In a previous article, we talked about the version 9.x of the CakeDC/Users plugin which is compatible with CakePHP 4 and compatible with the cakephp/authentication and cakephp/authorization plugins, we recommend you check it out.

In this article we will demonstrate how to migrate your code from AuthComponent.

Before we continue, it is important to remember some things:

• Authentication and Authorization are performed at the middleware layer

• Authorization is configured to work with Rbac (config/permissions.php)

• The migration guide `8.x-9.0` is available for additional information

• 9.x version is for CakePHP 4

Replacing AuthComponent::allow, also known as public actions

For many applications it is normal to have public actions that do not require a user login, previously this was possible with AuthComponent::allow, now the authorization check step is done in the Middleware layer and is part of RBAC by default. You will need to move this permissions to your config/permissions.php, but don’t worry because this migration is very simple.

For example, to enable the `index` and `view` actions you needed to have this code in your `ArticlesController`.

    /**
     * @inheritDoc
     */
    public function initialize()
    {
        parent::initialize();
        $this->Auth->allow(['index', ‘view’]);
    }

In this new version we don't need to call Auth->allow, but instead we just have to include a permission of type 'bypassAuth' in config/permissions.php

   [
        'controller' => ‘Articles’,
        'action' => [‘index’,’view’],
        'bypassAuth' => true,
   ],

Check a sample permissions file at: https://github.com/CakeDC/users-example/blob/9.next-basic-with-custom-username/config/permissions.php

Don’t forget to remove this snippet from your controller: $this->Auth->allow(['index']);

Replacing AuthComponent::user

Your application probably uses the AuthComponent::user method in at least one place, in fact it should be the method that you use the most from this component. The good news is that the migration here is the easiest, because instead of using this method, we will obtain the user data from a request attribute.

If you had something like this:

//Get all user data
$user = $this->Auth->user();
//Get the user id
$userId = $this->Auth->user('id');

Now you can get the user (identity) data this way:

$user = $this->getRequest()->getAttribute('identity');
$userId = $user['id'] ?? null;
//OR
$userId = $this->getRequest()->getAttribute('identity')['id'] ?? null;

Be careful with direct access from session data

Avoid the direct access of user data from session, it will only return the user data after authenticator has persisted, and this may not happen when you try to read from session.

Additional information

In the previous version we used the `Auth` configuration to customize the Auth component, now we have specific configurations to be used in the authentication and authorization process related to the new plugins. For example `Auth.Authenticators` and `Auth.Identifiers` provides information needed to setup authentication to work with Form, Token, Cookie (Remember Me) and Social (when enabled).

Form Authentication with email

One of the most common needs for user login is the ability to change the fields used for login via the form. The default behavior allows login by username or email, but let's assume you want to restrict login only by email, you can do it by including the following in your config/users.php file:

'Auth.Identifiers.Password.fields.username' => 'email'

You can get a sample app at https://github.com/CakeDC/users-example/tree/9.next-basic-with-custom-username

That’s all for today

In the plugin's documentation you can find more information about the available configurations and please be sure to check the migration guide if you have not https://github.com/CakeDC/users/blob/9.next/Docs/Documentation/Migration/8.x-9.0.md. The Auth component's migration shouldn't be very complicated, as our idea for the plugin was to offer you a set of default configurations to make it easier to use. If you have a config/users.php file it is recommended to compare it with the new users.php file from plugin.

That’s all for today, are you using the new version? Have suggestions for new features? Tell us what you think.