CakePhp 3.3 - How to allow access Different user roles to different methods in controller?
<p>I'm trying to allow different Controller methods to different user roles, tutorials on the official Dev site expect that user roles are two, but i would like to work with more roles, i did some digging about this, but without the luck. </p>

<p>I tried to following:</p>

<p><strong>AppController</strong></p>

<pre><code>class AppController extends Controller
{

    /**
     * Initialization hook method.
     *
     * Use this method to add common initialization code like loading components.
     *
     * e.g. `$this-&gt;loadComponent('Security');`
     *
     * @return void
     */
    public function initialize()
    {
        parent::initialize();

        $this-&gt;loadComponent('RequestHandler');
        $this-&gt;loadComponent('Flash');
        $this-&gt;loadComponent('Auth', [
            'authorize' =&gt; 'Controller',
            'authenticate' =&gt; [
                'Form' =&gt; [
                    'fields' =&gt; [
                        'username' =&gt; 'email',
                        'password' =&gt; 'password'
                    ]
                ]
            ],
            /*'loginRedirect' =&gt; [
                'controller' =&gt; 'Dashboards',
                'action' =&gt; 'index'
            ],*/
            'logoutRedirect' =&gt; [
                'controller' =&gt; 'Pages',
                'action' =&gt; 'logout'
            ],
            'loginAction' =&gt; [
                'controller' =&gt; 'Users',
                'action' =&gt; 'login'
            ],
            //'unauthorizedRedirect' =&gt; $this-&gt;referer()
        ]);

        // Allow the display action so our pages controller
        // continues to work.
        $this-&gt;Auth-&gt;allow(['login','register']);
    }

    public function isAuthorized($user)
    {
        return true;
    }
</code></pre>

<p><strong>UsersController</strong></p>

<pre><code>class UsersController extends AppController
{
    /**
     * Init method
     *
     * @return \Cake\Network\Response|null
     */
    public function initialize()
    {
        parent::initialize();
        //pr("initialize");
    }

    public function isAuthorized($user)
    {
        if (isset($user['role']) &amp;&amp; $user['role'] === 'ADMIN' ||
            isset($user['role']) &amp;&amp; $user['role'] === 'MANAGER' ) {
            $this-&gt;Auth-&gt;allow(['logout', 'index','delete']);
            //return;
        }
        if (isset($user['role']) &amp;&amp; $user['role'] === 'PARTNER') {
            $this-&gt;Auth-&gt;allow(['index']);
            //return;
        }
        if (!isset($user['role'])) {
            $this-&gt;Auth-&gt;allow(['register','index']);
        //return;
        }
        return parent::isAuthorized($user);
    }
</code></pre>

<p>User which have role allowed to called method is able to call method, others are redirected to not allowed method page. After logout is user redirected globally to login page.</p>

<p>I tried a few combinations based on the following tutorials:</p>

<p><a href="http://book.cakephp.org/3.0/en/tutorials-and-examples/blog-auth-example/auth.html" rel="nofollow">http://book.cakephp.org/3.0/en/tutorials-and-examples/blog-auth-example/auth.html</a></p>

<p>But without the luck</p>

<p>How can i do it in the right way please? </p>

<p>Many thanks for any advice.</p>