Zend AMF Authentication & Authorization

Question

How do I secure my PHP services created with 'Connect To PHP' wizard?
The web is full of tutorials on connecting to PHP but I found nothing on securing the services.
The 'Connect to PHP' wizard generates a gateway.php which doesn't do authorization.
Do I have to replace this endpoint with my own? Why doesn't Adobe have tutorials on this?
maybe PHP apps are not meant to be safe?

Answer 1

I've been struggling with it, and figured it all out - so, perhaps it could help others.
The authentication is called on the server only if credentials supplied from the client (via the remote procedure call headers). This snippet illustrates the setup of custom auth (these are the last 6 lines of gateway.php script):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
// Handle request
$auth = new My_Amf_Auth(); // authentication
$server->setAuth($auth);
$acl = new Zend_Acl(); // authorization
$server->setAcl($acl);
echo $server->handle();
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Now, your custom auth should extend Zend_Amf_Auth_Abstract. Since I want to authenticate users from a database, I bring the Zend_Auth_Adapter_DbTable to play. But since I cannot extend both Zend_Amf_Auth_Abstract and Zend_Auth_Adapter_DbTable, I use a composition:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<?php
require_once ('Zend/Amf/Auth/Abstract.php');
* AMF auth class by Danko Kozar, dankokozar.com
* @author dkozar
class My_Amf_Auth extends Zend_Amf_Auth_Abstract {
    function __construct() {
    public function authenticate() {
        $adapter = My_Db_Adapter::getInstance();            
        $adapter->setIdentity($this->_username);
        $adapter->setCredential($this->_password);
        // the adapter call
        // you can wrap it into try.. catch and process DB connection errors
        $result = Zend_Auth::getInstance()->authenticate($adapter);
        return $result;
?>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Here's the adapter class:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<?php
* DB table adapter auth class for AMF by Danko Kozar, dankokozar.com
* @author dkozar
* Singleton
class My_Db_Adapter extends Zend_Auth_Adapter_DbTable {
    protected static $_instance = null;
     * private!
     * @param My_Db_Adapter $adapter
    public function __construct(Zend_Db_Adapter_Abstract $adapter = null) {
        if (!$adapter)
            $adapter = new Zend_Db_Adapter_Mysqli(
                array(
                    'dbname' => 'test',
                    'username' => 'root',
                    'password' => '')
        parent::__construct($adapter);
        $this
            ->setTableName('users')
            ->setIdentityColumn('username')
            ->setCredentialColumn('password')
        // just for testing
//        $this
//            ->setIdentity('username')
//            ->setCredential('password')
     * @return  My_Db_Adapter
    public static function getInstance()
        if (null === self::$_instance) {
            self::$_instance = new self();
        return self::$_instance;
    public function authenticate() {
        $_authResult = parent::authenticate();
        // NOTE: The point is that $result->_identity is an OBJECT (of type stdClass), NOT string
        // with Zend_Auth_Adapter_DbTable it is internally accomplished by calling its getResultRowObject() method
        // It constructs the stdClass with properties named after table attributes
//        $user = new stdClass();
//        $user->role = "administrator";
//        $user->username = $_authResult->getIdentity();
        $identity = $this->getResultRowObject();
        $result = new Zend_Auth_Result($_authResult->getCode(), $identity);
        return $result;
?>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On the Flex side I have an auto-generated class (MyService) which extends another auto-generated class (_Super_MyService).
The point is that the outer one is auto-generated only once (initially), and you can modify it, without worrying to be overwritten on service regeneration.
There's a protected property _serviceControl (which is of type RemoteObject) which could be tweaked if needed.
I'm tweaking it by of setting the endpoint (with string read from a client side config in preInitializeService() method). Plus, I'm adding 2 more methods, which expose setCredentials and setRemoteCredentials methods of _serviceControl, so I can acces it from my code.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
package services.myservice
    public class MyService extends _Super_MyService
         * Override super.init() to provide any initialization customization if needed.
        protected override function preInitializeService():void
            super.preInitializeService();
            // Initialization customization goes here
            _serviceControl.endpoint = "http://localhost/myapp/gateway.php";
        public function setCredentials(username:String, password:String, charset:String=null):void
            _serviceControl.setCredentials(username, password, charset);
        public function setRemoteCredentials(username:String, password:String, charset:String=null):void
            _serviceControl.setRemoteCredentials(username, password, charset);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
So, before calling MyService methods, I'm setting the credentials with setCredentials() method and this runs the authentication on the PHP side:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
private var service:MyService;
service = new MyService(); // ServiceLocator.getInstance().getHTTPService("presetLoader");
service.setCredentials("user1", "pass1");
var token:AsyncToken = service.getData();
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
The authentication via Zend_Amf_Server is, by the way, OPTIONAL! Meaning, with no credentials supplied, Zend_Amf_Server will NOT RUN IT. Thus you should rely on Zend_Acl (e.g. roles) to so your permissions and security! 
Finally, here's the MySQL DB table I've been using for authentication: 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
-- Table structure for table `users`
CREATE TABLE IF NOT EXISTS `users` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `username` varchar(50) NOT NULL,
  `password` varchar(32) DEFAULT NULL,
  `role` varchar(45) DEFAULT NULL,
  `firstname` varchar(50) DEFAULT NULL,
  `lastname` varchar(50) DEFAULT NULL,
  `email` varchar(255) DEFAULT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `username` (`username`),
  UNIQUE KEY `id_UNIQUE` (`id`)
) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ; 
-- Dumping data for table `users`
INSERT INTO `users` (`id`, `username`, `password`, `role`, `firstname`, `lastname`, `email`) VALUES
(1, 'user1', 'pass1', 'administrator', 'Danko', 'Kozar', NULL); 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Cheers!
Danko