Access Control

For the purposes of this tutorial, issues about authorization permissions, access control, and restrictions are grouped under the terms "access control" and ACL (access control lists).

1 Access Control

1.1 Where?
1.2 Anonymous Users
1.3 How?

Where?

Each of the "locations" below present both an opportunity to perform authentication and use an authorization identity to determine access privileges and permissions. Authentication opportunities exist, if credentials were included with the request, while authorization opportunities exist if an authorization identity can be determined from the request and any associated session data.

URL patterns, such as "/forum/admin_*/*"
Module names, such as "/admim/post/edit"
Controller names, such as "/forum/admin/topic/"
Action names, such as "/forum/topics/admin/"
Inside the business logic of an action controller

The correct choice depends on each application and the situation. For example, a particular action as simple as viewing a post might need to first load a model for "forum moderators" to determine if the user has sufficient privileges to view a particular post. However, no access should ever be given to unauthenticated users for administration areas of the website. In this case, blocking access to administration areas with a single block of code outside of the body of action controllers might reduce the risk of accidental bugs in action controllers resulting in related security leaks.

Anonymous Users

Authentication is sometimes used as a primitive type of authorization mechanism. In the ZFDemo this type of authorization is called "anonymous access". The configuration setting "allowAnonymousUse" in "modules.ini" controls whether or not anonymous users (with no authentication id) may access any particular module. In the ZFDemo, access to the default module is always given to anonymous users. This avoids problems with users lacking view permissions for error controllers that create pages like a "404 not found" page.

How?

In order to apply access control, the application must have some notion of authorization identity. The authentication identity must be mapped to this authorization identity before access control restrictions may be applied. In many applications the mapping is done by looking up the username and finding the primary key in the "user" table of the data store.

These steps are done inside "forum/init.php", since we are going to apply access control to controllers and actions. By preventing unauthorized users from having any access to these restricted controllers and actions, we are not dependent on the maintainers of these controllers and actions to prevent accidental execution of their code. This advantage also comes with a disadvantage, since the business logic in these restricted controllers and actions can no longer make the dynamic determination of whether or not to allow access to a particular user.

class _ZF_Module_Forum
{
    // current user (an instance of the User model)
    static public $user;

    // forum module's name for the current user
    static public $username = 'anonymous';

    // Authorization id used for authorization / access control in this module.
    // Anonymous users will have an id of zero (0).
    static public $authorizationId = 0;

    public static function init(Zend_Config $config)
    {
        $authSpace = new Zend_Session_Namespace('auth');
        if (isset($authSpace->authenticationId)) {
            self::authenticationId2authorizationId($authSpace->authenticationId);
        }
        if ($config->allowAnonymousUse === false) {
            return $config->authenticate; // allow front controller plugin to redirect in preDispatch()
        }
    }

    /**
     * This method is responsible for mapping the ZFDemo's authentication ids to forum module authorization ids.
     * Each module can maintain its own set of ids used for authorization,
     * thus allowing integration of diverse modules.
     */
    public static function authenticationId2authorizationId($authenticationId)
    {
        self::$user = new ZFDemo_Models_Users($authenticationId['username']);
        self::$username = (string) self::$user;
        self::$authorizationId = self::$user->id();
    }

Next Section: 9. Filtering and Validating User Input

Page Operations

Browse Space

8. Access Control

Labels

Access Control

Where?

Anonymous Users

How?