Zend FR

[role]
guest = null
member = null
customer = null
admin = null

[resource]
; default
default_auth = null
default_error = null
default_index = null
default_user = null
default_test = null
; gp
gp_index = null
gp_error = null
gp_test = null
; backend
backend_error = null
backend_index = null
backend_user = null

[guest]
allow.default_auth = null
allow.default_error = null
allow.default_index = null
allow.default_user = null
deny.default_user = cancel,email,info,panel,pass,success,welcome

[member : guest]
allow.default_test = null
removeAllow.default_auth = login
removeDeny.default_auth = logout
removeDeny.default_user = cancel,email,info,panel,pass,success,welcome

[customer : member]
allow.gp_index = null
allow.gp_error = null
allow.gp_test = null

[admin : customer]
allow.backend_error = null
allow.backend_index = null

<?php
/**
 * Classe de création des ACL via un fichier de configuration INI
 * */
class Core_Acl extends Zend_Acl
{
    private $_aFilter = array();
    private $_aExclude = array();

    public function __construct()
    {
        $sFile = APPLICATION_PATH.'/configs/acl.ini';
        $oRole = new Zend_Config_Ini($sFile, 'role');
        $this->_setRole($oRole);

        $oResource = new Zend_Config_Ini($sFile, 'resource');
        $this->_setResource($oResource);

        foreach($oRole->toArray() as $sRole => $sParent) {
            $this->_setRight($sRole, new Zend_Config_Ini($sFile, $sRole));
        }
    }

    protected function _setRole($oRole)
    {
        foreach($oRole as $sRole => $sParent)
        {
            if(empty($sParent)) {
                $this->addRole(new Zend_Acl_Role($sRole));
            } else {
                $this->addRole(new Zend_Acl_Role($sRole), explode(',', $sParent));
            }
        }
        return $this;
    }

    protected function _setResource($oResource)
    {
        foreach($oResource as $sResource => $sParent)
        {
            if(empty($sParent)) {
                $this->add(new Zend_Acl_Resource($sResource));
            } else {
                $this->add(new Zend_Acl_Resource($sResource), explode(',', $sParent));
            }
            
        }
        return $this;
    }

    protected function _setRight($sRole, $oRight)
    {
        foreach($oRight as $mKey => $oResource)
        {
            foreach($oResource as $sResource => $sAction)
            {
                if(empty($sAction)) {
                    $this->{$mKey}($sRole, $sResource);
                } else {
                    $this->{$mKey}($sRole, $sResource, explode(',', $sAction));
                }
            }
        }
        return $this;
    }

}

<?php
class Core_Plugin_Auth extends Zend_Controller_Plugin_Abstract
{
    /**
     * @var Zend_Auth instance
     */
    private $_oAuth;

    /**
     * @var Zend_Acl instance
     */
    private $_oAcl;

    /**
     * Chemin de redirection lors de l'échec d'authentification
     */
    const FAIL_AUTH_MODULE     = 'default';
    const FAIL_AUTH_CONTROLLER = 'user';
    const FAIL_AUTH_ACTION     = 'deny';

    /**
     * Chemin de redirection lors de l'échec de contrôle de droits
     */
    const FAIL_ACL_MODULE     = 'default';
    const FAIL_ACL_CONTROLLER = 'user';
    const FAIL_ACL_ACTION     = 'right';

    /**
     * Constructeur
     */
    public function __construct(Zend_Acl $oAcl)
    {
        $this->_oAcl  = $oAcl;
        $this->_oAuth = Zend_Auth::getInstance();
    }

    /**
     * Vérifie les autorisations
     */
    public function preDispatch(Zend_Controller_Request_Abstract $oRequest)
    {
        if($this->_oAuth->hasIdentity()) {
            $sRole = $this->_oAuth->getIdentity()->sRole;
        } else {
            $sRole = 'guest';
        }
        $sResource = $oRequest->getModuleName().'_'.$oRequest->getControllerName();
        if(!$this->_oAcl->has($sResource)) {
            $sResource = null;
        }

        if(!$this->_oAcl->isAllowed($sRole, $sResource, $oRequest->getActionName())) {
            if(!$this->_oAuth->hasIdentity()) {
                $oRequest->setModuleName(self::FAIL_AUTH_MODULE);
                $oRequest->setControllerName(self::FAIL_AUTH_CONTROLLER);
                $oRequest->setActionName(self::FAIL_AUTH_ACTION);
            } else {
                $oRequest->setModuleName(self::FAIL_ACL_MODULE);
                $oRequest->setControllerName(self::FAIL_ACL_CONTROLLER);
                $oRequest->setActionName(self::FAIL_ACL_ACTION);
            }
        }
    }

}