Zend Framework - Глава 3. Zend_Auth

Глава 3. Zend_Auth

Содержание

3.1. Introduction

3.1.1. Adapters

3.1.2. Results

3.1.3. Identity Persistence

3.1.3.1. Default Persistence in the PHP Session

3.1.3.2. Implementing Customized Storage

3.1.4. Using Zend_Auth

3.2. Database Table Authentication

3.2.1. Introduction

3.2.2. Advanced Use: Persisting a DbTable Result Object

3.2.3. Advanced Usage By Example

3.3. Digest Authentication

3.3.1. Introduction

3.3.2. Specifics

3.3.3. Identity

3.4. HTTP Authentication Adapter

3.4.1. Introduction

3.4.2. Design Overview

3.4.3. Configuration Options

3.4.4. Resolvers

3.4.4.1. File Resolver

3.4.5. Basic Usage

3.5. LDAP Authentication

3.5.1. Introduction

3.5.2. Usage

3.5.3. The API

3.5.4. Server Options

3.5.5. Collecting Debugging Messages

3.5.6. Common Options for Specific Servers

3.5.6.1. Options for Active Directory

3.5.6.2. Options for OpenLDAP

3.6. Open ID Authentication

3.6.1. Introduction

3.6.2. Specifics

3.1. Introduction

Zend_Auth provides an API for authentication and includes concrete authentication adapters for common use case scenarios.

Zend_Auth is concerned only with authentication and not with authorization. Authentication is loosely defined as determining whether an entity actually is what it purports to be (i.e., identification), based on some set of credentials. Authorization, the process of deciding whether to allow an entity access to, or to perform operations upon, other entities is outside the scope of Zend_Auth. For more information about authorization and access control with the Zend Framework, please see Zend_Acl. Замечание

The Zend_Auth class implements the Singleton pattern - only one instance of the class is available - through its static getInstance() method. This means that using the new operator and the clone keyword will not work with the Zend_Auth class; use Zend_Auth::getInstance() instead.

3.1.1. Adapters

A Zend_Auth adapter is used to authenticate against a particular type of authentication service, such as LDAP, RDBMS, or file-based storage. Different adapters are likely to have vastly different options and behaviors, but some basic things are common among authentication adapters. For example, accepting authentication credentials (including a purported identity), performing queries against the authentication service, and returning results are common to Zend_Auth adapters.

Each Zend_Auth adapter class implements Zend_Auth_Adapter_Interface. This interface defines one method, authenticate(), that an adapter class must implement for performing an authentication query. Each adapter class must be prepared prior to calling authenticate(). Such adapter preparation includes setting up credentials (e.g., username and password) and defining values for adapter- specific configuration options, such as database connection settings for a database table adapter.

The following is an example authentication adapter that requires a username and password to be set for authentication. Other details, such as how the authentication service is queried, have been omitted for brevity:

<?php

require_once 'Zend/Auth/Adapter/Interface.php';

class MyAuthAdapter implements Zend_Auth_Adapter_Interface

{

/**

* Sets username and password for authentication

*

* @return void

*/

public function __construct($username, $password)

{

// ...

}

/**

* Performs an authentication attempt

*

* @throws Zend_Auth_Adapter_Exception If authentication cannot be performed

* @return Zend_Auth_Result

*/

public function authenticate()

{

// ...

}

}

As indicated in its docblock, authenticate() must return an instance of Zend_Auth_Result (or of a class derived from Zend_Auth_Result). If for some reason performing an authentication query is impossible, authenticate() should throw an exception that derives from Zend_Auth_Adapter_Exception.

3.1.2. Results

Zend_Auth adapters return an instance of Zend_Auth_Result with authenticate() in order to represent the results of an authentication attempt. Adapters populate the Zend_Auth_Result object upon construction, so that the following four methods provide a basic set of user-facing operations that are common to the results of Zend_Auth adapters:

isValid() - returns true if and only if the result represents a successful authentication attempt

getCode() - returns a Zend_Auth_Result constant identifier for determining the type of authentication failure or whether success has occurred. This may be used in situations where the developer wishes to distinguish among several authentication result types. This allows developers to maintain detailed authentication result statistics, for example. Another use of this feature is to provide specific, customized messages to users for usability reasons, though developers are encouraged to consider the risks of providing such detailed reasons to users, instead of a general authentication failure message. For more information, see the notes below.

getIdentity() - returns the identity of the authentication attempt

getMessages() - returns an array of messages regarding a failed authentication attempt

A developer may wish to branch based on the type of authentication result in order to perform more specific operations. Some operations developers might find useful are locking accounts after too many unsuccessful password attempts, flagging an IP address after too many nonexistent identities are attempted, and providing specific, customized authentication result messages to the user. The following result codes are available:

Zend_Auth_Result::SUCCESS

Zend_Auth_Result::FAILURE

Zend_Auth_Result::FAILURE_IDENTITY_NOT_FOUND

Zend_Auth_Result::FAILURE_IDENTITY_AMBIGUOUS

Zend_Auth_Result::FAILURE_CREDENTIAL_INVALID

Zend_Auth_Result::FAILURE_UNCATEGORIZED

The following example illustrates how a developer may branch on the result code:

<?php

// inside of AuthController / loginAction

$result = $this->_auth->authenticate($adapter);

switch ($result->getCode()) {

case Zend_Auth_Result::FAILURE_IDENTITY_NOT_FOUND:

/** do stuff for nonexistent identity **/

break;

case Zend_Auth_Result::FAILURE_CREDENTIAL_INVALID:

/** do stuff for invalid credential **/

break;

case Zend_Auth_Result::SUCCESS:

/** do stuff for successful authentication **/

break;

default:

/** do stuff for other failure **/

break;

}