Logging a user in after registration in CakePHP

Question

I did a lot of research, followed many different examples, but still cannot get it to run properly.

So here is a part of the controller action from the registration:

if(!empty($this->request->data)){

        $this->request->data['Company']['start_date']= date("Y-m-d");
        unset($this->Company->User->validate['company_id']);
        if($this->Company->saveAssociated($this->request->data)){
                $user = $this->request->data['User'];
                $data['User']['password'] = $user[0]['password'];
                $data['User']['email'] = $user[0]['email'];
            if($this->Auth->login($data)){
                $this->redirect($this->Auth->redirect(array('controller'=>'customers', 'action'=>'index')));
            }...

So the user is saved and a new array of user's email and password is created. It is then passed to $this->Auth->login. The login seems to pass, but the following error is on redirection to customers controller:

Notice (8): Undefined index: role [APP\Controller\CustomersController.php, line 32]
Notice (8): Undefined index: role [APP\Controller\CustomersController.php, line 36]

Even though the role field is autoset as manager on user creation. Here is how the CustomerController looks like:

public function isAuthorized($user){

if($user['role'] == 'manager'){
    return true;}
if (in_array($this->action, array('add', 'edit', 'index', 'view', 'delete', 'users'))){
    if($user['role'] != 'manager'){
        return false;
    }}return true;}

Any help is very much appreciated.

ndm ndm · Accepted Answer · 2013-10-31T20:02:11

Check the docs and the source for AuthComponent::login()

When passing user data to AuthComponent::login(), you are logging a user in, but no authentication is going to happen! "Logging in" in this case means, the data provided is being stored in the session, and on following requests the user is being treated as logged in in case data is present in the session (in the specific key used by the component), ie you could even just pass 123456, the user would be treated as being logged in.

Authenticating on the other hand would cause a DB lookup, where all the user data would be fetched and consequently being stored in the session.

So the role field is not available because you haven't passed it to AuthComponent::login(), you've only passed email and password, consequently these are the only fields being available later on. Btw, DO NOT supply the password when doing such a manual login! You don't want to carry such sensitive information in the session!

To fix this problem, either pass the role field too, or call AuthComponent::login() without passing any data at all (make sure you are using Form authentication so that the data passed in the request is being used), so that it's going to authenticate the user and fetch its data from the DB.

See also http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html

Logging a user in after registration in CakePHP

1 Answers