CakePhp Auth : Questions

Question

I've to make a cakePhp authentification, and I wish to use the "Auth" component. I'm trying to see if it fill my requirement:

I need to authenticate users with their email OR their customerId, (with an addition password of course). I can't find if it is possible to have two fields(or more) on which the authentication can be done
I've several parts on which I need to be authenticated. But I need differents granularity:
- For some things, it's the whole controller which should not be accessible(if possible with exception(e.g. all the "User" controller, except the login/register action) for other I really need that it's the whole controller(e.g. the cart controller)
- Sometimes I need that only some actions are unavailable without being logged
- Sometimes I need that only a part of the view isn't displayed(e.g. login element not displayed)
Does the component manage action like password change? Because if the user change its password I need that he did not get disconnected.

Thank you very much for your help

Rob Wilkerson Rob Wilkerson · Accepted Answer · 2011-09-02T13:43:01

The short answer is that yes, you can do these things, but it seems to me that the ACL might be overkill for your needs (but I also tend to avoid the ACL if there's any opening at all to do so). To your points:

As Ivo suggests, you'll need a custom UsersController::login() method to authenticate by multiple fields (If your auth model isn't User, then use the appropriate controller). If the Auth component's login method fails, it passes control to your custom login() method. Here's a snippet from a project I've been working on:

function login() {
  # Allow login by either username (legacy) or email.
  # If no authenticated user exists at this point then the Auth
  # component's login() method has failed and control has been passed
  # here for any further handling. Since the expected credentials
  # (email and password) have failed we're going to check for
  # username and password.
  $user = $this->Auth->user();
  if( empty( $user ) && !empty( $this->Auth->data['User']['email'] ) && !empty( $this->Auth->data['User']['password'] ) ) {
    $user = $this->User->find(
      'first',
      array(
        'recursive'  => -1,
        'conditions' => array(
          'User.username' => $this->Auth->data['User']['email'],
          'User.password' => $this->Auth->data['User']['password'],
        )
      )
    );

    if( empty( $user ) || !$this->Auth->login( $user ) ) {
      # Set the configured flash message b/c login failed after both checks.
      $this->Session->setFlash( $this->Auth->loginError, null, array(), 'auth' );
    }
  }

  $this->redirect( $this->Auth->redirect(), null, true );
}

For action access, just use the $this->Auth->allow() and $this->Auth->deny() methods in each relevant controller's beforeFilter() callback. For example, in the UsersController, you may want to do something like this:
```
public function beforeFilter() {
  parent::beforeFilter();

  $this->Auth->deny('*');
  $this->Auth->allow( 'login', 'logout' );
}
```
In views, just determine whether the user is authenticated by testing the Auth.User value to determine what to display/hide from anonymous/authenticated:
```
if( $this->Session->check( 'Auth.User' ) ) { ... }
```
If the password changes, you can re-authenticate the user transparently by calling $this->Auth->login( $user_data ). I do this, for example, when a user registers. I don't want him/her to have to then go login, so I just login automatically.

CakePhp Auth : Questions

5 Answers