php - How can i manage users permission?

Question

How can i manage user permission? i need a fast method to manage users (accsess to a page or dont accsee to a page) when they login?

Please help me ...

Answer 1

You may want a simple solution but it's not a simple question.

At one end you could have individual permissions for each page for each user. That gives you a lot of flexibility but it would be an administrative nightmare. At the other end you could give users access or not to the whole site. Not very flexible but very easy to administer and code for.

The first is fine-grained. The second is coarse-grained. The whole point of finding an authorization scheme is to define one that is as fine or coarse grained as you need to balance flexibility and administration/development.

Two common schemes that may be of interest to you:

1. Give each user a type in the database. When they log in put that type (eg User, Admin, Moderator) in the session and check that on each relevant page;
2. Give each user one or more roles (so someone could, say, be both an Admin and a Moderator or just one of them or neither). This requires a separate table (users and userroles) and putting probably an array in the session to indicate roles but is more flexible than (1). Role-based authorization is very common.

There are many, many variations upon these two and just as many alternatives. Various schemes can be combined.

This is why generic authorization libraries for me fall short because they have contrary needs of being broad enough to cover a large number of use cases and being coarse-grained enough to be useful for the individual user.

Answer 2

Implement an ACL system.

• A group of users form a role
• A user may belong to many roles
• Privileges are defined in the application - example, create user, post article. etc
• Add privileges to roles via admin interface
• Before the page loads, check ACL. If user belongs to a role with the required privileges for the requested page, allow user to continue. Else redirect to access denied page.
• It can be easily achieved using third party libraries like Zend_Acl

Choose a library you are comfortable working with. But the basic idea remains same.

Answer 3

You could also try this open source library for ACL implementation in your project.

PHPGACL => PHP Generic Access Control List.