Home.md

Home

The Users Plugin allow users to register and login, manage their profile, etc. It also allows admins to manage the users.

The plugin is thought as a base to extend your app specific users controller and model from.

That it works out of the box doesn't mean it is thought to be used exactly like it is but to provide you a kick start.

Documentation

• Overview
• Installation
• Configuration
• Authentication
• Authorization
• SimpleRbacAuthorize
• Permissions
• SuperuserAuthorize
• Intercept Login Action
• Social Authentication
• Two Factor Authenticator
• Webauthn Two-Factor Authentication (Yubico Key compatible)
• UserHelper
• AuthLinkHelper
• Events
• Extending the Plugin
• Commands
• Translations

I want to

• extend the

  • model
  • controller
  • templates

• enable or disable

  • email validation

    Add this to your config/users.php file to disable email validation

      'Users.Email.validate' => false,

    or this to enable (default)

      'Users.Email.validate' => true,

  • registration

    Add this to your config/users.php file to disable registration

    'Users.Registration.active' => false,

    or this to enable (default)

    'Users.Registration.active' => true,

  • reCaptcha on registration

    To enable reCaptcha you need to register your site at google reCaptcha console and add this to your config/users.php file to enable on registration:

    'Users.reCaptcha.key' => 'YOUR RECAPTCHA KEY',
    'Users.reCaptcha.secret' => 'YOUR RECAPTCHA SECRET',
    'Users.reCaptcha.registration' => true,

    To disable (default) add this to your config/users.php

    'Users.reCaptcha.registration' => false,

  • reCaptcha on login

    To enable reCaptcha you need to register your site at google reCaptcha console and add this to your config/users.php file to enable on login:

    'Users.reCaptcha.key' => 'YOUR RECAPTCHA KEY',
    'Users.reCaptcha.secret' => 'YOUR RECAPTCHA SECRET',
    'Users.reCaptcha.login' => true,

    To disable (default) add this to your config/users.php

    'Users.reCaptcha.login' => false,

  • social login

  • OTP Two-factor authenticator

  • Webauthn Two-Factor Authentication

  • Authentication component

    Add this to your config/users.php file to autoload the component (default):

    'Auth.AuthenticationComponent.load' => true,

    To not autoload add this to your config/users.php

    'Auth.AuthenticationComponent.load' => false,

  • Authorization component

    Add this to your config/users.php file to autoload the component (default):

      'Auth.AuthorizationComponent.enabled' => true,

    To not autoload add this to your config/users.php

      'Auth.AuthorizationComponent.enabled' => false,

  • TOS validation

    Add this to your config/users.php file to enable (default):

      'Users.Tos.required' => true,

    To disable add this to your config/users.php

      'Users.Tos.required' => false,

  • remember me

    Add this to your config/users.php file to enable (default):

      'Users.RememberMe.active' => true,

    To disable add this to your config/users.php

      'Users.RememberMe.active' => false,

• allow access to

  • public actions (non-logged user)
  • one specific action
  • all actions from one controller
  • all controllers from one prefix
  • entity owned by the user
  • action using a custom logic

• customize my login page to

  • use my template

    Copy the login file from `{project_dir}/vendor/cakedc/users/templates/Users/` to `{project_dir}/templates/plugin/CakeDC/Users/Users`.
  • use a custom finder

    First add this to your config/users.php:

    'Auth.Identifiers.Password.resolver.finder' => 'myFinderName',
    'Auth.Identifiers.Social.authFinder' => 'myFinderName',
    'Auth.Identifiers.Token.resolver.finder' => 'myFinderName',
    

    Important: You must have extended the model, see how to at Extending the Plugin

  • use a custom redirect url

    To use a custom redirect url on login add this to your config/users.php:

    'Auth.AuthenticationComponent.loginRedirect' => '/some/url/',
    

    or

    'Auth.AuthenticationComponent.loginRedirect' => ['plugin' => false, 'controller' => 'Example', 'action' => 'home'],
    

    Important: when using array you should pass 'plugin' => false, to match your app controller.

  • enable|disable reCaptcha

    To enable reCaptcha you need to register your site at google reCaptcha console and add this to your config/users.php file to enable on login:

    'Users.reCaptcha.login' => true,
    'Users.reCaptcha.key' => 'YOUR RECAPTCHA KEY',
    'Users.reCaptcha.secret' => 'YOUR RECAPTCHA SECRET',

    To disable (default) add this to your config/users.php

    'Users.reCaptcha.login' => false,

  • use user's email to login

  • override the password hasher

  • lock a users account after a number of failed password attempts

• add custom logic before

  • user logout
  • user register
  • linking social account
  • creating social account

• add custom logic after

  • user login
  • user logout
  • user register
  • user changed the password
  • sending the token for user validation
  • user email is validated
  • user email is validated to autologin user
  • intercept login action

Migration guides

• 4.x to 5.0
• 6.x to 7.0
• 8.x to 9.0