NOTE: following is valid for BjyAuthorize 1.2.*
First of all, consider that protecting both the routes and the controllers is unnecessary. I personally always protect the controllers only, since there may be multiple routes to a same controller.
Once you removed either the route or the controller guard's config, you can:
Install Zend Developer Tools, which allows you to have an overview of the currently set Acl role, like in this picture:
Check if you have configured the correct identity provider: the default one uses ZfcUser's user id and looks up his role in the
user_role
table.- Check that the
guest
role has access to the public pages, such as thezfcuser
controller (for login actions) or thezfcuser/login
route.
As Akrabat pointed out, the configuration for the BjyAuthorize\Guard\Controller
and BjyAuthorize\Guard\Route
are whitelists, which basically means that you have to setup access for the default guest
role if you want to browse pages being un-authenticated.
As soon as a guard is configured, it blocks access to any not configured resource, so be sure that you have granted the role guest
(or whatever you configured in $config['bjyauthorize']['default_role']
access at least the login controller or route.