Configuration¶

Everything lives under one root key, access_control. There is no enabled flag: registering the bundle is the opt-in.

# config/packages/access_control.yaml
access_control:
    default_strategy: permit_overrides
    allow_if_all_abstain: false
    allow_if_equal_granted_denied: true
    role_prefix: 'ROLE_'

The decision settings¶

Key	Default
`default_strategy`	`permit_overrides`	The combining algorithm applied when a request names none. One of `permit_overrides`, `deny_overrides`, `majority`, `first_applicable`.
`allow_if_all_abstain`	`false`	What to answer when no voter had anything to say.
`allow_if_equal_granted_denied`	`true`	Whether `majority` grants when both sides weigh the same.
`role_prefix`	`ROLE_`	The prefix an attribute must carry to be read as a role.

See Combining Algorithms for what each one does and for the Security names they correspond to.

role_prefix is the one setting with no equivalent in SecurityBundle, where 'ROLE_' comes from a constructor default and can only be changed by redefining the service.

If your application has Security, declare it there¶

An application with SecurityBundle keeps declaring these under security.access_decision_manager, and the bridge reads them. Do not declare the same thing on both keys.

Saying it twice does not silently pick one: the bundle raises at compile time on two algorithms named at once, on two contradictory values of allow_if_all_abstain, on two role hierarchies, and on two sets of URL rules. A build that stops is the point; access rules that quietly loosen are what this avoids.

Role hierarchy¶

access_control:
    role_hierarchy:
        ROLE_ADMIN: [ROLE_USER]
        ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

The shape is that of security.role_hierarchy, down to the normalisations, so a hierarchy reads the same whichever key declares it and moves across without being rewritten.

Declare it here only when the application has no Security. With SecurityBundle installed, keep it in security.yaml: the bridge points this component's service at security.role_hierarchy, so one tree serves both stacks and an application that replaced that service is honoured here too. Declaring it on both keys raises at compile time.

The adaptation goes that way round on purpose. Putting this component's implementation behind security.role_hierarchy would break every application typed against Security's interface, which this component does not implement and must not, the notion of role being on its way out of there.

URL rules¶

access_control:
    rules:
        - { path: ^/admin, roles: [ROLE_ADMIN] }
        - { path: ^/api, requires_channel: https }

The options are those of security.access_control. The key is rules rather than access_control, which would have read as access_control.access_control.

They are not a duplicate of Security's, and the difference matters. See URL Rules.

Services you may want to replace¶

Service	What it does
`access_control.requester_provider`	Tells the component who is currently asking. An alias, pointing at the static provider by default and at the token storage when Security is installed.
`access_control.manager`	The manager. Aliased from `AccessControlManagerInterface`.
`access_control.checker`	Binds the current requester to a question. Aliased from `RequesterBoundChecker`.
`access_control.role_hierarchy`	Aliased from `RoleHierarchyInterface`.

Replacing the requester provider is what makes the whole component work in an application with no Security at all: every entry point asks that one service. See Requesters and Actors.

Registering your own pieces¶

Implementing the interface is enough; autoconfiguration does the rest.

Interface	Tag
`AccessControl\VoterInterface`	`access_control.voter`
`AccessControl\Strategy\StrategyInterface`	`access_control.strategy`
`AccessControl\Handler\AccessPolicyHandlerInterface`	`access_control.policy_handler`

bin/console debug:container --tag=access_control.voter

debug:container may report these three tags as unused. That is cosmetic: FrameworkBundle's list of known tags does not include them, this bundle living outside the Symfony repository.