I was tasked with extending Magento ACL functionality and allowing one user to hold more than one role.

I have been jumping from blog to blog and file to file for the last week - all I can find says only about isAllowed() method - this is nothing to do with what I'm looking for.

Why? If I log all calls to isAllowed() I get different results for admin and user - system already knows for which resources isAllowed() must be called.

I'm trying to create additional tables that holds user_id and role_id ACL would be combine for all your roles.

I'm looking for a place in code when ACL matrix is contracted: I narrowed my suspects to:


loadRules() ( $acl->allow() and $acl->deny() )

but I couldn't find any user-specific queries or methods How system know you can access resources or not? Am I looking in the right place?

Also: checking files I found this comment:

//@FIXME: stupid fix of previous multi-roles logic.

in /app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php saveAction() aprx. Line 142

Looks like that functionality was available in previous versions - is there any existing code I could use?

Thank you in advance for any info that can help me to move that forward.

Best Regards,

  • It'll probably be quicker just to create the roles are the supersets of the roles you want to combine. Looking at that FIXME is a dead end, it's over 5 years old github.com/OpenMage/magento-mirror/blob/…
    – Richard
    Commented Oct 28, 2014 at 15:32

1 Answer 1


I have made a breakthrough today.

In fact isAllowed() is the only method to override. The reason why I was getting different numbers of calls for admin and user was because first time function isAllowed() is called is to find first available url - you can access in app/code/core/Mage/Adminhtml/controllers/IndexController.php setIsFirstPageAfterLogin()

In fact if you override isAllowed() like this:

public function isAllowed() {
    return true;

You will get access to all resources.

Thank you for your comment Richard!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.