Symfony2 Firewall: User has right role but "Access denied"

Question

I can't get my firewall rule working correctly. I have a user that has the role D-COMPLIANCEDIALOG, and a firewall rule, that grants access to that rule: - { path: ^/ , roles: D-COMPLIANCEDIALOG }. I still get an access denied (Access denied, the user is neither anonymous, nor remember-me.).

#security.yml

security:
    encoders:
        Symfony\Component\Security\Core\User\User: plaintext
    providers:
        reddot:
            id: reddot_user_provider

    firewalls:

        dev:
            pattern:  ^/(_(profiler|wdt)|css|images|js)/
            security: false

        secured_area:
            pattern: ^/
            anonymous: ~
            http_basic: ~
            simple_form:
                authenticator: reddot_authenticator
                    check_path:    login_check
                    login_path:    login

    access_control:
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/ , roles: D-COMPLIANCEDIALOG }

User data from symfony profiler:

Username    admin
Authenticated?  yes
Roles   [D-COMPLIANCEDIALOG]
Inherited Roles     { }
Token class Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken

What I checked:

• The controller has no own security settings
• The role name does not seem to have a typo
• It is really the last line in the firewall rule, if I remove it, I do have access.

Answer 1

The role name is incorrect. Please check the documentation Security - Roles

All roles you assign to a user must begin with the ROLE_ prefix. Otherwise, they won't be handled by Symfony's security system in the normal way (i.e. unless you're doing something advanced, assigning a role like FOO to a user and then checking for FOO as described below will not work).

I have faced the same issue when entered 'incorrect' role name and was confused by the error message too.

Answer 2

Although Symfony suggest prefixing the roles with ROLE_.. You can still use your custom roles via Securing by an Expression like:

access_control:
    - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/ , allow_if: "has_role('D-COMPLIANCEDIALOG')"}