}
}
}

My AppController BeforeFilter looks like:
public function beforeFilter(Event $event)
{
$this->Auth->allow(['/users/login', '/users/recovery']);
/*
switch(user_status){
case 'Active'
switch(role){
case 'Student'
allow student controller methods
break;
case 'Supervisor'
allow supervisor controller methods
break;
case 'Instructor'
allow instructor controller methods
break;
case 'Administrator'
allow administrator controller methods
break;
}
deny login and recovery methods
break;
case 'Inactive'
allow setup and logout methods
deny login and recovery methods
break;
default:
allow login and recovery methods
break;
}
*/
}


I have looked at some things, I am running a basic authentication system and I heard of Access Control Lists (ACL), but its seemed quite intricate and I don't want to spend a week trying to figure something out that's far from my reach.

Any suggestions how to accomplish this?

--
Sign up for our Newsletter for updates.
http://cakephp.org/newsletter/signup
 
We will soon be closing this Google Group. But don't worry, we have something better coming. Stay tuned for an updated from the CakePHP Team soon.
 
Like Us on FaceBook https://www.facebook.com/CakePHP
Follow us on Twitter http://twitter.com/CakePHP
---
You received this message because you are subscribed to the Google Groups "CakePHP" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cake-php+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

No comments: