php中Zend_Auth和Zend_Acl进行登录认证及根据用户角色进行权限控制

require_once 'Zend/Auth/Adapter/Interface.php';
class Auth implements Zend_Auth_Adapter_Interface{
    private $_useraccount;
    private $_password;
    private $_db;
    /**
     * 构造函数 设置用户名和密码 数据连接对象  
     *
     * @return void     
     */
    public function __construct($useraccount,$password,$db){  
        $this->_useraccount = $useraccount;
        $this->_password      = $password;
        $this->_db             = $db;
    }
   
    /**    
     * 进行认证 
     * @throws Zend_Auth_Adapter_Exception   
     * @return Zend_Auth_Result
     *
     */
    public function authenticate()
    {
        //默认情况下是认证失败
        $authResult = array(
            'code'     => Zend_Auth_Result::FAILURE,//详参：Zend_Auth_Result
            'identity' => '',
            'info' => array()
           );
          
           //获得登录用户信息
        $result = $this->_getAccountData();
               
        if(isset($result)&&!empty($result)) {//认证成功,则将用户信息存储到session中
            $authResult = array(
                'code'     => Zend_Auth_Result::SUCCESS,
                'identity' => $result['name'],
                'info'     => array('status'=>$result['status'])
            );
            //角色存储  个人缓存空间
            $namespace = Zend_Auth::getInstance()//单例模式
                                 -> getStorage()
                                 -> getNamespace();
            $_SESSION[$namespace]['role']     = $result['group_id'];//所属用户组
            $_SESSION[$namespace]['userInfo'] = $result;
            $_SESSION[$namespace]['userInfo']['lastLoginTime'] = $result['login_time'];
            $_SESSION[$namespace]['userInfo']['lastLoginIp']   = $result['login_ip'];          
//            $_SESSION[$namespace]['userInfo']['password']   = $result['password'];//密码是很重要的，不要写到session中
        }
       
        return new Zend_Auth_Result($authResult['code'], $authResult['identity'], $authResult['info']);
    }
    /**
     * 用户密码加密
     * @param $pwd  原始密码
     * @return string  加密后的密码字符串
     *
     */
    static public function encryptionType($pwd=null) {
        $pwd = md5($pwd);
        return $pwd;
    }
    /**
     * 获得用户数据结构
     *
     * @todo 整理密码的公共类
     */
    private function _getAccountData(){
        $resArr = array();
        $sysUserObj = Base_Dao_Factory::getObject('Admin_Models_User');
        //先登录普通会员帐号
        $data = array(
            'login_name' => $this->_useraccount,
            'login_pwd'  => $this->encryptionType($this->_password)
        );
        $result = $sysUserObj->login($data);
        //判断是否有数据,是则赋值
        if ($result) {
            if (!empty($result[0])) {
                $resArr = $result[0];
            }
        }
        return $resArr;
    }
}

 $auth=Zend_Auth::getInstance();       
 if ($auth->hasIdentity()){
       echo $auth->getIdentity();    //输出：张三
       $auth->clearIdentity();       //清除身份
 }
 echo $auth->getIdentity();          //NULL
 var_dump($auth->getStorage());     //Zend_Auth_Storage_Session对象  Zend_Acl进行权限控制

Verify.php

require_once 'Zend/Controller/Plugin/Abstract.php';
class Verify extends Zend_Controller_Plugin_Abstract
{
    /**
     * 访问控制列表对象
     * @var object
     */
    protected $_acl;
    /**
     * 登录的用户名
     * @var string
     */
    protected $_loginname;
   
    /**
     * 构造函数
     * 初始化访问控制列表
     * @param Acl $acl
     * @todo 未登录的时候,$this -> _loginname是为空的
     */
    public function __construct($acl)
    {
        $this -> _acl = $acl;
        require_once('Zend/Auth.php');
        $this -> _loginname = Zend_Auth::getInstance()->getIdentity();//eg:张三
    }
   
    /**
     * 重写父类的preDispatch方法
     *
     * @param Zend_Controller_Request_Abstract $request
     */
    public function preDispatch(Zend_Controller_Request_Abstract $request)
    {
        //请求信息
        $module     = $request -> module;                //模块
        $controller = $request -> controller;            //请求的控制器
        $action     = $request -> action;                //请求的action
       
        $resource = ucfirst(strtolower($controller));    //资源：一个限制访问的对象
        $action   = strtolower($action);               
        $role     = $this->_acl->getRole();                //角色：一个可以发出请求去访问Resource的对象
       
        //判断是否拥有资源
        if(!($this -> _acl -> has($resource))) {
            $resource = null;
        }

//        $this->_acl->removeAllow($role,$resource);        //可以针对某个role移除权限
        //判断当前用户是有权限执行某个请求
        if(!($this -> _acl -> isAllowed($role, $resource, $action))) {
            if (!$this -> _loginname) {//未登陆的情况
                $module     = 'admin';
                $controller = 'login';
                $action     = 'view';
            }else {                      //没有权限的情况
                echo "";
                exit();
            }
        }
//        else {    //认证成功
//           
//        }
        $request -> setModuleName($module);
        $request -> setControllerName($controller);
        $request -> setActionName($action);
    }
}

//判断资源数据格式是否正确
if(!is_Array($actionArray) || empty($actionArray)){
    echo '资源数据格式有错误！';exit();
}else{
    foreach ($actionArray as $action){
        $this -> allow($role, $resource, $action);//允许角色访问资源
    }
}

比如：

Array
(
    [admin] => Array
        (
            [Login] => Array
                (
                    [0] => index
                    [1] => admin
                    [2] => top
                    [3] => left
                    [4] => view
                    [5] => welcome
                )

            [Authgroup] => Array
                (
                    [0] => index
                    [1] => getpermission
                    [2] => edit
                )

            [Order] => Array
                (
                    [0] => orderhistory
                    [1] => allorders
                    [2] => delorder
                    [3] => latestorders
                    [4] => nopayorders
                    [5] => changepaystate
                    [6] => ordersbyrestaurant
                )

            [Shopping] => Array
                (
                    [0] => showmenu
                    [1] => uploadimage
                    [2] => showshop
                    [3] => showfood
                    [4] => addshop
                    [5] => delshop
                    [6] => editshop
                    [7] => updateshop
                    [8] => changestate
                    [9] => addfood
                    [10] => editfood
                    [11] => delfood
                    [12] => updatefood
                )

            [User] => Array
                (
                    [0] =>
                )

            [System] => Array
                (
                    [0] =>
                )

            [Dep] => Array
                (
                    [0] => showdep
                    [1] => adddep
                    [2] => deldep
                    [3] => viewusersbydep
                )

        )

)