Question

access_control:
    - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/logout, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/recover-password, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/activate-account, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/, roles: ROLE_USER }

It seems that the access_control works fine for restricting access for different roles, but I need something like IS_AUTHENTICATED_ANONYMOUSLYonly&& ! ROLE_USER && ! ROLE_ADMIN.

I don’t want that as already logged in to allow accessing this route. If this is possible from security.yml it would be great.

Answer 1

JMSSecurityExtraBundle adds expression support.

Example from documentation:

access_control:
    - { path: ^/foo, access: "hasRole('FOO') and hasRole('BAR')" }

Further reading: Expression-based Authorization Language