I'm trying to install an old legacy system from a company I'm freelancing for, but I keep getting
InvalidConfigurationException in ArrayNode.php line 309: Unrecognized
option "oauth" under "security.firewalls.primary"
This code supposedly runs without errors elsewhere is there anything I'm missing? Here's my security.yml where there error is probably in:
imports:
- { resource: ../../../_common/config/security.yml }
security:
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|bundles|assets)/
security: false
login:
context: primary
pattern: ^/account/login/$
anonymous: true
anonymous:
context: primary
pattern: ^/account/(register|login/reset-password).*
anonymous: true
primary:
pattern: ^/
form_login:
check_path: UserBundle:Front:loginCheck
login_path: UserBundle:Front:login
remember_me: true
csrf_provider: form.csrf_provider
remember_me:
key: '%secret%'
lifetime: 31536000 # 365 days in seconds
path: /
domain: ~
logout:
path: UserBundle:Front:logout
target: UserBundle:Front:login
oauth:
resource_owners:
facebook: /account/connect/check-facebook/
twitter: /account/connect/check-twitter/
login_path: UserBundle:Front:login
failure_path: UserBundle:Front:logout
oauth_user_provider:
service: user.oauth.manager
access_control:
- { path: ^/account/(login|register|connect), roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: ROLE_ADMIN }
Related
I'm trying to get FOSUserBundle and HWIOAuth working together for handle the authentication of two types of users: representatives and interns. The representatives ones would begin using HWIOAuth and would use Salesforce and internal FOSUserBundle.
I'm trying to set everything but I have problems because Symfony throws this error when I try to access the /login-salesforce or /admin routes.
InvalidConfigurationException in BaseNode.php line 313: Invalid
configuration for path "security.firewalls.admin_area": The check_path
"/login_check" for login method "form_login" is not matched by the
firewall pattern "^/admin".
This is the content of security.yml file:
security:
encoders:
FOS\UserBundle\Model\UserInterface: sha512
role_hierarchy:
ROLE_REPRESENTATIVE: [ROLE_USER]
ROLE_ADMIN: [ROLE_REPRESENTATIVE, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
fos_userbundle:
id: fos_user.user_provider.username_email
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
#this is the secured area accessed through web browser and only internals are allowed to login
admin_area:
pattern: ^/admin
anonymous: ~
form_login:
provider: fos_userbundle
csrf_provider: form.csrf_provider
login_path: /login
check_path: /login_check
post_only: true
always_use_default_target_path: true
target_path_parameter: _target_path
use_referer: false
failure_path: null
failure_forward: false
logout:
path: fos_user_security_logout
target: /
#this is the public area accessed by/from iOs app and only users registered at Salesforce as rep can login
rep_area:
methods: [GET, POST]
pattern: ^/
anonymous: true
logout: true
logout:
path: /logout
target: /
oauth:
resource_owners:
salesforce: "/login/check-salesforce"
login_path: /login
failure_path: /login
oauth_user_provider:
service: pdi_salesforce.oauth_user_provider
access_control:
- { path: ^/reptool, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin, roles: ROLE_SUPER_ADMIN }
From HWIOAuth side I got everything setup, I think (can share if needed by someone). This is the content of routing.yml file:
#HWIOAuthBundle
hwi_oauth_redirect:
resource: "#HWIOAuthBundle/Resources/config/routing/redirect.xml"
prefix: /connect
hwi_oauth_login:
resource: "#HWIOAuthBundle/Resources/config/routing/login.xml"
prefix: /login
salesforce_login:
pattern: /login/check-salesforce
#PDOne
pd_one:
resource: "#PDOneBundle/Controller/"
type: annotation
prefix: /
template:
resource: "#TemplateBundle/Controller/"
type: annotation
prefix: /
#FOSUserBundle
fos_user:
resource: "#FOSUserBundle/Resources/config/routing/all.xml"
#SonataAdmin
admin:
resource: '#SonataAdminBundle/Resources/config/routing/sonata_admin.xml'
prefix: /admin
_sonata_admin:
resource: .
type: sonata_admin
prefix: /admin
What else I am missing? Does any here get those two working together and can share their work to get it done?
Hohoho the problem is here
admin_area:
pattern: ^/admin
anonymous: ~
form_login:
provider: fos_userbundle
csrf_provider: form.csrf_provider
login_path: /admin/login
check_path: /admin/login_check
post_only: true
always_use_default_target_path: true
target_path_parameter: _target_path
use_referer: false
failure_path: null
failure_forward: false
logout:
path: fos_user_security_logout
target: /
The login_path and check_path need to have /admin at the front.
