Deny Access in the Controller

How does ROLE_ADMIN look like in the database role column? Is it litterly a string called 'ROLE_ADMIN'? Or is ROLE_ADMIN a const somewhere?

Hey Farry7,

Haha, good question! :D That you can also easily check it yourself... didn't you download the course code and follow the tutorials coding along with us? ;) ROLE_ADMIN is literally ROLE_ADMIN string in the DB on the user record, but because user may have a few roles - roles are stored as array that is serialized to string to store in the DB :) ROLE_ADMIN is just an arbitrary name, you can come up with any string, e.g. ROLE_ADMINISTRATOR.

Cheers!

wow nice!!!

Annotation @IsGranted can I somehow use it on multiple roles?

I have tried @IsGranted(["ROLE_ADMIN","ROLE_MANAGER"]) but this doesnt work.

I would like to check if the user has at least 1 of the roles.

btw ryan you have to update email just saw it in IsGranted.php :)

Hey Peter K.!

Good question! You can use multiple roles *anywhere* in Symfony - the IsGranted() annotation, denyAccessUnlessGranted, and even in access_control I believe. But, I never do this, because, for me, it's not clear what passing 2 roles means. Is it an "OR" (ROLE_ADMIN or ROLE_MANAGER) or an "AND". The answer is "OR", but because it's not clear to look at, I don't prefer using it (https://github.com/symfony/.... Instead, I rely on role_hierarchy - i would probably give ROLE_ADMIN the ROLE_MANAGER role in the hierarchy. But, it depends on your needs - there is certainly nothing wrong with passing multiple roles :).

> btw ryan you have to update email just saw it in IsGranted.php :)

What do you mean? What email? :)

Cheers!

Oh, and I just realized I misread your first comment! IsGranted with multiple roles is NOT working? It should - it should have the same affect as passing denyAccessUnlessGranted() those same 2 roles. What are you seeing?

Cheers!

when using this:

/**
 * @IsGranted(["ROLE_ADMIN","ROLE_MANAGER"])
 */

error:

Exception thrown when handling an exception (Symfony\Component\Config\Exception\FileLoaderLoadException: [Syntax Error] Expected PlainValue, got '[' at position 11 in class App\Controller\ResourcePlanningController in /Users/peterkosak/Desktop/symfony/test/config/routes/../../src/Controller/ (which is being imported from "/Users/peterkosak/Desktop/symfony/test/config/routes/annotations.yaml"). Make sure annotations are installed and enabled.)

when using without square [

/**
 * @IsGranted("ROLE_ADMIN","ROLE_MANAGER")
 */

getting this

Exception thrown when handling an exception (Symfony\Component\Config\Exception\FileLoaderLoadException: [Syntax Error] Expected Value, got 'ROLE_MANAGER' at position 24 in class App\Controller\ResourcePlanningController in /Users/peterkosak/Desktop/symfony/test/config/routes/../../src/Controller/ (which is being imported from "/Users/peterkosak/Desktop/symfony/test/config/routes/annotations.yaml"). Make sure annotations are installed and enabled.)

it is screaming about annotation not installed but when I use only 1 role in annotation I will get Access Denied

Try this syntax:

/**
 * @IsGranted({"ROLE_ADMIN","ROLE_MANAGER"})
 */

If I remember correctly, you always use { } in annotations, never [ ] (even if it's an index array). If you'r egetting an error about the annotation not being installed, make sure you have the use statement for it:

use Sensio\Bundle\FrameworkExtraBundle\Configuration\IsGranted;

The php-annotations plugin in PhpStorm auto-adds this for me when I auto-complete the annotation :).

Cheers!

> btw ryan you have to update email just saw it in IsGranted.php :)

Ohh. I understand now! Yep, I'll probably have a lot of knpuniversity.com email addresses around in the code for a long time :p. But, that email does still work ;).

Yeaha, curly brackets work :) Thank you.