I’m struggling to implement ACL in CakePHP. After reading the documentation in the cake manual as well as several other tutorials, blog posts etc, I found Aran Johnson’s excellent tutorial which has helped fill in many of the gaps. His examples seem to conflict with others I’ve seen though in a few places – specifically in the ARO tree structure he uses.
In his examples his user groups are set up as a cascading tree, with the most general user type being at the top of the tree, and its children branching off for each more restricted access type. Elsewhere I’ve usually seen each user type as a child of the same generic user type.
How do you set up your AROs and ACOs in CakePHP? Any and all tips appreciated!
CakePHP’s built-in ACL system is really powerful, but poorly documented in terms of actual implementation details. A system that we’ve used with some success in a number of CakePHP-based projects is as follows.
It’s a modification of some group-level access systems that have been documented elsewhere. Our system’s aims are to have a simple system where users are authorised on a group-level, but they can have specific additional rights on items that were created by them, or on a per-user basis. We wanted to avoid having to create a specific entry for each user (or, more specifically for each ARO) in the
aros_acostable.We have a Users table, and a Roles table.
Users
user_id, user_name, role_idRoles
id, role_nameCreate the ARO tree for each role (we usually have 4 roles – Unauthorised Guest (id 1), Authorised User (id 2), Site Moderator (id 3) and Administrator (id 4)) :
cake acl create aro / Role.1cake acl create aro 1 Role.2 ... etc ...After this, you have to use SQL or phpMyAdmin or similar to add aliases for all of these, as the cake command line tool doesn’t do it. We use ‘Role-{id}’ and ‘User-{id}’ for all of ours.
We then create a ROOT ACO –
cake acl create aco / 'ROOT'and then create ACOs for all the controllers under this ROOT one:
cake acl create aco 'ROOT' 'MyController' ... etc ...So far so normal. We add an additional field in the aros_acos table called
_editownwhich we can use as an additional action in the ACL component’s actionMap.We can then setup the Auth component to use the ‘crud’ method, which validates the requested controller/action against an AclComponent::check(). In the app_controller we have something along the lines of:
Again, this is fairly standard CakePHP stuff. We then have a checkAccess method in the AppController that adds in the group-level stuff to check whether to check a group ARO or a user ARO for access:
The
setupAuth()andcheckAccess()methods are called in theAppController‘sbeforeFilter() callback. There’s anisMinemethod in the AppControler too (see below) that just checks that the user_id of the requested item is the same as the currently authenticated user. I’ve left this out for clarity.That’s really all there is to it. You can then allow / deny particular groups access to specific acos –
cake acl grant 'Role-2' 'MyController' 'read'cake acl grant 'Role-2' 'MyController' 'editown'cake acl deny 'Role-2' 'MyController' 'update'cake acl deny 'Role-2' 'MyController' 'delete'I’m sure you get the picture.
Anyway, this answer’s way longer than I intended it to be, and it probably makes next to no sense, but I hope it’s some help to you …
— edit —
As requested, here’s an edited (purely for clarity – there’s a lot of stuff in our boilerplate code that’s meaningless here)
isMine()method that we have in our AppController. I’ve removed a lot of error checking stuff too, but this is the essence of it: