677f8d776c
* deactivate deprecated auto-mapping * use native month-picker with fallback on old browser * bump dependencies to new major versions * replace deprecated ARRAY column type with JSON * named arguments * nullable arguments * native lazy ghosts * update routes to use php config * disable PHP < 8.4 * use static RTL configuration * new qr code package * clear out env file * recipe updates * fix deprecations * preset new env variable if not existing * bump maria db version examples * remove deprecated api-token support * fix validator deprecations * remove timesheet category column * fix broken validator autoconfiguration * stabilize tests * fix migration syntax compatibility * fix doctrine deprecation * fix datetime format * remove constructor dependency * only include visible preferences in invoice templates * fix test container dependency * removed ProjectConstraint multi-constraint logic * allow to disable plugins in certain environments * refactor TimesheetConstraint to non-service * activate new interface methods * prevent update issues with .env * improved customer fixture * removed $user->isExportDecimal()
97 lines
3.6 KiB
YAML
97 lines
3.6 KiB
YAML
security:
|
|
# https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
|
|
password_hashers:
|
|
App\Entity\User: auto
|
|
# https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
|
|
providers:
|
|
chain_provider:
|
|
chain:
|
|
providers: [kimai_internal,kimai_ldap]
|
|
kimai_internal:
|
|
entity:
|
|
class: App\Entity\User
|
|
kimai_ldap:
|
|
id: App\Ldap\LdapUserProvider
|
|
firewalls:
|
|
dev:
|
|
# Ensure dev tools and static assets are always allowed
|
|
pattern: ^/(_(profiler|wdt)|css|images|js)/
|
|
security: false
|
|
api:
|
|
access_token:
|
|
token_handler: App\API\Authentication\AccessTokenHandler
|
|
success_handler: App\API\Authentication\AccessTokenSuccessHandler
|
|
remember_me: false
|
|
request_matcher: App\API\Authentication\ApiRequestMatcher
|
|
user_checker: App\Security\UserChecker
|
|
stateless: true
|
|
remember_me: false
|
|
provider: chain_provider
|
|
secured_area:
|
|
kimai_ldap: ~
|
|
pattern: ^/
|
|
user_checker: App\Security\UserChecker
|
|
stateless: false
|
|
entry_point: form_login
|
|
custom_authenticators:
|
|
- App\Saml\SamlAuthenticator
|
|
remember_me:
|
|
name: KIMAI_REMEMBER
|
|
secret: '%kernel.secret%'
|
|
lifetime: 604800
|
|
path: /
|
|
always_remember_me: true
|
|
# activate all configured user provider
|
|
provider: chain_provider
|
|
form_login:
|
|
check_path: security_check
|
|
login_path: login
|
|
enable_csrf: true
|
|
two_factor:
|
|
auth_form_path: 2fa_login
|
|
check_path: 2fa_login_check
|
|
remember_me_sets_trusted: true
|
|
logout:
|
|
path: logout
|
|
target: homepage
|
|
enable_csrf: false
|
|
login_throttling:
|
|
max_attempts: 5
|
|
interval: '5 minutes'
|
|
login_link:
|
|
check_route: link_login_check
|
|
signature_properties: ['id']
|
|
lifetime: 900
|
|
max_uses: 3
|
|
access_decision_manager:
|
|
# only grants access if there is no voter denying access
|
|
strategy: unanimous
|
|
allow_if_all_abstain: false
|
|
role_hierarchy:
|
|
ROLE_USER: ~
|
|
ROLE_TEAMLEAD: ROLE_USER
|
|
ROLE_ADMIN: ROLE_TEAMLEAD
|
|
ROLE_SUPER_ADMIN: ROLE_ADMIN
|
|
# Note: Only the *first* matching rule is applied
|
|
access_control:
|
|
- {path: '^/auth/2fa', role: IS_AUTHENTICATED_2FA_IN_PROGRESS}
|
|
- {path: '^/auth', roles: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}$', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/auth', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/login', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/register', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/resetting', role: PUBLIC_ACCESS}
|
|
- {path: '^/{_locale}/', roles: ROLE_USER}
|
|
- {path: '^/api', roles: IS_AUTHENTICATED}
|
|
|
|
when@test:
|
|
security:
|
|
password_hashers:
|
|
# Password hashers are resource-intensive by design to ensure security.
|
|
# In tests, it's safe to reduce their cost to improve performance.
|
|
App\Entity\User:
|
|
algorithm: auto
|
|
cost: 4 # Lowest possible value for bcrypt
|
|
time_cost: 3 # Lowest possible value for argon
|
|
memory_cost: 10 # Lowest possible value for argon
|