Symfony2 lock full site with firewall - security

Question

I would like to close my full site and only access to authenticated users, but I would like to keep some routes to public. Public routes would be:
/
/news
/registration
All otheres are locked.
I've made a firewall which looks like this:
firewalls:
user_login:
pattern: ^/
anonymous: ~
user_area:
pattern: ^/
form_login:
login_path: _main_index #this is a route to /
logout:
path: _main_logout #this is a route to /logout
target: _main_index #this is a route to /
invalidate_session: false
access_control:
- { path: ^/news, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/registration, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/user-panel, roles: ROLE_ACTIVE_USER } #is this neccessary?
Then when I'm logging in to a restricted area (/user-panel) it sais I need to fully authenticate myself.
I store my roles in security.yml, not in database.
I hope you can help me! Thank you very much!
EDIT:
My loginCheckAction looks like this::
$encodedPassword = $this->get('user.user_service')->generatePasswordHash($user, $request->request->get('_password'));
if ($user->getPassword() == $encodedPassword) {
$user->setLastLoginOn(new \DateTime());
$this->em->user($rocker);
$this->em->flush();
$token = new UsernamePasswordToken($user, $user->getPassword(), 'user_area', array($user->getRoles()));
$request->getSession()->set('_security_user_area', serialize($token));
return $this->redirect($this->generateUrl('_user_panel'));
}

Answer 1

You need to add an catch-all firewall that requires authentication, like this:
- { path: ^/, roles: ROLE_ACTIVE_USER }
That will make all pages that aren't explicitely listed to be accessible without authentication (i.e. with IS_AUTHENTICATED_ANONYMOUSLY) inaccessible. However, since you didn't list your homepage yet, you'll need to add that too.
- { path: ^/$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
Make sure to put it above the catch-all entry, as Symfony processes entries from top to bottom, and stops when it found a matching entry.

Answer 2

You need to allow anonymus token
user_area:
pattern: ^/
form_login:
login_path: _main_index #this is a route to /
logout:
path: _main_logout #this is a route to /logout
target: _main_index #this is a route to /
invalidate_session: false
anonymous: ~

Answer 3

Try this.
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/registration, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/news, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/(css|js), roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/(_wdt|_profiler), roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: ROLE_ACTIVE_USER }
I think login_check is used internally by the symfony security system just like logout. This empty function should work.
/**
* #Route("/login_check", name="login_check")
*/
public function loginCheckAction()
{
}
If you want to redirect the user to the panel route after successful login you need to implement login event listener. Symfony documentation How to create an Event Listener.
Some resources for symfony loginlistener.
http://www.ens.ro/2012/03/14/symfony2-login-event-listener/
https://gist.github.com/smottt/1075753

Answer 4

First of all, one of the major problem was the multiple firewall on the same route.
Symfony uses /login route to login, /login_check to check credentials and /logout to log out by default. For me, all routes was good, except the login route, because I wanted to log in users from / route.
Because of this, I had to implement UserProviderInterface into my UserRepository like this: Authenticating Someone with a Custom Entity Provider - Symfony2 documentation
I just modified this on my way (I user email as username).
Logincheck and logout is working automatically, because I use the default routes.
And for all of this, you have to implement AdvancedUserInterface to Users entity!!