Zend Framework 2 - BjyAuthorize always denies access

Question

I have setup the bjyoungblood/bjy-authorize module, but I am currently getting a 403 "access denied" error for each URL except for the one configured in the home route.

My module.byjauthorize.global.php looks like following:

'bjyauthorize' => array(
    'guards' => array(
        'BjyAuthorize\Guard\Controller' => array(
            array('controller' => 'index', 'action' => 'index', 'roles' => array('guest','user')),
            array('controller' => 'index', 'action' => 'stuff', 'roles' => array('user')),
            array('controller' => 'zfcuser', 'roles' => array()),
            //backend
            array('controller' => 'Application\Controller\Index', 'roles' => array('admin')),
            array('controller' => 'MyModule\MyEntity\MyEntity', 'roles' => array('admin')),

        ),

        'BjyAuthorize\Guard\Route' => array(
            array('route' => 'zfcuser', 'roles' => array('user')),
            array('route' => 'zfcuser/logout', 'roles' => array('user')),
            array('route' => 'zfcuser/login', 'roles' => array('guest')),
            array('route' => 'zfcuser/register', 'roles' => array('guest')),                
            array('route' => 'home', 'roles' => array('admin')),
            array('route' => 'my-entity', 'roles' => array('admin')),
        ),
    ),
),

I tried deleting the BjyAuthorize\Guard\Route part, but with no effect. When I remove the home route then the homepage is also blocked. So both Controller- and Route-Guard seem to work. How can I debug this behavior?

Answer 1

NOTE: following is valid for BjyAuthorize 1.2.*

First of all, consider that protecting both the routes and the controllers is unnecessary. I personally always protect the controllers only, since there may be multiple routes to a same controller.

Once you removed either the route or the controller guard's config, you can:

• Install Zend Developer Tools, which allows you to have an overview of the currently set Acl role, like in this picture:

  

• Check if you have configured the correct identity provider: the default one uses ZfcUser's user id and looks up his role in the user_role table.

• Check that the guest role has access to the public pages, such as the zfcuser controller (for login actions) or the zfcuser/login route.

As Akrabat pointed out, the configuration for the BjyAuthorize\Guard\Controller and BjyAuthorize\Guard\Route are whitelists, which basically means that you have to setup access for the default guest role if you want to browse pages being un-authenticated.

As soon as a guard is configured, it blocks access to any not configured resource, so be sure that you have granted the role guest (or whatever you configured in $config['bjyauthorize']['default_role'] access at least the login controller or route.

Answer 2

As soon as you create one entry in the 'BjyAuthorize\Guard\Controller' array, then you need to create entries for every controller with permissions as appropriate.

I have this:

'BjyAuthorize\Guard\Controller' => array(
    // Access for everyone
    array('controller' => 'zfcuser', 'roles' => array('guest')),
    array('controller' => 'Application\Controller\Index', 'action' => 'index', 'roles' => array('guest')),
    array('controller' => 'error', 'roles' => array('guest')),

    // Restricted
    array('controller' => 'User\Controller\AdminUser', 'roles' => array('admin')),

),

It's important that you give guest access to zfuser (for logging in!) and error (hard to debug stuff otherwise).

I've not tried using controller and route guards simultaneously.

Answer 3

I had the exact same issue.

I think the problem is that BjyAuthorize is not well documented so many of us are simply copying and pasting and working out from the files provided. For instance from the following:

'BjyAuthorize\Guard\Controller' => array(
            array('controller' => 'zfcuser', 'roles' => array()),
        ),

You would expect to add your controllers as such:

array('controller' => 'controllername', 'role' => array()),

However you need to add the full path otherwise it will not work:

array('controller' => 'Folder/Controller/Action', 'role' => array()),

I hope this saves someone a few hours work as I was totally befuddled by this!

Answer 4

debug your code by this in module.php

public function onBootstrap($e)
    {   echo "<pre>";
        var_dump($e->getTarget()->getServiceManager()->get('BjyAuthorize\Provider\Identity\ProviderInterface'));
    }