Symfony2 Pre-registration and Invite System

Symfony2: Secure User Management with Pre-Registration and Invitation System (Part 1)

This two-part series explores authentication and authorization in Symfony2, focusing on a pre-registration invite system for controlled user access. Symfony2's robust framework provides detailed user management and secure interactions.

Key Features:

• Controlled Access: Administrators manage site access by inviting users, creating a closed environment.
• Secure Credentials: User data, including securely hashed passwords, is stored in a SQL database, managed via security.yml.
• Invitation Process: Unique invitation codes, sent via email, verify invitation authenticity and prevent expiration issues.
• Role-Based Access Control: The system uses roles (e.g., ROLE_ADMIN, ROLE_USER) to define access permissions for different URIs.

Part 1: Setup and Configuration

This part covers database setup and security configuration. Future installments will detail registration and login processes, along with post-login actions. We'll build upon previous SitePoint articles on Symfony2 development.

User Table Structure:

The application uses a SQL database to store user credentials. The user table includes fields for id, username, password (bcrypt hashed), email, created, logged, roles, gravatar, active, and homepage. username, password, and roles are crucial for authentication and authorization.

CREATE TABLE `user` (
    `id` INT(255) AUTO_INCREMENT NOT NULL,
    `username` VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
    `password` VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
    `email` VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
    `created` DATETIME NOT NULL,
    `logged` DATETIME NULL,
    `roles` VARCHAR(25) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
    `gravatar` VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
    `active` TINYINT(1) NOT NULL,
    `homepage` VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL,
    PRIMARY KEY (`id`)
);

Security Configuration (security.yml):

The security.yml file configures the application's security settings:

security:
    providers:
        administrators:
            entity: { class: AppBundle:User, property: username }
    encoders:
        AppBundle\Entity\User:
            algorithm: bcrypt
            cost: 12
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt|error)|css|images|js)/
            security: false
        default:
            anonymous: ~
            http_basic: ~
            form_login:
                login_path: /login
                check_path: /login_check
            logout:
                path: /logout
                target: /login
    access_control:
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/preregister, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/create, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/invite, roles: [ROLE_ADMIN] }
        - { path: ^/, roles: [ROLE_USER, ROLE_ADMIN] }

This configuration defines user providers, password encoding, login/logout mechanisms, and access control rules based on roles.

AppBundle:User Entity:

The User entity extends Symfony's UserInterface and Serializable interfaces, providing necessary methods for user management. The getRoles() method is modified to handle roles as a comma-separated string, allowing for multiple roles in the future.

Creating the Initial Admin User:

An initial admin user is created manually, with the password bcrypt-hashed using an online tool. This user is granted the ROLE_ADMIN role.

Invitation System (Part 1):

The invitation system allows administrators to invite users via email. The process involves generating a unique code, storing it in the database, and sending an email with a link containing the code and the user's email address.

Next Steps (Part 2):

Part 2 will cover the registration and login processes, along with post-login actions like updating the last login timestamp.

Frequently Asked Questions: (A comprehensive FAQ section is included in the original input, and remains largely unchanged in this output.)

The above is the detailed content of Symfony2 Pre-registration and Invite System. For more information, please follow other related articles on the PHP Chinese website!