# To get started with security, check out the documentation:
# http://symfony.com/doc/current/security.html
security:

    role_hierarchy:
        ROLE_ADMINISTRATOR: ROLE_USER

    # http://symfony.com/doc/current/security.html#b-configuring-how-users-are-loaded
    providers:
        dashboard:
            id: surfnet.dashboard.security.service.identity

    firewalls:
        # disables authentication for assets and the profiler, adapt it according to your needs
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        saml_based:
            saml: true
            logout:
                path: /logout
                target: "%logout_redirect_url%"
                invalidate_session: true
                csrf_token_generator: security.csrf.token_manager
                csrf_parameter: 't'
                csrf_token_id: 'dashboard_logout_token'

    access_control:
        - { path: ^/saml, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
        - { path: ^/, roles: IS_AUTHENTICATED_FULLY, requires_channel: https }

# To get started with security, check out the documentation:
# http://symfony.com/doc/current/security.html
security:

    role_hierarchy:
        ROLE_ADMINISTRATOR: ROLE_USER

    # http://symfony.com/doc/current/security.html#b-configuring-how-users-are-loaded
    providers:
        dashboard:
            id: surfnet.dashboard.security.service.identity

    firewalls:
        # disables authentication for assets and the profiler, adapt it according to your needs
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        login_firewall:
            pattern:    ^/saml/metadata
            anonymous:  ~

        saml_based:
            saml: true
            logout:
                path: /logout
                target: "%logout_redirect_url%"
                invalidate_session: true
                csrf_token_generator: security.csrf.token_manager
                csrf_parameter: 't'
                csrf_token_id: 'dashboard_logout_token'

    access_control:
        - { path: ^/saml, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
        - { path: ^/, roles: IS_AUTHENTICATED_FULLY, requires_channel: https }

Allow unauthenticated access to SAML endpoints
Allow unauthenticated access to SAML endpoints
