title: Symfony 2: Two step (not two-factor) authentication
body: <p>I need to implement a two step (not two-factor) authentication in Symfony 2.3. The first step is the usual user+password+csrf form. The second step is "Terms &amp; Conditions", which the user should see when they first log in or when the terms are updated, and they should have to tick a box in order to proceed to the rest of the site.</p>
  
  <p>The second step isn't really an authentication step, but a user shouldn't be able to access the rest of the site unless that second step is acted upon, so it makes sense to conceptually think of it as part of the authentication.</p>
  
  <p>While writing this, the rubber duck tells me that I should think about authorisation instead, and the idea of starting the user on a "didn't accept terms yet" role, and updating the role to "fully authorised user" if the terms have been accepted. This sounds like the most sound solution so far, as I can let the firewall take care of the logic.</p>
  
  <p>Stumbled upon these pieces of information so far:<br>
  <a href="http://blogsh.de/2011/11/15/change-user-roles-during-a-session-in-symfony/" rel="nofollow">http://blogsh.de/2011/11/15/change-user-roles-during-a-session-in-symfony/</a><br>
  <a href="http://php-and-symfony.matthiasnoback.nl/2012/07/symfony2-security-creating-dynamic-roles-using-roleinterface/" rel="nofollow">http://php-and-symfony.matthiasnoback.nl/2012/07/symfony2-security-creating-dynamic-roles-using-roleinterface/</a></p>
  
  <p>There's one behaviour that I expect to encounter as I dig deeper into this: the firewall will display an error instead of re-directing the user to the Terms page and then let them on their way once they accept them.</p>
  
  <p>Has anybody done this before, so I have to invent as little of the wheel as possible?</p>