Class PrimaryKeySessionAuthenticator

Session Authenticator with only ID

This authenticator stores only the user's primary key in the session, and looks up the full user record from the database on each request.

By default, it uses a TokenIdentifier configured to look up users by their id field. This works out of the box for most applications:

$service->loadAuthenticator('Authentication.PrimaryKeySession');

You can customize the identifier configuration if needed:

$service->loadAuthenticator('Authentication.PrimaryKeySession', [
    'identifier' => [
        'className' => 'Authentication.Token',
        'tokenField' => 'uuid',
        'dataField' => 'key',
        'resolver' => [
            'className' => 'Authentication.Orm',
            'userModel' => 'Members',
        ],
    ],
]);

Namespace: Authentication\Authenticator

Property Summary

$_config protected

array<string, mixed>

Runtime config
$_configInitialized protected

bool

Whether the config property has already been configured with defaults
$_defaultConfig protected

array<string, mixed>

Default config for this object.
$_identifier protected

?IdentifierInterface

Identifier instance.

Method Summary

__construct() public

Constructor
_configDelete() protected

Deletes a single config key.
_configRead() protected

Reads a config key.
_configWrite() protected

Writes a config key.
authenticate() public

Authenticate a user using session data.
clearIdentity() public

Clears the identity data
configShallow() public

Merge provided config with existing config. Unlike config() which does a recursive merge for nested keys, this method does a simple merge.
deleteConfig() public

Deletes a config key.
getConfig() public

Returns the config.
getConfigOrFail() public

Returns the config for this specific key.
getIdentifier() public

Gets the identifier.
impersonate() public

Impersonate a user
isImpersonating() public

Returns true if impersonation is being done
persistIdentity() public

Persists the users data
setConfig() public

Sets the config.
setIdentifier() public

Sets the identifier.
stopImpersonating() public

Stops impersonation

Method Detail

__construct() ¶ public

__construct(Authentication\Identifier\IdentifierInterface|null $identifier = null, array<string, mixed> $config = [])

Constructor

Parameters

Authentication\Identifier\IdentifierInterface|null $identifier optional: Identifier instance.
array<string, mixed> $config optional: Configuration settings.

_configDelete() ¶ protected

_configDelete(string $key): void

Deletes a single config key.

Parameters

string $key: Key to delete.

Returns

void

Throws

Cake\Core\Exception\CakeException
if attempting to clobber existing config

_configRead() ¶ protected

_configRead(string|null $key): $key is null ? array : mixed

Reads a config key.

Parameters

string|null $key: Key to read.

Returns

$key is null ? array : mixed

_configWrite() ¶ protected

_configWrite(array<string, mixed>|string $key, mixed $value, string|bool $merge = false): void

Writes a config key.

Parameters

array<string, mixed>|string $key: Key to write to.
mixed $value: Value to write.
string|bool $merge optional: True to merge recursively, 'shallow' for simple merge, false to overwrite, defaults to false.

Returns

void

Throws

Cake\Core\Exception\CakeException
if attempting to clobber existing config

authenticate() ¶ public

authenticate(Psr\Http\Message\ServerRequestInterface $request): Authentication\Authenticator\ResultInterface

Authenticate a user using session data.

Parameters

Psr\Http\Message\ServerRequestInterface $request: The request to authenticate with.

Returns

Authentication\Authenticator\ResultInterface

clearIdentity() ¶ public

clearIdentity(Psr\Http\Message\ServerRequestInterface $request, Psr\Http\Message\ResponseInterface $response): array{request: \Psr\Http\Message\ServerRequestInterface, response: \Psr\Http\Message\ResponseInterface}

Clears the identity data

Parameters

Psr\Http\Message\ServerRequestInterface $request
Psr\Http\Message\ResponseInterface $response

Returns

array{request: \Psr\Http\Message\ServerRequestInterface, response: \Psr\Http\Message\ResponseInterface}

configShallow() ¶ public

configShallow(array<string, mixed>|string $key, mixed|null $value = null): $this

Merge provided config with existing config. Unlike config() which does a recursive merge for nested keys, this method does a simple merge.

Setting a specific value:

$this->configShallow('key', $value);

Setting a nested value:

$this->configShallow('some.nested.key', $value);

Updating multiple config settings at the same time:

$this->configShallow(['one' => 'value', 'another' => 'value']);

Parameters

array<string, mixed>|string $key: The key to set, or a complete array of configs.
mixed|null $value optional: The value to set.

Returns

$this

deleteConfig() ¶ public

deleteConfig(string $key): $this

Deletes a config key.

Parameters

string $key: Key to delete. It can be a dot separated string to delete nested keys.

Returns

$this

getConfig() ¶ public

getConfig(string|null $key = null, mixed $default = null): $key is null ? array : mixed

Returns the config.

Usage

Reading the whole config:

$this->getConfig();

Reading a specific value:

$this->getConfig('key');

Reading a nested value:

$this->getConfig('some.nested.key');

Reading with default value:

$this->getConfig('some-key', 'default-value');

Parameters

string|null $key optional: The key to get or null for the whole config.
mixed $default optional: The return value when the key does not exist.

Returns

$key is null ? array : mixed

Configuration data at the named key or null if the key does not exist.

getConfigOrFail() ¶ public

getConfigOrFail(string $key): mixed

Returns the config for this specific key.

The config value for this key must exist, it can never be null.

Parameters

string $key: The key to get.

