8000 Add example for using a voter to restrict switch_user by javiereguiluz · Pull Request #10842 · symfony/symfony-docs · GitHub
[go: up one dir, main page]
Skip to content

Add example for using a voter to restrict switch_user #10842

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jan 4, 2019
Merged

Add example for using a voter to restrict switch_user #10842

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
cf3bd00
[WIP] add example for using a voter to restrict switch_user
jwmickey Feb 26, 2018
e6c569b
Fix recommendations from community review
jwmickey Apr 4, 2018
876257b
implemented community suggestions
jwmickey May 18, 2018
7853ec0
Minor tweaks
javiereguiluz Jan 4, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Minor tweaks
  • Loading branch information
@javiereguiluz
javiereguiluz committed Jan 4, 2019
commit 7853ec02008b2046ab704a300feaf8ef8f86855a
24 changes: 14 additions & 10 deletions security/impersonating_user.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,13 +190,14 @@ also adjust the query parameter name via the ``parameter`` setting:
Limiting User Switching
-----------------------

If you need more control over user switching, but don't require the complexity
of a full ACL implementation, you can use a security voter. For example, you
may want to allow employees to be able to impersonate a user with the
``ROLE_CUSTOMER`` role without giving them the ability to impersonate a more
If you need more control over user switching, but don't require the complexity
of a full ACL implementation, you can use a security voter. For example, you
may want to allow employees to be able to impersonate a user with the
``ROLE_CUSTOMER`` role without giving them the ability to impersonate a more
elevated user such as an administrator.

.. versionadded:: 4.1

The target user was added as the voter subject parameter in Symfony 4.1.

Create the voter class::
Expand All @@ -223,7 +224,7 @@ Create the voter class::
return false;
}

if (in_array('ROLE_CUSTOMER', $subject->getRoles())
if (in_array('ROLE_CUSTOMER', $subject->getRoles())
&& $this->hasSwitchToCustomerRole($token)) {
return true;
}
Expand All @@ -238,16 +239,19 @@ Create the voter class::
return true;
}
}

return false;
}
}

Thanks to service autoconfiguration and autowiring, this new voter is automatically
registered as a service and tagged as a security voter.
To enable the new voter in the app, register it as a service and
:doc:`tag it </service_container/tags>` with the ``security.voter``
tag. If you're using the
:ref:`default services.yaml configuration <service-container-services-load-example>`,
this is already done for you, thanks to :ref:`autoconfiguration <services-autoconfigure>`.

Now a user who has the ``ROLE_SWITCH_TO_CUSTOMER`` role can switch to a user who explicitly has the
``ROLE_CUSTOMER`` role, but not other users.
Now a user who has the ``ROLE_SWITCH_TO_CUSTOMER`` role can switch to a user who
has the ``ROLE_CUSTOMER`` role, but not other users.

Events
------
Expand Down
0