rbam

Hi,

There's this issue I'm still looking into that is described here. In the meantime, please be advised that the bizrule attached to Guest role will lead to incorrect behavior (=bug) if Authenticated is to inherit from Guest, which is natural to assume. Solution? Remove the bizrule from the Guest role so anyone, from RBAC perspective could assumed to be of this role, including authenticated users. No, this is only an permissions granting perspective. If you think about it it bears no implication regarding application flow in general.

If User table have id column's type is not int ( example : varchar) . Fix these line:

\rbam\views\authAssignments\assign.php:

jQuery("#AuthAssignment_userId").val('.$user->{$module->userIdAttribute}.');

=>

jQuery("#AuthAssignment_userId").val("'.$user->{$module->userIdAttribute}.'");

\rbam\components\behaviors\RbamDbAuthManagerBehavior.php

$condition = 'type='.CAuthItem::TYPE_ROLE." AND name NOT IN(SELECT itemName FROM {$owner->assignmentTable} WHERE userid=$uid)"; =>

$condition = 'type='.CAuthItem::TYPE_ROLE." AND name NOT IN(SELECT itemName FROM {$owner->assignmentTable} WHERE userid='$uid')";

I think your demo page is broken.

in DataValidator

if (!empty($model->bizrule) && strpos($model->bizrule,'$data')!==false && empty($this->data))
// may be
$model->data

If you want to put this module (or any other module) in another folder, configure like this:

Put rbam folder in protected/extensions/:

(..)
// Modules
'modules' => array(
    'rbam'=>array(
        'class' => 'ext.rbam.RbamModule',
        (..)

There's a bug that enables a person with the role 'authAssignmentsManagerRole' to assign somebody (even himself) the 'rbacManagerRole' role, and then scaling privileges. To avoid this, you've to modify the method 'getEUnassignedRoles' and put the following:

foreach ($owner->defaultRoles as $defaultRole)
            unset($unassignedRoles[$defaultRole]);
 
        // start of modification
        if(!Yii::app()->user->checkAccess($this->module->rbacManagerRole))
        {
            unset($unassignedRoles[$this->module->rbacManagerRole]);
            unset($unassignedRoles[$this->module->authItemsManagerRole]);
            unset($unassignedRoles[$this->module->authAssignmentsManagerRole]);
        }
        // end of modification
 
        $assignedRoles = array();

I import the SQL schema (\yii\framework\web\auth\schema-mysql.sql). then this is the config:

'rbam'=>array(
            'development'=>TRUE,
            'initialise'=>array(
                'class'=>'CDbAuthManager',
                'connectionID'=>'db',
            ),
            'rbacManagerRole'=>'admin',
            'userClass'=>'User',
            'userIdAttribute'=>'id',
            'userNameAttribute'=>'username',
        ),

First, I could not go beyond the 'not initiliazed' screen. Second, I could, using this configs:

'rbam'=>array(
            'authAssignmentsManagerRole'=>'admin',
            'authenticatedRole'=>'Authenticated',
            'authItemsManagerRole'=>'admin',
            'development'=>true,
            'initialise'=>true,
            'rbacManagerRole'=>'admin',
            'userClass'=>'Usuario',
            'userIdAttribute'=>'id_usuario',
            'userNameAttribute'=>'usuario',
        )

After logout and login again, i am receiving a 403 error page. I cant access rbam any way else.

I tryed to change the initialise to false, I tryed to create an user RBAC Manager, to log using it, but the 403 persists.

Now I am leaving this extension. Thanks anyway.

,

as the title says, the demo has an error. can you fix it so i cloud check if this extension could help me :D thx

You don't have to initialize it when you set the proper roles (the initialize message is only shown when you don't have access to the RBAM interface). For instance, my application uses:

'rbam'=>array(
    'rbacManagerRole'=>'SuperAdmin',
    'authAssignmentsManagerRole'=>'SuperAdmin',
    'authItemsManagerRole'=>'SuperAdmin',
),

The message you saw implies that it needs to be initialized, and is misleading. Maybe the author can change it?

An option to disable (role based) authentication to the RBAM module would be handy though. For example, I only enable the module in my development environment where I wouldn't require access checks to RBAM.

This is the second rbac extension I've tried to get working in my app, yii-rbac, and now your rbam.

RBAM comes up fine, but demands to be initialized. Why wouldn't it just use the data in the tables that is already available?? I've completed the Agile-yii book and have authmanager working, just not an easy way of viewing and managing roles, tasks and operations.

