The API

Maps actions to CRUD operations. Used for controller-based validation ($validate = 'controller').

If using action-based access control, this defines how the paths to action ACO nodes is computed. If, for example, all controller nodes are nested under an ACO node named 'Controllers', $actionPath should be set to "Controllers/".

The name of an optional view element to render when an Ajax request is made with an invalid or expired session

Controller actions for which user validation is not required.

A reference to the object used for authentication

Error to display when user attempts to access an object or action to which they do not have acccess.

The name of the component to use for Authorization or set this to 'controller' will validate against Controller::isAuthorized() 'actions' will validate Controller::action against an AclComponent::check() 'crud' will validate mapActions against an AclComponent::check() array('model'=> 'name'); will validate mapActions against model $name::isAuthorized(user, controller, mapAction) 'object' will validate Controller::action against object::isAuthorized(user, controller, action)

Determines whether AuthComponent will automatically redirect and exit if login is successful.

Other components utilized by AuthComponent

Form data from Controller::$data

Allows you to specify non-default login name and password fields used in $userModel, i.e. array('username' => 'login_name', 'password' => 'passwd').

The name of the element used for SessionComponent::setFlash

A URL (defined as a string or array) to the controller action that handles logins.

Error to display when user login fails. For security purposes, only one error is used for all login failures, so as not to expose information on why the login failed.

Normally, if a user is redirected to the $loginAction page, the location they were redirected from will be stored in the session so that they can be redirected back after a successful login. If this session value is not set, the user will be redirected to the page specified in $loginRedirect.

The the default action to redirect to after the user is logged out. While AuthComponent does not handle post-logout redirection, a redirect URL will be returned from AuthComponent::logout(). Defaults to AuthComponent::$loginAction.

Method list for bound controller

The name of model or model object, or any other object has an isAuthorized method.

Parameter data from Controller::$params

The session key name where the record of the current user is stored. If unspecified, it will be "Auth.{$userModel name}".

The name of the model that represents users which will be authenticated. Defaults to 'User'.

Additional query conditions to use when looking up and authenticating users, i.e. array('User.is_active' => 1).