We have a system in which administrators and standard users are processed by individual security providers. This caused a problem on the administration pages because administrators cannot access the files or images located behind the firewall of the main site unless they are also logged in to the main site.
Images and files must be accessible to all authenticated users and administrators, regardless of provider. They are served through a controller that provides more precise access control.
Is it possible to define more than one provider to allow access to the route?
Here is a stripped down version of our current security.yml:
security:
providers:
admin_user_db:
entity: { class: OurAdminUserBundle:AdminUser, property: username }
site_user_db:
entity: { class: OurSiteUserBundle:SiteUser, property: username }
firewalls:
admin_login:
pattern: ^/admin/login$
security: false
site_user_login:
pattern: ^/login
security: false
file_route:
pattern: ^/file
anonymous: ~
admin_secured_area:
pattern: ^/admin
http_basic: ~
provider: admin_user_db
form_login:
check_path: /admin/login_check
login_path: /admin/login
logout:
path: /admin/logout
target: /
site_secured_area:
pattern: .*
http_basic: ~
provider: site_user_db
form_login:
check_path: /check_login
login_path: /login
failure_path: /login
failure_forward: false
logout:
path: /logout
target: /