Returns

mixed

Configuration data at the named key

Throws

InvalidArgumentException

getIdentifier() ¶ public

getIdentifier(): Authentication\Identifier\IdentifierInterface

Gets the identifier.

If no identifier was explicitly configured, creates a default TokenIdentifier configured to look up users by their primary key (id field).

Returns

Authentication\Identifier\IdentifierInterface

impersonate() ¶ public

impersonate(Psr\Http\Message\ServerRequestInterface $request, Psr\Http\Message\ResponseInterface $response, ArrayAccess<string, mixed> $impersonator, ArrayAccess<string, mixed> $impersonated): array{request: \Psr\Http\Message\ServerRequestInterface, response: \Psr\Http\Message\ResponseInterface}

Impersonate a user

Parameters

Psr\Http\Message\ServerRequestInterface $request
Psr\Http\Message\ResponseInterface $response
ArrayAccess<string, mixed> $impersonator
ArrayAccess<string, mixed> $impersonated

Returns

array{request: \Psr\Http\Message\ServerRequestInterface, response: \Psr\Http\Message\ResponseInterface}

isImpersonating() ¶ public

isImpersonating(Psr\Http\Message\ServerRequestInterface $request): bool

Returns true if impersonation is being done

Parameters

Psr\Http\Message\ServerRequestInterface $request: The request

Returns

bool

persistIdentity() ¶ public

persistIdentity(Psr\Http\Message\ServerRequestInterface $request, Psr\Http\Message\ResponseInterface $response, ArrayAccess<string, mixed>|array<string, mixed> $identity): array{request: \Psr\Http\Message\ServerRequestInterface, response: \Psr\Http\Message\ResponseInterface}

Persists the users data

Parameters

Psr\Http\Message\ServerRequestInterface $request
Psr\Http\Message\ResponseInterface $response
ArrayAccess<string, mixed>|array<string, mixed> $identity

Returns

array{request: \Psr\Http\Message\ServerRequestInterface, response: \Psr\Http\Message\ResponseInterface}

setConfig() ¶ public

setConfig(array<string, mixed>|string $key, mixed|null $value = null, bool $merge = true): $this

Sets the config.

Usage

Setting a specific value:

$this->setConfig('key', $value);

Setting a nested value:

$this->setConfig('some.nested.key', $value);

Updating multiple config settings at the same time:

$this->setConfig(['one' => 'value', 'another' => 'value']);

Parameters

array<string, mixed>|string $key: The key to set, or a complete array of configs.
mixed|null $value optional: The value to set.
bool $merge optional: Whether to recursively merge or overwrite existing config, defaults to true.

Returns

$this

Throws

Cake\Core\Exception\CakeException
When trying to set a key that is invalid.

setIdentifier() ¶ public

setIdentifier(Authentication\Identifier\IdentifierInterface $identifier): $this

Sets the identifier.

Parameters

Authentication\Identifier\IdentifierInterface $identifier: IdentifierInterface instance.

Returns

$this

stopImpersonating() ¶ public

stopImpersonating(Psr\Http\Message\ServerRequestInterface $request, Psr\Http\Message\ResponseInterface $response): array{request: \Psr\Http\Message\ServerRequestInterface, response: \Psr\Http\Message\ResponseInterface}

Stops impersonation

Parameters

Psr\Http\Message\ServerRequestInterface $request
Psr\Http\Message\ResponseInterface $response

Returns

array{request: \Psr\Http\Message\ServerRequestInterface, response: \Psr\Http\Message\ResponseInterface}

Property Detail

`$_config` ¶ protected

Runtime config

Type

array<string, mixed>

`$_configInitialized` ¶ protected

Whether the config property has already been configured with defaults

Type

bool

`$_defaultConfig` ¶ protected

Default config for this object.

identifierKey The key used when passing the ID to the identifier.
idField The field on the user entity that contains the primary key.

Type

array<string, mixed>

`$_identifier` ¶ protected

Identifier instance.

Type

?IdentifierInterface

Namespaces

Class PrimaryKeySessionAuthenticator

Property Summary

Method Summary

__construct() public

_configDelete() protected

_configRead() protected

_configWrite() protected

authenticate() public

clearIdentity() public

configShallow() public

deleteConfig() public

getConfig() public

getConfigOrFail() public

getIdentifier() public

impersonate() public

isImpersonating() public

persistIdentity() public

setConfig() public

setIdentifier() public

stopImpersonating() public

Method Detail

__construct() ¶ public

Parameters

_configDelete() ¶ protected

Parameters

Returns

Throws

_configRead() ¶ protected

Parameters

Returns

_configWrite() ¶ protected

Parameters

Returns

Throws

authenticate() ¶ public

Parameters

Returns

clearIdentity() ¶ public

Parameters

Returns

configShallow() ¶ public

Parameters

Returns

deleteConfig() ¶ public

Parameters

Returns

getConfig() ¶ public

Usage

Parameters

Returns

getConfigOrFail() ¶ public

Parameters

Returns

Throws

getIdentifier() ¶ public

Returns

impersonate() ¶ public

Parameters

Returns

isImpersonating() ¶ public

Parameters

Returns

persistIdentity() ¶ public

Parameters

Returns

setConfig() ¶ public

Usage

Parameters

Returns

Throws

setIdentifier() ¶ public

Parameters

Returns

stopImpersonating() ¶ public

Parameters

Returns

Property Detail

$_config ¶ protected

Type

`$_config` ¶ protected

`$_configInitialized` ¶ protected

`$_defaultConfig` ¶ protected

`$_identifier` ¶ protected