namespace AppBundle\Security;

use AppBundle\Entity\User;
use Symfony\component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Symfony\Component\Security\Core\Authorization\AcceSSDecisionManagerInterface;

class UserVoter extends Voter
{

    private $decisionManager;

    public function __construct(AccessDecisionManagerInterface $decisionManager)
    {
        $this->decisionManager = $decisionManager;
    }

    protected function supports($attribute,$subject)
    {

        // only Vote on User objects inside this Voter
        if (!$subject instanceof User) {
            return false;
        }

        return true;
    }

    protected function VoteOnAttribute($attribute,$subject,TokenInterface $token)
    {
        // ROLE_SUPER_ADMIN can do anything! The power!
        if ($this->decisionManager->decide($token,array('ROLE_SUPER_ADMIN'))) {
            return true;
        }

        $user = $token->getUser();

        if (!$user instanceof User) {
            // the user must be LOGged in; if not,deny access
            return false;
        }

        /** @VAR User $targetUser */
        $targetUser = $subject;

        // Put your custom logic here
        switch ($attribute) {
            case "ROLE_SONATA_ADMIN_USER_VIEW":
                return true;
            case "ROLE_SONATA_ADMIN_USER_EDIT":
                return ($user === $targetUser);
        }
        return false;

    }
}

然后,您创建服务

sonata_admin.user_Voter:
    class: AppBundle\Security\UserVoter
    arguments: ['@security.access.decision_manager']
    public: false
    tags:
        - { name: security.Voter }

小心access decision strategy,如果定义为一致或共识,我可能无法工作,具体取决于您的配置

如果您不希望为每个用户提供对用户列表的访问权限,您还可以向用户自己的编辑页面添加直接链接/路由.

编辑

要限制用户角色编辑,因为您不希望用户编辑自己的角色,您只需编辑configureFormFields函数：

protected function configureFormFields(FormMapper $formMapper)
{
    $formMapper
        ->add('username')
        ->add('plainPassword','text',array(
                 'required' => false,)
        )
        /* your other fields */
    ;



    if ($this->isGranted('ROLE_SUPER_ADMIN')) {
        $formMapper->add('roles',\Symfony\Component\Form\Extension\Core\Type\CollectionType::class,array(
            'entry_type'   => \Symfony\Component\Form\Extension\Core\Type\ChoiceType::class,'entry_options'  => array(
                'choices'  => array(
                    "ROLE_OPTICKSB2B" => "ROLE_OPTICKSB2B","ROLE_ADMIN" => "ROLE_ADMIN","ROLE_SUPER_ADMIN" => "ROLE_SUPER_ADMIN"
                ),)
        ));
    }

    $formMapper
        ->add('isActive')
        ->add('title')
        ->add('Firstname')
        ->add('lastname')
    ;
}

显然,Symfony表单组件将检查您,而不是添加其他字段.