Skip to content

Commit acf66f9

Browse files
wouterjwouterj
committed
Move access decision strategy section
1 parent 1b00161 commit acf66f9

File tree

2 files changed

+82
-83
lines changed

2 files changed

+82
-83
lines changed

‎cookbook/security/voters.rst

Lines changed: 0 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -149,86 +149,3 @@ and tag it as a ``security.voter``:
149149
configuration file (e.g. ``app/config/config.yml``). For more information
150150
see :ref:`service-container-imports-directive`. To read more about defining
151151
services in general, see the :doc:`/book/service_container` chapter.
152-
153-
.. _security-voters-change-strategy:
154-
155-
Changing the Access Decision Strategy
156-
-------------------------------------
157-
158-
In order for the new voter to take effect, you need to change the default access
159-
decision strategy, which, by default, grants access if *any* voter grants
160-
access.
161-
162-
In this case, choose the ``unanimous`` strategy. Unlike the ``affirmative``
163-
strategy (the default), with the ``unanimous`` strategy, if only one voter
164-
denies access (e.g. the ``ClientIpVoter``), access is not granted to the
165-
end user.
166-
167-
To do that, override the default ``access_decision_manager`` section of your
168-
application configuration file with the following code.
169-
170-
.. configuration-block::
171-
172-
.. code-block:: yaml
173-
174-
# app/config/security.yml
175-
security:
176-
access_decision_manager:
177-
# strategy can be: affirmative, unanimous or consensus
178-
strategy: unanimous
179-
180-
.. code-block:: xml
181-
182-
<!-- app/config/security.xml -->
183-
<config>
184-
<!-- strategy can be: affirmative, unanimous or consensus -->
185-
<access-decision-manager strategy="unanimous">
186-
</config>
187-
188-
.. code-block:: php
189-
190-
// app/config/security.xml
191-
$container->loadFromExtension('security', array(
192-
// strategy can be: affirmative, unanimous or consensus
193-
'access_decision_manager' => array(
194-
'strategy' => 'unanimous',
195-
),
196-
));
197-
198-
That's it! Now, when deciding whether or not a user should have access,
199-
the new voter will deny access to any user in the list of blacklisted IPs.
200-
201-
Note that the voters are only called, if any access is actually checked. So
202-
you need at least something like
203-
204-
.. configuration-block::
205-
206-
.. code-block:: yaml
207-
208-
# app/config/security.yml
209-
security:
210-
access_control:
211-
- { path: ^/, role: IS_AUTHENTICATED_ANONYMOUSLY }
212-
213-
.. code-block:: xml
214-
215-
<!-- app/config/security.xml -->
216-
<config>
217-
<access-control>
218-
<rule path="^/" role="IS_AUTHENTICATED_ANONYMOUSLY" />
219-
</access-control>
220-
</config>
221-
222-
.. code-block:: php
223-
224-
// app/config/security.xml
225-
$container->loadFromExtension('security', array(
226-
'access_control' => array(
227-
array('path' => '^/', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY'),
228-
),
229-
));
230-
231-
.. seealso::
232-
233-
For a more advanced usage see
234-
:ref:`components-security-access-decision-manager`.

‎cookbook/security/voters_data_permission.rst

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,3 +220,85 @@ from the security context is called.
220220
}
221221
222222
It's that easy!
223+
224+
.. _security-voters-change-strategy:
225+
226+
Changing the Access Decision Strategy
227+
-------------------------------------
228+
229+
In order for the new voter to take effect, you need to change the default access
230+
decision strategy, which, by default, grants access if *any* voter grants
231+
access.
232+
233+
In this case, choose the ``unanimous`` strategy. Unlike the ``affirmative``
234+
strategy (the default), with the ``unanimous`` strategy, if only one voter
235+
denies access (e.g. the ``ClientIpVoter``), access is not granted to the
236+
end user.
237+
238+
To do that, override the default ``access_decision_manager`` section of your
239+
application configuration file with the following code.
240+
241+
.. configuration-block::
242+
243+
.. code-block:: yaml
244+
245+
# app/config/security.yml
246+
security:
247+
access_decision_manager:
248+
# strategy can be: affirmative, unanimous or consensus
249+
strategy: unanimous
250+
251+
.. code-block:: xml
252+
253+
<!-- app/config/security.xml -->
254+
<config>
255+
<!-- strategy can be: affirmative, unanimous or consensus -->
256+
<access-decision-manager strategy="unanimous">
257+
</config>
258+
259+
.. code-block:: php
260+
261+
// app/config/security.xml
262+
$container->loadFromExtension('security', array(
263+
// strategy can be: affirmative, unanimous or consensus
264+
'access_decision_manager' => array(
265+
'strategy' => 'unanimous',
266+
),
267+
));
268+
269+
That's it! Now, when deciding whether or not a user should have access,
270+
the new voter will deny access to any user in the list of blacklisted IPs.
271+
272+
Note that the voters are only called, if any access is actually checked. So
273+
you need at least something like
274+
275+
.. configuration-block::
276+
277+
.. code-block:: yaml
278+
279+
# app/config/security.yml
280+
security:
281+
access_control:
282+
- { path: ^/, role: IS_AUTHENTICATED_ANONYMOUSLY }
283+
284+
.. code-block:: xml
285+
286+
<!-- app/config/security.xml -->
287+
<config>
288+
<access-control>
289+
<rule path="^/" role="IS_AUTHENTICATED_ANONYMOUSLY" />
290+
</access-control>
291+
</config>
292+
293+
.. code-block:: php
294+
295+
// app/config/security.xml
296+
$container->loadFromExtension('security', array(
297+
'access_control' => array(
298+
array('path' => '^/', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY'),
299+
),
300+
));
301+
302+
.. seealso::
303+
304+
For a more advanced usage see :ref:`components-security-access-decision-manager`.

0 commit comments

Comments
 (0)