Home / CakePHP

Configuring User Roles and Permissions in CakePHP

User roles and permissions are crucial aspects of modern web applications as they allow developers to control the level of access and actions that different users can perform. In CakePHP, configuring user roles and permissions can be achieved using the built-in Authentication and Authorization plugins.

Installation

Before we dive into configuring user roles and permissions, we need to install the necessary plugins. Open your terminal and navigate to the root directory of your CakePHP project. Run the following commands:

composer require cakephp/authentication
composer require cakephp/authorization

After successful installation, we can proceed with the configuration.

Configuration

Enable the plugins: In your src/Application.php file, make sure to include the following lines in the bootstrap() method:
```
 $this->addPlugin('Authentication');
 $this->addPlugin('Authorization');
```
Database Setup: The plugins require a few tables in your database to store authentication and authorization-related data. Run the following command to create the necessary tables:
```
 bin/cake migrations migrate -p Authentication
```

Configuration Files: Open the config/app.php file and find the Application configuration block. Inside it, add the following lines:

 'Authentication' => [
     'enabled' => true,
     'unauthenticatedRedirect' => '/users/login',
     'sessionKey' => 'Auth.User',
     // ...
 ],
 'Authorization' => [
     'skipAuthorization' => [
         // Specify actions that don't require authorization checks (e.g., login, register)
         'login',
     ],
 ],

User Roles

In most web applications, users can be assigned specific roles, such as admin, moderator, or regular user. To implement user roles in CakePHP, we'll use the Roles table and associated models.

Create the Roles table: Run the following command to create a migration file:
```
 bin/cake bake migration CreateRoles
```
Then, update the generated migration file with the necessary fields and run bin/cake migrations migrate.

Define the relationships: Update the src/Model/Entity/User.php file to include the following associations:

 use Authorization\AuthorizationService;
 use Authorization\Role\OrmResolver;

 // ...

 protected $_accessible = [
     // ...
     'roles' => true,
 ];

 // ...

 public function initialize(): void
 {
     parent::initialize();
     // ...
     $this->belongsToMany('Roles', [
         'joinTable' => 'users_roles',
         'foreignKey' => 'user_id',
         'targetForeignKey' => 'role_id',
         'through' => 'UsersRoles',
     ]);

     $resolver = new OrmResolver();
     $resolver->resolve('Roles', function ($role) {
         return $role->id;
     });

     AuthorizationService::setConfig([
         'roleResolver' => $resolver,
     ]);
 }

Permissions

To control what actions users can perform, we'll define permissions using actions and resource-based authorization.

Create the Permissions table: Run the following command to create a migration file:
```
 bin/cake bake migration CreatePermissions
```
Then, update the generated migration file with the necessary fields and run bin/cake migrations migrate.
Create policies: In the src/Policy directory, create policy classes for each entity you want to define permissions for (e.g., UsersTablePolicy.php). Implement the desired logic within those classes to determine whether a user has permission to perform certain actions on a resource.

Apply authorization rules: In the respective controllers, update the initialize() method to define authorization rules based on the defined policies and roles. For example:

 use Cake\Controller\Component\AuthorizationComponent;

 // ...

 public function initialize(): void
 {
     // ...

     $this->Authorization->authorize($this->request);

     $this->Authorization->mapActions([
         'create' => 'create',
         'edit' => 'update',
         'delete' => 'delete',
         // ...
     ]);

     // ...
 }

With these steps completed, you have successfully configured user roles and permissions in your CakePHP application. Now you can control access to various resources and actions based on the user's role or defined permissions. Happy coding!