cakepphp 2.3: Authentication via custom BaseAuthenticate - php

Question

I wrote a class AlephBaseAuthenticate that extents BaseAuthenticate which works fine:
<?php
// Authentication against Aleph X-Service
// user and password for x-service see aleph.ini
App::uses('BaseAuthenticate', 'Controller/Component/Auth');
App::uses('IniReader', 'Configure');
Configure::config('default', new IniReader());
class AlephAuthenticate extends BaseAuthenticate {
public function authenticate(CakeRequest $request, CakeResponse $response) {
// Do things for Aleph here.
// Return an array of user + group-id if they could authenticate the user,
// return false if not
// verification = empty works, so we have to check lenght of verification!
$configfile = Configure::read('configfile');
Configure::load($configfile, 'default');
$alephxurl = Configure::read('aleph.xurl');
$xlib = Configure::read('aleph.xlib');
$username = $request->data['Users']['username'];
$password = $request->data['Users']['password'];
$req = $alephxurl . 'library=' . $xlib . '&verification=' . $password . '&op=bor_info&bor_id=' . $username;
$userxml = file_get_contents($req);
$xml = simplexml_load_string($userxml);
$error = $xml->error;
if($error == 'Error retrieving Patron System Key' || strlen($password) == 0){
return FALSE;
} else {
$data['username'] = $xml->z303->{'z303-name'};
$data['group'] = $xml->z303->{'z303-profile-id'};
$data['id'] = $xml->z303->{'z303-id'};
return $data;
}
}
}
In my UserController I added
public $components = array(
'Session',
'Auth' => array(
'authenticate' => array(
'Aleph'
)
)
);
function beforeFilter(){
$this->Auth->allow('index', 'login', 'logout');
}
The problem is: Only in UsersController.php, action "login", I can access this->Auth->user('id'), and, $this->Auth->allow('index', 'login', 'logout') doesn't work at all. Access to every action after login throughs a "You are not authorized to access that location". Looks like authentication doesn't work at all.
Any idea whats wrong here?
Thanks,
Christoph