Authentication and sessions #

This page is for developers who configure a security firewall, guards or an authentication backend. In Exponential, users are content: each user is a content object of the user class with an ezuser field holding login, e-mail and password hash, placed in user groups in the content tree. Authentication is done by the kernel's user module and login handlers; the session keeps the signed-in user.

Contents #

1. Users and the anonymous user
2. Signing in
3. Sessions
4. Requiring login
5. Machines: API keys and OAuth2
6. The current user in code
7. Compared with other frameworks

Users and the anonymous user #

Because users are content, they get versions, translations of their profile fields, permissions and search like any other content.

Signing in #

• The user/login view signs a user in; user/logout, user/register, user/forgotpassword and user/activate do what their names say.
• Login handlers check credentials: site.ini [UserSettings] LoginHandler[] (standard shipped; LDAP and textfile exist as alternatives). The first handler that accepts the credentials signs the user in. Your own handler is an extension point (User login handler).
• Two-step sign-in (authenticator app or e-mail code) comes from the sevenx_authentication_2fa extension, a login handler placed before standard (Two-step sign-in).
• In code, eZUser::loginUser( $login, $password ) checks credentials and signs in.

Sessions #

• A session keeps one browser signed in. It ends site.ini [Session] SessionTimeout seconds after its last use (31104000, 360 days, shipped).
• site.ini [Session] Handler empty (the default) means ezpSessionHandlerPHP: PHP's own session storage. ezpSessionHandlerDB keeps sessions in the table ezsession, which lets Setup > Sessions list and remove them (Sessions). A Symfony-based handler (ezpSessionHandlerSymfony) is used when the kernel runs inside Symfony.
• Read and write session values through eZHTTPTool::instance() (setSessionVariable(), sessionVariable(), hasSessionVariable()), not $_SESSION directly.
• Session cookies are named with the prefix of [Session] SessionNamePrefix.

Requiring login #

Machines: API keys and OAuth2 #

Machines do not sign in with a form. The REST API accepts personal API keys (Authorization: Bearer expk_...) and OAuth2 tokens (POST /api/auth/v1/oauth/token); expservices has its own tokens (OAuth and API keys, Personal API keys). Whatever the credential, every call is checked against the user's policies.

The current user in code #

$user = eZUser::currentUser();
if ( !$user->isRegistered() ) { /* anonymous */ }
$userID = eZUser::currentUserID();

On the command line and in workers the user is anonymous until the code signs one in, for example a dedicated integration user with eZUser::setCurrentlyLoggedInUser( $user, $user->id() ); never the shared administrator (Access control in code). In templates: fetch( 'user', 'current_user' ).

Compared with other frameworks #

Related pages #

• Accounts and sign-in
• Member registration and areas
• Security and audit
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.