I'm getting an error when using 2 firewalls for my Symfony app. I have a firewall for regular members and another for vendors.
The error is "Unable to find the controller for path "/vendor/login-check". Maybe you forgot to add the matching route in your routing configuration?"
The member_secured_area works perfectly fine when I hit any of the login and logout routes, but it does not work for the vendor_secured_area routes.
When I go to the /vendor/dashboard route it redirects me to /vendor/login but posting to the /vendor/login-check fails with the above error.
Thanks
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
vendor_secured_area:
pattern: ^/vendor/dashboard
provider: member
anonymous: false
form_login:
login_path: vendor-login
check_path: vendor-login-check
logout:
path: vendor-logout
target: /
member_secured_area:
pattern: ^/
provider: member
anonymous: ~
form_login:
login_path: member-login
check_path: member-login-check
default_target_path: home
success_handler: security.authentication_handler
failure_handler: security.authentication_handler
logout:
path: member-logout
target: /
remember_me:
key: "%secret_key%"
lifetime: 2592000
path: /
domain: ~
access_control:
member_access:
path: ^/member/dashboard
roles: IS_AUTHENTICATED_REMEMBERED
# vendor_access:
# path: ^/vendor/dashboard
# roles: IS_AUTHENTICATED_REMEMBERED
I've found the issue. My login, logout and check paths were not behind the firewall.
I had to allow anonymous to my vendor secure area to allow the login page to be accessed, then using the access control to require a role.
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
vendor_secured_area:
pattern: ^/vendor/dashboard
provider: member
anonymous: ~
form_login:
login_path: vendor-login
check_path: vendor-login-check
default_target_path: vendor-dashboard-index
always_use_default_target_path: true
logout:
path: vendor-logout
target: /
member_secured_area:
pattern: ^/
provider: member
anonymous: ~
form_login:
login_path: member-login
check_path: member-login-check
default_target_path: home
success_handler: security.authentication_handler
failure_handler: security.authentication_handler
logout:
path: member-logout
target: /
remember_me:
key: "%secret_key%"
lifetime: 2592000
path: /
domain: ~
access_control:
- { path: ^/member/dashboard, roles: IS_AUTHENTICATED_REMEMBERED }
- { path: ^/vendor/dashboard/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/vendor/dashboard, roles: IS_AUTHENTICATED_REMEMBERED }
Related
Whenever a user with insufficient privileges tries to access a page I redirect him to the login page by setting the access_denied_url to /login field in my security.yml
My security.yml
security:
encoders:
FOS\UserBundle\Model\UserInterface: bcrypt
access_denied_url: /login
providers:
fos_userbundle:
id: fos_user.user_provider.username
firewalls:
# disables authentication for assets and the profiler, adapt it according to your needs
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
secured_area:
pattern: ^/
form_login:
login_path: /login
check_path: /login_check
default_target_path: /
logout:
path: /logout
target: /
anonymous: ~
main:
pattern: ^/
form_login:
provider: fos_userbundle
csrf_provider: security.csrf.token_manager # Use form.csrf_provider instead for Symfony <2.4
logout: true
anonymous: true
access_control:
- { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/tc, role: ROLE_TC }
- { path: ^/operations, role: ROLE_OPERATIONS }
In my twig template I want to get the page the user tried to access so how can I do that?
I've tried to get the target path and the referer path as follows but both of them are empty
app.session.get('_security.secured_area.target_path')
app.request.headers.get('referer')
You have to use use_referer.
This is my security.yml file:
firewalls:
main:
pattern: ^/
form_login:
provider: fos_userbundle
csrf_provider: security.csrf.token_manager
use_referer: true
logout: true
anonymous: true
I'm trying to install an old legacy system from a company I'm freelancing for, but I keep getting
InvalidConfigurationException in ArrayNode.php line 309: Unrecognized
option "oauth" under "security.firewalls.primary"
This code supposedly runs without errors elsewhere is there anything I'm missing? Here's my security.yml where there error is probably in:
imports:
- { resource: ../../../_common/config/security.yml }
security:
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|bundles|assets)/
security: false
login:
context: primary
pattern: ^/account/login/$
anonymous: true
anonymous:
context: primary
pattern: ^/account/(register|login/reset-password).*
anonymous: true
primary:
pattern: ^/
form_login:
check_path: UserBundle:Front:loginCheck
login_path: UserBundle:Front:login
remember_me: true
csrf_provider: form.csrf_provider
remember_me:
key: '%secret%'
lifetime: 31536000 # 365 days in seconds
path: /
domain: ~
logout:
path: UserBundle:Front:logout
target: UserBundle:Front:login
oauth:
resource_owners:
facebook: /account/connect/check-facebook/
twitter: /account/connect/check-twitter/
login_path: UserBundle:Front:login
failure_path: UserBundle:Front:logout
oauth_user_provider:
service: user.oauth.manager
access_control:
- { path: ^/account/(login|register|connect), roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: ROLE_ADMIN }
I've got a login for the frontend (which is optional), and another login for the admin panel, which is mandatory.
