8000 [Security] add "lazy_authentication" mode to firewalls · symfony/symfony@ff128ce · GitHub
[go: up one dir, main page]
Skip to content

Commit ff128ce

Browse files
nicolas-grekasnicolas-grekas
committed
[Security] add "lazy_authentication" mode to firewalls
1 parent 9efa555 commit ff128ce

File tree

11 files changed

+310
-4
lines changed

11 files changed

+310
-4
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,7 @@ private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $facto
196196
->scalarNode('entry_point')->end()
197197
->scalarNode('provider')->end()
198198
->bool 8000 eanNode('stateless')->defaultFalse()->end()
199+
->booleanNode('lazy_authentication')->defaultFalse()->end()
199200
->scalarNode('context')->cannotBeEmpty()->end()
200201
->booleanNode('logout_on_user_change')
201202
->defaultTrue()

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,8 @@ private function createFirewalls($config, ContainerBuilder $container)
204204
list($matcher, $listeners, $exceptionListener, $logoutListener) = $this->createFirewall($container, $name, $firewall, $authenticationProviders, $providerIds, $configId);
205205

206206
$contextId = 'security.firewall.map.context.'.$name;
207-
$context = $container->setDefinition($contextId, new ChildDefinition('security.firewall.context'));
207+
$context = new ChildDefinition($firewall['stateless'] || !$firewall['lazy_authentication'] ? 'security.firewall.context' : 'security.firewall.lazy_context');
208+
$context = $container->setDefinition($contextId, $context);
208209
$context
209210
->replaceArgument(0, new IteratorArgument($listeners))
210211
->replaceArgument(1, $exceptionListener)
@@ -374,7 +375,9 @@ private function createFirewall(ContainerBuilder $container, $id, $firewall, &$a
374375
}
375376

376377
// Access listener
377-
$listeners[] = new Reference('security.access_listener');
378+
if ($firewall['stateless'] || !$firewall['lazy_authentication']) {
379+
$listeners[] = new Reference('security.access_listener');
380+
}
378381

379382
// Exception listener
380383
$exceptionListener = new Reference($this->createExceptionListener($container, $firewall, $id, $configuredEntryPoint ?: $defaultEntryPoint, $firewall['stateless']));

‎src/Symfony/Bundle/SecurityBundle/Resources/config/collectors.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
<service id="data_collector.security" class="Symfony\Bundle\SecurityBundle\DataCollector\SecurityDataCollector">
1111
<tag name="data_collector" template="@Security/Collector/security.html.twig" id="security" priority="270" />
12-
<argument type="service" id="security.token_storage" on-invalid="ignore" />
12+
<argument type="service" id="security.actual_token_storage" />
1313
<argument type="service" id="security.role_hierarchy" />
1414
<argument type="service" id="security.logout_url_generator" />
1515
<argument type="service" id="security.access.decision_manager" />

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security.xml

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,14 @@
2121
</service>
2222
<service id="Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface" alias="security.authorization_checker" />
2323

24-
<service id="security.token_storage" class="Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage" public="true">
24+
<service id="security.token_storage" class="Symfony\Component\Security\Core\Authentication\Token\Storage\LazyTokenStorage" public="true">
2525
<tag name="kernel.reset" method="setToken" />
26+
<argument type="service" id="security.actual_token_storage" />
2627
</service>
2728
<service id="Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface" alias="security.token_storage" />
2829

30+
<service id="security.actual_token_storage" class="Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage" />
31+
2932
<service id="security.helper" class="Symfony\Component\Security\Core\Security">
3033
<argument type="service">
3134
<service class="Symfony\Compone F438 nt\DependencyInjection\ServiceLocator">
@@ -150,6 +153,14 @@
150153
<argument /> <!-- FirewallConfig -->
151154
</service>
152155

156+
<service id="security.firewall.lazy_context" class="Symfony\Bundle\SecurityBundle\Security\LazyFirewallContext" abstract="true">
157+
<argument type="collection" />
158+
<argument type="service" id="security.exception_listener" />
159+
<argument /> <!-- LogoutListener -->
160+
<argument /> <!-- FirewallConfig -->
161+
<argument type="service" id="security.lazy_access_listener" />
162+
</service>
163+
153164
<service id="security.firewall.config" class="Symfony\Bundle\SecurityBundle\Security\FirewallConfig" abstract="true">
154165
<argument /> <!-- name -->
155166
<argument /> <!-- user_checker -->

