Authentication & Authorization

by Kevin Pfeifer

About Kevin Pfeifer

  • Web-Developer at in Austria - www.sunlime.at
  • Main work: Wordpress, Drupal and lately Laravel
  • Started using CakePHP 3 in 2017 and love it ever since ❤️
  • Joined the Core Team in December 2021
  • Tutorial video series with currently 11 published videos

Lets get our basic setup running

Lets import our database schema

https://cakefest2022.pfiff.me/schema.sql

And bake everything!


          bin/cake bake all --everything

Lets image...

Lets image...

Bar owner
Store

Lets image...

Bar owner
Discount of 10% for members
Store

Lets image...

Bar owner
Discount of 10% for members
Store
Store

Conversation

What can I get you?

Conversation

What can I get you?

I'll take a beer, please. Paying right away.

Conversation

What can I get you?

I'll take a beer, please. Paying right away.

Here you go. That'll be 3€

Conversation

What can I get you?

I'll take a beer, please. Paying right away.

Here you go. That'll be 3€

But... I'm a member

How would you react?

We don't know who he is so...

We need some way to authenticate that he is actually a member!

  • Members Card
  • Personal ID and a members list
  • etc.

Phase 1: Authentication

Install cakephp/authentication

What is an Authenticator?

What is an Authenticator?

From which source do we get information about the user?

What is an Authenticator?

From which source do we get information about the user?

Form or Session or Cookie

What is an Identifier?

What is an Identifier?

How does the data from the Authenticator connect to a user entry in the database?

What is an Identifier?

How does the data from the Authenticator connect to a user entry in the database?

Username & Password or API/JWT Token

Each identifier is/can be used by each authenticator!

Stateless and Persistent Authenticators

Stateless and Persistent Authenticators

Persistent: Saved across multiple requests
Session and Cookie

Stateless and Persistent Authenticators

Persistent: Saved across multiple requests
Session and Cookie

Stateless: Needs to be present on each request
Token and HttpBasic

Lets get back to coding

Lets build a working login action

How does the data flow while logging in?

How does the data flow while logging in?

  • AuthenticationMiddleware

How does the data flow while logging in?

  • AuthenticationMiddleware
    • AuthenticationService::authenticate()

How does the data flow while logging in?

  • AuthenticationMiddleware
    • AuthenticationService::authenticate()
    • Loop through all configured authenticators

How does the data flow while logging in?

  • AuthenticationMiddleware
    • AuthenticationService::authenticate()
    • Loop through all configured authenticators
    • First one with a matching identity returns the result

How does the data flow while logging in?

  • AuthenticationMiddleware
    • AuthenticationService::authenticate()
    • Loop through all configured authenticators
    • First one with a matching identity returns the result
  • Presist the identity if matching authenticator is not stateless

How does the data flow while logging in?

  • AuthenticationMiddleware
    • AuthenticationService::authenticate()
    • Loop through all configured authenticators
    • First one with a matching identity returns the result
  • Presist the identity if matching authenticator is not stateless
  • UsersController => fetch Result from AuthenticationService

What happens if...

What happens if...

  • we delete the session cookie?

What happens if...

  • we delete the session cookie?
  • comment out the session authenticator in our Application.php?

Lets quickly add remember me functionality

Lets look back again...

Bar owner
Discount of 10% for members
Store
Store

What we have learned:

  • How to authenticate and identify anonymous users

What we have learned:

  • How to authenticate and identify anonymous users
  • Difference between Authenticators and Identifiers

What we have learned:

  • How to authenticate and identify anonymous users
  • Difference between Authenticators and Identifiers
  • Concept of Persistent and Stateless Authenticators

What we have learned:

  • How to authenticate and identify anonymous users
  • Difference between Authenticators and Identifiers
  • Concept of Persistent and Stateless Authenticators
  • How login data is being processed by the plugin

Before we continue...

Open questions?

Lets look back again...

Bar owner
Discount of 10% for members
Store
Store

But what if...

But what if...

Bar owner
Discount of 10% for members
Discount of 20% for VIPs
Store
Store Store

Its not enough...

Its not enough...

to know if a user is a member

Its not enough...

to know if a user is a member

we need groups inside our members list!

Phase 2: Authorization

Install cakephp/authorization

Just like the Authentication Plugin

Every method needs either a

Just like the Authentication Plugin

Every controller action needs either a
  • A connected policy

Just like the Authentication Plugin

Every controller action needs either a
  • A connected policy
  • ->skipAuthorization()

One more time...

Open questions?

Thank you!