When a user goes to fe_login, they can login to the frontend context. This is okay!
When they go to admin_login, they should be able to login to the admin context. This is not okay
The issue is that when I go to /admin, I get redirected to fe_login when I should be redirected to admin_login
Here's my security.yml:
security:
encoders:
App\FrontendBundle\Controller\UserController:
algorithm: bcrypt
App\AdminBundle\Controller\UserController:
algorithm: bcrypt
App\Entity\User:
algorithm: bcrypt
providers:
administrators:
entity: { class: AppEntity:User, property: username }
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
admin:
pattern: ^/admin
form_login:
login_path: admin_login
check_path: admin_auth
csrf_provider: form.csrf_provider
logout:
path: admin_logout
target: admin_login
frontend:
anonymous: ~
form_login:
login_path: fe_login
check_path: fe_auth
csrf_provider: form.csrf_provider
always_use_default_target_path: true
default_target_path: fe_landing
logout:
path: fe_logout
target: fe_landing
login:
pattern: ^/admin/login
anonymous: ~
default:
anonymous: ~
access_control:
- { path: ^/admin/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin, roles: [ROLE_ADMIN,ROLE_MANAGER,ROLE_DRIVER,ROLE_PARTNER] }
Any idea what I am doing wrong?
Here is my security.yml, but as I said it is for Symfony2.0, may be you will find a hint.
security:
encoders:
### ...
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
fos_userbundle:
id: fos_user.user_manager
admin_adminbundle:
id: custom_admin_manager_id
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
admin:
pattern: ^/admin/
form_login:
check_path: /admin/check-login
login_path: /admin/login
provider: admin_adminbundle
csrf_provider: form.csrf_provider
post_only: true
success_handler: login_success_handler
failure_handler: admin_login_failure_handler
username_parameter: login_username
password_parameter: login_password
remember_me: false
logout:
path: /admin/logout
target: /admin/login
anonymous: true
frontend:
pattern: ^/
form_login:
check_path: /frontend/check-login
login_path: /frontend/login
provider: fos_userbundle
csrf_provider: form.csrf_provider
post_only: true
success_handler: login_success_handler
failure_handler: login_failure_handler
username_parameter: login_username
password_parameter: login_password
logout:
path: /frontend/logout
success_handler: logout_success_handler
anonymous: true
access_control:
- { path: ^/frontend/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
I'm not quite sure about the reason, but you must now that security.yml must be a really clear file in order to avoid miss configuration (which would lead in security issues)
So, regarding your file:
it misses the pattern key on the frontend section: I would add pattern: ^/
the frontend login path could be specified as you did for the backend one
the order of your rules make me think something is not correct
This is a version you should test:
security:
encoders:
App\FrontendBundle\Controller\UserController:
algorithm: bcrypt
App\AdminBundle\Controller\UserController:
algorithm: bcrypt
App\Entity\User:
algorithm: bcrypt
providers:
administrators:
entity: { class: AppEntity:User, property: username }
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
login_admin:
pattern: ^/admin/login
anonymous: ~
admin:
pattern: ^/admin
form_login:
login_path: admin_login
check_path: admin_auth
csrf_provider: form.csrf_provider
logout:
path: admin_logout
target: admin_login
login_frontend:
pattern: ^/login # you should adapt this to your app
anonymous: ~
