Alright, after reading through the ACL documentation I think I'm beginning to form a rudimentary understanding of how the system works. I'm opting to use the IniAcl aproach rather than the DbAcl approach as the server that I'm hosting on doesn't allow for remote db access (everything needs to be done through phpMyAdmin), and the solution I need will be pretty simple (I think).
I expect to be using ACL on 3 controllers: UsersController, TrainingController, and QuizController. The UsersController will have a few views that will need to be available to non-authenticated users (the general public) but there will be other views that will need to be protected by ACL. The TrainingController and QuizController will be fully protected by ACL. Looking through the documentation, I see this for the format for the INI: ;------------------------------------- ; AROs ;------------------------------------- [aragorn] groups = warriors allow = diplomacy ... ;------------------------------------- ; ARO Groups ;------------------------------------- [warriors] allow = weapons, ale, salted_pork ... I really only need one group (users) and one custom user (the admin). So I should be able to set this up this way (pseudocode is in carat brackets: <...>): ;------------------------------------- ; AROs ;------------------------------------- [admin] groups = users allow = <everything> [<all other users>] groups = users ;------------------------------------- ; ARO Groups ;------------------------------------- [users] allow = users, quiz, training It's my assumption that the allow= line will map the values users, quiz, and training to UsersController, QuizController, and TrainingController. Then I see that in the controller you invoke the ACL functionality with: <?php $this->Acl->check($aro, $aco, $action = '*'); So, assuming that my INI is properly written, can I put this ACL checking in the beforeFilter() for it to be called on all views in the controller (which is what I want for the QuizController and TrainingController)? And then in my UsersController I can put my ACL check in the view methods that need it, and not including that check will allow any users access to that view? Finally, my user setup is a little unique in that there is no username/ password combo, there is only a 'passcode', which is a randomly generated string of characters (it's what the customer asked for, I would have done it differently). How can I work this into my INI configuration since it looks like it automatically keys on the username? I do have roles associated with users (it's very simple, there are 'users' and there is the 'admin'), and that's what I'd like to use to key the ARO on rather than a username. Any thoughts on how I could manage that? Thanks for any help, I'm sure I'll undestand this all soon enough. -- Our newest site for the community: CakePHP Video Tutorials http://tv.cakephp.org Check out the new CakePHP Questions site http://ask.cakephp.org and help others with their CakePHP related questions. To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/cake-php
