Security Upgrades

Hello everybody, I'm trying to implement security with no user table and authentication authorization all through an API, but I'm a little bit confused about what is the best way to implement it. Firstly I created the user with the make user method and Symfony creates the User class and a UserProvider class, then I check the course and learned about LoginFormAutheticator. I am already getting the response from the API with this piece of code in the class UserProvider implements UserProviderInterface, PasswordUpgraderInterface. But this method should return UserInterface and not a Passport. Do I have to implement the LoginFormAuthenticator instead of this method? What I'm missing is creating the user, the roles and processing the login. The User class created by Symfony implements UserInterface. Maybe is only an issue of filling the methods setUsername and setRoles and I can add there anything I need to store user information. Thanks for your help.

public function loadUserByIdentifier($identifier): UserInterface
{
    $user = $this->api->validateCredentials();

    dd($user->getContent());

    // Load a User object from your data source or throw UserNotFoundException.
    // The $identifier argument may not actually be a username:
    // it is whatever value is being returned by the getUserIdentifier()
    // method in your User class.
    throw new \Exception('TODO: fill in loadUserByIdentifier() inside ' . __FILE__);
}

Hey @MDelaCruzPeru

You can use the LoginFormAuthenticator if you have a login form or create a custom authenticator to fill in the logic for fetching users through the API. If I recall correctly, on a successful login, you'll need to return an instance of UserInterface, you can just add a User class to your project, it does not need to be an entity, just a holder for your users' info
You'll also need that UserProvider because Symfony will use it to reload your user object. You can learn more about Symfony's security here https://symfonycasts.com/screencast/symfony-security - The tutorial it's built on Symfony 5 but all concepts are up to date

Cheers!

Hi,

I already had the authenticate method in Symfony 5, however after upgrading to 6 I get this error when a user is not found or types in an incorrect password:

Symfony\Component\HttpFoundation\Exception\ BadRequestException
Input value "login_form" contains a non-scalar value.

<?php
use App\Kernel;
require_once dirname(__DIR__).'/vendor/autoload_runtime.php';
return function (array $context) {
    return new Kernel($context['APP_ENV'], (bool) $context['APP_DEBUG']);
};

This is the code I use:

public function authenticate(Request $request): Passport
    {
        $email = $request->get('login_form')['_username'];
        $password = $request->get('login_form')['_password'];
        return new Passport(
            new UserBadge($email, function($userIdentifier) {
                // optionally pass a callback to load the User manually
                $user = $this->em->getRepository(User::class)->findOneBy(['email' => $userIdentifier]);
                if (!$user) throw new UserNotFoundException();
                if (!$user->isEnabled()) throw new CustomUserMessageAuthenticationException('The account is deactivated.');
                if ($user->isLocked()) throw new CustomUserMessageAuthenticationException('The account is blocked.');
                return $user;
            }),
            new PasswordCredentials($password),
            [
                new CsrfTokenBadge(
                    'authenticate',
                    $request->request->get('_csrf_token')
                ),
                (new RememberMeBadge())->enable(),
            ]
        );
    }

Any idea what might cause this? It seems to not like the Exceptions I defined in the UserBadge.

Hey Dirk,

Yeah, the get() request method does not work with arrays in Symfony 6.x anymore, only with scalar values. You need to use all() instead, e.g. in your case it should be something like this:

$parameters = $request->request->all();
$email = $parameters['login_form']['_username'];
// and so on...

See a related PR https://github.com/php-translation/symfony-bundle/pull/488 for more context.

Cheers!

Spot on! Works flawlessly now. Many thanks for your quick reply, Victor!

Hey Dirk,

Awesome, thanks for confirming it helped :)

Cheers!

Hello MolloKhan,

Thank you for the quick response.

We only use http_basic_ldap.
It goes wrong when i want to start a session, when we have no PHP_AUTH_USER.
If i turn of enable_authenticator_manager everything works fine.

When I start a session and should get a popup for username, password, i get this error:

An exception has been thrown during the rendering of a template 
("Cannot autowire argument $user of "App\Controller\<controller>": it references 
interface "Symfony\Component\Security\Core\User\UserInterface" but no such service exists. Did you 
create a class that implements this interface?").

