I have been looking over the internet for an exposition of access control lists in Magento2 and will appreciate any insight on this.


Here are main points about Magento 2 authorization system:

  1. The same acl.xml is declaring resources used for backend actions protection and web API. It means, authorization system is now unified
  2. Resulting merged acl.xml is used to build 2 identical ACL trees for managing permissions in the admin panel. One is on the admin user role edit page, another is on web API integration edit page
  3. Permissions are checked in \Magento\Backend\App\AbstractAction::_isAllowed when accessing admin panel pages (this method is almost always overridden in child controllers to perform check against custom resource). During web API calls processing this check is done by framework based on resources node declared in webapi.xml
  4. See any core acl.xml to understand the syntax, e.g. customer module acl.xml. Also Magento 2 has XSDs available for all configs, so if configured properly, IDE should verify and suggest correct syntax on the fly
  5. To check if current user (admin or web API) has permission to access particular resource declared in acl.xml, just use \Magento\Framework\AuthorizationInterface::isAllowed($resource). User context is identified automatically in this case

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.