Security Configuration Reference (SecurityBundle) ¶

login_path ¶

type: string default: /login

This is the route or path that the user will be redirected to (unless use_forward is set to true) when they try to access a protected resource but aren't fully authenticated.

This path must be accessible by a normal, unauthenticated user, else you may create a redirect loop.

check_path ¶

type: string default: /login_check

This is the route or path that your login form must submit to. The firewall will intercept any requests (POST requests only, by default) to this URL and process the submitted login credentials.

Be sure that this URL is covered by your main firewall (i.e. don't create a separate firewall just for check_path URL).

failure_path ¶

type: string default: /login

This is the route or path that the user is redirected to after a failed login attempt. It can be a relative/absolute URL or a Symfony route name.

form_only ¶

type: boolean default: false

Set this option to true to require that the login data is sent using a form (it checks that the request content-type is application/x-www-form-urlencoded). This is useful for example to prevent the form login authenticator from responding to requests that should be handled by the JSON login authenticator.

use_forward ¶

type: boolean default: false

If you'd like the user to be forwarded to the login form instead of being redirected, set this option to true.

username_parameter ¶

type: string default: _username

This is the name of the username field of your login form. When you submit the form to check_path, the security system will look for a POST parameter with this name.

password_parameter ¶

type: string default: _password

This is the name of the password field of your login form. When you submit the form to check_path, the security system will look for a POST parameter with this name.

post_only ¶

type: boolean default: true

By default, you must submit your login form to the check_path URL as a POST request. By setting this option to false, you can send a GET request too.

Options Related to Redirecting after Login

always_use_default_target_path ¶

type: boolean default: false

If true, users are always redirected to the default target path regardless of the previous URL that was stored in the session.

default_target_path ¶

type: string default: /

The page users are redirected to when there is no previous page stored in the session (for example, when the users browse the login page directly).

target_path_parameter ¶

type: string default: _target_path

When using a login form, if you include an HTML element to set the target path, this option lets you change the name of the HTML element itself.

failure_path_parameter ¶

type: string default: _failure_path

When using a login form, if you include an HTML element to set the failure path, this option lets you change the name of the HTML element itself.

use_referer ¶

type: boolean default: false

If true, the user is redirected to the value stored in the HTTP_REFERER header when no previous URL was stored in the session. If the referrer URL is the same as the one generated with the login_path route, the user is redirected to the default_target_path to avoid a redirection loop.

Options Related to Logout Configuration

check_path ¶

type: string default: /login_check

This is the URL or route name the system must post to authenticate using the JSON authenticator. The path must be covered by the firewall to which the user will authenticate.

username_path ¶

type: string default: username

Use this and password_path to modify the expected request body structure of the JSON authenticator. For instance, if the JSON document has the following structure:

1
2
3
4
5
6
7
8

{
    "security": {
        "credentials": {
            "login": "dunglas",
            "password": "MyPassword"
        }
    }
}

The security configuration should be:

1
2
3
4
5
6
7
8
9
10
11

# config/packages/security.yaml
security:
    # ...

    firewalls:
        main:
            lazy: true
            json_login:
                check_path:    login
                username_path: security.credentials.login
                password_path: security.credentials.password

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

<!-- config/packages/security.xml -->
<?xml version="1.0" encoding="UTF-8" ?>
<srv:container xmlns="http://symfony.com/schema/dic/security"
    xmlns:srv="http://symfony.com/schema/dic/services"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://symfony.com/schema/dic/services
        https://symfony.com/schema/dic/services/services-1.0.xsd
        http://symfony.com/schema/dic/security
        https://symfony.com/schema/dic/security/security-1.0.xsd">

    <config>
        <firewall name="main" lazy="true">
            <json-login check-path="login"
                username-path="security.credentials.login"
                password-path="security.credentials.password"/>
        </firewall>
    </config>
</srv:container>

1
2
3
4
5
6
7
8
9
10
11
12

// config/packages/security.php
use Symfony\Config\SecurityConfig;

return static function (SecurityConfig $security) {
    $mainFirewall = $security->firewall('main');
    $mainFirewall->lazy(true);
    $mainFirewall->jsonLogin()
        ->checkPath('/login')
        ->usernamePath('security.credentials.login')
        ->passwordPath('security.credentials.password')
    ;
};

password_path ¶

type: string default: password

Use this option to modify the expected request body structure. See username_path for more details.

service ¶

type: string default: ldap

This is the name of your configured LDAP client.

dn_string ¶

type: string default: {user_identifier}

This is the string which will be used as the bind DN. The {user_identifier} placeholder will be replaced with the user-provided value (their login). Depending on your LDAP server's configuration, you may need to override this value.

query_string ¶

type: string default: null

This is the string which will be used to query for the DN. The {user_identifier} placeholder will be replaced with the user-provided value (their login). Depending on your LDAP server's configuration, you will need to override this value. This setting is only necessary if the user's DN cannot be derived statically using the dn_string config option.

User provider

Users will still be fetched from the configured user provider. If you wish to fetch your users from an LDAP server, you will need to use the LDAP User Provider and any of these authentication providers: form_login_ldap or http_basic_ldap or json_login_ldap.

user ¶

type: string default: SSL_CLIENT_S_DN_Email

The name of the $_SERVER parameter containing the user identifier used to load the user in Symfony. The default value is exposed by Apache.

credentials ¶

type: string default: SSL_CLIENT_S_DN

If the user parameter is not available, the name of the $_SERVER parameter containing the full "distinguished name" of the certificate (exposed by e.g. Nginx).

Symfony identifies the value following emailAddress= in this parameter.

provider ¶

type: string

The service ID of the user provider that should be used by this authenticator.

user ¶

type: string default: REMOTE_USER

The name of the $_SERVER parameter holding the user identifier.