rbam Follow @yiiframework

I found the rbam_manual.pdf mirrored here http://pdfio.com/k-2272549.html and on my site for save keeping http://bitbucket.org/bytebrain/yii-rbam-extension-manual It should be within the downloadable zip.

i'm trying to download PDF for the manual from

http://rbam.pbm-webdev.co.uk/documents/rbam_manual.pdf

but it's broken

The entire 3rd-level domain is unreachable

Last tested was RBAM version 1_6_1.

I'v noticed that RBAM dose not work well with PostgreSQL. Anyway there is a fix:

'authManager'=>array(
            'class'=>'CDbAuthManager',
            'connectionID'=>'db',
            'itemTable'=>'auth_item',
            'itemChildTable'=>'auth_item_child',
            'assignmentTable'=>'auth_assignment',
        ),

so the authorization table names must be changed. Why? Because in PostgreSQL,

SELECT * FROM AuthItem

is the same as

SELECT * FROM authitem

But PostgreSQL is case sensitive on tables name, so an error is trigger.

The correct syntax is by quoting the table name:

SELECT * FROM "AuthItem"

But in order to make no changes in the RBAM module, it is best to just rename the tables and make them lowercase...

Anyway one error still remains in: \rbam\components\behaviors\RbamDbAuthManagerBehavior.php(162)

$condition = 'type='.CAuthItem::TYPE_ROLE." AND name NOT IN(SELECT itemName FROM {$owner->assignmentTable} WHERE userid=$uid)";

$uid should be quoted, like:

$condition = 'type='.CAuthItem::TYPE_ROLE." AND name NOT IN(SELECT itemName FROM {$owner->assignmentTable} WHERE userid='$uid')";

and now RBAM works with PostgreSQL! :)

Beware: I just noticed that renaming an auth item does not propagate the new name to the 'relationships' and 'assignments' table! SRBAC does this (but, sadly, its GUI doesn't include any relationships manipulation).

Demo not working .Could you please correct it? thanks

Hi The RbamInitialiser and the 'assign' view of authAssignments still have some '$user->id' entries that should be something like:

$user->{$module->userIdAttribute}

(in assign) and

$user->{Yii::app()->getModule('rbam')->userIdAttribute}

Further, another modification was needed regarding the menu generation. When the current controller is not the RBAM, the menu is missing the controller's path prefix. Hence, the corresponding menu generation code had to be updated like this (last line of the snippet):

return array_merge(array(
            array(
                'label'=>Yii::t('RbamModule.rbam','Auth Assignments'),
                'url'=>array($this->baseUrl.'/authAssignments/index'),

To support ambigious columns, I changed this in AuthAssignmentController:

$asc = join(',',array_map(function($a){return (strpos($a,'.')===false)?'t.'.$a:$a;},$userNameAttribute));

This supposes that the alias for the user table is 't'.

Right, so I added a few permissions to the Guest and Authenticated role, but I kept on getting the access denied. So I did a

<?php print_r(Yii::app()->authManager->defaultRoles);?>

And hooray, empty array. The RBAM-module has the following in the beforeControllerAction:

<?php 
    public function beforeControllerAction($controller, $action) {
        $authManager = Yii::app()->getAuthManager();
        $authManager->defaultRoles = array_merge($authManager->defaultRoles, array(
            $this->authenticatedRole, $this->guestRole
        ));
        if ($authManager instanceof CAuthManager)
            $authManager->attachBehavior('authManager', array(
                'class'=>($authManager instanceof CDbAuthManager?
                    'RbamDbAuthManagerBehavior':'RbamPhpAuthManagerBehavior'
                ),
                'module'=>$this
            ));
        else
            throw new CException(Yii::t('RbamModule.rbam','AuthManager component is not an instance of CAuthManager'));
        $controller->authManager = $authManager;
      return true;
    } ?>

and guess what, authManager::defaultRoles is not an empty array when I access the RBAM-module, and works perfectly.

Seems to me something is misplaced? And what am I missing here that defaultRoles are not set in other modules?

Hi,

There's this issue I'm still looking into that is described here. In the meantime, please be advised that the bizrule attached to Guest role will lead to incorrect behavior (=bug) if Authenticated is to inherit from Guest, which is natural to assume. Solution? Remove the bizrule from the Guest role so anyone, from RBAC perspective could assumed to be of this role, including authenticated users. No, this is only an permissions granting perspective. If you think about it it bears no implication regarding application flow in general.

