As you may know, there are 2 new plugins "recently" (not so recently) added to deal with the concepts of Authentication and Authorization in your CakePHP applications.
Over the years, both Authentication and Authorization were managed in the Controller layer, via AuthComponent. These 2 things usually grow in complexity
as your project grows too, making the AuthComponent a complex class dealing with many features at the same time.
One of the original ideas behind these new plugins was to refactor AuthComponent and create specific layers to handle:
- Authentication: who are you?
- Authorization: are you allowed?
/tournaments/addany user can create a new Tournament/tournaments/indexbrowse all joined tournaments/tournaments/inviteonly current Members can invite others, and only if the Tournament has not started yet
- AuthorizationMiddleware is attached to your Application, and will ensure the Authorization will be checked somewhere while processing the request.
TheunauthorizedHandlerconfig will allow you to define what to do if the request was not authorized for some reason. - At some point in your code, you'll need to call
AuthorizationComponent, either toskipAuthorizationwhen you don't require any specific condition to authorize the operation. Example:// ... somewhere in your beforeFilter...if ($user->is_superadmin) {$this->Authentication->skipAuthorization();}// ...authorize($resource, $action)when you need to check if a given user is allowed to do some action on a given resource. Note the resource must be an Object.
How Authorization checks are done?
- We start by checking the resource, it's an Object so we use a Resolver to map every resource with a given Policy. There are some common defaults, for example to map ORM classes.
- Once we get to a Policy class, we check the matching method, for example if the action is "invite" we would check the method
canInvite(IdentityInterface $user, Tournament $tournament)
$authorizationService = new AuthorizationService(new OrmResolver());
...
->add(new AuthorizationMiddleware($authorizationService, [
'unauthorizedHandler' => [
'className' => 'Authorization.Redirect',
'url' => '/users/login',
'queryParam' => 'redirectUrl',
],
]));
Note the $authorizationService is configured with one resolver to match the CakePHP typical ORM classes, like Entities or Queries. https://book.cakephp.org/authorization/2/en/policy-resolvers.html#using-ormresolver
Once the middleware is added, you'll need to ensure the Authorization is checked, or you'll get an error?: "The request to / did not apply any authorization checks" .
The first step would be to skip authorization for all the controllers and actions, for example in beforeFilter callback that all Users are allowed to access.
About the previous Tournaments specific cases, we'll need to create a new Policy class including all the possible actions to be done, for example:-
/tournaments/add
class TournamentPolicy
{
public function canAdd(IdentityInterface $user, Tournament $tournament)
{
// all users can create tournaments
return true;
}
}
file src/Controller/TournamentsController.php
// ...
public function add()
{
$tournament = $this->Tournaments->newEmptyEntity();
$this->Authorization->authorize($tournament);
if ($this->request->is('post')) {
// ...
The call to $this->Authorization->authorize($tournament); will map the Tournament entity to the TournamentPolicy, by default the action is taken from the controller action, in this case "add" so we will need to define a canAdd() method. We allowed all Users to create Tournaments.
/tournaments/index
class TournamentsTablePolicy
{
public function canIndex(IdentityInterface $user, Query $query)
{
// all users can browse tournaments
return true;
}
public function scopeIndex(IdentityInterface $user, Query $query)
{
// scope to filter tournaments for a logged in user
return $query->matching('TournamentMemberships', function (Query $q) use ($user) {
return $q->where(['TournamentMemberships.user_id' => $user->get('id')]);
});
}
}
file src/Controller/TournamentsController.php
public function index()
{
$query = $this->Tournaments->find();
$this->Authorization->authorize($query);
$tournaments = $this->paginate($this->Authorization->applyScope($query));
$this->set(compact('tournaments'));
}-
/tournaments/invite
// ...
public function canInvite(IdentityInterface $user, Tournament $tournament)
{
return TableRegistry::getTableLocator()->get('TournamentMemberships')
->exists([
'user_id' => $user->get('id'),
'tournament_id' => $tournament->get('id'),
]);
}
// ...
file src/Controller/TournamentsController.php
// ...
public function invite($tournamentId, $userId)
{
$tournament = $this->Tournaments->get($tournamentId);
$this->Authorization->authorize($tournament);
// ...
In this case, we need to check if the logged in User is already a member of the TournamentMemberships group, if so, we are allowed to invite another user.
As you can see, Authorization plugin will provide a flexible way to manage your application permissions. In the previous examples we've covered typical application use cases to handle permissions per resource and action. New classes and interfaces, like policies, resolvers and mappers will allow you to configure the Authorization and ensure all the resources in your application will provide the required permissions.
If you're looking for RBAC based on your controller actions, take a look at https://github.com/CakeDC/auth/blob/master/Docs/Documentation/Authorization.md
For additional tools and plugins, check https://github.com/FriendsOfCake/awesome-cakephp#authentication-and-authorization
It’s time to beat out the competition, are you ready? I first recommend seeing where you stand. There are a few tools you can use to test your SEO score. One example is: 
To keep up with the planning process or any changes, make sure you follow us on 
3. Tests? Baked tests are enough, aren’t they?
Ehm.. no. You won’t be a bad developer if you don’t have 100% coverage. Even more, I don’t like to talk about what coverage is good because it exclusively depends on the project itself. I would say that you should feel good if your core features are fully covered.
