38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
security:
|
|
# No password_hashers: there are no passwords here. Authentication is OAuth2 against myep
|
|
# (plan step 6); until that lands there is no way to log in outside dev.
|
|
|
|
providers:
|
|
app_user_provider:
|
|
entity:
|
|
class: App\Entity\User
|
|
property: email
|
|
|
|
firewalls:
|
|
dev:
|
|
pattern: ^/(_profiler|_wdt|assets)/
|
|
security: false
|
|
main:
|
|
lazy: true
|
|
provider: app_user_provider
|
|
logout:
|
|
path: app_logout
|
|
|
|
access_control:
|
|
# ROLE_EMPLOYEE is the gate, not ROLE_USER: myep authenticates more people than are staff,
|
|
# and only staff may book a desk here.
|
|
- { path: ^/dev/, roles: PUBLIC_ACCESS }
|
|
- { path: ^/, roles: ROLE_EMPLOYEE }
|
|
|
|
when@dev:
|
|
security:
|
|
firewalls:
|
|
main:
|
|
# Real login is blocked on OAuth2 client registration on myep. Until then
|
|
# /dev/login lists the seeded users and logs one in without credentials.
|
|
# The entry point, the route and the controller are all dev-only, so this
|
|
# cannot leak into another environment by accident.
|
|
entry_point: App\Security\DevLoginEntryPoint
|
|
custom_authenticators:
|
|
- App\Security\DevLoginAuthenticator
|