Yii - Error 403 You are not authorized to perform this action

Question

I'm using Yii PHP framework for my web project. My question is how to settle this problem. I got error 403 when visit department page.

My LoginForm.php

public function authenticate($attribute,$params)
    {
        if(!$this->hasErrors())  // we only want to authenticate when no input errors
        {
            $identity=new UserIdentity($this->email,$this->password);
            $identity->authenticate();
            switch($identity->errorCode)
            {
                case UserIdentity::ERROR_NONE:
                    Yii::app()->user->login($identity);
                    break;
                case UserIdentity::ERROR_USERNAME_INVALID:
                    $this->addError('email','Email address is incorrect.');
                    break;
                default: // UserIdentity::ERROR_PASSWORD_INVALID
                    $this->addError('password','Password is incorrect.');
                    break;
            }
        }
    }

UserIdentity.php

<?php

/**
 * UserIdentity represents the data needed to identity a user.
 * It contains the authentication method that checks if the provided
 * data can identity the user.
 */
class UserIdentity extends CUserIdentity
{

     // Need to store the user's ID:
     private $_merchantId;


    /**
     * Authenticates a user.
     * The example implementation makes sure if the username and password
     * are both 'demo'.
     * In practical applications, this should be changed to authenticate
     * against some persistent user identity storage (e.g. database).
     * @return boolean whether authentication succeeds.
     */
    public function authenticate()
    {
        $merchant= Merchant::model()->findByAttributes(array('email'=>$this->username));

        if ($merchant===null) { // No user found!
            $this->errorCode=self::ERROR_USERNAME_INVALID;
        } else if ($merchant->password!== SHA1($this->password) ) { // Invalid password!
            $this->errorCode=self::ERROR_PASSWORD_INVALID;
        } else { // Okay!
            $this->errorCode=self::ERROR_NONE;
            // Store the role in a session:
            $this->setState('role', $merchant->role);
            $this->_merchantId= $merchant->merchantId;
        }
        return!$this->errorCode;
    }

    public function getId()
    {
     return $this->_merchantId;
    }


}

Department.php

public function accessRules()
    {
        return array(
            array('allow',  // allow all users to perform 'index' and 'view' actions
                'actions'=>array('index','view'),
                'users'=>array('*'),
            ),
            array('allow', // allow authenticated user to perform 'create' and 'update' actions
                'actions'=>array('create','update'),
                'users'=>array('@'),
            ),
            array('allow', // allow admin user to perform 'admin' and 'delete' actions
                'actions'=>array('admin','delete'),
                'users'=>array('admin'),
            ),
            array('deny',  // deny all users
                'users'=>array('*'),
            ),
        );
    }

Why?

Answer 1

In your department.php accessRules() change the 'users'=>array('admin') to 'users'=>array('@') in the following line as can be seen below:

array('allow', // allow admin user to perform 'admin' and 'delete' actions
    'actions'=>array('admin','delete'),
    'users'=>array('@'),
),

This should fix the unauthorized error.

Answer 2

As access rule has defined on Admin user can access this. So need to check as @kumar_v said