The Bakery Everything CakePHP

The following steps should guide you through the setup process and the files you need to alter.

Of course, you will need to have the models for your User table (and groups if applicable). I will assume you have these models setup with Cake conventions with the following schema (using HABTM association):


CREATE TABLE `users` (
`id` int(11) NOT NULL auto_increment,
`created` datetime default NULL,
`modified` datetime default NULL,
`live` tinyint(1) NOT NULL default 0,
`username` varchar(16) NOT NULL default '',
`pswd` varchar(32) NOT NULL default '',
PRIMARY KEY (`id`)
);

CREATE TABLE `groups` (
`id` int(11) NOT NULL auto_increment,
`created` datetime default NULL,
`modified` datetime default NULL,
`live` tinyint(1) NOT NULL default 0,
`name` varchar(32) NOT NULL default '',
PRIMARY KEY (`id`)
);

CREATE TABLE `groups_users` (
`group_id` int(11) NOT NULL,
`user_id` int(11) NOT NULL,
KEY `group_id` (`group_id`,`user_id`)
);

If you don't use the HABTM association, then remember to set var HABTM = false; later. This will then assume that the user $belongsTo a group (and therefore you'd need a "group_id" field in your "users" table).

Look at the Cake Manual for how to setup the Models for these tables.

Step 1: AppController

If you have created an AppController in your own controllers directory, nows the time, create a file called app_controller.php and populate it as follows. If you have got one, it should be easy enough to see what you'll need to add to yours.

Controller Class:

<?php 
class AppController extends Controller {
  var $uses = array('User');
  var $components = array('DarkAuth');

  function _login(){
    if(is_array($this->data) && array_key_exists('DarkAuth',$this->data) ){ 
      $this->DarkAuth->authenticate_from_post($this->data['DarkAuth']);
      $this->data['DarkAuth']['password'] = '';
    }
  }
  
  function logout(){
    $this->DarkAuth->logout();
  }
}
?>

Step 2: Login and Deny Views

You can create these however you want, however I discovered something very useful in that you can render Views using Controller::render() using absolute paths, so Controller::render('/login') would render a view in the root of your Views Folder. Using this to our advantage we can allow an arbitrary controller access to a view via the same render path. So I create a login View at /app/views/login.ctp, again it's up to you but it must post the following data:

[DarkAuth][username],
[DarkAuth][password]
and optionally if you have set the "$allow_cookie" variable:

[DarkAuth][remember_me],
[DarkAuth][cookie_expires],

Here's a simple one which will do the trick:

View Template:


<?php
  $this->pageTitle = 'Access Restricted';
  echo $form->create('DarkAuth',array('url'=>substr($this->here,strlen($this->base))));
  echo $form->input('DarkAuth.username');
  echo $form->password('DarkAuth.password');
                
/* Uncomment for cookies...
  echo $form->input('DarkAuth.remember_me',array(
          'label'=>'Remember Me? (uses cookies)',
          'type'=>'checkbox'
          ));
  echo $form->input('DarkAuth.cookie_expiry',array(
          'options'=>array(
                       'now'=>'end of session',
                       '+1 week'=>'in a week',
                       '+1 Months'=>'in a month',
                       '+6 Months'=>'in 6 months',
                     ),
          'label'=>'If so, for how long?'
          ));
*/
  echo $form->end('login');
?>

And a page for /app/views/deny.ctp:

View Template:


<?php
  $this->pageTitle = 'Access Denied!';
?>
  <p>I'm sorry, but you don't have sufficient permission to access this page!</p>


Step 4: Edit the Component's Variables and Hasher

There are a number which need to be configured to match your user and group models, the fields they use for username and password and the association type.

There are others for successful logout, login failure messages, default redirections and more. Please look over them to get the component to work how you want it.

The final thing to configure is the DarkAuth::hasher() function (which can be used anywhere to hash passwords in the same way that they are hashed in the database. Make sure your either use the same hashing function or amend this one how you want.

Step 5: The Logout Route

This is optional, as we put the logout() function in AppController so accessible from any controller. However, I find it more aesthetically pleasing to have a route for logout at /logout. Add this to your app/config/routes.php:


Router::connect('/logout',array('controller'=>'users','action'=>'logout'));

NB any controller would do, but you're pretty sure to have a UsersController.

Step 6: Enjoy!

That's it. Hopefully you haven't had too many issues, and your App is now secure and happy.