- What is atoolo/security-bundle used for?
- It is a Symfony bundle that builds on Symfony SecurityBundle and adds Atoolo-specific configuration and extensions for role and user management maintained through the IES CMS. It also provides custom services such as canonical host handling and user profile interfaces. It fits Symfony/Atoolo applications, not generic Laravel projects.
- Can I use atoolo/security-bundle in a Laravel app?
- Generally no. The package is a Symfony bundle tightly coupled to Symfony SecurityBundle, Flex recipes, and Atoolo services, while Laravel uses a different authentication and authorization stack. Composer may install it, but you would need substantial custom integration to make it useful in Laravel.
- Which Symfony and PHP versions does atoolo/security-bundle support?
- The README badges list PHP 8.1 through 8.4, with PHP 8.1 marked as no longer checked automatically. The assessment reports Symfony 6.3+ and 7.4+ support. Confirm current Composer constraints before adopting, especially if you are on older Symfony or PHP versions.
- How do I install and configure atoolo/security-bundle?
- Install it with composer require atoolo/security-bundle. Symfony Flex recipes preconfigure security.yaml, so review and merge those changes with your existing firewalls, user providers, and role hierarchy. You may need to override services or adjust configuration to avoid conflicts with custom security logic.
- What dependencies does atoolo/security-bundle require?
- The bundle depends on atoolo/resource-bundle, which the assessment flags as dev-main, plus LexikJWTAuthenticationBundle for JWT support and Symfony SecurityBundle. The dev-main dependency is a stability and versioning risk. Check Packagist and composer.lock constraints before using it in production.
- Does atoolo/security-bundle support JWT authentication?
- Yes, it integrates LexikJWTAuthenticationBundle to support token-based authentication for APIs or SPAs. That is useful if JWT is part of your architecture but adds complexity if you only need session-based auth. Verify firewall and token configuration against your Symfony setup.
- How does IES CMS user and role management work with atoolo/security-bundle?
- The bundle provides Atoolo-specific extensions for users and roles that are maintained via the IES CMS. The README points to Atoolo documentation rather than detailing the integration. Non-Atoolo projects may need custom logic to map IES users and roles into Symfony security.
- Is atoolo/security-bundle production-ready and actively maintained?
- Sitepark appears to be the sole maintainer, and the bundle is niche to the Atoolo ecosystem. The README shows PHPStan level 9, Codecov coverage, and E2E test badges, but you should inspect the repository for unit and integration coverage. Also assess the dev-main resource-bundle dependency and the Symfony 6/7 deprecation policy.
- What are alternatives to atoolo/security-bundle for Laravel teams needing role and user management?
- For Laravel, consider Laravel Breeze, Jetstream, Fortify, spatie/laravel-permission, and Sanctum or Passport for token auth. Symfony teams can use Symfony SecurityBundle with LexikJWTAuthenticationBundle directly. Choose atoolo/security-bundle only when you need Atoolo/IES-specific behavior.
- What security and performance risks should I check before adopting atoolo/security-bundle?
- The bundle relies on Symfony SecurityBundle, but custom logic such as Realm-Property-User password handling should be audited. No public benchmarks are provided, so JWT and custom services should be load-tested for high-traffic scenarios. Check CSRF, Argon2 password hashing, configuration conflicts, and test coverage before production.