0

I have a site under development with the following structure:

public_html/
    index.php
    symfony_app/
    other_app/

Currently I have the root of the site behind Basic HTTP authentication during the development testing phase. I couldn't figure out why my Symfony2 authentication for a valid user (myusername) was always redirecting to the Symfony login page. In the logs after successful Symfony login

security.INFO: User "myusername" has been authenticated successfully [] []

I found:

security.INFO: Basic Authentication Authorization header found for user "otherusername" [] []

..which is the user required by .htpasswd in the root of the site. So it seems that I have an issue with, for lack of a better term, nested http authentication.

Is it possible to have a Symfony app living behind http auth without the two clashing?

Security.yml

jms_security_extra:
    secure_all_services: false
    expressions: true

security:
    encoders:
        My\UserBundle\Entity\User:
            algorithm:        sha1
            encode_as_base64: false
            iterations:       1

role_hierarchy:
    ROLE_ADMIN:  ROLE_USER

providers:
    administrators:
        entity: { class: MyUserBundle:User }

firewalls:
    dev:
        pattern:  ^/(_(profiler|wdt)|css|images|js)/
        security: false

    login:
        pattern:  ^/login$
        security: false

    secured_area:
        pattern:    ^/
        http_basic: ~
        form_login:
            login_path:  login
            check_path:  login_check
            always_use_default_target_path: true
        logout:
            path:   /logout
        switch_user: true
access_control:
    - { path: ^/, roles: ROLE_USER, requires_channel: https }
Fo.
  • 3,752
  • 7
  • 28
  • 44
  • can you paste your security.yml ? – Florian Klein Jul 09 '13 at 19:24
  • 1
    that's what I was thinking: you have `http_basic: ~ ` enabled. It means that the security will listen for hhtp basic headers, and yes, they are present (because of htaccess stuff) and thus, you're anthenticated in symfony2 thru them. – Florian Klein Jul 10 '13 at 06:27
  • 1
    solution would be to remove the `http_basic: ~` line. – Florian Klein Jul 10 '13 at 06:30
  • Sorry for the late reply, I had switched to IP based access control so I didn't test your solution right away, but I just did and I'm afraid it doesn't work. A valid user still can't log in after going through the main http auth. – Fo. Jul 11 '13 at 19:40

0 Answers0