Symfony2 - Full authentication is required to access this resource.

redirect, security, symfony

Solution

This is an old question, but deserves an answer anyway. I had almost the same issue, but instead of redirecting users I just wanted to display a 403 json page. The problem is that SF2 does not provide default functionality when there is no `form_login` or that that the default functionality is incomplete, to further research this check out SF2's ExceptionListener class's `handleAccessDeniedException` method.

The workaround the problem is to implement an entry_point on a firewall. Security Configuration doc and a little more about in Firewalls.

You just have to implement Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface interface in a service and point to that service on your entry_point. So I'm assuming you want to HTTP.302

<?php
namespace Acme\ApiBundle\Security\Firewall;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;

class EntryPoint implements AuthenticationEntryPointInterface{
  private $url;
  public function __construct($url){
    $this->url = $url;
  }
  public function start(Request $request, AuthenticationException $authException = null){
      $response = new Response(
        '',
        Response::HTTP_FOUND, //for 302 and Response::HTTP_TEMPORARY_REDIRECT for HTTP307 read about in [Response][4]
        array('Location'=>$this->url)); 
      return $response;
  }
}

EDIT: I have to add, this is a known issue and is somewhat design specific/intended error: https://github.com/symfony/symfony/issues/8467#issuecomment-163670549

Problem

I want to redirect anonymous users to the login page, but (obviously) encountered a problem. I get an error: Full authentication is required to access this resource. This is an Internal Server error. I could resolve this by adding the form_login, but I've written a custom auth provider, and using the form_login, would result in the fact that my custom ldap auth provider is not being used anymore. (which means that users cannot login any longer) ``` security: firewalls: dev: pattern: ^/(_(profiler|wdt)|css|images|js)/ security: false login: pattern: ^/login$ security: false api: pattern: ^/api security: false secured_area: pattern: ^/ anonymous: true ldap: true logout: path: /logout target: /login providers: chain_provider: chain: providers: [in_memory, ldap] in_memory: memory: users: admin: { password: adminpass } ldap: id: ldap_user_provider encoders: Symfony\Component\Security\Core\User\User: plaintext Prophets\ParkingBundle\Entity\User: plaintext access_control: - { path: ^/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY } - { path: ^/, roles: IS_AUTHENTICATED_REMEMBERED } - { path: ^/_wdt, roles: 'IS_AUTHENTICATED_ANONYMOUSLY' } ``` Anyone?

Original source