Admin section in ZendFramework application

2
votes

I have an application at the moment using Zend_Auth for user access. The site has an admin section where I want one user who has the role of admin in my database to be allowed access when he uses his credentials. Is Zend_Acl the only way to do this? As it seems a little complex for what I want to do or would there be any easier solutions to my problem?

I have had a think about this and I am now wondering if it is possible to have two auth controllers one for users and one for my admin section?

2
zend-frameworkzend-authzend-acl

2 Answers

2
votes

I did something like this recently. Create a front-controller plugin for the admin module that checks the user credential. Something like:

class Admin_Plugin_Auth extends Zend_Controller_Plugin_Abstract
{    
    public function preDispatch(Zend_Controller_Request_Abstract $request)
    {
        if ($request->getModuleName() != 'admin'){
            return;
        }
        $auth = Zend_Auth::getInstance();
        if (!$auth->hasIdentity()){
            // send him to login
        }
        $user = $auth->getIdentity();
        if (!$user->isAdmin()){ // or however you check
            // send him to a fail page
        }
    }    
}
0
votes

I decided to go with the method of having a field of "is_admin" in my database if its set to 1 the user is an admin. I then use this code:

public function init()
{
    $this->auth=Zend_Auth::getInstance();
    if ($this->auth->getStorage()->read()->is_admin) {
    $route = array('controller'=>'admin', 'action'=>'index');
    } else {
        $route = array('controller'=>'index', 'action'=>'index');
    $this->_helper->redirector->gotoRoute($route);
    }
}

This redirects the user from the admin area if they are not an admin and allows them access if they are an admin.. A lot easier to implement than ACL for the simple use in my application.