Access and login

Roles and permissions

Option	Default	Purpose
`$rbac`	`true`	roles and permissions in the database, with the role and user administration
`$shieldGroupFallback`	`true`	also grant the permissions of the Shield groups in `Config\AuthGroups`
`$policies`	`[]`	record policies for every gate (panels, API, CLI)
`$permissions`	`[]`	additional permissions for the role editor

public array $policies = [
    \App\Entities\Order::class => \App\Policies\OrderPolicy::class,
];

public array $permissions = [
    'Reports' => ['reports.view' => 'View reports', 'reports.export' => 'Export reports'],
];

Shield fallback: useful while bootstrapping – the first administrator gets permissions from Config\AuthGroups. Switch it off once roles are maintained in Anvil, so that permissions have one source.
Policies decide per record, see Authorization.
Permissions of resources, their actions, bulk actions, relation actions, pages, panels, workflows and documents are found automatically (php spark anvil:permissions lists them); $permissions adds others, grouped for the role editor.

Option	Default	Purpose
`$passwordLogin`	`true`	the login page offers email and password
`$mfaRequired`	`false`	password logins need a second factor (TOTP) in every panel
`$sso`	`[]`	single sign-on providers (OpenID Connect, SAML)
`$ssoAutoRedirect`	`''`	provider the login page goes to directly

public bool $mfaRequired = true;

public array $sso = [
    'adfs' => [
        'type'         => 'oidc',
        'label'        => 'ADFS',
        'issuer'       => 'https://adfs.example.com/adfs',
        'clientId'     => '0b5c…',
        'clientSecret' => '',                 // in .env: anvil.sso.adfs.clientSecret
        'scopes'       => ['openid', 'profile', 'email', 'allatclaims'],
        'groupsClaim'  => 'groups',
    ],
];

public string $ssoAutoRedirect = 'adfs';     // "login?local" still shows the page

Users without TOTP are sent to their profile to set it up when $mfaRequired applies. Single panels require it with Panel::requiresMfa().
Panels restrict login methods with Panel::authMethods(), e.g. single sign-on only for the back office.
Never write secrets into the class; set them in .env.

Details: Two-factor authentication, Single sign-on, Panels → Access and login.

Access and login

Roles and permissions

Login