Missing configuration builder class when using the Security bundle without a Symfony application

I’m using the symfony/security-bundle as a standalone composer package. This is not part of a Symfony application. Just the package itself.

I’ve added the package via composer by doing composer require symfony/security-bundle.

My composer.json file looks like this

{
    ...
    "require-dev": {
        "phpunit/phpunit": "9.6"
    },
    "autoload": {
        "psr-4": {
            "App\\": "app/"
        }
    },
    "require": {
        "symfony/dependency-injection": "^5.4",
        "symfony/config": "^5.4",
        "ext-json": "*",
        "ext-pdo": "*",
        "symfony/monolog-bundle": "^3.10",
        "symfony/cache": "^5.4",
        "twig/twig": "3.0",
        "symfony/security-bundle": "^5.4"
    }
}

Please note that I’ve removed some parts for the sake of keeping the composer.json file listed here short.

I’m trying to set up a very simple firewall using the documentation. I’m using the PHP configuration, not the YAML or XML one.

I have copy + pasted the documentation example straight into my project

// config/packages/security.php
use Symfony\Config\SecurityConfig;

return static function (SecurityConfig $security) {
    // ...
    $security->firewall('dev')
        ->pattern('^/(_(profiler|wdt)|css|images|js)/')
        ->security(false)
    ;

    $security->firewall('main')
        ->lazy(true)

        // activate different ways to authenticate
        // https://symfony.com/doc/current/security.html#firewalls-authentication

        // https://symfony.com/doc/current/security/impersonating_user.html
        // ->switchUser(true)
    ;
};

The issue that I’m having is that Symfony\Config\SecurityConfig class simply doesn’t exist.

I’ve tried redownloading the packages. Clearing composer cache. Manually downloading the security bundle too.

• Do I need to install another package?

• Is this a bug in the docs? If so, do I have any options to make this work?

>Solution :

There is no bug in the documentation, that article is meant to be used to understand the Symfony Bundle within a Symfony application. Which makes senses, since "bundles" are by definition Symfony packages, with many pieces that are meant to be tied together by the Framework bundle. What makes a "package" into a "bundle" is precisely the framework integration.

In this case, the specifics of the Symfony\Config\SecurityConfig "missing" class… that class is built by the Framework bundle during container compilation. They do not come with the bundle, as explained here:

These classes are generated automatically in your project build directory and transform your bundle configuration classes into fluent interface classes with methods named after your config option

(Emphasis mine).

Without the framework bundle, those classes are simply not generated. And they do not exist in the original source, as one can easily verify.

If you want to use these packages outside a Symfony application, you’ll have to deal with the configuration yourself. You may want to check this article, that you may find useful.