1

With CakePHP 3 we used Auth component and this worked like this CakePHP - How to allow unauthenticated access to specific pages

Now I'm trying to use the new Authentication and Authorization plugins instead (I don't know if it is the best solution).

I have this case:

I have some tables in the database for entities (cars, brands, and users). I have users and 4 level user roles (pyramid). - Admins can change everything - Editors can see and add brands and cars, but only can edit or update cars and brands created by themselves. - Registered users can add only cars and edit their cars (and see all cars and brands). - Anonymous users can see all but only can create a user account.

Authentication works well alone. To allow anonymous user access to content I use $this->Authentication->allowUnauthenticated(['login', 'add']); but when I load Authorization plugin, everything give error.

Do I need to specify all Authorization access with authorizeModel and other functions? There is a way to authorize at the same time with both plugins? Do I really need Authorization plugin for this and is recommended or Authentication plugin can handle this?

With previous Auth component I worked with something like this piece of code:

In AppController.php

public function beforeFilter(Event $event)
{
    $this->Auth->allow(['view', 'display']);
}

public function isAuthorized($user)
{
    return true;
}

In UsersController.php

public function beforeFilter(Event $event)
{
    parent::beforeFilter($event);
    $this->Auth->allow('add', 'logout');
}

In Cars and Brands controllers

public function isAuthorized($user)
{
    if (isset($authUser['role']) && $authUser['role'] === 'admin') {
        return true;
    }

    if ($this->request->action === 'add') {
        return true;
    }

    if ($this->request->action === 'index') {
        return true;
    }

    if (in_array($this->request->action, ['edit'])) {
        $carId = (int)$this->request->params['pass'][0];
        if ($this->Cars->exists(['id' => $carId, 'user_id' => $authUser['id']])) {
            return true;
        }
    }

    return false;
}

Followed from https://book.cakephp.org/3/es/tutorials-and-examples/blog-auth-example/auth.html

My versions are: - CakePHP 3.8 - Authentication plugin 1.4 - Authorization plugin 1.3

Sorry if my question is a bit basic but documentation is not very clear with this. I can add more details if needed.

Edit: If I quit unauthenticatedRedirect I get:

No identity found. You can skip this check by configuring `requireIdentity` to be `false`.
Authentication\Authenticator\UnauthenticatedException

If I add requireItentity as false, in AppController

        $this->loadComponent('Authentication.Authentication', [
            'requireIdentity' => false
        ]);

I get (where / is the path, can be /cars /brands)

The request to `/` did not apply any authorization checks.
Authorization\Exception\AuthorizationRequiredException

If I use this in AppController (always Authentication before Authorization)

        $this->loadComponent('Authentication.Authentication', [
            'requireIdentity' => false
        ]);
        $this->loadComponent('Authorization.Authorization', [
            'skipAuthorization' => [
                'login',
            ]
        ]);

and this in Application

        $service->setConfig([
            'unauthenticatedRedirect' => \Cake\Routing\Router::url('/users/login'),
            'queryParam' => 'redirect',
        ]);

I send all users to login page but authorization checks error appears. With $this->Authorization->skipAuthorization(); in beforeFilter() user can see the pages and works but I don't know if it is appropriated.

If I use this in any controller beforeFilter $this->Authorization->authorizeModel('index', 'add', 'display' ...);

I get

Policy for `App\Model\Table\CarsTable` has not been defined.
Authorization\Policy\Exception\MissingPolicyException

In home (or pages controller) I get

Policy for `Cake\ORM\Table` has not been defined.
Authorization\Policy\Exception\MissingPolicyException

Do I really need to create policies for each table? I think is more complex than previous Auth component or maybe I'm doing something wrong.

4

0 回答 0