Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
This is a question related to the process of adding multiple user roles.
My end-goal is to add multiple authentication roles/guards, such as a user and admin role.
Since I haven't done this before, I am thinking what the "best/practical" approach would be to add such functionality.
Should I begin by creating login-authentication for the user role incl. reset email, and then on top of that add multiple roles, such as admin, or is there another smart way?
I am trying to be smart here, I believe it is a good idea to ask those that know rather than jump into this blindly!
totally depends on the size of your web app. if its simple and small and you only need those two, use the laravel's built-in ACL, gates and policies (episodes 13-16) https://laracasts.com/series/whats-new-in-laravel-5-1
but if not you can use one of these two packages. both are great and well maintained.
https://github.com/spatie/laravel-permission
https://github.com/JosephSilber/bouncer
also checkout https://laravel-news.com/two-best-roles-permissions-packages
@BezhanSalleh, thanks! I am looking for something simple and straightforward.
Basic question: What does ACL stand for, and what does it basically do?
Just to give you an idea of what I type of application I am working on. The app will provide the user the ability to register data and when completed, send and wait for approval. The admin holds the information, and can accept or decline the retreived data.
This means I will have to control what the user/admin sees, we are talking about 5-6 different views with 4 (users) and 1 (admin).
Do you still believe that the built-in ACL will be appropriate for this type of example?
ACL stands for Access Control List.
seems pretty straight forward, you don't need to use the packages the built-in ACL is more than enough to handle this. just follow the episodes (13-to-16) in the what's new in laravel 5.1 series.
@aripal A simple approach would be to have a table called roles, and then add a role_id column to your users table. Then use this role in things like policies to determine if a user is able to perform actions in your application.
@BezhanSalleh, thanks for the resource, I'll take a look at it!
@martinbean, is there any resources out there that show this simple approach, or can you provide an example?
Thanks guys!
Please or to participate in this conversation.