Symfony，“超级”管理员用户，带有硬编码密码

Question

I have a Symfony 3.3 application with users stored in db with a normal User Entity as per manual.

I need to be able to login as "admin" (which is always the user with id=2), but with a fixed "master" password which will be hardcoded (its hash, not in plain text).

So this is the idea: if the username is tech and the password is xyz, the user admin must be logged in, and a custom role must be set.

I've tried as described here, and I did:

public function loadUserByUsername($username)
{
    if($username == 'TECH') {
        /** @var $user User */
        $user = $this->createQueryBuilder('u')
            ->where('u.username = :username')
            ->setParameter('username', 'admin')
            ->getQuery()
            ->getOneOrNullResult();

        $user->setUsername('⭐ TECH');
        $user->setPassword('$2y$13$u...');
        $user->setIsTech(true);
        return $user;
    }

    return $this->createQueryBuilder('u')
        ->where('u.username = :username')
        ->setParameter('username', $username)
        ->getQuery()
        ->getOneOrNullResult();
}

And in the User entity:

public function getRoles() : array
{
    if($this->isAdmin()) {
        if($this->isTech) {
            return ['ROLE_TECH', 'ROLE_ADMIN', ...];
        }
        return ['ROLE_ADMIN', ...];
    } else {
        return ['ROLE_USER'];
    }
}

But it's not working, the user is logged in as admin, but the ROLE_TECH role is not granted, and the custom name is not set (I don't know if that is possible, if not it's not so important)

Answer 1

If you want to log in with a master password you could do it by creating an in memory user like this at security.yml

in_memory:
    memory:
        users:
            tech: {password: encoded_password, roles:['ROLE_TECH','ROLE_SUPER_ADMIN','.....']}

or you could store it at database and assign to it the proper roles. If you don't want the user/role be available for any action you could mark it as well with some boolean attribute. You are making a method like getRoles() a little bit complex just for one user.

otherwise try to refresh the user...