O Guia Definitivo do Yii 1.1

When authorization fails, i.e., the user is not allowed to perform the specified action, one of
the following two scenarios may happen:
If the user is not logged in and if the loginUrl property of the user component is configured
to be the URL of the login page, the browser will be redirected to that page. Note that by
default, loginUrl points to thesite/login page.
Otherwise an HTTP exception will be displayed with error code 403.
When configuring the loginUrl property, one can provide a relative or absolute URL. One
can also provide an array which will be used to generate a URL by calling
CWebApplication::createUrl. The first array element should specify the route to the login
controller action, and the rest name-value pairs are GET parameters. For example,
array(
......
'components'=>array(
'user'=>array(
// this is actually the default value
'loginUrl'=>array('site/login'),
),
),
)
If the browser is redirected to the login page and the login is successful, we may want to
redirect the browser back to the page that caused the authorization failure. How do we
know the URL for that page? We can get this information from the returnUrl property of the
user component. We can thus do the following to perform the redirection:
Yii::app()->request->redirect(Yii::app()->user->returnUrl);
Role-Based Access Control
Role-Based Access Control (RBAC) provides a simple yet powerful centralized access
control. Please refer to the Wiki article for more details about comparing RBAC with other
more traditional access control schemes.
Yii implements a hierarchical RBAC scheme via its authManager application component.
In the following ,we first introduce the main concepts used in this scheme; we then
describe how to define authorization data; at the end we show how to make use of the
authorization data to perform access checking.
Overview
A fundamental concept in Yii's RBAC is authorization item. An authorization item is a
permission to do something (e.g. creating new blog posts, managing users). According to
its granularity and targeted audience, authorization items can be classified as operations,
tasks and roles. A role consists of tasks, a task consists of operations, and an operation is