php – Symfony 2 ACL和角色层次结构

在我的应用测试中,我创建了两个实体用户和注释都正确映射.

我已经创建了一个小控制器,根据用户将注释和数据添加到ACL表,如果我创建我的注释作为标准用户与“ROLE_USER”关联,并尝试以用户身份访问它角色’ROLE_ADMIN’我被拒绝访问,似乎完全忽略了security.yml层次结构.

我知道这可以通过添加而不是用户ID ROLE_USER等来工作,但我不想这样做.

我的代码示例如下.

CommentController

<?php

    namespace ACLTestBundleController;

    use SymfonyBundleFrameworkBundleControllerController;
    use SensioBundleFrameworkExtraBundleConfigurationRoute;
    use SensioBundleFrameworkExtraBundleConfigurationTemplate;
    use SymfonyComponentHttpFoundationRequest;
    use ACLTestBundleFormsTypecommentType;
    use ACLTestBundleEntityComment;
    use SymfonyComponentSecurityCoreExceptionAccessDeniedException;
    use SymfonyComponentSecurityAclDomainObjectIdentity;
    use SymfonyComponentSecurityAclDomainUserSecurityIdentity;
    use SymfonyComponentSecurityAclPermissionMaskBuilder;

    class DefaultController extends Controller
    {
        /**
         * @Route("/",name="_default")
         * @Template()
         */
        public function indexAction()
        {
            die('success');
        }

        /**
         * @Route("/comment/new/")
         * @Template()
         */
        public function newAction(Request $request)
        {
            $comment = new Comment();

            $form = $this->createForm(new commentType(),$comment);

            $form->handleRequest($request);

            if ($form->isValid()) {
                $comment->setUsers($this->getUser());
                $em = $this->getDoctrine()->getManager();
                $em->persist($comment);
                $em->flush();

                // creating the ACL
                $aclProvider = $this->get('security.acl.provider');
                $objectIdentity = ObjectIdentity::fromDomainObject($comment);
                $acl = $aclProvider->createAcl($objectIdentity);

                // retrieving the security identity of the currently logged-in user
                $securityIdentity = UserSecurityIdentity::fromAccount($this->getUser());

                // grant owner access
                $acl->insertObjectAce($securityIdentity,MaskBuilder::MASK_OWNER);
                $aclProvider->updateAcl($acl);
            }

            return array(
                'form' => $form->createView(),);
        }

        /**
         * @Route("/comment/{id}/",requirements={"id":"d+"})
         * @Template()
         */
        public function editAction(Request $request,$id)
        {
            $em = $this->getDoctrine()->getManager();
            $comment = $em->find('ACLTestBundle:Comment',$id);

            $securityContext = $this->get('security.context');

            // check for edit access
            if (false === $securityContext->isGranted('EDIT',$comment)) {
                throw new AccessDeniedException();
            }

            $form = $this->createForm(new commentType(),$comment);

            $form->handleRequest($request);

            if($form->isValid()){
                $em->persist($comment);
                $em->flush();
            }

            return array('form' => $form->createView());
        }
    }

security.yml

security:
        encoders:
            ACLTestBundleEntityUser: plaintext
        acl:
            connection: default

        providers:
            database:
                entity: { class: ACLTestBundle:User }

        role_hierarchy:
            ROLE_ADMIN: [ROLE_USER,ROLE_ALLOWED_TO_SWITCH]

        firewalls:
            dev:
                pattern:  ^/(_(profiler|wdt)|css|images|js)/
                security: false
            main:
                pattern:     ^/
                provider:    database
                anonymous:   true
                logout:      true
                switch_user: true
                form_login:
                    login_path: _security_login

        access_control:
            - { path: ^/login,roles: IS_AUTHENTICATED_ANONYMOUSLY }
            - { path: ^/,roles: IS_AUTHENTICATED_FULLY }

我很感激任何建议！