Challenge 1 / 2

In security.yaml, our access_control rule for ^/admin needs the user to be an admin and fully authenticated. Why doesn't this do the job?

access_control:
    - { path: ^/admin, roles: [ROLE_ADMIN, IS_AUTHENTICATED_FULLY] }

The list is an and, but it's evaluated before the user is loaded, so it always fails.

access_control accepts only one role; a list is a configuration error.

A list of attributes is an or - any fully authenticated user, admin or not, would get in.

IS_AUTHENTICATED_FULLY isn't allowed under roles:, only inside an expression.