Yii Framework: Custom authentication

login.php

<div class="form">
    <?php echo CHtml::form(); ?> 
    <?php echo CHtml::errorSummary($model); ?>
    
    <div class="row">
        <?php echo CHtml::activeLabel($model, 'login'); ?> 
        <?php echo CHtml::activeTextField($model, 'login', array('maxlength' => 64)); ?> 
    </div><!-- /.row -->
    
    <div class="row">
        <?php echo CHtml::activeLabel($model, 'password', array('maxlength' => 64)); ?> 
        <?php echo CHtml::activePasswordField($model, 'password'); ?> 
    </div><!-- /.row -->
    
    <div class="row buttons">
        <?php echo CHtml::submitButton('ログイン'); ?>
    </div><!-- /.row buttons -->

    <?php echo CHtml::endForm(); ?>
</div><!-- /.form -->

LoginForm.php

<?php
class LoginForm extends CFormModel
{
    private $loginLabel;
    
    public $login;
    public $password;
    public $rememberMe;
    
    /**
     * @see CFormModel::init()
     */
    public function init()
    {
        if (Yii::app()->params['login'] === null) {
            $this->loginLabel = 'ユーザ名、またはメールアドレス';

        } else if (Yii::app()->params['login'] === 'username') {
            $this->loginLabel = 'ユーザ名';

        } else {
            $this->loginLabel = 'メールアドレス';
        }

        return parent::init();
    }
    
    public function attributeLabels()
    {
        return array(
            'login' => $this->loginLabel,
            'password' => 'パスワード',
            'rememberMe' => '次回から自動的にログイン',
        );
    }
    
    public function rules()
    {
        return array(
            array('login, password', 'loginValidator'),
            array('rememberMe', 'boolean'),
        );
    }

    /**
     * 認証処理
     */
    public function loginValidator($attribute, $params)
    {
        if (!$this->hasErrors()) {
            $identity = new UserIdentity($this->login, $this->password);
            $identity->authenticate();
            
            if ($identity->errorCode === UserIdentity::ERROR_NONE) {
                $duration = $this->rememberMe ? 3600*24*30 : 0; // 30 days
                Yii::app()->user->login($identity, $duration);
            } else {
                $this->addError(null, 'ログイン情報が正しくありません');
            }
        }
    }
}

main.php

<?php
return array(
    ...
    'params' => array(
        'salt' => 'sdc085cn0io8halk2jflv243hv895nc', // 憶測できないランダム文字列
        'login' => 'username', // ユーザ名、パスワードでログイン
        // or 'login' => 'email', // メールアドレス、パスワードでログイン
        // or 何も指定しない場合、ユーザ名またはメールアドレス、パスワードでログイン
    ),
);

SiteController.php

<?php
class SiteController extends Controller
{
    ...
    public function actionLogin()
    {
        $model = new LoginForm;
        if (isset($_POST['LoginForm'])) {
            $model->attributes = $_POST['LoginForm'];

            if($model->validate()) {
                $this->redirect(Yii::app()->user->returnUrl);
            }
        }
        $this->render('login', compact('model'));
    }
    ...

User.php

<?php
class User extends CActiveRecord
{
    ...
    public function hashPassword($password)
    {
        return sha1(Yii::app()->params['salt'] . $password);
    }
}

UserIdentity.php

<?php
class UserIdentity extends CUserIdentity
{
    private $id;

    public function authenticate()
    {
        if (Yii::app()->params['login'] !== null) {
            $attr = array(Yii::app()->params['login'] => $this->username);

        } else if (strpos($this->username, '@')) {
            $attr = array('email' => $this->username);

        } else {
            $attr = array('username' => $this->username);
        }
        
        $model = User::model()->findByAttributes($attr);
        
        if ($model === null) {
            $this->errorCode = self::ERROR_USERNAME_INVALID;

        } else if ($model->password !== $model->hashPassword($this->password)) {
            $this->errorCode = self::ERROR_PASSWORD_INVALID;

        } else {
            $this->id = $model->id;
            $this->username = $model->username;
            $this->errorCode = self::ERROR_NONE;
        }
        return !$this->errorCode;
    }

    public function getId()
    {
        return $this->id;
    }
}