How do I implement single authentication in a RESTful app? - php

Question

I can't seem to grasp how authentication works for REST using Zend Framework. I want the user to be able to login once and then allow him to access any area of the site depending on his user level. We have a working non-REST login code, I just basically copied it and placed in postAction() method of the Api_LoginController class.
class Api_LoginController extends REST_Controller
{
public function postAction() {
$request = $this->getRequest();
$form = new Application_Form_LoginForm;
if ($request->isPost()) {
if ($form->isValid($request->getPost())) {
$email = $form->getValue('email');
$password = $form->getValue('password');
$user = Application_Model_UserModel::getUserByEmail($email);
if ( $user && $user->login($password)) {
echo json_encode(array('error' => false, 'message' => 'Logged in.'));
} else {
echo json_encode(array('error' => true, 'message' => 'Login failed.'));
}
}
}
}
}
How do I go from here? Should Zend(1.11) be able to identify the user in the subsequent access? Right now, it appears it can't identify the same user after login.

Answer 1

It is possible to provide authentication in a REST application using Zend.
This is roughly the idea behind it:
A User logs in using his username/password
In your Application you validate the login credentials
Using these credentials you can generate an unique token, similar to a session token in a normal application
You send back the identification token to the User
Each subsequent request the User has to provide his token, as proof he's logged in
Your Application will validate this token and do the required action
Zend contains a lot of this stuff already, with a bit of searching you'll find a lot of functionality that might provide some of these points and make them fit in your application.