====== Authorization ======

VuFind has included standard authentication function for a long time, but more detailed authorization logic was introduced in release 2.4.

===== Components =====

VuFind's authorization is built using the [[https://github.com/ZF-Commons/zfc-rbac|ZfcRbac]] component.

===== Configuration =====

Documentation on how to define roles (or configure existing ones) can be found in [[https://github.com/vufind-org/vufind/blob/dev/config/vufind/permissions.ini|permissions.ini]].

===== Usage =====

The authorization service can be injected into an object by implementing ZfcRbac\Service\AuthorizationServiceAwareInterface.

The authorization service provides a simple isGranted() method to check if a particular permission is granted.

VuFind's standard controllers implement an accessPermission property that, if set, can specify the name of a permission that must be granted in order to allow access to the controller. If the permission is missing, the user will be redirected to the login screen (or, if already logged in, will be presented with an error screen).

===== Extension =====

New types of checks can be implemented for use in [[https://github.com/vufind-org/vufind/blob/dev/config/vufind/permissions.ini|permissions.ini]] by building [[development:plugins:permission_providers|permission providers]].