Hi All,

I followed the tutorial but I can't connect via my email / tada

I'm on Symfony 5.3

LoginFormAuthenticator.php on line 83:<br />Symfony\Component\Security\Core\Exception\BadCredentialsException {#589 ▼<br /> #message: "The presented password is invalid."<br /> #code: 0<br /> #file: "/home/amine/Projets/Symfony/Symfony6/symfony-doctrine-formation/vendor/symfony/security-http/EventListener/CheckCredentialsListener.php"<br /> #line: 74<br /> -token: null

Best,
Amine

I foun the prob.

My methode getPAssword() in USer entity return null

Good night :)

Hey Amine,

I'm happy to hear you were able to find the problem yourself, well done! And thanks for sharing your solution with others ;)

Cheers!

Another question =) I thought the new hashing system always used sodium, and those hashed passwords always started with "$argon". If I use the symfony console security:encode-password indeed passwords do, but when I use the password hasher

$user->setPassword($this->passwordHasher->hashPassword($user, $user->getPlainPassword()));

I get a completely different string.

Both passwords work, just curious =)

Hey @MattWelander!

Hmm, that's interesting! The point of the "auto" is that you no longer need to really care what algorithm is being used, because it'll choose whatever the latest and greatest is. That being said, I would definitely expect that security:encode-password and using the UserPasswordHasherInterface service in PHP would use the same algorithm. The algorithm is chosen, iirc, entirely based on the User class (well, the User class is used to look up your hasher config - so basically, it's chosen based on your hasher config, which does not change between php and that console command). So I also would expect to see $argon style hashed passwords in both cases. When I just checked Symfonycasts, indeed, that IS what I see: both ways give me $argon2 style hashed password.

So... that's a mystery why doing that in PHP would result in a non-argon hasher being used - I can't explain that...

Cheers!

Hi!
Prior to sym4 (I believe) the config security - firewalls - main - form_login would make it so that any request to a page that required authentication automatically redirected to the login page.

I find that in sym5 instead the user gets an access denied exception. What would be the equivalent config to auto-redirect to the login page?

Nevermind - that question is answered a few lessons down the line =) https://symfonycasts.com/screencast/symfony-security/entry-point

This command does not work with PostgeSQL
symfony console doctrine:query:sql "SELECT * FROM user"

returned just
`

user

postgres

`

Solved - need to add -->"
symfony console doctrine:query:sql 'SELECT * FROM "user"'<br />

Hey Maxim,

Yeah, user might be a reserved keyword, usually we wrap table names with tick. Thank you for sharing your solution!

Cheers!

Hi, if this is correct way to set password without Factory ?

class UserFixtures extends Fixture
{
    private UserPasswordHasherInterface $passwordHasher;

    public function __construct(UserPasswordHasherInterface $passwordHasher)
    {
        $this->passwordHasher = $passwordHasher;
    }

    public function load(ObjectManager $manager): void
    {
         $user = new User();
         $user->setEmail('panda@example.com');
         $user->setRoles(['ROLE_ADMIN', 'ROLE_SUPERADMIN', 'ROLE_USER']);
         $user->setPlainPassword('tada');
         $user->setPassword('tada');

         $manager->persist($user);
         $manager->flush();

         $user->setPassword($this->passwordHasher->hashPassword($user, $user->getPlainPassword()));

         $manager->persist($user);
         $manager->flush();
    }
}

Hey Mepcuk!

Yes! But we can even do a bit less work:

A) You can skip setting the plain password and just do $this->passwordHasher->hashPassword($user, 'tada')

B) You only need one flush(). Remove the first one and just flush/save once after you set the real password. Also, you can then remove the $user->setPassword('tada'). I'm guessing you had that just so that your database didn't throw an error during the first flush ;).

Cheers!