Symfony 4 Sonata Admin面板：无需FosUserBundle创建管理员用户方案

嘿，我刚好在Symfony 4里用SecurityBundle配过Sonata Admin的用户管理，完全不用FosUserBundle也能搞定，给你一步步梳理：

1. 先把SecurityBundle的核心配置搞定 #

首先修改config/packages/security.yaml，配置防火墙、用户提供者和访问控制，把Sonata后台（默认路径/admin）锁起来，只有带ROLE_ADMIN的用户能进：

security:
    enable_authenticator_manager: true
    # 自动适配密码加密方式
    password_hashers:
        App\Entity\AdminUser: 'auto' # 替换成你的用户实体类

    # 指定从数据库加载用户的提供者
    providers:
        app_admin_provider:
            entity:
                class: App\Entity\AdminUser
                property: email # 用邮箱登录，换成username也可以

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        # 后台的防火墙配置
        admin:
            pattern: ^/admin
            lazy: true
            provider: app_admin_provider
            form_login:
                login_path: admin_login
                check_path: admin_login
                default_target_path: sonata_admin_dashboard # 登录成功后跳Sonata首页
            logout:
                path: admin_logout
                target: admin_login # 退出后跳登录页

    # 访问控制规则
    access_control:
        - { path: ^/admin/login, roles: PUBLIC_ACCESS } # 登录页允许匿名访问
        - { path: ^/admin, roles: ROLE_ADMIN } # 其他后台路径必须有ROLE_ADMIN

2. 调整你的用户实体类 #

确保你的用户类实现Symfony\Component\Security\Core\User\UserInterface，并且实现所有必填方法。这里给个示例，记得加上ORM注解：

// src/Entity/AdminUser.php
namespace App\Entity;

use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\User\UserInterface;

#[ORM\Entity(repositoryClass: App\Repository\AdminUserRepository::class)]
class AdminUser implements UserInterface
{
    #[ORM\Id]
    #[ORM\GeneratedValue]
    #[ORM\Column(type: 'integer')]
    private ?int $id = null;

    #[ORM\Column(type: 'string', length: 180, unique: true)]
    private ?string $email = null;

    #[ORM\Column(type: 'json')]
    private array $roles = [];

    #[ORM\Column(type: 'string')]
    private ?string $password = null;

    // Getters & Setters
    public function getId(): ?int
    {
        return $this->id;
    }

    public function getEmail(): ?string
    {
        return $this->email;
    }

    public function setEmail(string $email): self
    {
        $this->email = $email;
        return $this;
    }

    // Symfony 4.3+ 用这个方法替代getUsername
    public function getUserIdentifier(): string
    {
        return (string) $this->email;
    }

    public function getRoles(): array
    {
        $roles = $this->roles;
        // 确保每个用户至少有基础的ROLE_USER权限
        $roles[] = 'ROLE_USER';
        return array_unique($roles);
    }

    public function setRoles(array $roles): self
    {
        $this->roles = $roles;
        return $this;
    }

    public function getPassword(): string
    {
        return $this->password;
    }

    public function setPassword(string $password): self
    {
        $this->password = $password;
        return $this;
    }

    // 清空临时明文密码（如果有的话）
    public function eraseCredentials(): void
    {
        // 比如如果有$plainPassword字段，这里可以设为null
    }

    // 兼容旧版本Symfony，可留可删
    public function getUsername(): string
    {
        return $this->getUserIdentifier();
    }
}

3. 写登录/退出控制器 #

你说已经有控制器了，那可以参考这个调整，确保路由和Security配置对应上：

// src/Controller/AdminSecurityController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;

class AdminSecurityController extends AbstractController
{
    #[Route('/admin/login', name: 'admin_login')]
    public function login(AuthenticationUtils $authenticationUtils): Response
    {
        // 获取登录错误信息
        $error = $authenticationUtils->getLastAuthenticationError();
        // 获取上次输入的邮箱
        $lastEmail = $authenticationUtils->getLastUsername();

        return $this->render('admin/login.html.twig', [
            'last_email' => $lastEmail,
            'error' => $error,
        ]);
    }