4. Why should I put the code in one place only if you can copy and paste it everywhere?
Even most modern IDEs identify this as a bad practice now, but this is something we see in almost every code we get for review. People prefer to copy and paste the same function in multiple classes instead of creating a Component or Behavior or even a library and use it everywhere.
5. Plugins? What is a plugin?
CakePHP has a very large set of available plugins, or you can always start your own plugin and publish it so other people can use it. Plugins are one of the most important features in CakePHP since you can encapsulate a feature or a set of features to use them in multiple projects. Just be careful and don’t overplugin.
6. How the hell would somebody hash a password?
Well, even when you think it's a joke, no, it's not. Some people think hashing a password is not required. CakePHP provides several options for password hashing to secure your application.
7. Do you document your code? I don’t think it is useful.
Having the availability of documentation aids in understanding the intended use, as well as the expected functionality and result of the code's execution. It is pretty easy if you just document your code while you are doing it instead of waiting to have 20 classes to document.
8. Should I declare variables to execute find methods / DB / Service requests or should I put them inside a for/while loop to "save" memory?
Please no, doing external service requests (DB / File / Web Service) from inside a loop affects application performance very badly. You should always try to put the result in a variable and then use it inside the loop.
9. Who needs coding standards?
Coding standards help make code more readable and maintainable. For CakePHP applications, the Cake Conventions and Coding Standards should be applied.
10. Is it better to make all calculations inside for/while loops level in code instead of calculating at the DB/query level?
Data iteration at the DB level offers way better performance than iteration done at the application level.
![](https://i.imgur.com/ky39PFY.jpg src="//s.imgur.com/min/embed.js" charset="utf-8"></script> )
Basically, what I am trying to say is to choose a development team, and choose wisely. The team should start with asking your needs and wants, and your vision for the project. An experienced development team can bring that project to life. The decision you make now, can save time, money, and many meltdowns in the future. Don’t say I didn’t warn you (just kidding…kinda).
* Install the plugin using
Let’s talk about the event, and the workshops. Jorge Gonzalez, Jose Rodriquez, and Mark Story definitely delivered in the knowledge department. The participation was fantastic, although the class size was smaller than in other years. We’ve had a lot of requests for their slides, so those are included in the link below ⬇️ One thing that was different this year, is that we had different venues for the workshops and conference. This makes it difficult for the team, with transferring our equipment in such a busy city (shout out to the quick responding taxi services). We did try the metro when we had less baggage, and got up close and personal with the locals. Speaking of venues, we cannot thank 
If you are a PHPer or specifically working with CakePHP, the speakers topics were overflowing with useful information. Like Yuki Kanazawa’s tips for a smooth upgrade to CakePHP 3, or Tadahisa Motooka’s ideas about database replication. Kazuki Higashiguchi helped talk us through painful testing of code, and Sho Ito walked us through an initial OSS with CakePHP. We had such a great lineup this year, and we cannot wait to have some speakers return. Other great talks included David Yell, Daniel Voyce, Jose Gonzalez, and Wim Godden, and superstar core members Mark Story and Jose Rodriguez. We even had to be confronted with details about life after CakePHP (GASP!) from Andrej Griniuk.
Unfortunately, no event can be executed without some roadblocks, and we aren’t exempt. We had a couple late cancellations (understandable) from speakers, but definitely made up the time with chats and lightning talks. There was so much information exerted during the short 2 days, that we all probably needed and extra day to take notes. Luckily, we did that for you. All of the slides included during CakeFest are available at the link below as well.
So, would we come back and host in Japan again? YES! We hope to do so sooner rather than later. Are there some things we will change on our end? Yes, again. We hoped for higher numbers for workshops, as the information given is invaluable. We hope that in the future, all conference attendees will take advantage of those sessions as well. You can stay up to date with all things CakeFest at 
We could not have done all of this without the amazing sponsors we had this year:
Now we need to customize our new pool adding a pool name, etc. We can use default settings for testing purposes. If you want to customize fields you should then go through steps.
Once we check everything is okay we can click on Create Pool.
Now, it's time to setup App Clients. If you are familiar with OAuth and another services it is like creating a Facebook or Twitter App.
And then click on Add an app client. Just add a name and save.
Remember to write down your client ID and client secret because they will be needed later to configure Users plugin.
The next step is to setup app client settings. We need to configure:
Finally we need to configure a domain name for the user pool. Use a custom domain or a subdomain from Cognito.
Now that we are ready with Cognito setup, let’s easily create a new CakePHP app, to connect with Amazon Cognito.
First, we need a new CakePHP app:
composer create-project --prefer-dist cakephp/app users-app
Remember to create a new empty database.
Now we can go to users-app folder and run:
composer require cakedc/users
After CakeDC Users plugin is installed, we need to install Oauth 2 Cognito provider package:
composer require cakedc/oauth2-cognito
CakeDC Users plugin configuration is pretty easy:
$this->addPlugin('CakeDC/Users');
public function pluginBootstrap()
{
parent::pluginBootstrap();
Configure::load('users');
}
and click on Sign in with Cognito. If everything is setup correctly you should see the following screen:
You can previously create a user in AWS panel or just click signup on that screen. After login you will be redirected to homepage in CakePHP App.
As you can see, the setup for both Cognito and App are simple if you use default settings. However after testing defaults, you can start customizing forms, fields, adding third party apps. You have no limits.
