RESTful with authentication

[polinwei]

Hi Sir:

Is possible to setup a authentication for RESTful?

[Alexey Schevchenko]

Hi!
Look in the documentation: http://www.yiiframework.com/doc-2.0/guide-rest-authentication.html

[Alexey Schevchenko]

To implement authentication, you need to do the following steps:

1. Implement the findIdentityByAccessToken() in the User model
   

   yii2-advanced-start/modules/users/models/User.php

   Lines 302 to 305 in 943ebab

    public static function findIdentityByAccessToken($token, $type = null) 
    { 
        return static::findOne(['auth_key' => $token, 'status' => self::STATUS_ACTIVE]); 
    } 

2. Configure authentication method
   

   yii2-advanced-start/modules/users/controllers/api/DefaultController.php

   Lines 31 to 33 in 943ebab

    $behaviors['authenticator']['class'] = QueryParamAuth::className(); 
    $behaviors['authenticator']['only'] = ['update']; 
    $behaviors['authenticator']['tokenParam'] = 'auth_key'; // This value can be changed to its own, for example hash 

Done! Checking:

http://yii2-advanced-start.loc/api/users // All users received

We put the authentication on the action index

yii2-advanced-start/modules/users/controllers/api/DefaultController.php

Lines 31 to 33 in a4387f0

 $behaviors['authenticator']['class'] = QueryParamAuth::className(); 
 $behaviors['authenticator']['only'] = ['update', 'index']; 
 $behaviors['authenticator']['tokenParam'] = 'auth_key'; // This value can be changed to its own, for example hash 

Checking

http://yii2-advanced-start.loc/api/users // Received status 401

Trying to authenticate

http://yii2-advanced-start.loc/api/users?auth_key=4GLpuUYaqFpoKQ9i8FiQaLxcWnkcdBo9 // All users received

auth_key field:

yii2-advanced-start/modules/users/models/User.php

Line 22 in 1717245

  * @property string $auth_key 

Authorized User Key:

echo Yii::$app->user->identity->auth_key;

[polinwei]

Hi Sir:
Thanks!! Your explanation is so clear and simple. BTW whether I can to specify a specific user with its access token ?

[Alexey Schevchenko]

Hi, thanks)

Thanks!! Your explanation is so clear and simple. BTW whether I can to specify a specific user with its access token ?

If you mean RBAC then yes, access control does not differ from the normal mode.

Or what do you mean?

The user's token can be displayed for example in its profile.

yii2-advanced-start/modules/users/views/frontend/default/index/_profile.php

Line 41 in 021f5be

 'auth_key', 

Before using the API, the user must find out his / her token. This is generally a standard OAuth procedure.

[polinwei]

Do it has the parameter $behaviors['authenticator']['userParam'] ?

$behaviors['authenticator']['tokenParam'] = 'auth_key';
$behaviors['authenticator']['userParam'] = 'username';

then
http://yii2-advanced-start.loc/api/users?user=polin&auth_key=4GLpuUYaqFpoKQ9i8FiQaLxcWnkcdBo9

[Alexey Schevchenko]

If you want to provide access by login and password, you can use:
http://www.yiiframework.com/doc-2.0/yii-filters-auth-httpbasicauth.html

Just replace it:

yii2-advanced-start/modules/users/controllers/api/DefaultController.php

Lines 31 to 33 in a4387f0

 $behaviors['authenticator']['class'] = QueryParamAuth::className(); 
 $behaviors['authenticator']['only'] = ['update', 'index']; 
 $behaviors['authenticator']['tokenParam'] = 'auth_key'; // This value can be changed to its own, for example hash 

On this:

$behaviors['authenticator'] = [
            'class' => \yii\filters\auth\HttpBasicAuth::className(),
            'only' => ['update'],
            'auth' => function ($username, $password) {
                $user = \modules\users\models\api\User::find()->where(['username' => $username])->one();
                if ($user->validatePassword($password)) {
                    return $user;
                }
                return null;
            },
        ];

[Alexey Schevchenko]

Multiple authentication methods:

yii2-advanced-start/modules/users/controllers/api/DefaultController.php

Lines 33 to 55 in eced507

 $behaviors['authenticator'] = [ 
     'class' => CompositeAuth::className(), 
     'only' => ['update', 'index'], // Access only for these actions 
     'authMethods' => [ 
         // Access by token 
         [ 
             'class' => QueryParamAuth::className(), 
             'tokenParam' => 'auth_key', // This value can be changed to its own, for example hash 
         ], 
         // Access by username and password 
         [ 
             'class' => HttpBasicAuth::className(), 
             'auth' => function ($username, $password) { 
                 if($user = \modules\users\models\api\User::find()->where(['username' => $username])->one()) { 
                     if (!empty($password) && $user->validatePassword($password)) { 
                         return $user; 
                     } 
                 } 
                 return null; 
             }, 
         ], 
     ], 
 ]; 

Login by login and password or by token

Documentation: http://www.yiiframework.com/doc-2.0/yii-filters-auth-compositeauth.html

[polinwei]

Excellent !! Thanks