CakePHP中的自定义用户注册/登录和角色/权限？

Question

In my application, there are certain modifications needed. I am trying to list them below :

1. User Registration: Email should be verified.
2. User Registration : Users are given choice to register as different roles.
3. User Login : Access Control on various controllers/actions and views based on logged-in user.

I have found there is a plugin for email verification and then there is Acl for user access control. But I am new to Cake and certainly I am comfortable with native sessions and cookies and tokens (for email verification). So,what is more preferable, if I skip Auth module in favor of $this->Session and write a tokenization script? What are advantages of using Auth besides security ?

Edit (one more question) : In cakePHP if we use allow method :

if($this->Auth->user('roles') == 'usertype1') {
            $this->Auth->allow('index', 'add', 'edit', 'delete');
        }

I can handle the access to controller methods. But how should I add "pending" column in users table so that I can verify it with Auth that whether user is pending or active? If this is done, I shall only be needed to write verification email part. Or is it advisable to go for checking sessions only *with a session variable "isactive" and perform checks on methods as asked in original question above ?

Answer 1

You can easily achieve the desired functionality using Admin routing ( routing prefix) or ACL. You have to write email verification part with th ehelp of email helper. For you second question: You can have a field in your database showing user is active or not. Let us say it's 'active' of boolean type. This value will setto TRUE is user verified his email. To allow only Active user to login, you can

$this->Auth->authenticate = array(
            AuthComponent::ALL => array(
                'userModel' => 'User',
                'fields' => array(
                    'username' => 'username',
                    'password' => 'password'
                ),
                'scope' => array(
                    'User.active' => 1,
                )
            ), 'Form'
        );

In this way only active can login.