Use built-in rbac or create your own?

Question

The following scenario:

I have a web application with multiple tenants in an advanced Yii2 template.

This application has three portals:
- backend
- dashboard
- interface

Each portal has its own user authentication table.
(-frontend_user,
-dashboard_user,
-backend_user)

The front panel and toolbar can be reached with the name of the tenant at the end, for example:

When a user tries to log into the control panel or interface, I have to check if they have the right to log in. This happens through a contingency table (ex: dashboard_user_tenant)

Now I want to create rbac for the toolbar application.

But the roles should not hang with the user of the toolbar, but on the dashboard_user_tenant (table of unforeseen circumstances), because the rights can change on each toolbar of the tenant.

Yii2 has its own rbac system, but as I understand it, it is not suitable for my needs.

Do you have a chance to configure Yii2 rbac or is it better to create your own solution? Maybe my own component?

I hope my description is clear enough :)

Answer 1

I had a similar desire in one of my projects, but I did not create my own complete RBAC system, instead I rewrote the role checking method

In my class of User components, I extend \ yii \ web \ User, and also overwrite the can () function of this class. This allows me to use my own way of checking the appropriate permissions. for instance

<?php namespace app\modules\users\models; use Yii; use yii\web\User as WebUser; use app\modules\users\models\UserPermissionManager; class User extends WebUser { public function can( $operation, $params = [], $allowCaching = true ) { if(Yii::$app->user->isGuest) { return false; } return ( new UserPermissionManager() )->has( $operation ); } } 

In the UserPermissionManager class, it queries a database table full of permissions such as "users: access", "users: edit", etc.

They all have a specific user level assigned to them, which refers to the user level that I set in my users database table.

All can () functions should do this, return true or false, depending on whether this user has permission to do what he sets. You can handle it as you like.

This is a pretty big system to fully explain in one post, but I hope this helps a bit, feel free to let me know if I can explain anything better!