Symfony 2 Multiple providers not working in secuirty.yml - php

Question

I have multiple proivders users and admin so i have following security.yml
security:
encoders:
AppBundle\Entity\AdminUser: bcrypt
# https://symfony.com/doc/current/security.html#b-configuring-how-users-are-loaded
providers:
#in_memory:
# memory: ~
admin_db:
entity: { class: AppBundle\Entity\AdminUser, property: email }
firewalls:
# disables authentication for assets and the profiler, adapt it according to your needs
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
admin_db:
provider: admin_db
anonymous: false
form_login:
login_path: login
check_path: login
# activate different ways to authenticate
# https://symfony.com/doc/current/security.html#a-configuring-how-your-users-will-authenticate
#http_basic: ~
# https://symfony.com/doc/current/security/form_login_setup.html
#form_login: ~
access_control:
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: ROLE_ADMIN }
But when i try to access login page then i see this error
This page isn’t working localhost redirected you too many times. Try
clearing your cookies. ERR_TOO_MANY_REDIRECTS

Answer 1

The problem is that your firewall does not allow any anonymous access as specified with anonymous: false. That means your access control for login does not work. The 2 common ways to solve this are either taking the login rout out of the firewall or allowing anonymous access and then use access_controls to require a role.
If you want to move the login route out:
firewalls:
login:
pattern: ^/login$
security: false
admin_db:
...
form_login:
login_path: login
check_path: login_check
It's important that the route login_check points to something inside your firewall. So basically anything but /login will work, e.g. login/check. In your controller you can create an empty action for this or you can point it to the same action as login.
The other solution would be even simpler in your case, as your access_control is already correct:
firewalls:
admin_db:
...
anonymous: ~
In your access control you allow anonymous access for login, but all other routes must have ROLE_ADMIN. So no other changes should be necessary.