It seems to me that there are two problems associated with the security.yml configuration.
First, one cannot override a plugin module security.yml file in the application module (as, for instance, is possible to do with other module-specific files like the templates). As example I consider the following situation: i develop an application when login is required for almost all actions. Therefore i set my application security to true (is_secure: on) in the myapp/config/security.yml file. In addition, I extend the sfGuardAuth module from the sfGuardPlugin with a registration action. Now, as I have globally secured all actions, I want to be able to enable sfGuardAuth/register from the module specific security.yml. I create myapp/modules/sfGuardAuth/config/security.yml which contains:
register:
is_secure: off
It seems to me that the sfSecurityConfigHandler doesn't process the overridden security.yml, but continues to work only with the one inside the plugins/.../sfGuardAuth/config directory.
The second problem is, that if I try to change directly the plugin security.yml and override the global is_secure: on setting for all module actions, it doesn't work. Putting
all:
is_secure.yml
inside plugins/.../sfGuardAuth/config/security.yml has no effect in the compiled modules_sfGuardAuth_config_security.yml.php file.
