i have a Twig extension menu in my page, but i need use isGranted method to display the menu items according to the user, but symfony2 profilers shows me an alert:
The profilers says:
AuthenticationCredentialsNotFoundException: The security context contains no authentication token. One possible reason may be that there is no firewall configured for this URL.
in C:\xampp\htdocs\galvez_motos\app\cache\dev\classes.php line 2395
at SecurityContext->isGranted('ROLE_ADMIN') in C:\xampp\htdocs\galvez_motos\src\GalvezMotos\AlmacenBundle\Twig\MenuExtension.php line 432
How can i use the isGranted method before login?
security.yml:
security:
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
secured_area:
pattern: ^/
anonymous: ~
form_login:
login_path: login
check_path: login_check
logout:
path: /logout
target: /
invalidate_session: false
access_control:
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin, roles: ROLE_ADMIN }
- { path: ^/, roles: ROLE_USER }
providers:
user_db:
entity: { class: GalvezMotos\AlmacenBundle\Entity\Usuario, property: username }
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
encoders:
GalvezMotos\AlmacenBundle\Entity\Usuario:
algorithm: sha1
iterations: 1
encode_as_base64: false
Pd: Images
Related
I try to configure FOSUserBundle in Symfony 2.7 but I still get "You must configure the check path to be handled by the firewall using form_login in your security firewall configuration." exception.
I searched vendor folder for Security Controller and I found that checkAction throws such exception.
I would like to allow
admin to log into /admin section,
and editors to /editor section.
I use two ways of logging: one is in_memory, and second fos_userbundle. This is my security.yml
encoders:
Symfony\Component\Security\Core\User\User: plaintext
Inpero\PageBundle\Entity\User: bcrypt
# http://symfony.com/doc/current/book/security.html#hierarchical-roles
role_hierarchy:
ROLE_EDITOR: ROLE_USER
ROLE_ADMIN: [ROLE_EDITOR, ROLE_USER]
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
# http://symfony.com/doc/current/book/security.html#where-do-users-come-from-user-providers
providers:
in_memory:
memory:
users:
admin: { password: pass1, roles: [ 'ROLE_ADMIN' ] }
fos_userbundle:
id: fos_user.user_provider.username
# the main part of the security, where you can set up firewalls
# for specific sections of your app
firewalls:
# disables authentication for assets and the profiler, adapt it according to your needs
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
# the login page has to be accessible for everybody
page_login:
pattern: ^/admin/login$
security: false
page_admin:
pattern: ^/admin
form_login:
check_path: my_page_check
login_path: my_page_login
logout:
path: my_page_logout
target: /
editor_login:
pattern: ^/editor/login
security: false
editors:
pattern: ^/editor
form_login:
provider: fos_userbundle
check_path: /editor/login_check
login_path: /editor/login
failure_path: /editor/login
default_target_path: /editor/
always_use_default_target_path: true
#csrf_token_generator: security.csrf.token_manager
# if you are using Symfony < 2.8, use the following config instead:
csrf_provider: form.csrf_provider
logout:
path: fos_user_security_logout
target: /
anonymous: ~
# with these settings you can restrict or allow access for different parts
# of your application based on roles, ip, host or methods
# http://symfony.com/doc/current/book/security.html#security-book-access-control-matching-options
access_control:
- { path: ^/efconnect, role: IS_AUTHENTICATED_REMEMBERED }
- { path: ^/elfinder, role: IS_AUTHENTICATED_REMEMBERED }
- { path: ^/admin, role: ROLE_ADMIN }
- { path: ^/editor, role: ROLE_EDITOR }
What am I doing wrong?
I need to create a portal for my website using two authentication protocols.
Using a standard approach with login / password
Using a CAS service
So, when a user arrives on the homepage he can choose one of these two authentication systems.
I am not very skilled in security in symfony2, so I have follow the Symfony documentation to write this code:
#Security.yml
security:
encoders:
Symfony\Component\Security\Core\User\User: plaintext
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
firewalls:
secure_area:
pattern: ^/
anonymous: ~
context: form_auth
form_login:
login_path: /form_login
check_path: /form_login_check
logout:
path: /logout
target: /riac
access_control:
- { path: ^/riac/admin, roles: ROLE_ADMIN }
providers:
in_memory:
memory:
users:
bob: { password: bob, roles: 'ROLE_ADMIN' }
main:
entity: { class: Riac\HomeBundle\Entity\Login, property: username }
This one works fine for the login/password approach.
To create the CAS protocol I have found BeSimpleSsoAuthBundle, but... problems....
So I have read the installation documentation to implement this one and I have success to run it alone (with no login/password protocol). For now to implement both protocols at once I have written this code:
security:
encoders:
Symfony\Component\Security\Core\User\User: plaintext
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
firewalls:
cas_secure_area:
pattern: ^/
anonymous: ~
context: cas_auth
trusted_sso:
manager: admin_sso
login_action: false
logout_action: false
login_path: /cas_login
check_path: /cas_login_check
create_users: true
created_users_roles: [ROLE_USER, ROLE_ADMIN]
check_path: /form_login_check
logout:
path: /logout
target: /riac
secure_area:
pattern: ^/
anonymous: ~
context: form_auth
form_login:
login_path: /form_login
check_path: /form_login_check
logout:
path: /logout
target: /riac
access_control:
- { path: ^/riac/admin, roles: ROLE_ADMIN }
providers:
in_memory:
memory:
users:
bob: { password: bob, roles: 'ROLE_ADMIN' }
main:
entity: { class: Riac\HomeBundle\Entity\Login, property: username }
But it doesn't work (logout problem, login_check not found, difficulty to identify what method to use).
