Multiple Instances (2) of Zend_Auth

Question

I have a CMS built on the Zend Framework. It uses Zend_Auth for "CMS User" authentication. CMS users have roles and permissions that are enforced with Zend_Acl. I am now trying to create "Site Users" for things like an online store. For simplicity sake I would like to use a separate instance of Zend_Auth for site users. Zend_Auth is written as a singleton, so I'm not sure how to accomplish this.

Reasons I don't want to accomplish this by roles:

1. Pollution of the CMS Users with Site Users (visitors)
2. A Site User could accidentally get elevated permissions
3. The users are more accurately defined as different types than different roles
4. The two user types are stored in separate databases/tables
5. One user of each type could be signed in simultaneously
6. Different types of information are needed for the two user types
7. Refactoring that would need to take place on existing code

Loreenlorelei

You should be considering using roles for your 'CMS User' and 'Site User' instead of having multiple levels of Authentication. – Danielldaniella

Thanks Darryl, I've addressed your comment now in my post. – Loreenlorelei

Answer 1

In that case, you want to create your own 'Auth' class to extend and remove the 'singleton' design pattern that exists in Zend_Auth

This is by no means complete, but you can create an instance and pass it a 'namespace'. The rest of Zend_Auth's public methods should be fine for you.

<?php
class My_Auth extends Zend_Auth
{

    public function __construct($namespace) {
        $this->setStorage(new Zend_Auth_Storage_Session($namespace));
        // do other stuff
    }
    static function getInstance() {
        throw new Zend_Auth_Exception('I do not support getInstance');
    }  
}

Then where you want to use it, $auth = new My_Auth('CMSUser'); or $auth = new My_Auth('SiteUser');

Danielldaniella

Testing now. This looks very promising! – Loreenlorelei

It's working, but Zend_Auth is not singleton for no reason ;) – Dispensary

I already stated my recommendation for roles. It's not my job to force my beliefs on others :) – Danielldaniella

Answer 2

class App_Auth
{
    const DEFAULT_NS = 'default';

    protected static $instance = array();

    protected function __clone(){}

    protected function __construct() {}

    static function getInstance($namespace = self::DEFAULT_NS) {
        if(!isset(self::$instance[$namespace]) || is_null(self::$instance[$namespace])) {
            self::$instance[$namespace] = Zend_Auth::getInstance();
            self::$instance[$namespace]->setStorage(new Zend_Auth_Storage_Session($namespace));
        }

        return self::$instance[$namespace];
    }
}

Try this one , just will need to use App_Auth instead of Zend_Auth everywhere, or App_auth on admin's area, Zend_Auth on front

Handley

Answer 3

that is my suggestion :

i think you are in case that you should calculate ACL , recourses , roles dynamically ,

example {md5(siteuser or cmsuser + module + controller)= random number for each roles }

and a simple plugin would this role is allowed to this recourse

or you can build like unix permission style but i guess this idea need alot of testing one day i will build one like it in ZF :)

i hope my idea helps you

Editor

I use that pattern for the "CMS Users" – Loreenlorelei

Answer 4

You're mixing problems. (not that I didn't when I first faced id)

Zend_Auth answers the question "is that user who he claims to be"? What you can do is to add some more info to your persistence object. Easiest option is to add one more column into your DB and add it to result.

Logway

Thanks Tomáš, I do use that feature – Loreenlorelei