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security_listeners.xml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,5 +241,13 @@
241241
<argument type="service" id="security.access_map" />
242242
<argument type="service" id="security.authentication.manager" />
243243
</service>
244+
245+
<service id="security.lazy_access_listener" class="Symfony\Component\Security\Http\Firewall\LazyAccessListener">
246+
<tag name="monolog.logger" channel="security" />
247+
<argument type="service" id="security.token_storage" />
248+
<argument type="service" id="security.access.decision_manager" />
249+
<argument type="service" id="security.access_map" />
250+
<argument type="service" id="security.authentication.manager" />
251+
</service>
244252
</services>
245253
</container>

‎src/Symfony/Bundle/SecurityBundle/Security/LazyFirewallContext.php

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Bundle\SecurityBundle\Security;
13+
14+
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
15+
use Symfony\Component\Security\Core\Exception\LazyResponseException;
16+
use Symfony\Component\Security\Http\Event\LazyResponseEvent;
17+
use Symfony\Component\Security\Http\Firewall\ExceptionListener;
18+
use Symfony\Component\Security\Http\Firewall\LazyAccessListener;
19+
use Symfony\Component\Security\Http\Firewall\ListenerInterface;
20+
use Symfony\Component\Security\Http\Firewall\LogoutListener;
21+
22+
/**
23+
* Lazily calls authentication listeners when actually required by the access listener.
24+
*
25+
* @author Nicolas Grekas <p@tchwork.com>
26+
*/
27+
class LazyFirewallContext extends FirewallContext implements ListenerInterface
28+
{
29+
private $accessListener;
30+
31+
public function __construct(iterable $listeners, ?ExceptionListener $exceptionListener, ?LogoutListener $logoutListener, ?FirewallConfig $config, LazyAccessListener $accessListener)
32+
{
33+
parent::__construct($listeners, $exceptionListener, $logoutListener, $config);
34+
35+
$this->accessListener = $accessListener;
36+
}
37+
38+
public function getListeners(): iterable
39+
{
40+
return array($this);
41+
}
42+
43+
public function handle(GetResponseEvent $event)
44+
{
45+
$this->accessListener->getTokenStorage()->setInitializer(function () use ($event) {
46+
$event = new LazyResponseEvent($event);
47+
foreach (parent::getListeners() as $listener) {
48+
$listener->handle($event);
49+
}
50+
});
51+
52+
try {
53+
$this->accessListener->handle($event);
54+
} catch (LazyResponseException $e) {
55+
$event->setResponse($e->getResponse());
56+
}
57+
}
58+
}

‎src/Symfony/Component/Security/Core/Authentication/Token/Storage/LazyTokenStorage.php

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Core\Authentication\Token\Storage;
13+
14+
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
15+
16+
/**
17+
* Lazily populates a token storage.
18+
*
19+
* @author Nicolas Grekas <p@tchwork.com>
20+
*
21+
* @final
22+
*/
23+
class LazyTokenStorage implements TokenStorageInterface
24+
{
25+
private $storage;
26+
private $initializer;
27+
28+
public function __construct(TokenStorageInterface $storage)
29+
{
30+
$this->storage = $storage;
31+
}
32+
33+
public function setInitializer(\Closure $initializer)
34+
{
35+
$this->initializer = $initializer;
36+
}
37+
38+
/**
39+
* {@inheritdoc}
40+
*/
41+
public function getToken()
42+
{
43+
if ($initializer = $this->initializer) {
44+
$this->initializer = null;
45+
$initializer();
46+
}
47+
48+
return $this->storage->getToken();
49+
}
50+
51+
/**
52+
* {@inheritdoc}
53+
*/
54+
public function setToken(TokenInterface $token = null)
55+
{
56+
$this->initializer = null;
57+
$this->storage->setToken($token);
58+
}
59+
}

‎src/Symfony/Component/Security/Core/Exception/LazyResponseException.php

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Core\Exception;
13+
14+
use Symfony\Component\HttpFoundation\Response;
15+
16+
/**
17+
* Wraps a lazily computed response in a signaling exception.
18+
*
19+
* @author Nicolas Grekas <p@tchwork.com>
20+
*/
21+
class LazyResponseException extends \Exception implements ExceptionInterface
22+
{
23+
private $response;
24+
25+
public function __construct(Response $response)
26+
{
27+
$this->response = $response;
28+
}
29+
30+
public function getResponse(): Response
31+
{
32+
return $this->response;
33+
}
34+
}