So I think that is not the best methodology, but I don't know how do this. Can you help me please?
Hi i got an problem with my access control in symfony 2.
I want to secure the whole site except of the "/" route cause there is the login. So every route else, for example "/hello" must be secured and redirect to / if there is no user logged in.
In my security config i got this configuration:
security:
encoders:
FOS\UserBundle\Model\UserInterface: sha512
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: ROLE_ADMIN
providers:
fos_userbundle:
id: fos_user.user_provider.username
firewalls:
main:
pattern: ^/
form_login:
provider: fos_userbundle
csrf_provider: form.csrf_provider
login_path: /
logout: true
anonymous: ~
access_control:
- { path: ^/, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/.*, roles: ROLE_ADMIN }
What am I doing wrong?
This should work:
access_control:
- { path: ^/$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: ROLE_ADMIN }
for more info:
http://symfony.com/doc/master/book/security.html
Hello I followed this tutorial:
http://symfony.com/doc/current/cookbook/security/entity_provider.html
My security.yml:
security:
encoders:
Symfony\Component\Security\Core\User\User: plaintext
modules\UserBundle\Entity\User:
algorithm: sha1
encode_as_base64: false
iterations: 1
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
chain_provider:
chain:
providers: [in_memory, user_db]
in_memory:
memory:
users:
test: { password: test }
user_db:
entity: { class: modulesUserBundle:User }
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
login:
pattern: ^/demo/secured/login$
security: false
login_firewall:
pattern: ^/login$
anonymous: ~
secured_area:
pattern: ^/
provider: user_db
http_basic:
realm: "Secured Demo Area"
provider: in_memory
form_login: ~
logout:
path: _demo_logout
target: _demo
#anonymous: ~
#http_basic:
# realm: "Secured Demo Area"
admin_area:
pattern: ^/admin
http_basic: ~
access_control:
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/users, roles: ROLE_SUPER_ADMIN }
- { path: ^/admin, roBad credentialsles: ROLE_ADMIN }
#- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
In database I have this:
users:
(id, username, salt, password, email, is_active)
(1,'admin','123456','7c4a8d09ca3762af61e59520943dc264','admin#modules.com',1)
(2,'bruno','123456','7c4a8d09ca3762af61e59520943dc264','mail#gmail.com',1)
roles:
(id, name, role)
(1,'Admin','ROLE_ADMIN')
(2,'User','ROLE_USER')
user_role:
(user_id, role_id)
(1,1)
(2,2)
Everytime I try to login with one user from DB I got "Bad credentials".
But if I login with 'test' user, defined in in_memory, no problem
I think the error is in my security.yml. But what I'm doing wrong?
How have you registered this users in the DB? I can see users passwords in plain text, so i suppose that in the login process it's enconding the password with your config and after the hole proccess encoded pass != db pass, so it cant do the login. Encode DB passwords and i'm sure everithing will be ok
If you are loading fixtures, use $user->setPlainPassword('pass') to store user's password, compare db value with the new one, look how different they are
I hope it helps you
fixed:
security.yml
security:
encoders:
Symfony\Component\Security\Core\User\User: plaintext
modules\UserBundle\Entity\User:
algorithm: sha1
encode_as_base64: false
iterations: 1
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
administrators:
entity: { class: modulesUserBundle:User }
firewalls:
login_firewall:
pattern: ^/login$
anonymous: ~
secured_area:
pattern: ^/
provider: administrators
form_login: ~
access_control:
- { path: ^/admin/, roles: ROLE_ADMIN }
Im trying to create an oauth2 server based on FOSOauthServerBundle, FOSRestBundle and FOSUserBundle. I created a demo application to test the my oauth-server and it failed receiving the data via the GET reguest
(received 401 error ' error="access_denied", error_description="OAuth2
authentication required" '),
in spite the fact that the user was authenticated and the client received an access token properly.
How should I implement the api controllers so the oauth2 will execute the authentication process?
Also, i would like to take a look on real working oauth server example based on those bundles so i would be able to check my application on it.
my security.yml:
jms_security_extra:
secure_all_services: false
expressions: true
security:
acl:
connection: default
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
in_memory:
memory:
users:
user: { password: userpass, roles: [ 'ROLE_USER' ] }
admin: { password: adminpass, roles: [ 'ROLE_ADMIN' ] }
fos_userbundle:
id: fos_user.user_provider.username
encoders:
FOS\UserBundle\Model\UserInterface: sha512
Symfony\Component\Security\Core\User\User: plaintext
firewalls:
api:
pattern: ^/api
fos_oauth: true
stateless: true
oauth_authorize:
pattern: ^/oauth/v2/auth
form_login:
provider: fos_userbundle
check_path: /oauth/v2/auth_login_check
login_path: /oauth/v2/auth_login
use_referer: true
anonymous: true
oauth_token:
pattern: ^/oauth/v2/token
security: false
secured_area:
pattern: ^/
anonymous: ~
form_login:
provider: fos_userbundle
check_path: /login_check
login_path: /login
always_use_default_target_path: true
default_target_path: /
access_control:
- { path: ^/oauth/v2/auth_login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/oauth/v2/auth, role: ROLE_USER }
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY}
- { path: ^/, roles: ROLE_USER }
- { path: ^/api, roles: [ IS_AUTHENTICATED_FULLY ] }
Thanks.
Submitting the answer so this will close the open question.
Access denied caused because the request did not contain the access token. Refer to documentation with section titled Creating A Client and Usage.
https://github.com/FriendsOfSymfony/FOSOAuthServerBundle/blob/master/Resources/doc/index.md