# CakePHP2 Access Control to CakePHP4 Authorization

**URL:** <https://discourse.cakephp.org/t/cakephp2-access-control-to-cakephp4-authorization/8350>\
**Category:** Need Help\
**Created:** [September 8, 2020, 5:01pm UTC](https://discourse.cakephp.org/t/cakephp2-access-control-to-cakephp4-authorization/8350 "2020-09-08T17:01:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![justinkbug](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@justinkbug](https://discourse.cakephp.org/u/justinkbug)\
**Post date:** [September 8, 2020, 5:01pm UTC](https://discourse.cakephp.org/t/cakephp2-access-control-to-cakephp4-authorization/8350/1 "2020-09-08T17:01:00Z")

</div>

I’m migrating from CakePHP2 Access Control to CakePHP4 Authorization plugin. Does anyone know of some practical examples of doing this? I’m having trouble wrapping my head around the differences and how to make this migration happen. CakePHP2 had the database Tree structure thing going on so we could check for authorization against an item and it’s parent associations would all be considered. I’m not seeing anything like that with CakePHP4.

In version 2 I was using the Controller authorization and the isAuthorized() method and performing ACL checks inside that. I don’t know… I guess any practical examples might help.

---

<div class="post-metadata">

**Author:** ![dreamingmind](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/dreamingmind/32/1857_2.png) [@dreamingmind](https://discourse.cakephp.org/u/dreamingmind)\
**Post date:** [September 8, 2020, 7:09pm UTC](https://discourse.cakephp.org/t/cakephp2-access-control-to-cakephp4-authorization/8350/2 "2020-09-08T19:09:22Z")

</div>

I can’t give you specific details, only a general idea of the new system and a little guess-work.

Authorization is now implemented using policies. There is a little bit of naming-convention magic that decides which policy to run at any given moment.

A typical call might be something like:

```auto
$identity->can('edit', $article);

```

> **Details of this example call**
>
> In this example call the `$identity` is the [authenticated user’s identity object](https://book.cakephp.org/authentication/2/en/identity-object.html). This basic object gets [wrapped and expanded](https://book.cakephp.org/authorization/2/en/middleware.html#identity-decorator) by the Authorization plugin.
> 
> The policy class that gets called is determined by the second argument; in this expample `$article`.
> 
> A specific Policy Class will be called for each class type you pass ([more details here](https://book.cakephp.org/authorization/2/en/policy-resolvers.html)).
> 
> There are a couple of other general policy checks beyond `can` (which will return a boolean). `canResult` will return an Policy Result Object. `scope` will operate on and modify query objects.

I expect you will need to map your old v2 ACL checks to these new policy checks.

If I recall correctly, `isAuthorized()` returned a boolean. So your `isAuthorized()` calls will need to be changed to `can` calls as illustrated above.

The logic that determined access from your ACL arrays will need to be handled by your new `can` policies. Or possibly, the `can` can delegate back to the older auth check logic.

Possibly this brief overview will help?

---

<div class="post-metadata">

**Author:** ![raul338](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/raul338/32/69_2.png) [@raul338](https://discourse.cakephp.org/u/raul338)\
**Post date:** [September 8, 2020, 9:03pm UTC](https://discourse.cakephp.org/t/cakephp2-access-control-to-cakephp4-authorization/8350/3 "2020-09-08T21:03:59Z")

</div>

It is now a plugin [cakephp/acl](https://github.com/cakephp/acl/), recently merged 4x. support

I used this repo as base: [mattmemmesheimer/cakephp-3-acl-example](https://github.com/mattmemmesheimer/cakephp-3-acl-example)

---

<div class="post-metadata">

**Author:** ![justinkbug](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@justinkbug](https://discourse.cakephp.org/u/justinkbug)\
**Post date:** [September 9, 2020, 4:20pm UTC](https://discourse.cakephp.org/t/cakephp2-access-control-to-cakephp4-authorization/8350/4 "2020-09-09T16:20:07Z")

</div>

I think this may be exactly what I need. Didn’t know it existed, so I guess I’ll see if everything works with version 4. Thanks! You’ve been a life saver during this migration of mine. So I’m guessing with this there is no need for the Authorization plugin?

---

<div class="post-metadata">

**Author:** ![raul338](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/raul338/32/69_2.png) [@raul338](https://discourse.cakephp.org/u/raul338)\
**Post date:** [September 9, 2020, 5:59pm UTC](https://discourse.cakephp.org/t/cakephp2-access-control-to-cakephp4-authorization/8350/5 "2020-09-09T17:59:08Z")

</div>

You can use the AuthorizationPlugin that is a wrapper of an Acl call