Form-less authentication using standard Symfony2 security

Question

I have the following scenario: I have a secured area of my domain under the pattern "/register", for which I have associated a fixed user called "registrant", with the unique role USER_REGISTRANT. The relevant security.yml sections are:

providers:
    in_memory:
        memory:
            users:
                registrant: { password: registrant, roles: 'REGISTERING_USER' }

firewalls:
    register:
        pattern: ^/register/.*
        anonymous: false
        form_login:
            login_path: /register/initiate_registration
            check_path: /register/start_registration

My goal is the following: whenever the user tries to enter the "/register" security context, she should be automatically authenticated as the user "registrant", without any form interaction or other user-side authentication steps.

I want to achieve this using the standard form-login mechanisms in Symfony2, i.e. when the user is sent to the login_path, the system should simply generate the necessary token/form data and pass it to check_path, just as would be done if the user had filled in a form and submitted it.

The general outline of the logic should go something like this:

/**
 * @Route("/register/initiate_registration", name="initiate_registration")
 */
public function startAction() {

    // TODO: Generate form data etc here

    return $this->redirect($this->generateUrl('start_registration'));
}

What steps should be taken in the login_path controller in order to get the functionality desired above?

Victor Bocharsky · Accepted Answer · 2014-01-15 08:46:54Z

1

Is this docs can be usefull for you security?

answered Jan 15, 2014 at 8:46

Victor Bocharsky

12.4k14 gold badges66 silver badges92 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

csvan Over a year ago

I have read the documentation already, it unfortunately does not address (to my knowledge) what I want to do here.

Victor Bocharsky Over a year ago

Is it that you need? How to programmatically login/authenticate a user?

csvan Over a year ago

That is the solution I am currently using, but I would like to do it purely using the form-mechanics, i.e. I don't want to set any tokens or access the security context manually in the controller.

Chris P. Bacon Over a year ago

You should be aware of the fact, that anybody could address a brute force attack on that route and flood your database with fake-registrants.

Collectives™ on Stack Overflow

Form-less authentication using standard Symfony2 security

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related