Class AuthComponent

Constants summary

• string
  ALL ¶
  'all'

Properties summary

• $_authenticateObjects protected
  array
  Objects that will be used for authentication checks.
• $_authorizeObjects protected
  array
  Objects that will be used for authorization checks.
• $_methods protected
  array
  Method list for bound controller
• $_user protected static
  array

  The current user, used for stateless authentication when sessions are not available.

• $ajaxLogin public
  string

  The name of an optional view element to render when an Ajax request is made with an invalid or expired session

• $allowedActions public
  array
  Controller actions for which user validation is not required.
• $authError public
  string

  Error to display when user attempts to access an object or action to which they do not have access.

• $authenticate public
  array

  An array of authentication objects to use for authenticating users. You can configure multiple adapters and they will be checked sequentially when users are identified.

• $authorize public
  mixed

  An array of authorization objects to use for authorizing users. You can configure multiple adapters and they will be checked sequentially when authorization checks are done.

• $components public
  array
  Other components utilized by AuthComponent
• $flash public
  array

  Settings to use when Auth needs to do a flash message with SessionComponent::setFlash(). Available keys are:

• $loginAction public
  mixed

  A URL (defined as a string or array) to the controller action that handles logins. Defaults to /users/login

• $loginRedirect public
  mixed

  Normally, if a user is redirected to the $loginAction page, the location they were redirected from will be stored in the session so that they can be redirected back after a successful login. If this session value is not set, the user will be redirected to the page specified in $loginRedirect.

• $logoutRedirect public
  mixed

  The default action to redirect to after the user is logged out. While AuthComponent does not handle post-logout redirection, a redirect URL will be returned from AuthComponent::logout(). Defaults to AuthComponent::$loginAction.

• $request public
  CakeRequest
  Request object
• $response public
  CakeResponse
  Response object
• $sessionKey public static
  string

  The session key name where the record of the current user is stored. If unspecified, it will be "Auth.User".

Inherited Properties

• _Collection, _componentMap, settings

Method Summary

• _getUser() protected

  Similar to AuthComponent::user() except if the session user cannot be found, connected authentication objects will have their getUser() methods called. This lets stateless authentication methods function correctly.

• _setDefaults() protected

  Attempts to introspect the correct values for object properties.

• allow() public

  Takes a list of actions in the current controller for which authentication is not required, or no parameters to allow all actions.

• constructAuthenticate() public

  loads the configured authentication objects.

• constructAuthorize() public

  Loads the authorization objects configured.

• deny() public

  Removes items from the list of allowed/no authentication required actions.

• flash() public

  Set a flash message. Uses the Session component, and values from AuthComponent::$flash.

• identify() public

  Use the configured authentication adapters, and attempt to identify the user by credentials contained in $request.

• initialize() public

  Initializes AuthComponent for use in the controller

• isAuthorized() public

  Uses the configured Authorization adapters to check whether or not a user is authorized. Each adapter will be checked in sequence, if any of them return true, then the user will be authorized for the request.

• loggedIn() public

  Check whether or not the current user has data in the session, and is considered logged in.

• login() public

  Log a user in. If a $user is provided that data will be stored as the logged in user. If $user is empty or not specified, the request will be used to identify a user. If the identification was successful, the user record is written to the session key specified in AuthComponent::$sessionKey. Logging in will also change the session id in order to help mitigate session replays.

• logout() public

  Logs a user out, and returns the login action to redirect to. Triggers the logout() method of all the authenticate objects, so they can perform custom logout logic. AuthComponent will remove the session data, so there is no need to do that in an authentication object. Logging out will also renew the session id. This helps mitigate issues with session replays.

• mapActions() public

  Maps action names to CRUD operations. Used for controller-based authentication. Make sure to configure the authorize property before calling this method. As it delegates $map to all the attached authorize objects.

• password() public static

  Hash a password with the application's salt value (as defined with Configure::write('Security.salt');

• redirect() public

  If no parameter is passed, gets the authentication redirect URL. Pass a url in to set the destination a user should be redirected to upon logging in. Will fallback to AuthComponent::$loginRedirect if there is no stored redirect value.

• shutdown() public

  Component shutdown. If user is logged in, wipe out redirect.

• startup() public

  Main execution method. Handles redirecting of invalid users, and processing of login form data.

• user() public static

  Get the current user.

Method Detail

Methods inherited from Component

Methods inherited from Object

Properties detail

array()

array()

array()

array()

null

array()

null

array('Form')

false

array('Session', 'RequestHandler')

array(
    'element' => 'default',
    'key' => 'auth',
    'params' => array()
)

array(
    'controller' => 'users',
    'action' => 'login',
    'plugin' => null
)

null

null

'Auth.User'