Last active
June 20, 2020 09:01
-
-
Save webdevilopers/6eec6ebc1f55cdf52b3b to your computer and use it in GitHub Desktop.
Security Config for FOSUserBundle with SonataUserBundle with SonataAdminBundle
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| admin: | |
| resource: '@SonataAdminBundle/Resources/config/routing/sonata_admin.xml' | |
| prefix: /admin | |
| _sonata_admin: | |
| resource: . | |
| type: sonata_admin | |
| prefix: /admin | |
| soanata_user: | |
| resource: '@SonataUserBundle/Resources/config/routing/admin_security.xml' | |
| prefix: /admin | |
| sonata_user_security: | |
| resource: "@SonataUserBundle/Resources/config/routing/sonata_security_1.xml" | |
| sonata_user_resetting: | |
| resource: "@SonataUserBundle/Resources/config/routing/sonata_resetting_1.xml" | |
| prefix: /resetting | |
| sonata_user_profile: | |
| resource: "@SonataUserBundle/Resources/config/routing/sonata_profile_1.xml" | |
| prefix: /profile | |
| sonata_user_change_password: | |
| resource: "@SonataUserBundle/Resources/config/routing/sonata_change_password_1.xml" | |
| prefix: /profile | |
| gallery: | |
| resource: '@SonataMediaBundle/Resources/config/routing/gallery.xml' | |
| prefix: /media/gallery | |
| media: | |
| resource: '@SonataMediaBundle/Resources/config/routing/media.xml' | |
| prefix: /media |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| security: | |
| encoders: | |
| FOS\UserBundle\Model\UserInterface: sha512 | |
| role_hierarchy: | |
| ROLE_STAFF: [ROLE_USER, ROLE_SONATA_FOO_READER] | |
| ROLE_ADMIN: [ROLE_STAFF, ROLE_SONATA_FOO_EDITOR, ROLE_SONATA_FOO_ADMIN] | |
| ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH] | |
| SONATA: | |
| - ROLE_SONATA_PAGE_ADMIN_PAGE_EDIT # if you are using acl then this line must be commented | |
| access_decision_manager: | |
| strategy: unanimous | |
| providers: | |
| fos_userbundle: | |
| id: fos_user.user_manager | |
| firewalls: | |
| # Disabling the security for the web debug toolbar, the profiler and Assetic. | |
| dev: | |
| pattern: ^/(_(profiler|wdt)|css|images|js)/ | |
| security: false | |
| # This firewall is used to handle the public login area | |
| # This part is handled by the FOS User Bundle | |
| main: | |
| pattern: .* | |
| context: user | |
| form_login: | |
| provider: fos_userbundle | |
| login_path: /login | |
| use_forward: false | |
| check_path: /login_check | |
| failure_path: null | |
| logout: true | |
| # path: /logout | |
| anonymous: true | |
| # Session liftime | |
| remember_me: | |
| key: '%secret%' | |
| lifetime: 28800 | |
| # Sonata User Impersonating | |
| switch_user: true | |
| # -> custom firewall for the admin area of the URL | |
| admin: | |
| pattern: /admin(.*) | |
| context: user | |
| form_login: | |
| provider: fos_userbundle | |
| login_path: /login | |
| # login_path: /admin/login | |
| use_forward: false | |
| check_path: /admin/login_check | |
| # failure_path: null | |
| logout: | |
| # path: /admin/logout | |
| path: /logout | |
| anonymous: false | |
| access_control: | |
| # URL of FOSUserBundle which need to be available to anonymous users | |
| - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY } | |
| # - { path: ^/logout$, role: IS_AUTHENTICATED_ANONYMOUSLY } | |
| - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY } | |
| - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY } | |
| # Admin login page needs to be access without credential | |
| - { path: ^/admin/login$, role: IS_AUTHENTICATED_ANONYMOUSLY } | |
| # - { path: ^/admin/logout$, role: IS_AUTHENTICATED_ANONYMOUSLY } | |
| - { path: ^/admin/login_check$, role: IS_AUTHENTICATED_ANONYMOUSLY } | |
| # Secured part of the site | |
| # This config requires being logged for the whole site and having the admin role for the admin part. | |
| # Change these rules to adapt them to your needs | |
| # - { path: ^/admin/, role: [ROLE_ADMIN, ROLE_SONATA_ADMIN] } | |
| - { path: ^/admin/, role: [ROLE_SONATA_ADMIN] } | |
| - { path: ^/.*, role: IS_AUTHENTICATED_ANONYMOUSLY } | |
| acl: | |
| connection: default |
Author
Here is my final configuration which actually works on Symfony 4.4
// config/routes/sonata_admin.yaml
admin_area:
resource: "@SonataAdminBundle/Resources/config/routing/sonata_admin.xml"
prefix: /admin
_sonata_admin:
resource: .