frontend:
pattern: ^/
anonymous: ~
form_login:
login_path: fe_login
check_path: fe_auth
csrf_provider: form.csrf_provider
always_use_default_target_path: true
default_target_path: fe_landing
logout:
path: fe_logout
target: fe_landing
access_control:
- { path: ^/admin/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin, roles: [ROLE_ADMIN,ROLE_MANAGER,ROLE_DRIVER,ROLE_PARTNER] }
You have some firewalls that seem unnecessary. Let's simplify your firewall config:
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
admin:
pattern: ^/admin
form_login:
login_path: admin_login
check_path: admin_auth
csrf_provider: form.csrf_provider
logout:
path: admin_logout
target: admin_login
anonymous: ~
frontend:
pattern: ^/
anonymous: ~
form_login:
login_path: fe_login
check_path: fe_auth
csrf_provider: form.csrf_provider
always_use_default_target_path: true
default_target_path: fe_landing
logout:
path: fe_logout
target: fe_landing
access_control:
# allow unauthenticated to access admin login
- { path: ^/admin/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
# restrict admin access
- { path: ^/admin, roles: [ROLE_ADMIN,ROLE_MANAGER,ROLE_DRIVER,ROLE_PARTNER] }
# allow unauthenticated to access front end login
- { path: ^/fe/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
# restrict front end access
- { path: ^/fe, roles: ROLE_USER } # or whatever the role is of your frontend user
# allow all other pages to be viewed by unauthenticated users
- { path: ^/, roles: IS_AUTHENTICATED_ANONYMOUSLY }
This config makes it so that all pages under /fe require front end authorization and all pages under /admin require admin authorization. And all other pages are not protected at all. You can adjust that however you want.
The order of the access_control is important. As soon as a rule is matched, it does not try to match any further entries. This config should work so that the correct login is displayed. However, it does not appear that you are using a different user provider for each firewall. So when you are logging in, the application will use the same provider for both logins. This may or may not be what you intend, but I thought I would point it out. If you do want a different user provider for each login, just add the provider: ProviderName to each firewall.
I have an application that has two login pages - one for frontend users and one for administrators.
I have a custom auth provider that I would like to use for both. Here is my code:
firewalls:
admin_area:
pattern: ^/admin
anonymous: ~
form_login:
check_path: /admin/admin_login_check
login_path: knetik_admin_user_login
logout:
path: knetik_user_logout
target: _welcome
invalidate_session: true
handlers: [ knetik.authentication.logout.listener ]
context: my_context
secured_area:
pattern: ^/
anonymous: ~
form_login:
check_path: /admin/login_check
login_path: knetik_user_login
remember_me: true
logout:
path: knetik_user_logout
target: _welcome
invalidate_session: true
handlers: [ knetik.authentication.logout.listener ]
knetik_auth:
remember_me: true
remember_me:
key: "%secret%"
lifetime: 2232000
path: /
domain: ~
context: my_context
access_control:
# - { path: ^/, roles: ROLE_USER, requires_channel: http }
- { path: ^/admin, roles: ROLE_ADMIN }
This gives me an error message of:
2InvalidConfigurationException: Invalid configuration for path "security.firewalls.admin_area": The check_path "/login_check" for login method "knetik_auth" is not matched by the firewall pattern "^/admin/".
Looking to see if anyone has run into a similar issue?
