title: Symfony2 - 2 firewalls, 1 login
body: <p><strong>Question:</strong> I want to create an admin part in my Symfony2 website that would be available only to users with a ROLE_ADMIN</p>
  
  <p>I don't know if I should create a new firewall or use acces controls. I tried to do both together but the admin part is still accessible to all users.</p>
  
  <p>Currently all the website is under secured area firewall and pages i want available to anonymous are freed with access control.</p>
  
  <p>Here is my security.yml</p>
  
  <pre><code>security:
      encoders:
          Symfony\Component\Security\Core\User\User: plaintext
          FOS\UserBundle\Model\UserInterface: sha512
  
      role_hierarchy:
          ROLE_ADMIN:       ROLE_USER
          ROLE_SUPER_ADMIN: ROLE_ADMIN
  
      providers:
          fos_userbundle:
              id: fos_user.user_provider.username_email
          my_facebook_provider:
              id: my_user.facebook_provider 
  
      firewalls:
          dev:
              pattern:  ^/(_(profiler|wdt)|css|images|js)/
              security: false
  
          login:
              pattern:  ^/login$
              security: false
              context: login
  
          admin:
              pattern: /admin/
              form_login:
                  provider: fos_userbundle
                  check_path: /login_check
                  login_path: /login
              anonymous: ~
  
          secured_area:
               pattern: ^/
              anonymous: ~
              form_login:
                   login_path: /login
                  check_path: /login_check
                  default_target_path: tk_group_homepage
                  provider: fos_userbundle
                  remember_me: true
                  csrf_provider: form.csrf_provider
              remember_me:
                  key: %secret%
                  lifetime: 31536000 # 365 days in seconds
              fos_facebook:
                  app_url: "%api_facebook_name%"
                  server_url: "%api_facebook_server%"
                  check_path: /login_facebook_check   
                  default_target_path: tk_user_homepage
                  provider: my_facebook_provider
              logout:
                  path:   fos_user_security_logout
                  target: fos_user_security_login
                  invalidate_session: false
              context: login
  
      access_control:
          - { path: ^/$, role: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/new, role: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/invitation, role: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/(subscribe|about|blog|press|contact), role: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/, role: IS_AUTHENTICATED_REMEMBERED }
          - { path: ^/admin/, role: ROLE_ADMIN }
  </code></pre>
  
  <p>I am also thinking about checking in the controller is the user has an admin role and throwing an exception if not, as my admin part is only one page currently. But I do not know if it is best practice and it could be a problem if i want to extend my admin part.</p>
  
  <p>And I do not want to create a new user provider as we would be only 2 admins.</p>
  
  <p>Thank you very much,
  Jules</p>