    #[Route('/admin/logout', name: 'admin_logout')]
    public function logout(): void
    {
        // 这个方法不用写逻辑，SecurityBundle会自动拦截处理
        throw new \LogicException('这个方法不需要实现，防火墙会自动处理退出逻辑');
    }
}

然后写个简单的登录模板templates/admin/login.html.twig：

{% extends 'base.html.twig' %}

{% block body %}
    <div class="container mt-5">
        <h2>后台登录</h2>
        {% if error %}
            <div class="alert alert-danger mt-3">
                {{ error.messageKey|trans(error.messageData, 'security') }}
            </div>
        {% endif %}

        <form method="post" action="{{ path('admin_login') }}" class="mt-3">
            <div class="mb-3">
                <label for="email" class="form-label">邮箱</label>
                <input type="email" class="form-control" id="email" name="_username" value="{{ last_email }}" required>
            </div>
            <div class="mb-3">
                <label for="password" class="form-label">密码</label>
                <input type="password" class="form-control" id="password" name="_password" required>
            </div>
            <button type="submit" class="btn btn-primary">登录</button>
        </form>
    </div>
{% endblock %}

4. 创建管理员用户 #

没有FosUserBundle的命令，我们自己写个控制台命令来创建，方便又安全：

// src/Command/CreateAdminUserCommand.php
namespace App\Command;

use App\Entity\AdminUser;
use Doctrine\ORM\EntityManagerInterface;
use Symfony\Component\Console\Command\Command;
use Symfony\Component\Console\Input\InputArgument;
use Symfony\Component\Console\Input\InputInterface;
use Symfony\Component\Console\Output\OutputInterface;
use Symfony\Component\Console\Style\SymfonyStyle;
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;

class CreateAdminUserCommand extends Command
{
    protected static $defaultName = 'app:create-admin';
    private $em;
    private $passwordHasher;

    public function __construct(EntityManagerInterface $em, UserPasswordHasherInterface $passwordHasher)
    {
        $this->em = $em;
        $this->passwordHasher = $passwordHasher;
        parent::__construct();
    }

    protected function configure()
    {
        $this
            ->setDescription('创建一个后台管理员用户')
            ->addArgument('email', InputArgument::REQUIRED, '管理员邮箱')
            ->addArgument('password', InputArgument::REQUIRED, '管理员密码')
        ;
    }

    protected function execute(InputInterface $input, OutputInterface $output): int
    {
        $io = new SymfonyStyle($input, $output);
        $email = $input->getArgument('email');
        $password = $input->getArgument('password');

        // 检查用户是否已存在
        $existingUser = $this->em->getRepository(AdminUser::class)->findOneBy(['email' => $email]);
        if ($existingUser) {
            $io->error("邮箱 {$email} 已经存在！");
            return Command::FAILURE;
        }

        $user = new AdminUser();
        $user->setEmail($email);
        $user->setRoles(['ROLE_ADMIN']); // 给管理员权限
        // 加密密码
        $hashedPassword = $this->passwordHasher->hashPassword($user, $password);
        $user->setPassword($hashedPassword);

        $this->em->persist($user);
        $this->em->flush();

        $io->success("管理员用户 {$email} 创建成功！");
        return Command::SUCCESS;
    }
}

然后运行命令创建用户：

php bin/console app:create-admin admin@yourdomain.com YourStrongPassword123!

5. 验证Sonata权限 #

Sonata Admin默认会读取用户的roles，只要用户有ROLE_ADMIN，就能访问后台。如果需要更细粒度的权限控制，可以在Sonata配置里调整security.handler，但基础的后台锁定已经满足你的需求了。

最后启动服务器，访问/admin，会自动跳转到登录页，用刚才创建的账号登录就能进入Sonata后台啦！

内容的提问来源于stack exchange，提问作者Dimitrios Markopoulos