When I did this, Auth was doing weird things – like writing the out the value of the *hashed* password back to the password field, and saying I was never authorised (whether the login was valid or not.)

Auth->loginAction = array(‘controller’ => ‘users’, ‘action’ => ‘login’);
$this->Auth->loginRedirect = array(‘controller’ => ’sermons’, ‘action’ => ‘index’);
$this->Auth->logoutRedirect = ‘/’;
$this->Auth->loginError = ‘Invalid username / password combination. Please try again’;
}

function index() {
$this->set(’sermons’, $this->Sermon->find(‘all’));
}
}
?>
==========================================
and here is the users controller: users_controller.php:

Auth->user()) {
if (!empty($this->data)) {
if (empty($this->data['User']['remember_me'])) {
$this->Cookie->del(‘User’);
}
else {
$cookie = array();
$cookie['email'] = $this->data['User']['email'];
$cookie['token'] = $this->data['User']['pasword'];
$this->Cookie->write(‘User’, $cookie, true, ‘+2 weeks’);
}
unset($this->data['User']['remember_me']);
}
$this->Auth->authorize = ‘controller’;

$this->redirect($this->Auth->redirect());
}
}

function isAuthorized() {
if (isset($this->params[Configure::read('Routing.admin')])) {
if ($this->Auth->user(‘admin’) == 0) {
return false;
}
}
return true;
}

function logout() {
$this->Session->setFlash(“You’ve successfully logged out.”);
$this->redirect($this->Auth->logout());
}
}
?>
==============================
sorry for my bad english

No, you can put all that stuff in beforeFilter() of your app_controller, and then in your controllers that inherit from it you can do this

function beforeFilter() {
parent::beforeFilter()
}

You will have to have a beforeFilter() method in *every* controller though

The code in my login() method is to handle the use of a cookie for “remember me” functionality, that’s all. Having a completely empty login() method works just fine.