Design pattern for an authentication system in PHP - php

Question

I'm learning PHP, and I'm curious if there are elegant solutions to designing an authentication interface for a website.
Basically, I will have three types of users: Regular Users, Admins, and "Power users".
each type of user will have its own actions.
Here is a brief sketch of my current code:
# Regular User = Non-Authenticated
interface IRegularUser {
# Will return an object of a class that implements this interface
public static function loginUser ($name, $pass);
}
# Authenticated User
class AuthUser extends RegularUser {
public function logoutUser();
}
interface IAdmin {..}
interface IPowerUser {...}
class User implements IRegularUser {}
class Admin extends AuthUser implements IAdmin {}
class PowerUser extends AuthUser implements IPowerUser {}
In the script that checks for correct login, I would write something similar to this:
$user = new User();
$user = $user->loginUser($_POST['username'], $_POST['password']);
if (get_class($user) == get_class(new Admin()))
# Redirect to admin_home.html
else if (get_class($user) == get_class(new PowerUser()))
# Redirect to power_user_home.html
I am trying to use the OOP features of PHP, in order to establish some constraints between the entities in my application (Ex: Only by acquiring an User object, you can then login, and acquire an object of type Admin, or PowerUser).
I feel that my authentication system is kind of clunky, and I would like to know if there is a common design pattern for a webapp authentication system.

Answer 1

Actually, its not that easy as it seems at first glance. There are 3 different aspects when dealing with users, that have roles. The "system" you're looking for would consists of these components:
Query adapter
Its responsible for finding records match against some adapter. This can query against almost any type, be it MySQL table, XML file or Mongo DB collection. All your query adapters would implement this interface:
interface QueryAdapter
{
public function recordValid($username, $password);
}
Access Control List (ACL/RBAC)
It must be separated layer, that deals with roles and their permissions. Typically
$roleManager = new RoleManager();
$roleManager->register(array(
'admin' => 'write, edit, read, delete',
'user' => 'view',
'moderator' => 'write, edit, read'
));
$currentUser = get_that_from_session();
if ($roleManager->isAllowed($currentUser, 'write')) {
// Allow writing
} else {
echo 'You are not allowed to write';
}
Storage adapter
That is responsible for storing passwords and tokens inside either $_SESSION or $_COOKIE. If user clicked on Remember me, then you would store that info inside $_COOKIE, otherwise in $_SESSION.
Typical workflow
To "connect" them all together, you would write it like this : (Keep in mind, this is extremely simplified version of it)
<?php
$queryAdapter = new Query_Adapter_MySQL($pdo); // or $mongo, whatever
if ($queryAdapter->rowExists($_POST['username'], $_POST['password'])) {
$role = $queryAdapter->getRole(); // Let's assume that its "user"
$roleManager = new RoleManager();
$roleManager->register(array(
$role => 'read'
));
if (isset($_POST['rememberMe'])){
$storageAdapter = new StorageAdapter_Cookie();
} else {
$storageAdapter = new StorageAdapten_Session();
}
$storageAdapter->write(array(
'role' => $role,
'passwordHash' => $passwordHash,
'token' => $token
));
}
To check if that user logged in, and has a right to do something, you would simply query an adapter to sees that, like,
<?php
if ($storageAdapter->isLoggedIn()){
if ($roleManager->hasRight($storageAdapter->get('role'), 'read')){
// Allowed to read content
}
}
What would you gain with this approach?
Clear separation of responsibilities (This adheres to Single-Responsibility Principle)
Improved code readability
Adhering to Dependency Injection (thus making unit-testing possible)
You can easily switch from MySQL to another storage, without affecting the rest of your code. You would simply inject an instance of the adapter you're going to use.
Is that it?
Yes. You can also take a look at how Zend Framework implements this