# Separate Admin login

**URL:** <https://discourse.cakephp.org/t/separate-admin-login/12423>\
**Category:** Need Help\
**Created:** [February 13, 2025, 8:06pm UTC](https://discourse.cakephp.org/t/separate-admin-login/12423 "2025-02-13T20:06:31Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 13, 2025, 8:06pm UTC](https://discourse.cakephp.org/t/separate-admin-login/12423/1 "2025-02-13T20:06:31Z")

</div>

Hi together,  
I created a page where user can login.  
This was done by using cakephp Authentication and Authorization. All works fine.  
I did it like it is described in tutorial.  
And now I added an admin area by using prefix for admin in routes.  
But when I try to login right now in Admin area, I get an error

```auto
'Login URL `/project/admin/users/login` did not match `/project/users/login`.',

```

In Application.php I add a function getAuthenticationService (like described in tutorial).  
And here I have the unauthenticatedRedirect and loginUrl

```auto
public function getAuthenticationService(ServerRequestInterface $request): AuthenticationServiceInterface
    {
        $authenticationService = new AuthenticationService([
            'unauthenticatedRedirect' => Router::url('/users/login'),
            'queryParam' => 'redirect',
        ]);
        
        // Load identifiers, ensure we check email and password fields
        $authenticationService->loadIdentifier('Authentication.Password', [
            'fields' => [
                'username' => 'email',
                'password' => 'password',
            ],
        ]);
        
        // Load the authenticators, you want session first
        $authenticationService->loadAuthenticator('Authentication.Session');
        // Configure form data check to pick email and password
        $authenticationService->loadAuthenticator('Authentication.Form', [
            'fields' => [
                'username' => 'email',
                'password' => 'password',
            ],
            'loginUrl' => Router::url('/users/login'),
        ]);
        return $authenticationService;
    }

```

Both URLS are showing to the frontend login but not on admin login.  
Do I need to create a separate function for Backend? If yes, where should I put it?  
And what is about the policies. Do I also have to create some in aditional for Admin?  
Maybe someone knows

---

<div class="post-metadata">

**Author:** ![Rods](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@Rods](https://discourse.cakephp.org/u/Rods)\
**Post date:** [February 14, 2025, 2:09am UTC](https://discourse.cakephp.org/t/separate-admin-login/12423/2 "2025-02-14T02:09:40Z")

</div>

do you have login function in your admin prefix?

---

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 14, 2025, 7:05am UTC](https://discourse.cakephp.org/t/separate-admin-login/12423/3 "2025-02-14T07:05:46Z")

</div>

Yes I do have.

```auto
public function login()
{
	$this->Authorization->skipAuthorization();
	$this->request->allowMethod(['get', 'post']);
	$result = $this->Authentication->getResult();

	// regardless of POST or GET, redirect if user is logged in
	if ($result && $result->isValid()) {
		return $this->redirect(['action' => 'index']);
	} else {
		$this->Flash->error(__('Benutzername und Passwort sind nicht korrekt'));
	}
}

```

But problem was before. I guess I solved it.  
I am checking now in the getAuthenticationService function if there is an ‘admin’ prefix.  
If yes, I will change the URL to admin, if not, I will stay with URL /users/login.  
But now I get an error that there is no policy for UserTable.  
In Frontend I also have no policy for UsersTable and it works fine.  
Question is now, if I need to create some policies for the admin backend too?

---

<div class="post-metadata">

**Author:** ![Rods](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@Rods](https://discourse.cakephp.org/u/Rods)\
**Post date:** [February 14, 2025, 8:53am UTC](https://discourse.cakephp.org/t/separate-admin-login/12423/4 "2025-02-14T08:53:46Z")

</div>

looks like you just need to fix your route

```
$routes->prefix('admin', function (RouteBuilder $routes) {
    $routes->connect('/users/login', ['prefix' => 'Admin', 'controller' => 'Users', 'action' => 'login']);
    $routes->fallbacks(DashedRoute::class);
});

```

or may be you should make a middleware fot the routes

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [February 14, 2025, 2:50pm UTC](https://discourse.cakephp.org/t/separate-admin-login/12423/5 "2025-02-14T14:50:29Z")

</div>

Usually, people don’t have two separate logins for admin vs normal, they build a role-based thing where everyone logs in the same way, the user record indicates whether they’re an admin or not, and policies and the like give access based on that.

---

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 23, 2025, 6:43pm UTC](https://discourse.cakephp.org/t/separate-admin-login/12423/6 "2025-02-23T18:43:29Z")

</div>

Sorry for giving that late an answer.  
I had this idea to create a separate login for Admin from a tutorial.  
And I also know this from several CMS or Webshop frameworks.  
For example in Joomla you have to login in a separate area which is named /administrator.  
Why is it not comming in cakephp?

---

<div class="post-metadata">

**Author:** ![Rods](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@Rods](https://discourse.cakephp.org/u/Rods)\
**Post date:** [February 24, 2025, 12:16am UTC](https://discourse.cakephp.org/t/separate-admin-login/12423/7 "2025-02-24T00:16:53Z")

</div>

you need a prefix for that

---

<div class="post-metadata">

**Author:** ![efjot](https://avatars.discourse-cdn.com/v4/letter/e/b38774/32.png) [@efjot](https://discourse.cakephp.org/u/efjot)\
**Post date:** [February 25, 2025, 7:46pm UTC](https://discourse.cakephp.org/t/separate-admin-login/12423/8 "2025-02-25T19:46:29Z")

</div>

I fixed the route like you described in your comment.  
But the question is still to have a Table policy