What is the difference between ACL and user roles in Symfony2

Question

I am new to symfony2 and i am confused with the terms and what is use case for these. can anyone please explain what is the difference between

1. ACL
2. Roles
3. Groups

Answer 1

Let's take the most basic example: a Blog application (again).

When building a blog application, you often need to authenticate users and authorize them to do specific actions, like:

• authorize Bob to add a new contributor to the blog
• authorize Alice to create a new blog post
• authorize Alice to edit her own blog post
• authorize Bob to delete Alice's blog post

What is a Role

A role represents a set of permissions, hard coded in your application. When checking if a user is allowed to add a new contributor to the blog, your code checks if the current user has the Role "ROLE_ADMIN".

That's why Bob (he has the ROLE_ADMIN) is allowed to add a Alice as a new Contributor. See Symfony documentation on Security/Roles.

What is a Group

When a user belongs to a group, she's usually entitled a set of Roles. Alice belongs to the group "Contributors", so she has the Roles ROLE_STATS (she's allowed to see the blog stats) and ROLE_POST (she's allowed to post a new blog entry).

Again, this concept is not hard coded in Symfony, but developers usually think it that way. See some bit on managing Roles in a database with Groups.

ACLs

Access Control Lists come in handy when you need to take a authorization decision based on a Role + a domain object.

Alice is allowed to edit blog entries written by her only. To check this authorization, you need Alice's Roles and the Post model she's trying to edit. Symfony's documentation on ACLs is also pretty clear about that.

Oh, and Bob is allowed to edit all blog entries because he has the ROLE_ADMIN. The decision here is only based on a Role.