PHP Access Control System

Question

Hi.

I am part of a team creating a web application using PHP and MySQL. The application will have multiple users with different roles. The application will also be used in a geographically distributed manner. Accordingly we need to create an access control system that operates at the following two levels:

1. Controls user permissions for specific php pages i.e. provides or denies access to specific pages (or user interface elements) based on the user's role. For example: a user may be allowed access to the "Students" page but not to the "Teachers" page.
2. Controls user permissions for specific database records i.e. modifies database queries so that only specific records are displayed. For example, for a user at the city level, only those records should be displayed that relate to the user's particular city, while for a user at the national level, records for ALL CITIES in the country should be displayed.

I need help on designing a system that can handle both these types of access control. Point no. 1 seems to be simple enough. However, I am completely at a loss on how to do point number 2 without hardcoding the information in the SQL queries.

Any help would be appreciated.

Thanks in advance

Vinayak

Answer 1

Don't know about the details of your problem but the Zend Framework has a rather potent ACL and AUTH set of components you may want to look at. Good stuff like very precise access control, storing data for persistance, advanced conditional rules.

Answer 2

It seems to me like what you need is this: (I'll use a country/state/city example)

1. A list of all countries. Each "country" has an ID.
2. A list of all States within countries. Each state is bound to the ID of the coutnry, but also has its own unique ID.
3. A list of all cities. Each city is bound to either a state, or directly to a country, and has a flag to indicate which.

For a city user, obviously search for and display only those records pertaining to the city that matches their ID. For a state or national level though, search for all records pertaining to each city that has an ID matching that nation (or state or what have you).

So basically, each sub group is dependant on the group above it, and although I don't recall correctly, I believe you can use sub queries to do the trick from there.

Answer 3

If you don't know how to do this I would use a php framework like Zend Framework, CakePHP, or Symphony. They have done the heavy lifting for you and have some type of access control scheme already in place.

Answer 4

you can try http://phpgacl.sourceforge.net/