AclVoter denies access to 'LIST'

Question

As soon as I set sonata_admin.security.handler to sonata.admin.security.handler.acl the only user who has access is the one with ROLE_SUPER_ADMIN. I think I configured everything right, obviously not.

I tried:

• to give the user the real role ROLE_VIP_CONTACT_ADMIN instead of assigning by a fos_group, no success.
• all options forsecurity.access_decision_manager.strategy: affirmative, consensus and unanimous
• to delete all acl tables, acl:init, sonata:admin:setup-acl, with and without sonata:admin:generate-object-acl and cleared the cache every time.

With no success.

# Acme\MyBundle\Controller\CRUDController.php

$securityContext->getAdminPermissions();
# -> ["CREATE", "LIST", "DELETE", "UNDELETE", "EXPORT", "OPERATOR", "MASTER"]

dump($this->admin->getSecurityInformation());
/* -> array:3 [▼
  "GUEST" => array:2 [▼
    0 => "VIEW"
    1 => "LIST"
  ]
  "STAFF" => array:3 [▼
    0 => "EDIT"
    1 => "LIST"
    2 => "CREATE"
  ]
  "ADMIN" => array:3 [▼
    0 => "MASTER"
    1 => "OPERATOR"
    2 => "EXPORT"
  ]
] */

dump($this->getUser()->getRoles());
/* -> array:15 [▼
  0 => "ROLE_ADMIN"
  1 => "ROLE_VIP_CONTACT_GUEST"
  2 => "ROLE_VIP_CONTACT_STAFF"
  3 => "ROLE_VIP_CONTACT_ADMIN"  # <--- I gave him everything!
  [...]
  9 => "ROLE_ALLOWED_TO_SWITCH"
  [...]
  16 => "ROLE_USER"
] */

Now I open my browser and go to app_dev.php/my-path-to/vip/contact/list, resulting in an AccessDeniedException.

/edit: It's the same problem as here ACL + SonataAdminBundle + SonataUserBundle.

Answer 1

After hours of debugging, the result is to let ACL know about the LIST permission by using Sonata's AdminPermissionMap. See SonataAdminBundle 5. Security and Documentation » Admin (Ctrl+F: security.acl.permission.map.class)

parameters:
    security.acl.permission.map.class: Sonata\AdminBundle\Security\Acl\Permission\AdminPermissionMap

You might already know this.

To make a long story short: Configuration is not only done by writing some config files, but also to import the right ones.

Answer 2

On Symphony >3.1 you should use this:

services:
  security.acl.permission.map:
    class: Sonata\AdminBundle\Security\Acl\Permission\AdminPermissionMap

instead

parameters: security.acl.permission.map.class: Sonata\AdminBundle\Security\Acl\Permission\AdminPermissionMap