Question

I’m using FOSUserBundle to manager users, now I’m trying to secure some controller actions with JMS\SecurityExtraBundle. I have set ROLE_SUPER_USER on my user and protected a method with @Secure(roles="SUPER_ADMIN") but I am not allawed to call the method.

After a LOT of digging up into the code of Symfony2 I think I have traced the issue to the fact that getToken()->getRoles() only returns ROLE_USER whereas getToken()->getUser()->getRoles() correctly returns the user roles, including ROLE_SUPER_USER.

So what could be happening there?

Answer 1

HAHA

I was missing the lines :

providers:
            main:
                entity: { class: FM\SymSlateBundle\Entity\User, property: username }

in security.yml :

security:
    providers:
        main:
            entity: { class: FM\SymSlateBundle\Entity\User, property: username }
        fos_userbundle:
            id: fos_user.user_provider.username

Thus the Context was using the default user class which only has USER_ROLE