‎src/Symfony/Component/Security/Http/Event/LazyResponseEvent.php

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Http\Event;
13+
14+
use Symfony\Component\HttpFoundation\Response;
15+
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
16+
use Symfony\Component\Security\Core\Exception\LazyResponseException;
17+
18+
/**
19+
* Wraps a lazily computed response in a signaling exception.
20+
*
21+
* @author Nicolas Grekas <p@tchwork.com>
22+
*
23+
* @final
24+
*/
25+
class LazyResponseEvent extends GetResponseEvent
26+
{
27+
private $event;
28+
29+
public function __construct(parent $event)
30+
{
31+
$this->event = $event;
32+
}
33+
34+
/**
35+
* {@inheritdoc}
36+
*/
37+
public function setResponse(Response $response)
38+
{
39+
$this->stopPropagation();
40+
$this->event->stopPropagation();
41+
42+
throw new LazyResponseException($response);
43+
}
44+
45+
/**
46+
* {@inheritdoc}
47+
*/
48+
public function getKernel()
49+
{
50+
return $this->event->getKernel();
51+
}
52+
53+
/**
54+
* {@inheritdoc}
55+
*/
56+
public function getRequest()
57+
{
58+
return $this->event->getRequest();
59+
}
60+
61+
/**
62+
* {@inheritdoc}
63+
*/
64+
public function getRequestType()
65+
{
66+
return $this->event->getRequestType();
67+
}
68+
69+
/**
70+
* {@inheritdoc}
71+
*/
72+
public function isMasterRequest()
73+
{
74+
return $this->event->isMasterRequest();
75+
}
76+
}

‎src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
use Symfony\Component\Security\Core\Exception\AuthenticationException;
2222
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
2323
use Symfony\Component\Security\Core\Exception\InsufficientAuthenticationException;
24+
use Symfony\Component\Security\Core\Exception\LazyResponseException;
2425
use Symfony\Component\Security\Core\Exception\LogoutException;
2526
use Symfony\Component\Security\Http\Util\TargetPathTrait;
2627
use Symfony\Component\Security\Http\HttpUtils;
@@ -92,6 +93,8 @@ public function onKernelException(GetResponseForExceptionEvent $event)
9293
return $this->handleAuthenticationException($event, $exception);
9394
} elseif ($exception instanceof AccessDeniedException) {
9495
return $this->handleAccessDeniedException($event, $exception);
96+
} elseif ($exception instanceof LazyResponseException) {
97+
return $event->setResponse($exception->getResponse());
9598
} elseif ($exception instanceof LogoutException) {
9699
return $this->handleLogoutException($exception);
97100
}

‎src/Symfony/Component/Security/Http/Firewall/LazyAccessListener.php

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Http\Firewall;
13+
14+
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
15+
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
16+
use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
17+
use Symfony\Component\Security\Core\Authentication\Token\Storage\LazyTokenStorage;
18+
use Symfony\Component\Security\Http\AccessMapInterface;
19+
20+
/**
21+
* Enforces access control rules while allowing unauthenticated access when no attributes are found.
22+
*
23+
* @author Nicolas Grekas <p@tchwork.com>
24+
*/
25+
class LazyAccessListener extends AccessListener
26+
{
27+
private $tokenStorage;
28+
private $map;
29+
30+
public function __construct(LazyTokenStorage $tokenStorage, AccessDecisionManagerInterface $accessDecisionManager, AccessMapInterface $map, AuthenticationManagerInterface $authManager)
31+
{
32+
parent::__construct($tokenStorage, $accessDecisionManager, $map, $authManager);
33+
$this->tokenStorage = $tokenStorage;
34+
$this->map = $map;
35+
}
36+
37+
/**
38+
* {@inheritdoc}
39+
*/
40+
public function handle(GetResponseEvent $event)
41+
{
42+
list($attributes) = $this->map->getPatterns($event->getRequest());
43+
44+
if (null !== $attributes) {
45+
return parent::handle($event);
46+
}
47+
}
48+
49+
public function getTokenStorage(): LazyTokenStorage
50+
{
51+
return $this->tokenStorage;
52+
}
53+
}

0 commit comments

Comments
 (0)
0