0

I have the following scenario: I have a secured area of my domain under the pattern "/register", for which I have associated a fixed user called "registrant", with the unique role USER_REGISTRANT. The relevant security.yml sections are:

providers:
    in_memory:
        memory:
            users:
                registrant: { password: registrant, roles: 'REGISTERING_USER' }

firewalls:
    register:
        pattern: ^/register/.*
        anonymous: false
        form_login:
            login_path: /register/initiate_registration
            check_path: /register/start_registration

My goal is the following: whenever the user tries to enter the "/register" security context, she should be automatically authenticated as the user "registrant", without any form interaction or other user-side authentication steps.

I want to achieve this using the standard form-login mechanisms in Symfony2, i.e. when the user is sent to the login_path, the system should simply generate the necessary token/form data and pass it to check_path, just as would be done if the user had filled in a form and submitted it.

The general outline of the logic should go something like this:

/**
 * @Route("/register/initiate_registration", name="initiate_registration")
 */
public function startAction() {

    // TODO: Generate form data etc here

    return $this->redirect($this->generateUrl('start_registration'));
}

What steps should be taken in the login_path controller in order to get the functionality desired above?

csvan
  • 8,782
  • 12
  • 48
  • 91

1 Answers1

1

Is this docs can be usefull for you security?

Victor Bocharsky
  • 11,930
  • 13
  • 58
  • 91
  • I have read the documentation already, it unfortunately does not address (to my knowledge) what I want to do here. – csvan Jan 15 '14 at 09:10
  • 1
    Is it that you need? [How to programmatically login/authenticate a user?](http://stackoverflow.com/questions/9550079/how-to-programmatically-login-authenticate-a-user) – Victor Bocharsky Jan 15 '14 at 09:12
  • That is the solution I am currently using, but I would like to do it purely using the form-mechanics, i.e. I don't want to set any tokens or access the security context manually in the controller. – csvan Jan 15 '14 at 10:21
  • You should be aware of the fact, that anybody could address a brute force attack on that route and flood your database with fake-registrants. – Chris P. Bacon Jun 12 '18 at 09:23