@schmittjoh As you previously rejected such change saying it was a security issue, please explain why (and add a comment in the code to avoid later changes)

This pull requestpasses (mergedd624d1d into48e384b).

similar PR:#5076

We're also using RoleInterface. This would be really nice to have, as it makes Symfony2 even more flexible. Please@schmittjoh why is it a security vulnerability?

A quick and dirty workaround that worked for me:

In my app/config/config.xml

    <parameters>        <parameterkey="security.acl.security_identity_retrieval_strategy.class">{my bundle}\Security\Acl\Domain\SecurityIdentityRetrievalStrategy</parameter>    </parameters>

Copy SecurityIdentityRetrievalStrategy to {my bundle}\Security\Acl\Domain\SecurityIdentityRetrievalStrategy
Copy RoleSecurityIdentity to {my bundle}\Security\Acl\Domain\RoleSecurityIdentity
Patch your own RoleSecurityIdentity with this PR (da5ec3b)
Do not forget to change the "equals" method like so:

/**     * {@inheritDoc}     */publicfunctionequals(SecurityIdentityInterface$sid)    {if (!$sidinstanceof RoleSecurityIdentity && !$sidinstanceof SymfonyRoleSecurityIdentity) {returnfalse;        }return$this->role ===$sid->getRole();    }

Any news about this?

@schmittjoh ping

Closing as this is a duplicate.