this is my project security.yml file maybe will give you some references:
security:
encoders:
myBundle\Service\WebserviceUser: plaintext
entity_admin:
class: My\Entity\Administrator
algorithm: sha1
iterations: 1
encode_as_base64: false
providers:
entity_admin:
entity:
class: myBundle\Entity\Administrator
property: username
provider_members:
id: my_custom.service.user_provider//this is my customized user provider
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
admin_secured_area:
pattern: ^/admin
provider: entity_admin
anonymous: ~
form_login:
login_path: /admin/login
check_path: /admin/login_check
logout:
path: /admin/logout
target: /admin
members_secured_area:
pattern: ^/
provider: provider_members
anonymous: ~
form_login:
check_path: /login_check
login_path: /login
remember_me: true
remember_me:
key: "%secret%"
lifetime: 31536000 # 365 days in seconds
path: /
domain: ~ # Defaults to the current domain from $_SERVER
logout:
path: /logout
target: /
access_control:
admin_login:
path: /admin/login
roles: IS_AUTHENTICATED_ANONYMOUSLY
admin_area:
path: ^/admin
roles: ROLE_ADMIN
members_login:
path: /login
roles: IS_AUTHENTICATED_ANONYMOUSLY
members_area:
path: ^/
roles: ROLE_USER
For implementing multiple login in symfony 2XX, try the following code
Security.yml
security:
encoders:
Symfony\Component\Security\Core\User\User: plaintext
Company\AngularBundle\Entity\User: plaintext
Company\AngularBundle\Entity\Admin: plaintext
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
users:
entity: { class: CompanyAngularBundle:User, property: username }
admin:
entity: { class: CompanyAngularBundle:Admin, property: username }
firewalls:
admin_secured_area:
pattern: ^/admin
anonymous: ~
provider: admin
form_login:
login_path: /admin/login
check_path: /admin/login_check
default_target_path: /admin
user_secured_area:
pattern: ^/
anonymous: ~
provider: users
form_login:
login_path: login
check_path: login_check
default_target_path: /home
routing.yml
login_check:
path: /login_check
admin_login_check:
path: /admin/login_check
Twig file
Action of login form should be like this
<form action="{{ path('login_check') }}" method="post">
Action of admin/login form should be like this
<form action="{{ path('admin_login_check') }}" method="post">
I have a secured area for logged users
like this-->
firewalls:
members_secured_area:
pattern: ^/
provider: entity_searchers
anonymous: ~
form_login:
check_path: /searchers/login_check
login_path: /searchers/login
default_target_path: /searchers/
logout:
path: /searchers/logout
target: /searchers/login
crm_secured_area:
pattern: ^/crm/
provider: entity_crmusers
anonymous: ~
form_login:
check_path: /crm/login_check
login_path: /crm/login
default_target_path: /crm/customers
logout:
path: /crm/logout
target: /crm/login
remember_me:
#token_provider: entity_crmusers
key: someS3cretKey
name: NameOfTheCookie
lifetime: 3600 # in seconds
secure: false
httponly: true
always_remember_me: false
remember_me_parameter: _remember_me
access_control:
members_login:
path: /searchers/login
roles: IS_AUTHENTICATED_ANONYMOUSLY
members_register:
path: /searchers/register
roles: IS_AUTHENTICATED_ANONYMOUSLY
members_area:
path: /searchers/.*
roles: ROLE_USER
crm_login:
path: /crm/login
roles: IS_AUTHENTICATED_ANONYMOUSLY
crm_register:
path: /crm/register
roles: IS_AUTHENTICATED_ANONYMOUSLY
crm_area:
path: /crm/.*
roles: ROLE_CRM
so when the user is in the secured area I can see he is logged,
but when he is getting back to main page or to mysite.com/about page
I cant know he is logged or not...
is there a way to know that?
In the controller you can get the user with $this->getUser(). When the user is logged it returns an instance of the User class, otherwise it returns NULL, so you can do something like:
$user = $this->getUser();
$is_logged = isset($user);
$is_logged is boolean and is true if the user is logged and false otherwise.
You get a valid user only under the secured area (estimated trough pattern). Therefore everything not matching the given pattern is not under the firewall and has no user token. You can change this by securing the whole site and with a new access rule
firewalls:
crm_secured_area:
pattern: ^/crm/
# ... stuff
members_secured_area:
pattern: ^/
anonymous: ~
# ... all other config
access_control:
# ... all your existing access rules
- { path: ^/, role: IS_AUTHENTICATED_ANONYMOUSLY }
The last rule allows all routes, which doesn't matched any rule yet to access them anonymously and you have access to the user token (if one authenticated) in all controllers.
found this solution, simply place in the pattern of the main site : ^/(?!crm)
means not to include the folder crm.
firewalls:
members_secured_area:
pattern: ^/(?!crm)
provider: entity_searchers
anonymous: ~
form_login:
check_path: /searchers/login_check
login_path: /searchers/login
default_target_path: /searchers/
logout:
path: /searchers/logout
target: /searchers/login
crm_secured_area:
pattern: ^/crm/
provider: entity_crmusers
anonymous: ~
form_login:
check_path: /crm/login_check
login_path: /crm/login
default_target_path: /crm/customers
logout:
path: /crm/logout
target: /crm/login
remember_me:
#token_provider: entity_crmusers
key: someS3cretKey
name: NameOfTheCookie
lifetime: 3600 # in seconds
secure: false
httponly: true
always_remember_me: false
remember_me_parameter: _remember_me