If User table have id column's type is not int ( example : varchar) . Fix these line:

\rbam\views\authAssignments\assign.php:

jQuery("#AuthAssignment_userId").val('.$user->{$module->userIdAttribute}.');

=>

jQuery("#AuthAssignment_userId").val("'.$user->{$module->userIdAttribute}.'");

\rbam\components\behaviors\RbamDbAuthManagerBehavior.php

$condition = 'type='.CAuthItem::TYPE_ROLE." AND name NOT IN(SELECT itemName FROM {$owner->assignmentTable} WHERE userid=$uid)"; =>

$condition = 'type='.CAuthItem::TYPE_ROLE." AND name NOT IN(SELECT itemName FROM {$owner->assignmentTable} WHERE userid='$uid')";

I think your demo page is broken.

in DataValidator

if (!empty($model->bizrule) && strpos($model->bizrule,'$data')!==false && empty($this->data))
// may be
$model->data

If you want to put this module (or any other module) in another folder, configure like this:

Put rbam folder in protected/extensions/:

(..)
// Modules
'modules' => array(
    'rbam'=>array(
        'class' => 'ext.rbam.RbamModule',
        (..)

There's a bug that enables a person with the role 'authAssignmentsManagerRole' to assign somebody (even himself) the 'rbacManagerRole' role, and then scaling privileges. To avoid this, you've to modify the method 'getEUnassignedRoles' and put the following:

foreach ($owner->defaultRoles as $defaultRole)
            unset($unassignedRoles[$defaultRole]);
 
        // start of modification
        if(!Yii::app()->user->checkAccess($this->module->rbacManagerRole))
        {
            unset($unassignedRoles[$this->module->rbacManagerRole]);
            unset($unassignedRoles[$this->module->authItemsManagerRole]);
            unset($unassignedRoles[$this->module->authAssignmentsManagerRole]);
        }
        // end of modification
 
        $assignedRoles = array();

I import the SQL schema (\yii\framework\web\auth\schema-mysql.sql). then this is the config:

'rbam'=>array(
            'development'=>TRUE,
            'initialise'=>array(
                'class'=>'CDbAuthManager',
                'connectionID'=>'db',
            ),
            'rbacManagerRole'=>'admin',
            'userClass'=>'User',
            'userIdAttribute'=>'id',
            'userNameAttribute'=>'username',
        ),

First, I could not go beyond the 'not initiliazed' screen. Second, I could, using this configs:

'rbam'=>array(
            'authAssignmentsManagerRole'=>'admin',
            'authenticatedRole'=>'Authenticated',
            'authItemsManagerRole'=>'admin',
            'development'=>true,
            'initialise'=>true,
            'rbacManagerRole'=>'admin',
            'userClass'=>'Usuario',
            'userIdAttribute'=>'id_usuario',
            'userNameAttribute'=>'usuario',
        )

After logout and login again, i am receiving a 403 error page. I cant access rbam any way else.

I tryed to change the initialise to false, I tryed to create an user RBAC Manager, to log using it, but the 403 persists.

Now I am leaving this extension. Thanks anyway.

,

as the title says, the demo has an error. can you fix it so i cloud check if this extension could help me :D thx

You don't have to initialize it when you set the proper roles (the initialize message is only shown when you don't have access to the RBAM interface). For instance, my application uses:

'rbam'=>array(
    'rbacManagerRole'=>'SuperAdmin',
    'authAssignmentsManagerRole'=>'SuperAdmin',
    'authItemsManagerRole'=>'SuperAdmin',
),

The message you saw implies that it needs to be initialized, and is misleading. Maybe the author can change it?

An option to disable (role based) authentication to the RBAM module would be handy though. For example, I only enable the module in my development environment where I wouldn't require access checks to RBAM.

This is the second rbac extension I've tried to get working in my app, yii-rbac, and now your rbam.

RBAM comes up fine, but demands to be initialized. Why wouldn't it just use the data in the tables that is already available?? I've completed the Agile-yii book and have authmanager working, just not an easy way of viewing and managing roles, tasks and operations.

Please help out with a detailed data array that initialise can use, or let it just go into a mode where it can use what's there.

thanks,

The demo does not work or is it just for me?

rbam\views\authAssignments\assign.php

replace two

$user->id

with

>

$user->{$module->userIdAttribute}