8000 [Security] added userChecker to SimpleAuthenticationProvider by i3or1s · Pull Request #26370 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content

[Security] added userChecker to SimpleAuthenticationProvider #26370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

[Security] added userChecker to SimpleAuthenticationProvider #26370

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c5bd0bd
[Security] added userChecker to SimpleAuthenticationProvider
Mar 2, 2018
63d9dce
[Security] added userChecker to SimpleAuthenticationProvider
i3or1s Mar 3, 2018
3cc426e
[Security] added userChecker to SimpleAuthenticationProvider
i3or1s Mar 4, 2018
476861e
[Security] added userChecker to SimpleAuthenticationProvider
Mar 5, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
[Security] added userChecker to SimpleAuthenticationProvider 
retrieve user from authToken, rather then fetching it from userProvider
  • Loading branch information
@i3or1s
i3or1s committed Mar 3, 2018
commit 63d9dce10bdda859f485eb6e21fccb7a30216ced
5 changes: 2 additions & 3 deletions src/Symfony/Component/Security/Core/Authentication/Provider/SimpleAuthenticationProvider.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,9 @@ public function __construct(SimpleAuthenticatorInterface $simpleAuthenticator, U

public function authenticate(TokenInterface $token)
{
$user = $this->userProvider->loadUserByUsername($token->getUsername());
$this->userChecker->checkPreAuth($user);
$authToken = $this->simpleAuthenticator->authenticateToken($token, $this->userProvider, $this->providerKey);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While I understand the need to have the user here, it would be loaded twice now

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@iltar maybe then skip the pre auth check since it can be done during authentication of the token.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if you do $this->userChecker->checkPreAuth($authToken->getUser())? I know it's not exactly correct flow wise, but it beats fetching the user twice 🤔

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@iltar I was thinking about it but it sounds strange to me to pre authenticate authenticated token.
Changin interface to exclude the userProvider would cause BC breaks.
You are correct about twice loading the user and simple authenticator could do the pre-check if needed.
Maybe best is to remove the checkPreAuth

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While it might seem strange, guard does it before/after the credentials check:

symfony/src/Symfony/Component/Security/Guard/Provider/GuardAuthenticationProvider.php

Lines 124 to 128 in a8dc953

$this->userChecker->checkPreAuth($user);
if (true !== $guardAuthenticator->checkCredentials($token->getCredentials(), $user)) {
throw new BadCredentialsException(sprintf('Authentication failed because %s::checkCredentials() did not return true.', get_class($guardAuthenticator)));
}
$this->userChecker->checkPostAuth($user);

I don't see another option to be honest, leaving it out would be as not having it at all.

$this->userChecker->checkPostAuth($user);
$this->userChecker->checkPreAuth($authToken->getUser());
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to call $authToken->getUser() twice ?

$this->userChecker->checkPostAuth($authToken->getUser());
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be moved after the instanceof check below


if ($authToken instanceof TokenInterface) {
return $authToken;
Expand Down
0