3

I have written a system in which a background PHP process (written using the RabbitMQBundle) processes messages from a message queue. The worker process updates user accounts. This may include a change in the user roles.

The problem is that a user won't notice any changes in his roles while being logged in. The new roles only get applied after logging out and in again. From a security perspective this is not desirable. A user should loose any role as soon as an administrator takes away privileges from that user in the backend system.

The question is: How can a session for a specific user be updated with the new roles? Or when that is not possible, how can the session be invalidated?

Note that in the background process we don't have an active security.context or request that we can use. Code like this therefore doesn't work:

$this->get('security.context')->setToken(null);
$this->get('request')->getSession()->invalidate();
Sander Toonen
  • 3,463
  • 35
  • 54

1 Answers1

3

You can solve this in several ways:

1) via security.always_authenticate_before_granting

You can force Symfony to refresh user on each request, effectively reloading all roles with it.

See this SO question/answer: Change the role of a distant user without having to relog

2) Via EquatableInterface:

You need to implement isEqualsTo(User) which in turn should compare everything with User class, including roles.

See this link: Create a User Class

3) Finally, you can use DBMS to store sessions. Then, it's just matter of find the record and delete it.

Community
  • 1
  • 1
Jovan Perovic
  • 19,846
  • 5
  • 44
  • 85
  • Thank you! I'll take a look at the performance impact of the first option. Any idea whether option 3 can be done with Memcache or Redis as a session store as well? – Sander Toonen Jan 16 '15 at 15:58
  • I didn't use any of those so far, but knowing the capability of each I would say that it's totally doable ;) As for the #1, I did use this option on project with ~100 users and I didn't notice any impact. This makes sense since 100 users is pretty low... – Jovan Perovic Jan 16 '15 at 16:00