News Archive
PhpRiot Newsletter
Your Email Address:

More information

Auth/ACL implementation strategies

Note: This article was originally published at Planet PHP on 10 August 2010.
Planet PHP

I'm going to talk more about ACLs than Auth. Auth is simple, it's the ACL that will trip you up.A Since both concepts are coupled together when you're making a login system, I feel it's appropriate to at least touch on Auth. What I want to cover is the ways we can create the ACL object to suit needs based on the scale of the project. I'm going to assume that readers have a passing familiarity with using the Auth and Acl objects and may have even implemented them into projects.


The reason I say Auth is simple is because Zend Framework makes it simple with their Zend_Auth class. You can pick an auth style, implement and then go from there. For the purpose of this discussion, I'll be talking using Database authentication. So after one has set up a login page that uses Zend_Auth (there are already a lot of articles that cover this so i'll move on), the major bear you have to tackle is using the Zend_Auth_Result to determine proper access. Sounds simple, that's what Zend_Acl is for.


So how do we create our Acl? Again, ZF's reference guide gives us some handy-dandy examples of using their object but how you utilize the object depends on your scale. Other articles give you a way to bind the two together, usually via a controller plugin of some sort. The thing that can be tricky is how you want the Acl and Auth to interact with each other within that plugin. I utilize a controller plugin that fires off an Auth/Acl check in the dispatchLoopStartup() method. If no Zend_Auth_Result object exists, it assigns a guest role and if one does exist, it searches the Zend_Auth_Storage for a role value (assigning guest if one doesn't exist somehow) and checks that value against the Acl that was created in my Bootstrap. My biggest conundrum has always been translating Requests into Resources. I'll talk more on that later.


I tend to put my scaling into one of the following categories: small,decent or ZOMG. Small is something like a personal site or a proof-of-concept/self-tutorial project where my users will probably be a 1-5 roles and 1-5 resources at best. Decent is most collaborative niche projects with 50-100 resources. ZOMG is where the number of resources I'm dealing with is 100, unknown or potentially large. I define my ACLs in my Bootstrap in one of three ways:

  1. Hardcoded
  2. As part of my Navigation Object properties
  3. Pulled from a database


This one is easy to implement since if you follow the ZF reference or the numerous guides/posts you find when you google for auth/acl systems, you'll be able to hardcode your ACL. I find this ideal for small projects where the number of resources is relatively low and the growth of adding additional resources is non-existent. This is the simplest way to do things.


This method makes use of the Zend_Navigation object. Brandon Savage wrote up a nice guide to integrating ACLs into you r Navigation. I usually instant

Truncated by Planet PHP, read more at the original (another 8983 bytes)