This is our services.yaml

 Symfony\Component\Ldap\Ldap:
    arguments: [ '@Symfony\Component\Ldap\Adapter\ExtLdap\Adapter' ]
    tags:
      - ldap

  Symfony\Component\Ldap\Adapter\ExtLdap\Adapter:
    arguments:
      - connection_string: 'ldap://%env(LDAP_URL)%:389'
        options:
          protocol_version: 3
          referrals: false

And this is our security.yaml

security:
  enable_authenticator_manager: true
  providers:
    my_ldap:
      ldap:
        service: Symfony\Component\Ldap\Ldap
        base_dn: ...
        search_dn: ...
        search_password: 
        default_roles: ROLE_USER

  firewalls:
    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false
    main:
      stateless: true
      provider: my_ldap
      http_basic_ldap:
        service: Symfony\Component\Ldap\Ldap
        dn_string:...

Thanks for your help

Hey Annemieke, sorry for my slow response, but I was on holiday :)

You seem to be trying to inject a User object into a controller's action. Double-check the arguments of your controller

Hi MolloKhan,

Hope you had a nice vacation.

I get errors with every url (in the controller, voter etc.).
Because the username, password popup does not show up while it should when it is a new session.
When i turn of enable_authenticator_manager the popup does show, you fill in your username and password and everything works fine.
Can i send you some code or anything for you to try and replicate this situation?
Thanks in advance.

That's interesting... yea, I think I'd need to see your code. Perhaps you could give me access to your repository?

Hi Diego,

Do do you have some base example of a working ldap authentication program with symfony 6?
I have it working with symfony 5 and with symfony 3 for the last 4 years.
And what code do you need exactly?
Thanks in advance.

With kind regards,

Annemieke

Hey Annemieke-B,

Symfony Docs have some examples about authenticating against an LDAP server, you can check it here: https://symfony.com/doc/current/security/ldap.html - unfortunately, I have never used this before, so can't help with examples, but I hope the official docs help!

Cheers!

I'm afraid I do not have a working example. I'd like to play around with your application so I can debug what's going on, but I'd understand if you cannot share your app's code. I'll ask the team if someone can jump in to help

Hi all,

It goes wrong in HttpBasicAuthenticator class.

public function supports(Request $request): ?bool
{
    return $request->headers->has('PHP_AUTH_USER');
}

Since with a new session i do not have a PHP_AUTH_USER i will never get a response true.

For testing purposes I've added a few lines of code and everything works like a charm:

public function supports(Request $request): ?bool
{
    if (!$request->headers->has('PHP_AUTH_USER')) {
        $request->headers->set('PHP_AUTH_USER', '')
    }

    return $request->headers->has('PHP_AUTH_USER');
}

But now of course i have to find out how to set PHP_AUTH_USER outside vendor code.

Hey Annemieke, an option would be to create a custom authenticator that extends from HttpBasicAuthenticator so you can override the supports() method and add those lines

Cheers!

Hi Diego, thanks for the help.
HttpBasicAuthenticator is a final class, so I cannot extend it.
Or did you mean something else?

Greetz!

ps. I think i have to do something in apache virtual hosts.

Ohh, I was not aware of that (personally, I don't like final classes too much :p). What you can do instead is to decorate the HttpBasicAuthenticator class - https://symfony.com/doc/current/service_container/service_decoration.html

Cheers!

Hi Symfony Casts,

Again, great work people, thank you very much for making these videos.
Finally got my employers to invest in its developers and arrange a team account for symfony casts !!!

My question is:
We use ldap for authentication and authorization in symfony 5.4.
This works fine as long as we do not set 'enable_authenticator_manager' to true.
We want to use the LdapAuthenticator class of course, but the code first goes to HttpBasicAuthenticator.
There the support function gives us a false because of course we do not use PHP_AUTH_USER.
If i hack this function and let it always return true, it will get to LdapAuthenticator.
When i do a dump in the AuthenticatorManager class in the constructor of $this->authenticators i get:

0 => Symfony ...\LdapAuthenticator {
    authenticator: Symfony ..\HttpBasicAuthenticator { // is this HttpBasicAuth... correct??
        userProvider: Symfo..LdapUserProvider
        ......
  }
}

Thank you very much for your help. Hope to hear from you soon, we are upgrading to sf 6!

Kind regards,

Annemieke Buijs

Hey Annemieke,

Congratulations on convincing your employers! They're not going to regret this ;)

About your problem. When you activate the enable_authenticator_manager, it enables the new Symfony security system, so you need to adapt your authenticators. Perhaps you already did it, so the next step is to set up the execution order of your custom authenticators by tweaking the security.firewalls.main.custom_authenticators config option in your security.yaml file. Symfony will call the authenticators from top to bottom and will stop calling them as soon as one of them returns true from its supports method

Cheers!