I want to implement an authentication system with a username and password of the users table.
I have 2 other tables and users_type1 users_type2 that contain a foreign key to the users table (fk_users).
My goal is to identify during the authentication if the user matches the type 1 or type 2 in order to redirect properly.
With the Symfony authentication system, I can not do it.
If I code everything myself without using the Symfony system, so I managed to do what I want.
My question is: What do you think to use Symfony2 without its authentication system?
You can use Symfony's RoleInterface to group users by their roles.
Symfony's documentation.
You can also control the redirect from a form parameter.
Related
I want to create a new Laravel 5.8 based application using the database of an old PHP based application.
The problem is: My previous project uses five tables to store user-related information and all of those tables are used during login (to set session data).
Those tables are user_account, user_role, user_partner_portal, user_access_control, and user_control_access_right.
The relationship between those tables are in the below images:
By default, laravel uses users table to handle authentication and I don't know how to customize Laravel login system so that I can use all of those five tables during login to authenticate a user and also store the user-related information into the session.
I am primarily using CodeIgniter for all of my projects and it is very easy to do that authentication using CodeIgniter. But I am new in Laravel, so I can't figure it out.
So my question is: Is it possible using laravel to design such an authentication system? If yes then how?
TIA
So laravel uses LoginController class for the login. Inside there you are going to find the function authenticate.
Laravel put's the predefined logic there but if you want to make it really custom like update all your tables etc etc you are free to do it.
You can even create your own class and change the login route to point to your own controller. Basically you can do anything you like.
First off, I am new to Symfony, so I don't know the exact functionality of bundles like FOSUserBundle etc., as well as the terminology.
I am looking for a way to use the Symfony security component in a way that enables me to decouple a user's login credentials (say, a login name and a password, maybe the roles) from the actual user meta data (like first name, last name, groups, birth date, etc.).
The idea is that a user can login with different sets of login name/password and still be recognized as the same user (in the end that means, getting the same User object).
To me, this comes especially handy in combination with multiple authentication providers. For example, if I wanted to enable my users to login via an OAuth2 service as an alternative to logging in with their locally-hosted login name/password-combination (like StackExchange does, for instance), how would I do that?
I have read multiple pages of documentation of Symfony, e.g.:
https://symfony.com/doc/current/security.html
https://symfony.com/doc/current/security/entity_provider.html#create-your-user-entity
This latter one even says at 1) Create your User Entity, that a password is a field of User.
I have recently created just that, first I named my classes UserCredentials and UserDitails and because of the confusion of the getUser function i decided to rename UserCredentials to User. I agree with Alex Blex about the relation (manyToOne on the User side). When you decouple your login and metadata you will need to learn how to embed forms or creating your own form models, which is something I am currently working on and you might need to implement callback functions for deleting and updating entities. The more I work on my UserBundle, the more it looks like the FOSUserBundle. There is quite a bit of work of designing it to work well but it's great for learning. If you wish to inspect how the FOSUserBundle works, after you install it, you can find it in the vendor/friendsOfSymfony folder, it might provide a few answers.
I have 2 separate controls for my website.
Operators
Users
I want to authenticate users from 2 different tables for my application. Like if user if on myapplication.com/admin it should be authenticated from tbl_operators and if the user if on myapplication.com it should be authenticated from tbl_users
How to achieve this functionality in Laravel 5.2
If you plan to use the Auth built in with Laravel then this may not be possible. However if you wanna build your own authentication specifically for the admin then this may be possible.
You could also look into storing in an entirely new database using
DB::connection('name')
I am new to CakePHP, planning to develop a marketplace website using CakePHP. Four types of users will use this website.
1. Anonymous
2. Administrator
3. Service Provider
4. Service Seeker
Can i use ACL plugin to develop the website. OR should i store these users in different tables and use this technique? CakePHP 2.x Auth with Two Separate Logins
Kinldy guide me which technique to use with it's structure.
Here, ACL will be the best solution. You don't have to manage anything manually. You only have to implement ACL successfully, that's it.
Having separate logins is against KISS and doesn't make much sense in any case. The only difference for example between a frontend and backend login is usually the view. Nothing else. If you have different user types they will still have a single login. Even if their data differs this should be abstracted by having one table that deals with the accounts (users) and another that is associated and contains the data (User hasOne FooProfile, User hasOne BarProfile). The association to the data or profile type table can be done on the fly after login depending on the user type.
ACL is relativly complicated and can become slow. Depending on the requirements I would evaluate role based access as well. I've written an easy to use RBAC adapter for CakePHP. See the test case to get an idea how it works. Basically you just have to define a map for the roles. By default the users table needs a field roleit can contain a single role or a comma separated list of roles. You can even have a table with roles but then need to generate that comma separated list, because thats what the adapter is expecting.
Using Tank Auth for first time along with HMVC. In my application there are 2 type of user one is say student and another is institute.
I created two modules for each user type and separated the tank auth library , both user's registration, login and tables are different from each other.
Now if I try to add any other page which is common to both users like home page, Which library should be used.
I know there must be better solution to handle multiple user problem.
Please let me know where I'm doing wrong. And what should I do to tackle this problem.
You're right, there's a better way to handle this. Duplicating your user / registration system is the wrong way to go.
You'll need to modify TankAuth to include a user type column, and then check for that user type. I'd suggest a new column in the 'users' table for 'user_role':
https://github.com/ilkon/Tank-Auth/blob/master/schema.sql
You could handle the user_type as either an int or enum. I'd lean towards int since enum is harder to change later. You could also add a new table for user_roles but I usually just store these in a config file.
Once the schema is altered, you'll need to add a reference to the new column (along with possible options) in the Tank_Auth code. You'll need to include it in creation, update (data is passed to model from the tank auth controller: controllers/auth.php) and lookup functions. I would add a lookup by user_role as well to the tank_auth model (application / models / tank_auth / users.php):
function get_user_by_role($role)
{
$this->db->where('LOWER(user_role)=', strtolower($role));
$query = $this->db->get($this->table_name);
if ($query->num_rows() == 1) return $query->row();
return NULL;
}
Lastly, you'll want to set the user role to session on login so that you can track the user type (and what content / functionality they have access to).
I've used Tank_Auth myself for several projects.
building on what calvin said, codeigniter does a good job a securing your application, tank auth will verify them, however you need different user levels, this usually falls under permissions. Your job as a developer is to make sure codeigniter does it's security checks via CSRF & XSS( I would suggest you do this in each validaton rule, rather than globally, especially If your admins need to add any tags not allowed suc as "script"). you can see how I personally setup my controllers regardless of my Auth library here...
You need to have a row in your users table called "permissions" which is either a serialized array or json encoded, or you can do a google search on permission bitmasking, which requires an int field