我该如何拒绝具有角色成员的用户访问yii2中的后端？

Question

I want to restrict the users of role member from accessing the backend. I am using the default RBAC of yii2 advanced for authorization, but I can't add any roles in access rules for rules:

rules => [
    [                       
        'actions' => ['login', 'error'],
        'allow' => TRUE,                                              
    ]

in siteController of the backend. If there is any way to do this, I will be thankful.

Answer 1

If you want only deny access to member and allow to your_role you can

public function behaviors()
{
    return [
        'access' => [
            'class' => AccessControl::className(),
            'rules' => [
                [
                   'allow' => false,
                   'roles' => ['member']
                ],
                [

                    'allow' => true,
                    'roles' => ['your_role'],
                ],
            ],
        ],
        'verbs' => [
            'class' => VerbFilter::className(),
            'actions' => [
                'logout' => ['post'],
            ],
        ],
    ];
}

Answer 2

It's no need to code every backend controllers behaviors. You can add same code to end of $config['components'] array backend/config/main.php:

'as beforeRequest' => [
    'class' => \yii\filters\AccessControl::className(),
    'rules' => [
        [                       
            'actions' => ['login', 'error'],
            'allow' => true,                                              
        ],
        [
            'allow' => false,
            'roles' => ['member'],
        ],
    ],
    'denyCallback' => function () {
        return Yii::$app->response->redirect(['frontend']);
    },
],

Answer 3

Try this ,

public function behaviors()
{
    return [
        'verbs' => [
            'class' => VerbFilter::className(),
            'actions' => [
                'delete' => ['post'],
            ],
        ],
        'access' => [
            'class' => AccessControl::className(),
            // We will override the default rule config with the new  AccessRule class
            'ruleConfig' => [
                'class' => AccessRule::className(),
            ],
            'only' => ['index','create', 'update', 'delete'],
            'rules' => [
                [
                    'actions' => ['index','create'],
                    'allow' => true,
                    // Allow users, moderators and admins to create
                    'roles' => [
                        User::ROLE_USER,
                        User::ROLE_MODERATOR,
                        User::ROLE_ADMIN
                    ],
                ],
                [
                    'actions' => ['update'],
                    'allow' => true,
                    // Allow moderators and admins to update
                    'roles' => [
                        User::ROLE_MODERATOR,
                        User::ROLE_ADMIN
                    ],
                ],
                [
                    'actions' => ['delete'],
                    'allow' => true,
                    // Allow admins to delete
                    'roles' => [
                        User::ROLE_ADMIN
                    ],
                ],
            ],
        ],
    ];
}