Question

I am doing new project in symfony1.4. Now this project requires users to log-in and browse, and as any project of this type requires a way of restricting users based on roles.
I don’t want to implement this in obvious way, i.e to have roles attribute for each user and have pre-defined roles and assign these to users. The problem with this is it’s not very flexible as more roles get defined later.

I was thinking on the lines of using an EAV model here, (not sure I can do that in symfony). What you guys think, do you have any better suggestions to make user roles much more flexible when they get added or deleted.

Also, what is the best way to display the page based on user roles, as I want some elements to be hidden according to the roles. Should I compare the role in each page and hide elements on every page? Is there a better solution?

Please shed some light on these.

Thanks

Answer 1

The sfDoctrineGuard plugin (http://www.symfony-project.org/plugins/sfDoctrineGuardPlugin) is a pretty comprehensive way of handling user authentication, groups and credentials. Users can be set permissions either individually or as a group, and access to specific page sections or entire actions can be restricted based on those permissions. You can set new user credentials in the controller code itself, e.g.

<?php
$this->getUser()->setCredential('editor');
?>

And verify that a user has particular permissions in views:

<?php
if ($sf_user->hasCredential('editor')) {
  // stuff only for editors
}
?>

This page has lots of extra info on the plugin not covered by the readme file – http://trac.symfony-project.org/wiki/sfGuardPluginExtraDocumentation (although it refers to Propel rather than Doctrine). Also the following series of short tutorials is pretty useful:

http://www.finalconcept.com.au/article/view/symfony-user-management-sfdoctrineguard-installation

http://www.finalconcept.com.au/article/view/symfony-user-management-sfdoctrineguard-administration

http://www.finalconcept.com.au/article/view/symfony-user-management-sfdoctrineguard-securing-actions

And the Symfony tutorial page on users:

http://www.symfony-project.org/jobeet/1_4/Doctrine/en/13