8000 [DX][Security] Add (de)authentication information to the profiler · Issue #36668 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content

[DX][Security] Add (de)authentication information to the profiler #36668

New issue

Have a question about this project? Sign up for a free GitH 8000 ub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
3 of 6 tasks
wouterj opened this issue May 3, 2020 · 2 comments
Open
3 of 6 tasks

[DX][Security] Add (de)authentication information to the profiler #36668

wouterj opened this issue May 3, 2020 · 2 comments
Labels
DX DX = Developer eXperience (anything that improves the experience of using Symfony) Feature Help wanted Issues and PRs which are looking for volunteers to complete them. Keep open Security SecurityBundle

Comments

@wouterj
Copy link
Member
wouterj commented May 3, 2020 •
edited by fabpot
Loading

Description

It would be nice to display information about authentication in the profiler:

I think (1) can be done by creating a TraceableAuthenticator that decorates all authenticators and (2) and (3) should probably be done by an event listener on CheckPassportEvent (with a very low priority).

  • Another case where we can improve debugging is when deauthenticating. This often happens when the user provider is misconfigured (or the user is wrongly reloaded in any other way) and these are hard to debug. Adding information about deauthentication (especially why it happens) will be more helpful to debug these.

After this information is added to the profiler, we can investigate looking back at the profiler data before redirection to the login form and modifying the security item in the toolbar related to this. Most of this information is hidden behind at least one redirection (both authentication errors as deauthentication usually result in a redirect response).
@chalasr chalasr added DX DX = Developer eXperience (anything that improves the experience of using Symfony) Security SecurityBundle Feature labels May 3, 2020
@wouterj wouterj changed the title [DX][Security] Add authentication information to the profiler [DX][Security] Add (de)authentication information to the profiler Jan 19, 2021
@wouterj wouterj added the Help wanted Issues and PRs which are looking for volunteers to complete them. label Jan 19, 2021
@alexandre-daubois
Copy link
Member
alexandre-daubois commented Jun 2, 2021 •
edited
Loading

Hi @wouterj! Started to work on a little something for this issue. For now, I'm able to retrieve and display in profiler if an authenticator is able to support request and is used to authenticate the current request. Here is the result in the profiler for now:

Capture d’écran du 2021-06-02 16-31-27

I've been struggling a bit with something. As Authenticator isn't a service, I wasn't able to create a TraceableAuthenticator. Instead, I inspired myself from the TraceableAccessDecisionManager and created a TraceableAuthenticatorManager.
As AuthenticatorManager is declared as an abstract service, I can't decorate it directly. So here's what I tried:

->set('debug.security.authenticator.manager', TraceableAuthenticatorManager::class)
            ->decorate('security.authenticator.manager.main')
            ->args([
                service('debug.security.authenticator.manager.inner')
            ])

Although it works, that's a problem if the application has more than one firewall, other than the main one. Do you have any idea how to deal with this? Thanks!

@wouterj wouterj mentioned this issue Aug 15, 2021
Merged
@carsonbot
Copy link

Thank you for this suggestion.
There has not been a lot of activity here for a while. Would you still like to see this feature?

@wouterj wouterj added Keep open and removed Stalled labels Apr 20, 2022
@wouterj wouterj mentioned this issue Nov 22, 2022
Open
@Jean-Beru Jean-Beru mentioned this issue Sep 6, 2023
Merged
fabpot added a commit that referenced this issue Sep 10, 2023
@fabpot
feature #51585 [Security] Add badge resolution to profiler (Jean-Beru)
fee9b30 
This PR was squashed before being merged into the 6.4 branch.

Discussion
----------

[Security] Add badge resolution to profiler

| Q             | A
| ------------- | ---
| Branch?       | 6.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | #36668
| License       | MIT
| Doc PR        |

This PR add badges resolution status in Security profiler as mentioned in #36668 (" See which badges are resolved and which aren't").

### CSRF error

![image](https://github.com/symfony/symfony/assets/6114779/fbadfdeb-451f-4ac1-bd59-23f0cb121e6d)

### Wrong credentials

![image](https://github.com/symfony/symfony/assets/6114779/49246ffa-4152-448c-b82e-eebd43bad9d8)

### Authentication successful

![image](https://github.com/symfony/symfony/assets/6114779/1cb5f9a7-5dc2-460c-a744-0f89fb6b8e3b)

Commits
-------

2324da2 [Security] Add badge resolution to profiler
@MatTheCat MatTheCat mentioned this issue Jun 12, 2024
Closed
@MatTheCat MatTheCat mentioned this issue Jun 25, 2024
Merged
@MatTheCat MatTheCat mentioned this issue Jul 9, 2024
Merged
fabpot added a commit that referenced this issue Jul 10, 2024
@fabpot
feature #57692 [SecurityBundle] Link to the profile the token was (de…
2da6a13 
…)authenticated (MatTheCat)

This PR was merged into the 7.2 branch.

Discussion
----------

[SecurityBundle] Link to the profile the token was (de)authenticated

| Q             | A
| ------------- | ---
| Branch?       | 7.2
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Issues        | Part of #36668
| License       | MIT

When using a stateful firewall, this PR allows an easy access to the profile of the request where a user was

- authenticated: ![](https://github.com/symfony/symfony/assets/1898254/a3342407-2d2d-44ca-b271-ce35834297d4)
- de-authenticated: ![](https://github.com/symfony/symfony/assets/1898254/a279ba0f-3634-40ce-8d81-d2009729485b)

Commits
-------

e3bd133 [SecurityBundle] Link to the profile the token was (de)authenticated
fabpot added a commit that referenced this issue Jul 25, 2024
@fabpot
feature #57525 [SecurityBundle] Improve profiler’s authenticators tab…
0ca5232 
… (MatTheCat)

This PR was merged into the 7.2 branch.

Discussion
----------

[SecurityBundle] Improve profiler’s authenticators tab

| Q             | A
| ------------- | ---
| Branch?       | 7.2
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Issues        | Fix parts of #36668
| License       | MIT

This PR adds two new pieces of data to the profiler’s security panel’s authenticators tab: their “laziness” (if their `supports` method returned `null`) and the exception passed to their `onAuthenticationFailure` method.

It also redesigns the table because displaying every possible column leads to a lot of wasted space and decreases legibility:

![](https://github.com/MatTheCat/symfony/assets/1898254/0e0aeb07-a526-4d36-a4aa-40068bf170ed)
(You can see the table overflowing its container and the screen.)

Instead, I took inspiration from the messenger panel and

- reduced the number of columns to two: “status” (skipped/success/failure) and authenticator’s data
- put additional data behind a toggle, expanded by default for authenticators whose `authenticate` method was called
- wrote yes/no instead of using icons to get rid of the sense of rightness/wrongness

![](https://github.com/user-attachments/assets/8d59845d-9629-470a-89ec-49db97b99ccb)

This will also make easier to add data if needed.

Commits
-------

a8075d4 [SecurityBundle] Improve authenticators tab
@MatTheCat MatTheCat mentioned this issue Sep 11, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
DX DX = Developer eXperience (anything that improves the experience of using Symfony) Feature Help wanted Issues and PRs which are looking for volunteers to complete them. Keep open Security SecurityBundle
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@wouterj @alexandre-daubois @chalasr @carsonbot
0