I'm getting an error when using 2 firewalls for my Symfony app. I have a firewall for regular members and another for vendors.
The error is "Unable to find the controller for path "/vendor/login-check". Maybe you forgot to add the matching route in your routing configuration?"
The member_secured_area works perfectly fine when I hit any of the login and logout routes, but it does not work for the vendor_secured_area routes.
When I go to the /vendor/dashboard route it redirects me to /vendor/login but posting to the /vendor/login-check fails with the above error.
Thanks
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
vendor_secured_area:
pattern: ^/vendor/dashboard
provider: member
anonymous: false
form_login:
login_path: vendor-login
check_path: vendor-login-check
logout:
path: vendor-logout
target: /
member_secured_area:
pattern: ^/
provider: member
anonymous: ~
form_login:
login_path: member-login
check_path: member-login-check
default_target_path: home
success_handler: security.authentication_handler
failure_handler: security.authentication_handler
logout:
path: member-logout
target: /
remember_me:
key: "%secret_key%"
lifetime: 2592000
path: /
domain: ~
access_control:
member_access:
path: ^/member/dashboard
roles: IS_AUTHENTICATED_REMEMBERED
# vendor_access:
# path: ^/vendor/dashboard
# roles: IS_AUTHENTICATED_REMEMBERED
I've found the issue. My login, logout and check paths were not behind the firewall.
I had to allow anonymous to my vendor secure area to allow the login page to be accessed, then using the access control to require a role.
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
vendor_secured_area:
pattern: ^/vendor/dashboard
provider: member
anonymous: ~
form_login:
login_path: vendor-login
check_path: vendor-login-check
default_target_path: vendor-dashboard-index
always_use_default_target_path: true
logout:
path: vendor-logout
target: /
member_secured_area:
pattern: ^/
provider: member
anonymous: ~
form_login:
login_path: member-login
check_path: member-login-check
default_target_path: home
success_handler: security.authentication_handler
failure_handler: security.authentication_handler
logout:
path: member-logout
target: /
remember_me:
key: "%secret_key%"
lifetime: 2592000
path: /
domain: ~
access_control:
- { path: ^/member/dashboard, roles: IS_AUTHENTICATED_REMEMBERED }
- { path: ^/vendor/dashboard/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/vendor/dashboard, roles: IS_AUTHENTICATED_REMEMBERED }
I've got a login for the frontend (which is optional), and another login for the admin panel, which is mandatory.
When a user goes to fe_login, they can login to the frontend context. This is okay!
When they go to admin_login, they should be able to login to the admin context. This is not okay
The issue is that when I go to /admin, I get redirected to fe_login when I should be redirected to admin_login
Here's my security.yml:
security:
encoders:
App\FrontendBundle\Controller\UserController:
algorithm: bcrypt
App\AdminBundle\Controller\UserController:
algorithm: bcrypt
App\Entity\User:
algorithm: bcrypt
providers:
administrators:
entity: { class: AppEntity:User, property: username }
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
admin:
pattern: ^/admin
form_login:
login_path: admin_login
check_path: admin_auth
csrf_provider: form.csrf_provider
logout:
path: admin_logout
target: admin_login
frontend:
anonymous: ~
form_login:
login_path: fe_login
check_path: fe_auth
csrf_provider: form.csrf_provider
always_use_default_target_path: true
default_target_path: fe_landing
logout:
path: fe_logout
target: fe_landing
login:
pattern: ^/admin/login
anonymous: ~
default:
anonymous: ~
access_control:
- { path: ^/admin/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin, roles: [ROLE_ADMIN,ROLE_MANAGER,ROLE_DRIVER,ROLE_PARTNER] }
Any idea what I am doing wrong?
Here is my security.yml, but as I said it is for Symfony2.0, may be you will find a hint.
security:
encoders:
