The Auth Component in CakePHP redirects the user to the log-in page when a user tries to access any protected pages in the application. The default log-in page is set by defining the loginAction variable in the beforeFilter function in your UsersController or AppController.

But if you have used plug-ins in your application, and if a user tries to access a controller action of a plug-in the user is redirected to an invalid page like this.

http://domain.com/plugin_name/users/login

This is because, CakePHP assumes the user controller to be a a part of the Plug-in.

Normally, your beforeFilter function could look like this.

function beforeFilter() {
	Security::setHash('md5');
	$this->Auth->loginAction = array('controller' => 'users', 'action' => 'login');
	$this->Auth->loginRedirect = array('controller' => 'home', 'action' => 'index');
	$this->Auth->loginError = 'Invalid Username or Password.';
	$this->Auth->authError = "You are not authorized to access.";
	$this->Auth->logoutRedirect = array('controller' => 'users', 'action' => 'login');
}

The redirection problem can be avoided by defining the loginAction in the above function like this:

$this->Auth->loginAction = array(‘controller’ => ‘users’, ‘action’ => ‘login’, ‘plugin’ => null);

This tells CakePHP that the user controller is a global controller.

The same problem occurs when you use $html->link or $html->url to generate links to global contoller actions from a plugin view. If you didn’t define the parameter ‘plugin’=>true in $html->link or $html->url, CakePHP will assume the controller to be a part of the current plugin and will try to access a controller within the plugin instead of redirecting the user to the global controller.