Databases
StackOverflow2013
Postsdbo
POSymfony UserProvider. Can I / should I determine roles based on URL parameter?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSymfony UserProvider. Can I / should I determine roles based on URL parameter?
    primarykey
    data
    text
    <p>I'm building the next version of a my multi-tenanted Symfony application.</p> <p>Lets say that my tenants are companies. Each company has a subdomain of my application domain.</p> <p>e.g, company1.example.com, company2.example.com. </p> <p>Apache is configured with ServerAlias *.example.com</p> <p>I have written a UserProvider so that users are unique by company and email address. The same email address can be registered at company1 and company2 but they are separate users as far as Symfony is concerned. I have a service which looks at the host name to determine the company. A FilterControllerEvent handler makes a Company object magically available in controllers.</p> <p>That's all working nicely.</p> <p>But ... those companies have divisions. e.g, company1 - division 1,</p> <p>company1 - division 2,</p> <p>company2 - division 3</p> <p>For most actions, divisionId will be the first parameter so ...</p> <p>company1.example.com/1</p> <p>company1.example.com/2</p> <p>Now the complication. A user potentially has different roles at different divisions. User1 at company1 might have ROLE_BOSS at division 1 but ROLE_WORKER at division 2.</p> <p>The UserProvider loads roles from the database. This is currently based on email address and company but ... can it also be based on a URL parameter? I think I need to inject the Request object into my UserProvider and look at attributes. Are there any problems with that approach? Is this just a bit too klugy?</p> <p>I've been burning up brain cycles trying to figure the best way to do this. My requirements are basically:</p> <ul> <li><p>Single login (based on email address) for a user at a company even though they access multiple divisions and have different roles at those divisions.</p></li> <li><p>Companies are unrelated so allow same email address in different companies. If a user does have accounts at multiple companies then he can login to each separately and go between them with bookmarks or whatever. To the user they are separate, unrelated sites.</p></li> <li><p>The user should be able to go between divisions without needing to login again.</p></li> <li><p>The Symfony firewall system should "just work". User1 should be able to access company1.example.com/1/BossStuff but not company1.example.com/2/BossStuff based just on roles loaded by my UserProvider and not tedious security checking code in every controller action (been there done that).</p></li> </ul> <p>Other ways I've considered are ...</p> <ul> <li><p>Have a unique subdomain for each division. Division id implies company id so the users could still be unique by company. We no longer need the divisionId URL parameter. The problem then is that the user would need to login when moving between divisions of the same company.</p></li> <li><p>Unique subdomain for divisions as above but make the PHP session cookie .example.com rather than the subdomain. That fixes the need to login again between divisions but gets messy if you want to switch between companies. You couldn't stay logged in on both company1 and company2.</p></li> <li><p>Again, unique subdomain for divisions, cookie at subdomain, but have some other authentication mechanism so that when logging into company1-division1.example.com, it puts a unique cookie at .example.com so if you then visit company1-division2.example.com, it reads that cookie and automatically logs you in. Might work but getting a bit messy and scary from a security point of view. I'm not sure if I want to go there.</p></li> </ul> <p>I've read about authentication providers, access control lists, voters etc. I don't think they really help me much here.</p> <p>Thanks for any ideas.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. UStetranz
    1. UStetranz
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. COFor what I read, it seems to be a good case for using groups. Passing roles in the url seems pretty exploitable to me if someone figures it.
      singulars
      1. POSymfony UserProvider. Can I / should I determine roles based on URL parameter?
      1. USjmoreno
    2. COThanks. I'm not really passing roles in the URL. The URL tells the UserProvider to go get the roles that the company admin has assigned for the logged in user at this division. Division just happens to be determined by a parameter. As for groups, I suspect you're thinking of user groups in FOSUserBundle which I'm not using. I have a similar concept in my own UserProvider. The Symfony roles that my UserProvider provides are more like "permissions" then "roles". What I think of as a role is really a collection of those.
      singulars
      1. POSymfony UserProvider. Can I / should I determine roles based on URL parameter?
      1. UStetranz
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload