Dynamic Credentials in Symfony

For a long time now I've been using dynamic credentials in Symfony as laid out in this code snippit: http://www.symfony-project.org/snippets/snippet/18.




// to put in the actions.class.php file
function getCredential()
{
  $this->post = $this->_retrievePost(); // retrieving the object based on the request parameters
  if ($this->getUser()->isOwnerOf($this->post))
    $this->getUser()->addCredential('owner');
  else
    $this->getUser()->removeCredential('owner');

  // the hijack is over, let the normal flow continue:
  return parent::getCredential();
}

However, it seems like this isn't really the proper way to add dynamic credentials. The getCredential() method is called by the Symfony FilterChain to discover what credentials that module requires, not to add credentials to the user.

For me, the problem cam to a head when I was trying to show a link if a user had a particular credential. The problem was that the page with the link was not a secure page. Since the page was not secute (is_secure: off in the config/security.yml file) the getCretential() method was never called.

The solution is to use the preExecute() method instead of getCredential()




// to put in the actions.class.php file
function preExecute()
{
  $this->post = $this->_retrievePost(); // retrieving the object based on the request parameters
  if ($this->getUser()->isOwnerOf($this->post))
    $this->getUser()->addCredential('owner');
  else
    $this->getUser()->removeCredential('owner');

  // the hijack is over, let the normal flow continue:
  return parent::getCredential();
}