There is another quick workaround to add roles. Just edit security.yml
and add roles to ROLE_SUPER_ADMIN.
role_hierarchy:
...
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH, ROLE_FOO, ROLE_BAR, ...]
Question
I need to create a new ROLE as ROLE_ERECTA_TASK_ADMIN but I don't know how, where I must to declare to se it in a Sonata admin interface? I use Sonata Bundle to manage my User Group Role, now I have only some ROLES but I want to create some other form my Bundles.
My security.yml
role_hierarchy:
ROLE_ADMIN: [ROLE_USER, ROLE_SONATA_ADMIN]
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
# PROTEZIONE MODULO TASK
ROLE_ERECTA_TASK_ADMIN: [ROLE_ERECTA_TASK_USER]
ROLE_ERECTA_TASK_SA: [ROLE_ERECTA_TASK_ADMIN, ROLE_ALLOWED_TO_SWITCH]
SONATA:
- ROLE_SONATA_PAGE_ADMIN_PAGE_EDIT # if you are using acl then this line must be commented
Sonata Admin User manager:
Thanks in advance.
Solution 2
There is another quick workaround to add roles. Just edit security.yml
and add roles to ROLE_SUPER_ADMIN.
role_hierarchy:
...
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH, ROLE_FOO, ROLE_BAR, ...]
OTHER TIPS
I suggest you to set up the roles manually in the formMapper like that :
$formMapper->with('Roles')
->add('roles', 'choice',
array('choices'=>
array('ROLE_SUPER_ADMIN' => 'ROLE_SUPER_ADMIN', 'ROLE_...' => 'ROLE_...'),
'expanded'=> true,
'multiple'=> true))
->end();
Also add ROLE_ADMIN
and ROLE_SONATA_ADMIN
to your roles.
for a more flexible implementation one can also override vendor/sonata-project/user-bundle/Security/EditableRolesBuilder.php.
Do not edit this file directly, but do this through bundle inheritance or override the service sonata.user.editable_role_builder to inject a custom class.
I do have some customized action within my Admin classes. What I do is, just "configuring" these within the admin classes. The standard Sonata\UserBundle\Security\EditableRolesBuilder calls the public function of the Sonata BaseAdmin class "getSecurityInformation":
foreach ($admin->getSecurityInformation() as $role => $permissions) {
$role = sprintf($baseRole, $role);
if ($isMaster) {
// if the user has the MASTER permission, allow to grant access the admin roles to other users
$roles[$role] = $role;
} elseif ($this->securityContext->isGranted($role)) {
// although the user has no MASTER permission, allow the currently logged in user to view the role
$rolesReadOnly[$role] = $role;
}
}
That's where I hook in. Just overwrite this function own Admin class (I have done this in my BaseAdmin class which extends from Sonata\AdminBundle\Admin\Admin)
/**
* List here the customized roles actions which are used within the Admin class you have extended. (e.g. the
* CustomerAdmin uses a special function to login as the customer. In this case set the array to array('LOGIN') and
* use at certain points like ->isGranted('LOGIN'). This is also available in templates like
* admin.isGranted('LOGIN', object)).
* The actions you are listing here, will be appended to the standard actions: EDIT, LIST, CREATE, VIEW, DELETE,
* EXPORT, OPERATOR, MASTER.
*
* @see http://sonata-project.org/bundles/admin/master/doc/index.html
*
* @var array
*/
protected $customizedRoles = array();
/**
* {@inheritdoc}
*/
public function getSecurityInformation()
{
$standardAdminRoles = parent::getSecurityInformation();
$customizedAdminRoles = $this->getCustomizedAdminRoles();
$allAdminRoles = array_merge($standardAdminRoles, $customizedAdminRoles);
ksort($allAdminRoles);
return $allAdminRoles;
}
/**
* Get the customized roles set at property of the Admin class 'customizedRoles' prepared to append to the standard
* roles.
*
* @return array
*/
private function getCustomizedAdminRoles()
{
$customizedRoles = array();
if (is_array($this->customizedRoles) && !empty($this->customizedRoles)) {
foreach ($this->customizedRoles as $customizedRole) {
$customizedRole = strtoupper($customizedRole);
$customizedRoles[$customizedRole] = $customizedRole;
}
}
return $customizedRoles;
}
And the just fill this array in your Admin class by overwriting:
/** @{inheritdoc} */
protected $customizedRoles = array('LOGIN');
That's it. Effort and design seems to be pretty fair for me. :-)
I have found another way, thanks to Rpg600 :)
I wrote this code on vendor/bundles/Sonata/UserBundle/Form/Type/SecurityRolesType.php
public function getDefaultOptions(array $options) { $options = parent::getDefaultOptions($options);
$roles = array();
//== MY-CODE ============================================================================================================
$Role_to_add= array();
foreach ($this->pool->getContainer()->getParameter('security.role_hierarchy.roles') as $key => $value_roles_group_array)
if('_ALL'== substr($key,-4,4))
foreach ($value_roles_group_array as $key => $new_roles_string)
$roles[$new_roles_string]=$new_roles_string;
//======================================================================================================================
$rolesReadOnly = array();
...
Now in app/config/security.yml
role_hierarchy:
ROLE_ADMIN: [ROLE_USER, ROLE_SONATA_ADMIN]
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
# PROTEZIONE MODULO TASK
ROLE_ERECTA_TASK_ALL: [ROLE_ERECTA_TASK_USER, ROLE_ERECTA_TASK_ADMIN, ROLE_ERECTA_TASK_SA]
ROLE_ERECTA_TASK_ADMIN: [ROLE_ERECTA_TASK_USER]
ROLE_ERECTA_TASK_SA: [ROLE_ERECTA_TASK_ADMIN, ROLE_ALLOWED_TO_SWITCH]
SONATA:
- ROLE_SONATA_PAGE_ADMIN_PAGE_EDIT # if you are using acl then this line must be commented
When I add in the hierarchy role a ROLE ended by "_ALL" my code load all sub element inside showing the new role string in the sonata admin form user.
Now when I perform the login I can See my new Roles.