Question

How can I get a security token for any user, not only the one currently logged in ?

I would like to be able to call isGranted() on a user fetched from the database

Answer 1

isGranted() comes from the Security service, so it would be hard/unnecessary to use that to get Roles without adjusting the state of the session.

Don’t get me wrong, it’s definitely possible… This would work, for example:

public function strangeAction()
{
    // Get your User, however you normally get it
    $user = $userRepository->find($id);
    // Save the current token so you can put it back later
    $previousToken = $this->get("security.context")->getToken();
    // Create a new token
    $token = new UsernamePasswordToken($user, null, "main", $user->getRoles());
    // Update the security context with the new token
    $this->get("security.context")->setToken($token);
    // Now you have access to isGranted()
    if ($this->get("security.context")->isGranted("ROLE_SOMETHING"))
    { /* Do something here */ }
    // Don't forget to reset the token!
    $this->get("security.context")->setToken($previousToken);
}

…but that really makes no sense.

In reality, you don’t need the token. A much better way of doing this would be to add an isGranted() method into your User entity:

// Namespace\YourBundle\Entity\User.php

class User
{
    ...
    public function isGranted($role)
    {
    return in_array($role, $this->getRoles());
    }
    ...
}

Now you can get those roles in your controllers:

public function notSoStrangeAction()
{
    // Get your User, however you normally get it
    $user = $userRepository->find($id);
    // Find out if that User has a Role associated to it
    if ($user->isGranted("ROLE_SOMETHING"))
    { /* Do something here */ }
}