How to convert 'users' in accessRules from Yii1 into behaviors() in Yii2

Question

I have these codes in my Controller.php when in Yii:

public function filters()
{
    return array('accessControl');
}

public function accessRules()
{
    $allAuthUsers = MyAdmin::model()->getAllUsers(); 

    if (empty($allAuthUsers))
        $allUsers = array(NULL);

    return array(
        array('allow',
            'users' => $allAuthUsers, 
        ),
        array('deny'),
    );
}

But, how can I implement this into Yii2 using behaviors() ?

public function behaviors()
{
    return [
        'access' => [
            'class' => AccessControl::className(),
            'rules' => [
                [
                    'allow' => true,                        
                    'roles' => ['@'],
                ],
                [
                    'allow' => true,
                    'actions' => ['logout'],
                    'roles' => ['@'],
                ],
            ],
        ],
    ];
}

I wanted to put an array list of certain users which is allow to login to the system.

May someone advise how can I do the similar way in Yii2 as how I did in Yii?

Answer 1

Your idea cannot work, you only allow certain users to login, but you do not know what user tries to login until they do. So what you are trying to accomplish cannot work like you want it to because it does not make sense.

What you did in yii1 is to allow access to a controller (not login) to certain users. Your code still does not make sense (but it works) because you actually allow everybody to have access anyway. So your exact code can be written in yii2

/**
 * @inheritdoc
 */
public function behaviors()
{
    return [
        'access' => [
            'class' => AccessControl::className(),
            'only' => ['logout', 'register', 'register-interest', 'forgot-password', 'login-register', 'reset-password', 'auth_login', 'auth_register', 'request-password-reset'],
            'rules' => [
                [
                    'actions' => ['register', 'auth_login', 'auth_register', 'register-interest', 'login-register', 'forgot-password', 'reset-password', 'request-password-reset'],
                    'allow' => true,
                    'roles' => ['?'],
                ],
                [
                    'actions' => ['logout'],
                    'allow' => true,
                    'roles' => ['@'],
                ],
            ],
        ],
    ];
}

Why do you insist to make use a list of users instead of using roles? Here is the official RBAC documentation https://github.com/yiisoft/yii2/blob/master/docs/guide/security-authorization.md . The idea is allow only a specific role (or roles) to access the controller, after a user logs in assign the role to him based a criteria. You can create very complex roles but if you do not want to you can create simple ones too.

Also you can take a look at this: https://github.com/dektrium/yii2-user with the documentation here: http://yii2-user.readthedocs.org/en/latest/index.html for inspiration on what you want to do. It actually has something similar to what you want too, it has a list of usernames that will be admins.

Answer 2

Use this function:

       array('allow', // allow admin user to perform 'admin' and 'delete' actions
            'actions'=>array('index','delete','update','approve','unapprove','admin'),
            'expression'=>'YourFunc(UserRole::LEVEL_ADMIN)',
        ),

and in YourFunc(), return true or false

Answer 3

I tried with this. It works but I am not sure if my idea/concept is correct.

public function behaviors()
{
    return [
        'access' => [
            'class' => AccessControl::className(),
            'ruleConfig' => [
                'class' => 'app\modules\mymodules\components\MyAccessRule'
            ],
            'rules' => [
                [
                    'allow' => true,  
                    'roles' => ['@'],
                ],
                [
                    'allow' => true,
                    'actions' => ['logout'],
                    'roles' => ['@'],
                ],
            ],
        ],
    ];
}

Then, in my MyAccessRule.php:

protected function matchRole($user)
{
    if( !empty($user->identity->username) && (MyAdmin::isAdmin($user->identity->username) )
    {

        return true;            

    }       

    return false;

}

@Mihai P., could you please advise? Anyone could kindly advise too. Thanks. :)