Access control List(ACL) in CakePHP

An Access control list or ACL is used to make access control for each of the logins and handle security of the app.

For example, ACL handles menu level permission access and function or module level access permission. When a subject requests an operation on an object in an ACL-based security model the operating system first checks the ACL for an applicable entry to decide whether the requested operation is authorized. A key issue in the definition of any ACL-based security model is determining how access control lists are edited, namely which users and processes are granted ACL-modification access. ACL models may be applied to collections of objects as well as to individual entities within the system’s hierarchy.
ACL basically handles 2 things:

ARO(Access Request Object):

Aros are of usergroups and users. Each of the users are mapped to aros to know the group he belongs to.

ACO(Access Control Object):

Aros are of menus and modules. Where every usergroup will have permissions to access each of these menus and modules.

Essentially, ACL is what is used to decide when an ARO can have access to an ACO.

In order to help you understand how everything works together, let’s use a semi-practical example. Imagine, for a moment, a computer system used by a familiar group of fantasy novel adventurers from the Lord of the Rings. The leader of the group, Gandalf, wants to manage the party’s assets while maintaining a healthy amount of privacy and security for the other members of the party. The first thing he needs to do is create a list of the AROs involved:

• Gandalf
• Aragorn
• Bilbo
• Frodo
• Gollum
• Legolas
• Gimli
• Pippin

The next thing Gandalf needs to do is make an initial list of things, or ACOs, the system will handle. His list might look something like:

• Weapons
• The One Ring
• Salted Pork
• Diplomacy
• Ale

Read more…

Source: InstaCarma