Using pre Authenticated Security FirewallsEdit this page
Warning: You are browsing the documentation for Symfony 2.3, which is no longer maintained.
Read the updated version of this page for Symfony 6.1 (the current stable version).
A lot of authentication modules are already provided by some web servers, including Apache. These modules generally set some environment variables that can be used to determine which user is accessing your application. Out of the box, Symfony supports most authentication mechanisms. These requests are called pre authenticated requests because the user is already authenticated when reaching your application.
When using client certificates, your webserver is doing all the authentication
process itself. With Apache, for example, you would use the
SSLVerifyClient Require directive.
Enable the x509 authentication for a particular firewall in the security configuration:
1 2 3 4 5 6 7 8 9
# app/config/security.yml security: # ... firewalls: secured_area: pattern: ^/ x509: provider: your_user_provider
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
<!-- app/config/security.xml --> <srv:container xmlns="http://symfony.com/schema/dic/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:srv="http://symfony.com/schema/dic/services" xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd"> <config> <!-- ... --> <firewall name="secured_area" pattern="^/"> <x509 provider="your_user_provider" /> </firewall> </config> </srv:container>
1 2 3 4 5 6 7 8 9 10 11 12 13
// app/config/security.php $container->loadFromExtension('security', array( // ... 'firewalls' => array( 'secured_area' => array( 'pattern' => '^/', 'x509' => array( 'provider' => 'your_user_provider', ), ), ), ));
By default, the firewall provides the
SSL_CLIENT_S_DN_Email variable to
the user provider, and sets the
SSL_CLIENT_S_DN as credentials in the
You can override these by setting the
user and the
in the x509 firewall configuration respectively.
An authentication provider will only inform the user provider of the username
that made the request. You will need to create (or use) a "user provider" that
is referenced by the
provider configuration parameter (
in the configuration example). This provider will turn the username into a User
object of your choice. For more information on creating or configuring a user