Add in memory users

[spolischook]

https://github.com/symfony-cmf/standard-edition/issues/38

[lsmith77]

@WouterJ we removed this because it was removed from the SE, right?

[wouterj]

@lsmith77 yes.

I don't see why we would need to add memory users to the SE. The SE doesn't configure any security (except from an anonymous firewall) and doesn't include an admin interface (so no need to protect an admin area).

Also, unless I'm missing something, #38 is about these lines in app_dev.php, which is not related to the Security system.

[wouterj]

Oh well, my bad. This is related to the CreateBundle integration. However, in this case, we need to assign the ROLE_ADMIN role and not ROLE_SUPER_ADMIN. Also, I would prefer to not use parameters here, but just configure it in security.yml.

[dbu]

+1 for not using parameters but do it in security.yml. and add a comment around it that you want to change this in a real project?

[spolischook]

If you use in memory users you must hold all passwords in parameters.yml. If you add or remove users you need change two files. I find this way is more usable in a project with in memory users.

[dbu]

the thing is we want to strongly discourage from using this outside of demo purposes. having the passwords in plain text in a parameters.yml file is not good security

[spolischook]

so I can change "encoders" setting and live users with passwords in parameters.yml?

[wouterj]

I highly recommend to use in memory users purely for demo purposes and use a user in a database, a custom user provider with built-in users or something else in production.

[spolischook]

@WouterJ ok so what am I gonna do? We have broken behavior in fresh installation, and we need users for fixing it. I can add a comment like "Highly recommend to not use in memory users in the production environment"

[wouterj]

I propose to just add the condig.yml (so no parameter) and add a comment that this is just for demo purposes and one should use another user provider in real apps, maybe even linking to the docs

[lsmith77]

ping

[spolischook]

will fix your comments, asap, thanks for reminders!

[lsmith77]

thx!

[spolischook]

done

[lsmith77]

@spolischook thanks .. can you also add a comment as noted by @WouterJ above?

[spolischook]

done

[lsmith77]

thanks!