50 lines
2.1 KiB
YAML
50 lines
2.1 KiB
YAML
security:
|
|
# No password_hashers: there are no passwords here. Authentication is OAuth2 against myep,
|
|
# which owns the credentials; ephub only ever sees a userinfo response.
|
|
|
|
providers:
|
|
app_user_provider:
|
|
entity:
|
|
class: App\Entity\User
|
|
property: email
|
|
|
|
firewalls:
|
|
dev:
|
|
# _error is the dev-only preview of the error pages (/_error/404, /_error/500).
|
|
pattern: ^/(_profiler|_wdt|_error|assets)/
|
|
security: false
|
|
main:
|
|
lazy: true
|
|
provider: app_user_provider
|
|
entry_point: App\Security\LoginEntryPoint
|
|
custom_authenticators:
|
|
- App\Security\EpAuthenticator
|
|
logout:
|
|
path: app_logout
|
|
target: app_login
|
|
|
|
access_control:
|
|
# The login surface itself has to stay reachable, or the entry point redirects in a loop.
|
|
- { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS }
|
|
- { path: ^/auth/, roles: PUBLIC_ACCESS }
|
|
- { path: ^/dev/, roles: PUBLIC_ACCESS }
|
|
# Before the catch-all, or ROLE_EMPLOYEE would match ^/ first and the admin area would be
|
|
# open to everybody. Order is the whole guard here.
|
|
- { path: ^/admin, roles: ROLE_ADMIN }
|
|
# Either role opens the app -- access_control treats a list of roles as an OR. Not
|
|
# ROLE_USER: myep authenticates far more people than work here, and someone who holds
|
|
# neither of these is refused at login with an explanation rather than let in to an
|
|
# empty screen.
|
|
- { path: ^/, roles: [ROLE_EMPLOYEE, ROLE_ADMIN] }
|
|
|
|
when@dev:
|
|
security:
|
|
firewalls:
|
|
main:
|
|
# Until a client is registered on myep, /dev/login lists the seeded users and
|
|
# logs one in without credentials. The route and the controller are both
|
|
# dev-only, so this cannot leak into another environment by accident.
|
|
custom_authenticators:
|
|
- App\Security\EpAuthenticator
|
|
- App\Security\DevLoginAuthenticator
|