Symfony access control forbids user with correct role

0
votes

security.yml:

role_hierarchy:
    admin: [test, simple]

providers:
    database:
        entity: { class: UserBundle:User, property: username }

firewalls:
    dev:
        pattern: ^/(_(profiler|wdt|error)|css|images|js)/
        security: false

    prod:
        pattern: ^/
        provider: database
        anonymous: true
        form_login:
            login_path: public_login
            check_path: public_login_check
            default_target_path: dashboard
            always_use_default_target_path: true
            csrf_provider: form.csrf_provider
        logout:
            path: logout
            target: public_login

access_control:
    - { path: ^/(.+), roles: admin }
    - { path: ^/$, roles: IS_AUTHENTICATED_ANONYMOUSLY }

When i login, I get 403 forbidden exception. Then i check profiler/security, and roles looks like that:

Roles   [ROLE_USER, admin]

When i switch access control to:

- { path: ^/(.+), roles: ROLE_USER }

It works fine.

Why the hell my access control doesn't allow me to access pages with "admin" role, but does with "ROLE_USER" ?

My goal is to drop built-in roles (like ROLE_USER, ROLE_ADMIN etc), because I'm writing application for existing database, which contains already defined roles for users, so i want to use them.

2
securitysymfonyaccess-control
I believe that the Symfony security component expects role names to follow the ROLE_* format. I don't know of any exposed way to change this, you'll probably need to dig into the source and see if it's something that you could extend / override in your own class. - AlpineCoder

2 Answers

3
votes

I have confirmed that 'ROLE_' prefix is required - its because symfony by default use its own RoleVoter implementation.

To get rid of this prefix, custom RoleVoter is needed. To do that you need to create custom class implementing RoleVoterInterface, make it service and tag it with 'security.voter', to enforce security layer to use it instead of default one.

Read more about implementing own RoleVoters on this example.

2
votes

You are not using the right syntax for roles in the Security configuration you should change

- { path: ^/(.+), roles: admin }

To:

 - { path: ^/(.+), roles: ROLE_ADMIN }