### ...
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
fos_userbundle:
id: fos_user.user_manager
admin_adminbundle:
id: custom_admin_manager_id
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
admin:
pattern: ^/admin/
form_login:
check_path: /admin/check-login
login_path: /admin/login
provider: admin_adminbundle
csrf_provider: form.csrf_provider
post_only: true
success_handler: login_success_handler
failure_handler: admin_login_failure_handler
username_parameter: login_username
password_parameter: login_password
remember_me: false
logout:
path: /admin/logout
target: /admin/login
anonymous: true
frontend:
pattern: ^/
form_login:
check_path: /frontend/check-login
login_path: /frontend/login
provider: fos_userbundle
csrf_provider: form.csrf_provider
post_only: true
success_handler: login_success_handler
failure_handler: login_failure_handler
username_parameter: login_username
password_parameter: login_password
logout:
path: /frontend/logout
success_handler: logout_success_handler
anonymous: true
access_control:
- { path: ^/frontend/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
I'm not quite sure about the reason, but you must now that security.yml must be a really clear file in order to avoid miss configuration (which would lead in security issues)
So, regarding your file:
it misses the pattern key on the frontend section: I would add pattern: ^/
the frontend login path could be specified as you did for the backend one
the order of your rules make me think something is not correct
This is a version you should test:
security:
encoders:
App\FrontendBundle\Controller\UserController:
algorithm: bcrypt
App\AdminBundle\Controller\UserController:
algorithm: bcrypt
App\Entity\User:
algorithm: bcrypt
providers:
administrators:
entity: { class: AppEntity:User, property: username }
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
login_admin:
pattern: ^/admin/login
anonymous: ~
admin:
pattern: ^/admin
form_login:
login_path: admin_login
check_path: admin_auth
csrf_provider: form.csrf_provider
logout:
path: admin_logout
target: admin_login
login_frontend:
pattern: ^/login # you should adapt this to your app
anonymous: ~
frontend:
pattern: ^/
anonymous: ~
form_login:
login_path: fe_login
check_path: fe_auth
csrf_provider: form.csrf_provider
always_use_default_target_path: true
default_target_path: fe_landing
logout:
path: fe_logout
target: fe_landing
access_control:
- { path: ^/admin/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin, roles: [ROLE_ADMIN,ROLE_MANAGER,ROLE_DRIVER,ROLE_PARTNER] }
You have some firewalls that seem unnecessary. Let's simplify your firewall config:
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
admin:
pattern: ^/admin
form_login:
login_path: admin_login
check_path: admin_auth
csrf_provider: form.csrf_provider
logout:
path: admin_logout
target: admin_login
anonymous: ~
frontend:
pattern: ^/
anonymous: ~
form_login:
login_path: fe_login
check_path: fe_auth
csrf_provider: form.csrf_provider
always_use_default_target_path: true
default_target_path: fe_landing
logout:
path: fe_logout
target: fe_landing
access_control:
# allow unauthenticated to access admin login
- { path: ^/admin/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
# restrict admin access
- { path: ^/admin, roles: [ROLE_ADMIN,ROLE_MANAGER,ROLE_DRIVER,ROLE_PARTNER] }
# allow unauthenticated to access front end login
- { path: ^/fe/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
# restrict front end access
- { path: ^/fe, roles: ROLE_USER } # or whatever the role is of your frontend user
# allow all other pages to be viewed by unauthenticated users
- { path: ^/, roles: IS_AUTHENTICATED_ANONYMOUSLY }
This config makes it so that all pages under /fe require front end authorization and all pages under /admin require admin authorization. And all other pages are not protected at all. You can adjust that however you want.
The order of the access_control is important. As soon as a rule is matched, it does not try to match any further entries. This config should work so that the correct login is displayed. However, it does not appear that you are using a different user provider for each firewall. So when you are logging in, the application will use the same provider for both logins. This may or may not be what you intend, but I thought I would point it out. If you do want a different user provider for each login, just add the provider: ProviderName to each firewall.
I have an application that has two login pages - one for frontend users and one for administrators.
I have a custom auth provider that I would like to use for both. Here is my code:
firewalls:
admin_area:
pattern: ^/admin
anonymous: ~
form_login:
check_path: /admin/admin_login_check
login_path: knetik_admin_user_login
logout:
path: knetik_user_logout
target: _welcome
invalidate_session: true
handlers: [ knetik.authentication.logout.listener ]
context: my_context
secured_area:
pattern: ^/
anonymous: ~
form_login:
check_path: /admin/login_check
login_path: knetik_user_login
remember_me: true
logout:
path: knetik_user_logout
target: _welcome
invalidate_session: true
handlers: [ knetik.authentication.logout.listener ]
knetik_auth:
remember_me: true
remember_me:
key: "%secret%"
lifetime: 2232000
path: /
domain: ~
context: my_context
access_control:
# - { path: ^/, roles: ROLE_USER, requires_channel: http }
- { path: ^/admin, roles: ROLE_ADMIN }
This gives me an error message of:
2InvalidConfigurationException: Invalid configuration for path "security.firewalls.admin_area": The check_path "/login_check" for login method "knetik_auth" is not matched by the firewall pattern "^/admin/".
