Zend Mvc Plugin Identity Laravel Package

Getting Started

The zend-mvc-plugin-identity package is a single-class controller plugin that exposes the currently authenticated identity from a Zend\Authentication\AuthenticationService. It is the Zend Framework analogue of Laravel's auth()->user() / Auth::user(); if you are a Laravel developer dropped into a legacy Zend MVC app, this is the hook you reach for first.

Minimal steps:

1. Install it: composer require zendframework/zend-mvc-plugin-identity (or migrate to laminas/laminas-mvc-plugin-identity, which is the maintained successor).
2. Look first at Zend\Mvc\Plugin\Identity\Identity — its only job is to wrap an AuthenticationService and return getIdentity(). There is no magic; the constructor takes the auth service.
3. Register the plugin with the controller plugin manager, aliased as identity, in module.config.php:

return [
    'controller_plugins' => [
        'factories' => [
            'identity' => function ($container) {
                return new \Zend\Mvc\Plugin\Identity\Identity(
                    $container->get(\Zend\Authentication\AuthenticationService::class)
                );
            },
        ],
    ],
];

First use case: gating a controller action behind authentication.

public function profileAction()
{
    $user = $this->identity();

    if (!$user) {
        return $this->redirect()->toRoute('login');
    }

    return ['user' => $user];
}

Implementation Patterns

Guard clauses in controller actions. The canonical pattern is $this->identity() at the top of an action and an early redirect when it is falsy. This mirrors Laravel's auth middleware but is manual, so build a small base controller or an AbstractActionController subclass that does the check.

Passing identity to views. The plugin is controller-scoped only; it is not a view helper. Assign it explicitly:

return ['user' => $this->identity()];

If templates need it everywhere, add a view helper that lazily reads from the same AuthenticationService.

Auth-service configuration. The plugin is only as good as the AuthenticationService you inject. Wire it with a session storage (Zend\Authentication\Storage\Session) and your adapter (e.g. Zend\Authentication\Adapter\DbTable\CredentialTreatmentAdapter). The plugin does no validation itself; it is a read-only accessor.

Type handling. getIdentity() returns whatever your storage/adapter stored — an object (e.g. a User entity like Zend\Db\ResultSet\ResultSet produces), an array, or a scalar. Normalise early in the controller so downstream code is not littered with is_object checks.

Cross-module aliasing. Because the alias is the string identity, you can swap in a subclass via the controller_plugins factory without touching call sites. This is the cleanest extension seam.

Event listeners / middleware. The plugin is not usable outside controller context. For global checks (e.g. a dispatch listener or RouteMatch-aware middleware), inject the AuthenticationService directly instead.

Gotchas and Tips

• Null identity is the default. Unauthenticated requests return null without an exception. Always check truthiness before calling methods on the result; a missing guard produces a "call to a member function on null" rather than an auth error.
• Plugin not found means config not merged. If $this->identity() throws a "plugin … was unable to be found" exception, the controller_plugins key was not loaded — usually a module config ordering or a missing config merge. Dump $controllerPlugins->getRegisteredPluginNames() to confirm the alias exists.
• Session/storage mismatch. A logged-in user can still read as null if the plugin's AuthenticationService uses a different storage than the one written at login, or if the session was not started. Keep a single shared service instance in the container.
• getIdentity() is not cached. Each call delegates to the auth service/storage. In hot actions, read it once into a local variable rather than calling $this->identity() repeatedly.
• Package lineage matters. Zend Framework is retired; zendframework/* packages received only maintenance patches (this 1.1.1 release just adds PHP 7.3 support). For new work, prefer laminas/laminas-mvc-plugin-identity. In a Laravel codebase, use the native Auth facade/guard instead — this plugin has no Laravel integration.
• Extension point. Subclass Identity and override getIdentity() if you want to cache the identity per request or coerce it to a DTO; register the subclass in the controller_plugins factory.
• Debugging tip. When authentication "works" but identity is empty, log get_class($authService->getStorage()) and the adapter's getResult() — the plugin will faithfully return whatever the service reports, so the fault is upstream in the adapter/storage, not the plugin.