Please help out with a detailed data array that initialise can use, or let it just go into a mode where it can use what's there.

thanks,

The demo does not work or is it just for me?

rbam\views\authAssignments\assign.php

replace two

$user->id

with

>

$user->{$module->userIdAttribute}

After integrating this extension in my application, it seems parts of the styling are missing. For example, the form on "rbam/authItems/create?type=2" has no styling applied to it. Any solutions?

Hi yeti just installed latest version of RBAM but I'm stuck on RBAM Not Initialised what should I do ?

I have a working example again! RBAM forum thread

doodle

This should be

// task 'editOwnPage'
return Yii::app()->user==$params['Webpage']->createdby;

I caught that typo but it still didn't work as expected. doodle

@Yeti thanks so much for your help, I agree with your approach and no I did not realize that roles where the same as authItems, that should definitely be in the guide!

So now I want only a super admin or the owner of the document to edit the document. I have done stuff like this in the past but I could never figure out the business rules.

According to the guide.

$bizRule='return Yii::app()->user->id==$params["post"]->authID;';
$task=$auth->createTask('updateOwnPost','update a post by author himself',$bizRule);
$task->addChild('updatePost');

My model is called 'Webpage' and the field 'createdby' contains the id of the user who created this page. So this is my business rule.

// task 'editOwnPage'
return Yii::app()->user==$param['Webpage']->createdby;

in my accessRules

// pageEditor is a role, editOwnpage is a task        
array('allow',
                'actions'=>array('update'),
                'roles'=>array('pageEditor','editOwnPage'),
            ),

My user 'demo' has one role 'member', member role has two tasks 'ViewPageContent' and 'editOwnPage' the first task doesn't really do anything but the second contains a business rule. Setup this way the user 'demo' cannot edit any pages.

If I change my accessRules to this

array('allow',
                'actions'=>array('update'),
                'roles'=>array('pageEditor','member'),
            ),

Then user 'demo' can edit any page.

Thanks in advance for your help, I really find the RBAC part of Yii confusing. doodle

@doodle As you say, there is usually more than one way to things in Yii, and what you have will work just fine. Another (IMHO better) way is to declare access control in the controller's accessRules() method; this is the logical place and describes what is going on, and means the actions don't need to worry about authorisation - if they get called the user is authorised and they can just get on with what they need to do.

Taking your example this would become:

public function filters() {
  return array(
    'accessControl',
    // other filters
  );
}
 
public function accessRules() {
  return array(
    array('allow',
      'actions'=>array('EditPageContent'),
      'roles'=>array('EditPageContent'),
    ),
    // other access rules
    array('deny',
      'users'=>array('*'),
    ),
  );
}

Note: the "roles" in accessRules refers to roles, tasks and operations (it's badly named in my opinion - should have been authItems to describe it better, but we have what we have)

The real benefit and beauty of RBAC comes by defining a hierarchy. Consider this: Have the roles "PageManager" and "PageEditor"; users are assigned appropriately Have the tasks "EditPage", "EditOwnPage" Have the operations "Create", "Delete" (The Create and Delete operations could equally well be tasks. I like have atomic actions as operations, others prefer direct inheritance by roles to be tasks; it's purely personal preference and makes no difference.)

The hierarchy is: PageManager inherits EditPage, Create, and Delete PageEditor inherits EditOwnPage and Create EditOwnPage has a business rule that checks that the page creator is the current user

(Defining the above roles, tasks, operations, hierarchy and assignments is what RBAM and other extensions - Rights and SRBAC - manage)

In the PagesController there are the "create", "update", and "delete" actions.

The access rules can now be: public function accessRules() { return array( array('allow', 'actions'=>array('create'), 'roles'=>array('Create'), // PageManagers and PageEditors will be allowed ), array('allow', 'actions'=>array('update'), 'roles'=>array('EditPage', 'EditOwnPage'), // PageManagers will be allowed to update all pages, PageEditors only their own ), array('allow', 'actions'=>array('delete'), 'roles'=>array('Delete'), // Only PageManagers will be authorised ), // other access rules array('deny', 'users'=>array('*'), ), ); }

Like all things Yii there are many ways to do things. I like the idea of creating a task and assigning it to a role.

I managed to protect an entire controller from being accessed by anyone not having a task within their role with the following code.

In this example the task is 'EditPageContent'

public function init()
        {
          if(Yii::app()->user->checkAccess('EditPageContent')) {
            // Do whatever the user is authorised to do
             return;
            } else {
                $this->redirect(Yii::app()->user->loginUrl);
            }
        }

thanks