Phly, boy, phly
the weblog and site of Matthew Weier O'Phinney

Authentication Adapter

For all this to work, you'll need an authentication adapter. I'm not going to go into specifics on this, as the documentation covers them, and your needs will vary based on your site. I will make the assumption, however, that your authentication adapter requires a username and password for authentication credentials.

Our login controller will make use of the adapter, but simply have a placeholder for retrieving it.

Login Form

The login form itself is pretty simple. You can setup some basic validation rules so that you can prevent a database or other service hit, but otherwise keep things relatively simple. For purposes of this tutorial, we'll define the following criteria:

• Username must be alphabetic characters only, and must contain between 3 and 20 characters
• Password must consist of alphanumeric characters only, and must be between 6 and 20 characters

The form would look like this:

Login Controller

Now, let's create a controller for handling login and logout actions. The typical flow would be:

• User hits login form
• User submits form
• Controller processes form
  • Validation errors redisplay the form with error messages
  • Successful validation redirects to home page
• Logged-in user gets redirected to home page
• Logout action logs out user and redirects to login form

The LoginController will make use of your chosen authentication adapter, as well as the login form. We will pass to the login form constructor the form action and method (since we now know what they will be for this usage of the form). When we have valid values, we'll pass them to our authentication adapter.

So, let's create the controller. First off, we'll create accessors for the form and authentication adapter.

Next, we need to do some checking before we dispatch any actions to ensure the following:

• If the user is already authenticated, but has not requested to logout, we should redirect to the home page
• If the user is not authenticated, but has requested to logout, we should redirect to the login page

The following preDispatch() routine will do this for us:

Now, we need to do our login form. This is our simplest method -- we simply retrieve the form and assign it to the view:

Processing the form involves slightly more logic. We need to verify that we have a post request, then that the form is valid, and finally that the credentials are valid.

Finally, we can tackle the logout action. This is almost as simple as displaying the login form; we simply clear the identity from the authentication object, and redirect:

Okay, that's it for our login/logout routines. Let's look at the one associated view we have, the form:

And that's it. Really. Zend_Form makes view scripts simple.

Checking for Authenticated Users

The last part of the question area is: how do I determine if a user is authenticated, and restrict access if not?

If you look carefully at the preDispatch() method above, you can see already how this can be done. Zend_Auth persists the identity in the session, allowing you to query it directly using this construct:

You can use this to determine if the user is logged in, and then use the redirector to redirect to the login page if not. You can pull the identity from the auth object as well:

This could be sprinkled into a helper to show login status in your layout, for instance:

Conclusion

Zend_Auth does a lot of behind the scenes work to make persisting an identity in the session trivial. Combine it with Zend_Form, and you have a very easy to implement solution for retrieving and validating credentials; add standard hooks in the Zend_Controller component for filtering actions prior to dispatch, and you can restrict access to applications easily based on authentication status.