Looking to see if anyone has run into a similar issue?
this is my project security.yml file maybe will give you some references:
security:
encoders:
myBundle\Service\WebserviceUser: plaintext
entity_admin:
class: My\Entity\Administrator
algorithm: sha1
iterations: 1
encode_as_base64: false
providers:
entity_admin:
entity:
class: myBundle\Entity\Administrator
property: username
provider_members:
id: my_custom.service.user_provider//this is my customized user provider
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
admin_secured_area:
pattern: ^/admin
provider: entity_admin
anonymous: ~
form_login:
login_path: /admin/login
check_path: /admin/login_check
logout:
path: /admin/logout
target: /admin
members_secured_area:
pattern: ^/
provider: provider_members
anonymous: ~
form_login:
check_path: /login_check
login_path: /login
remember_me: true
remember_me:
key: "%secret%"
lifetime: 31536000 # 365 days in seconds
path: /
domain: ~ # Defaults to the current domain from $_SERVER
logout:
path: /logout
target: /
access_control:
admin_login:
path: /admin/login
roles: IS_AUTHENTICATED_ANONYMOUSLY
admin_area:
path: ^/admin
roles: ROLE_ADMIN
members_login:
path: /login
roles: IS_AUTHENTICATED_ANONYMOUSLY
members_area:
path: ^/
roles: ROLE_USER
For implementing multiple login in symfony 2XX, try the following code
Security.yml
security:
encoders:
Symfony\Component\Security\Core\User\User: plaintext
Company\AngularBundle\Entity\User: plaintext
Company\AngularBundle\Entity\Admin: plaintext
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
users:
entity: { class: CompanyAngularBundle:User, property: username }
admin:
entity: { class: CompanyAngularBundle:Admin, property: username }
firewalls:
admin_secured_area:
pattern: ^/admin
anonymous: ~
provider: admin
form_login:
login_path: /admin/login
check_path: /admin/login_check
default_target_path: /admin
user_secured_area:
pattern: ^/
anonymous: ~
provider: users
form_login:
login_path: login
check_path: login_check
default_target_path: /home
routing.yml
login_check:
path: /login_check
admin_login_check:
path: /admin/login_check
Twig file
Action of login form should be like this
<form action="{{ path('login_check') }}" method="post">
Action of admin/login form should be like this
<form action="{{ path('admin_login_check') }}" method="post">
i am using HWIOAuthBundle to integrate Facebook oAuth and when i update my schema i am getting following error
[Symfony\Component\Config\Definition\Exception\InvalidConfigurationException]
Unrecognized options "resource_owners" under "security.firewalls.oauth"
here is my security.yml and i really dont know what is this error
jms_security_extra:
secure_all_services: false
expressions: true
security:
providers:
fos_userbundle:
id: fos_user.user_provider.username
# administrators:
# entity: { class: NotificaHomeBundle:TbNotificaUser }
encoders:
"FOS\UserBundle\Model\UserInterface": sha512
firewalls:
main:
pattern: ^/
form_login:
provider: fos_userbundle
csrf_provider: form.csrf_provider
login_path: /login
check_path: /login_check
logout: true
anonymous: true
oauth:
resource_owners:
facebook: "/login/check-facebook"
oauth_user_provider:
#this is my custom user provider, created from FOSUBUserProvider - will manage the
#automatic user registration on your site, with data from the provider (facebook. google, etc.)
service: my_user_provider
oauth_token:
pattern: ^/oauth/v2/token
security: false
oauth_authorize:
pattern: ^/oauth/v2/auth
form_login:
provider: fos_userbundle
check_path: /oauth/v2/auth/login_check
login_path: /oauth/v2/auth/login
anonymous: true
# Add your favorite authentication process here
api:
pattern: ^/api
fos_oauth: true
stateless: true
anonymous: true # can be omitted as its default value
# admin_area:
# pattern: ^/xadmin
# http_basic: ~
access_control:
- { path: ^/login, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/, role: ROLE_ADMIN }
- { path: ^/notifica/login, role: IS_AUTHENTICATED_ANONYMOUSLY }
# - { path: ^/xadmin/, role: ROLE_ADMIN }
- { path: ^/api, roles: [ IS_AUTHENTICATED_ANONYMOUSLY ] }
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: ROLE_ADMIN
Your identation is wrong. YAML files are based on identation.
firewalls:
main:
pattern: ^/
form_login:
provider: fos_userbundle
csrf_provider: form.csrf_provider
login_path: /login
check_path: /login_check
oauth:
resource_owners:
facebook: "/login/check-facebook"
google: "/login/check-google"
login_path: /login
failure_path: /login
oauth_user_provider:
#this is my custom user provider, created from FOSUBUserProvider - will manage the
#automatic user registration on your site, with data from the provider (facebook. google, etc.)
service: my_user_provider