CODEWITHSUNDEEP
symfonyfosuserbundlefosrestbundlefosoauthserverbundle
Romain
Romain

Reputation: 3673

RESTFul OAuth with FOSOAuthServer / FOSRest & FOSUser

I'm having difficulties to fully understand the concept of the client creation explained here. I followed the post to set up the OAuthBundle, and tried to make the changes needed to comply with FOSUser. Though I'm not sure it's perfect.

My situation

The Problem

I finished setting up the first part of the article up to the doctrine:schema:update command. Now I'm supposed to create a client.

How can I set the security for parts of the ^/api for differents ROLES ?

example:

For testing I'm using Postman (that support OAuth1 & 2, along with other means of auth).

Upvotes: 2

Views: 791

Answers (1)

Nicolai Fröhlich
Nicolai Fröhlich

Reputation: 52493

Using expressions in security.yml

In order to secure certain routes by a conditional combination of (request)-method AND (user)-role ...

... you can make use of Expressions in your security.yml.

More information can be found in the documentation chapter Securing by an Expression.

Example

Only users with role ROLE_ADMIN shall be allowed to access /api/users/{id} using a DELETE request:

# app/config/security.yml
security:
    # ...
    access_control:
        - path: "^/api/users/\d+$"
          allow_if: "'DELETE' == request.getMethod() and has_role('ROLE_ADMIN')"

Regex explanation

  • ^ begins with
  • \d+ one or more digits (= user id)
  • $ string end

Upvotes: 3

Related Questions