type: sonata_admin
prefix: /admin
admin:
resource: '@SonataAdminBundle/Resources/config/routing/sonata_admin.xml'
prefix: /admin
soanata_user:
resource: '@SonataUserBundle/Resources/config/routing/admin_security.xml'
prefix: /admin
sonata_user_admin_resetting:
resource: '@SonataUserBundle/Resources/config/routing/admin_resetting.xml'
prefix: /admin/resetting// config/packages/security.yaml
security:
encoders:
FOS\UserBundle\Model\UserInterface: bcrypt
providers:
fos_userbundle:
id: fos_user.user_provider.username
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
# -> custom firewall for the admin area of the URL
admin:
pattern: /admin(.*)
context: user
form_login:
provider: fos_userbundle
login_path: /admin/login
use_forward: false
check_path: /admin/login_check
failure_path: null
default_target_path: /admin/dashboard
always_use_default_target_path: true
logout:
path: /admin/logout
target: /admin/login
anonymous: true
# -> end custom configuration
# default login area for standard users
# This firewall is used to handle the public login area
# This part is handled by the FOS User Bundle
main:
pattern: .*
context: user
form_login:
provider: fos_userbundle
login_path: /login
use_forward: false
check_path: /login_check
failure_path: null
logout:
path: /admin/logout
target: /admin/login
anonymous: true
access_control:
# The WDT has to be allowed to anonymous users to avoid requiring the login with the AJAX request
- { path: ^/wdt/, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/profiler/, role: IS_AUTHENTICATED_ANONYMOUSLY }
# AsseticBundle paths used when using the controller for assets
- { path: ^/js/, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/css/, role: IS_AUTHENTICATED_ANONYMOUSLY }
# Admin login page needs to be accessed without credential
- { path: ^/admin/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/logout$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/login_check$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
# URL of FOSUserBundle which need to be available to anonymous users
- { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/login_check$, role: IS_AUTHENTICATED_ANONYMOUSLY } # for the case of a failed login
- { path: ^/user/new$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/user/check-confirmation-email$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/user/confirm/, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/user/confirmed$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/user/request-reset-password$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/user/send-resetting-email$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/user/check-resetting-email$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/user/reset-password/, role: IS_AUTHENTICATED_ANONYMOUSLY }
# Secured part of the site
# This config requires being logged for the whole site and having the admin role for the admin part.
# Change these rules to adapt them to your needs
- { path: ^/admin/, role: ROLE_ADMIN }
- { path: ^/.*, role: IS_AUTHENTICATED_ANONYMOUSLY }
# Sonata "special" roles (ROLE_SONATA_ADMIN and ROLE_SUPER_ADMIN) are configurable
role_hierarchy:
ROLE_ADMIN: [ROLE_USER, ROLE_SONATA_ADMIN]
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
# set access_strategy to unanimous, else you may have unexpected behaviors
access_decision_manager:
strategy: unanimous// config/packages/acl.yaml
acl:
connection: default// config/packages/fos_user.yaml
fos_user:
db_driver: orm # other valid values are 'mongodb' and 'couchdb'
firewall_name: main
user_class: App\Domain\Model\User\User
registration:
confirmation:
enabled: false
from_email:
address: '%env(MAILER_USER_ADDRESS)%'
sender_name: '%env(MAILER_USER_NAME)%'
service:
user_manager: sonata.user.orm.user_manager
mailer: 'fos_user.mailer.noop'
group:
group_class: App\Entity\Group
group_manager: sonata.user.orm.group_manager// config/packages/sonata_admin.yaml
sonata_admin:
title: 'Sonata Admin'
dashboard:
blocks:
- { type: sonata.admin.block.admin_list, position: left }
options:
legacy_twig_text_extension: false
security:
handler: sonata.admin.security.handler.acl
sonata_block:
blocks:
sonata.admin.block.admin_list:
contexts: [admin]// config/packages/sonata_core.yaml
sonata_core:
form:
mapping:
enabled: false// config/packages/sonata_user.yaml
sonata_user:
security_acl: true
manager_type: orm
mailer: fos_user.mailer.noop
class:
user: App\Domain\Model\User\User
group: App\Domain\Model\User\Group
Author
Thanks for your feedback @popovserhii .
This gist is 5 years old and we are no longer using admin generator like Sonata. But maybe it will help others. :)
@webdevilopers
Yeah, I know. I've just spent a couple of days to make it work. If I found your gist, then others will find.
If it isn't a secret, what admin generator are you using?
Author
Actually none. Most of our systems have a separated UI now. Our backends are mostly event-driven applications and our domain models are built according to domain-driven-design and event-sourcing. Rich models. You will never find a setter or Doctrine ORM association with full object graphs linked to each other, just references by ID.
At the bottom line prototyping may be slower. But we only built long-living apps. And admin generators just killed our productivity every time when the business logic was growing. In the beginning there may be not too much logic. But when it grows you just want that great domain model and care about the infrastructure later.
Thanks for your feedback @popovserhii .
This gist is 5 years old and we are no longer using admin generator like Sonata. But maybe it will help others. :)
Hello, could you please help me with admin bundle ? What admin are you using instead of Sonata ?
Author
Welcome @gansky-alexander.
I guess your question is adressed to @popovserhii . As mentioned we would never use any admin generators at all.
We start with out "Domain" (the business logic) and mostly use Event Sourcing. Then we add the infrastructure e.g. a framework.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Error:
You must activate the logout in your security firewall configuration.
Related issues: