Ryan Weaver, profile picture
Uploaded byRyan Weaver
PDF, PPTX9,393 views

Guard Authentication: Powerful, Beautiful Security

The document provides an overview of authentication in Symfony, focusing on the implementation of a security system using guard authenticators. It details the steps involved in user authentication, including credential verification and user creation while showcasing examples of traditional form login and API token authentication. The author also addresses user provider implementations and integration of social login options, like Facebook, along with error handling and customization of authentication failure messages.

Embed presentation

Download as PDF, PPTX
1 / 102
2 / 102
3 / 102
4 / 102
5 / 102
6 / 102
7 / 102
8 / 102
9 / 102
10 / 102
11 / 102
12 / 102
13 / 102
14 / 102
15 / 102
16 / 102
17 / 102
18 / 102
19 / 102
20 / 102
21 / 102
22 / 102
23 / 102
24 / 102
25 / 102
26 / 102
27 / 102
28 / 102
29 / 102
30 / 102
31 / 102
32 / 102
33 / 102
34 / 102
35 / 102
36 / 102
37 / 102
38 / 102
39 / 102
40 / 102
41 / 102
42 / 102
43 / 102
44 / 102
45 / 102
46 / 102
47 / 102
48 / 102
49 / 102
50 / 102
51 / 102
52 / 102
53 / 102
54 / 102
55 / 102
56 / 102
57 / 102
58 / 102
59 / 102
60 / 102
61 / 102
62 / 102
63 / 102
64 / 102
65 / 102
66 / 102
67 / 102
68 / 102
69 / 102
70 / 102
71 / 102
72 / 102
73 / 102
74 / 102
75 / 102
76 / 102
77 / 102
78 / 102
79 / 102
80 / 102
81 / 102
82 / 102
83 / 102
84 / 102
85 / 102
86 / 102
87 / 102
88 / 102
89 / 102
90 / 102
91 / 102
92 / 102
93 / 102
94 / 102
95 / 102
96 / 102
97 / 102
98 / 102
99 / 102
100 / 102
101 / 102
102 / 102
Guard Authentication: Powerful, Beautiful Security by your friend: Ryan Weaver @weaverryan
KnpUniversity.com github.com/weaverryan Who is this guy? > Lead for the Symfony documentation
 > KnpLabs US - Symfony Consulting, training & general Kumbaya > Writer for KnpUniversity.com Tutorials > Husband of the much more talented @leannapelham
Introducing… @weaverryan
sfGuardPlugin! @weaverryan
What’s the hardest part of Symfony? @weaverryan
Authentication Who are you? @weaverryan
Authorization Do you have access to do X? @weaverryan
VOTERS! @weaverryan
Authentication in Symfony sucks @weaverryan
1) Grab information from the request @weaverryan
2) Load a User @weaverryan
3) Validate if the credentials are valid @weaverryan
4) authentication success… now what? @weaverryan
5) authentication failure … dang, now what?! @weaverryan
6) How do we “ask” the user to login? @weaverryan
6 Steps 5 Different Classes @weaverryan
security:
 firewalls:
 main:
 anonymous: ~
 logout: ~
 
 form_login: ~
 http_basic: ~
 some_invented_system_i_created: ~
 Each activates a system of these 5 classes @weaverryan
On Guard! @weaverryan
interface GuardAuthenticatorInterface
 {
 public function getCredentials(Request $request);
 
 public function getUser($credentials, $userProvider);
 
 public function checkCredentials($credentials, UserInterface $user);
 
 public function onAuthenticationFailure(Request $request);
 
 public function onAuthenticationSuccess(Request $request, $token);
 public function start(Request $request); 
 public function supportsRememberMe();
 }
 @weaverryan
Bad News… @weaverryan
It’s getting coal for Christmas!
You still have to do work (sorry Laravel people) @weaverryan
But it will be simple @weaverryan https://github.com/knpuniversity/guard-presentation
You need a User class (This has nothing to do with Guard) @weaverryan
@weaverryan use SymfonyComponentSecurityCoreUserUserInterface;
 
 class User implements UserInterface
 {
 
 }
class User implements UserInterface
 {
 private $username;
 
 public function __construct($username)
 {
 $this->username = $username;
 }
 
 public function getUsername()
 {
 return $this->username;
 }
 
 public function getRoles()
 {
 return ['ROLE_USER'];
 }
 
 // …
 } a unique identifier (not really used anywhere)
@weaverryan class User implements UserInterface
 {
 // … 
 public function getPassword()
 {
 }
 public function getSalt()
 {
 }
 public function eraseCredentials()
 {
 }
 } These are only used for users that have an encoded password
The Hardest Example Ever: Form Login @weaverryan
A traditional login form setup @weaverryan
class SecurityController extends Controller
 {
 /**
 * @Route("/login", name="security_login")
 */
 public function loginAction()
 {
 return $this->render('security/login.html.twig');
 }
 
 /**
 * @Route("/login_check", name="login_check")
 */
 public function loginCheckAction()
 {
 // will never be executed
 }
 }

<form action="{{ path('login_check') }}” method="post">
 <div>
 <label for="username">Username</label>
 <input name="_username" />
 </div>
 
 <div>
 <label for="password">Password:</label>
 <input type="password" name="_password" />
 </div>
 
 <button type="submit">Login</button>
 </form>
Let’s create an authenticator! @weaverryan
class FormLoginAuthenticator extends AbstractGuardAuthenticator
 {
 public function getCredentials(Request $request)
 {
 }
 
 public function getUser($credentials, UserProviderInterface $userProvider)
 {
 }
 
 public function checkCredentials($credentials, UserInterface $user)
 {
 }
 
 public function onAuthenticationFailure(Request $request)
 {
 }
 
 public function onAuthenticationSuccess(Request $request, TokenInterface $token)
 {
 }
 
 public function start(Request $request, AuthenticationException $e = null)
 {
 }
 
 public function supportsRememberMe()
 {
 }
 }
public function getCredentials(Request $request)
 {
 if ($request->getPathInfo() != '/login_check') {
 return;
 }
 
 return [
 'username' => $request->request->get('_username'),
 'password' => $request->request->get('_password'),
 ];
 } Grab the “login” credentials! @weaverryan
public function getUser($credentials, UserProviderInterface $userProvider)
 {
 $username = $credentials['username'];
 
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 } Create/Load that User! @weaverryan
public function checkCredentials($credentials, UserInterface $user)
 {
 $password = $credentials['password'];
 if ($password == 'santa' || $password == 'elves') {
 return;
 }
 
 return true;
 } Are the credentials correct? @weaverryan
public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
 {
 $url = $this->router->generate('security_login');
 
 return new RedirectResponse($url);
 } Crap! Auth failed! Now what!? @weaverryan
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
 {
 $url = $this->router->generate('homepage');
 
 return new RedirectResponse($url);
 } Amazing. Auth worked. Now what? @weaverryan
public function start(Request $request)
 {
 $url = $this->router->generate('security_login');
 
 return new RedirectResponse($url);
 } Anonymous user went to /admin now what? @weaverryan
Register as a service services:
 form_login_authenticator:
 class: AppBundleSecurityFormLoginAuthenticator
 arguments: [‘@router’]
 @weaverryan
Activate in your firewall security:
 firewalls:
 main:
 anonymous: ~
 logout: ~
 guard:
 authenticators:
 - form_login_authenticator @weaverryan
AbstractFormLoginAuthenticator Free login form authenticator code @weaverryan
User Providers (This has nothing to do with Guard) @weaverryan
Every App has a User class @weaverryan And the Christmas spirit
Each User Class Needs 1 User Provider @weaverryan
class FestiveUserProvider implements UserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 // "load" the user - e.g. load from the db
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 }
 
 public function refreshUser(UserInterface $user)
 {
 return $user;
 }
 
 public function supportsClass($class)
 {
 return $class == 'AppBundleEntityUser';
 }
 }
services:
 festive_user_provider:
 class: AppBundleSecurityFestiveUserProvider
 @weaverryan
security:
 providers:
 elves:
 id: festive_user_provider
 
 firewalls:
 main:
 anonymous: ~
 logout: ~
 # this is optional as there is only 1 provider
 provider: elves
 guard:
 authenticators: [form_login_authenticator]
 Boom! Optional Boom!
class FestiveUserProvider implements UserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 // "load" the user - e.g. load from the db
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 }
 
 public function refreshUser(UserInterface $user)
 {
 return $user;
 }
 
 public function supportsClass($class)
 {
 return $class == 'AppBundleEntityUser';
 }
 } But why!?
class FestiveUserProvider implements UserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 // "load" the user - e.g. load from the db
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 }
 
 public function refreshUser(UserInterface $user)
 {
 return $user;
 }
 
 public function supportsClass($class)
 {
 return $class == 'AppBundleEntityUser';
 }
 } refresh from the session
class FestiveUserProvider implements UserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 // "load" the user - e.g. load from the db
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 }
 
 public function refreshUser(UserInterface $user)
 {
 return $user;
 }
 
 public function supportsClass($class)
 {
 return $class == 'AppBundleEntityUser';
 }
 } switch_user, remember_me
Slightly more wonderful: Loading a User from the Database @weaverryan
class FestiveUserProvider implements UserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 $user = $this->em->getRepository('AppBundle:User')
 ->findOneBy(['username' => $username]);
 
 if (!$user) {
 throw new UsernameNotFoundException();
 }
 
 return $user;
 }
 } @weaverryan (of course, the “entity” user provider does this automatically)
public function getUser($credentials, UserProviderInterface $userProvider)
 {
 $username = $credentials['username'];
 //return $userProvider->loadUserByUsername($username);
 
 return $this->em
 ->getRepository('AppBundle:User')
 ->findOneBy(['username' => $username]);
 } FormLoginAuthenticator you can use this if you want to … or don’t!
Easiest Example ever: Api Token Authentication @weaverryan Jolliest
1) Client sends a token on an X- API-TOKEN header 2) We load a User associated with that token class User implements UserInterface
 {
 /**
 * @ORMColumn(type="string")
 */
 private $apiToken;
 
 // ...
 }
class ApiTokenAuthenticator extends AbstractGuardAuthenticator
 {
 public function getCredentials(Request $request)
 {
 }
 
 public function getUser($credentials, UserProviderInterface $userProvider)
 {
 }
 
 public function checkCredentials($credentials, UserInterface $user)
 {
 }
 
 public function onAuthenticationFailure(Request $request)
 {
 }
 
 public function onAuthenticationSuccess(Request $request, TokenInterface $token)
 {
 }
 
 public function start(Request $request, AuthenticationException $e = null)
 {
 }
 
 public function supportsRememberMe()
 {
 }
 }
public function getCredentials(Request $request)
 {
 return $request->headers->get('X-API-TOKEN');
 } @weaverryan
public function getUser($credentials, UserProviderInterface $userProvider)
 {
 $apiToken = $credentials;
 
 return $this->em
 ->getRepository('AppBundle:User')
 ->findOneBy(['apiToken' => $apiToken]);
 } @weaverryan
OR If you use JWT, get the payload from the token and load the User from it @weaverryan
public function checkCredentials($credentials, UserInterface $user)
 {
 // no credentials to check
 return true;
 }
 @weaverryan
public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
 {
 return new JsonResponse([
 'message' => $exception->getMessageKey()
 ], 401);
 } @weaverryan
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
 {
 // let the request continue to the controller
 return;
 } @weaverryan
Register as a service services:
 api_token_authenticator:
 class: AppBundleSecurityApiTokenAuthenticator
 arguments:
 - '@doctrine.orm.entity_manager' @weaverryan
Activate in your firewall security:
 # ...
 firewalls:
 main:
 # ...
 guard:
 authenticators:
 - form_login_authenticator
 - api_token_authenticator
 entry_point: form_login_authenticator
 which “start” method should be called
curl http://localhost:8000/secure <!DOCTYPE html> <html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="1;url=/login" /> <title>Redirecting to /login</title> </head> <body> Redirecting to <a href="/login">/login</a>. </body> </html> @weaverryan
curl --header "X-API-TOKEN: BAD" http://localhost:8000/secure {"message":"Username could not be found."} @weaverryan
curl --header "X-API-TOKEN: GOOD" http://localhost:8000/secure {"message":"Hello from the secureAction!"} @weaverryan
Social Login! @weaverryan
! AUTHENTICATOR /facebook/check?code=abc give me user info! load a User object " User !
composer require league/oauth2-facebook @weaverryan
@weaverryan services:
 app.facebook_provider:
 class: LeagueOAuth2ClientProviderFacebook
 arguments:
 -
 clientId: %facebook_app_id%
 clientSecret: %facebook_app_secret%
 graphApiVersion: v2.3
 redirectUri: "..."
 @=service('router').generate('connect_facebook_check', {}, true)
@weaverryan public function connectFacebookAction()
 {
 // redirect to Facebook
 $facebookOAuthProvider = $this->get('app.facebook_provider');
 
 $url = $facebookOAuthProvider->getAuthorizationUrl([
 // these are actually the default scopes
 'scopes' => ['public_profile', 'email'],
 ]);
 
 return $this->redirect($url);
 }
 
 /**
 * @Route("/connect/facebook-check", name="connect_facebook_check")
 */
 public function connectFacebookActionCheck()
 {
 // will not be reached!
 }
class FacebookAuthenticator extends AbstractGuardAuthenticator
 {
 public function getCredentials(Request $request)
 {
 }
 
 public function getUser($credentials, UserProviderInterface $userProvider)
 {
 }
 
 public function checkCredentials($credentials, UserInterface $user)
 {
 }
 
 public function onAuthenticationFailure(Request $request)
 {
 }
 
 public function onAuthenticationSuccess(Request $request, TokenInterface $token)
 {
 }
 
 public function start(Request $request, AuthenticationException $e = null)
 {
 }
 
 public function supportsRememberMe()
 {
 }
 }
public function getCredentials(Request $request)
 {
 if ($request->getPathInfo() != '/connect/facebook-check') {
 return;
 }
 
 return $request->query->get('code');
 } @weaverryan
public function getUser($credentials, …)
 {
 $authorizationCode = $credentials;
 
 $facebookProvider = $this->container->get('app.facebook_provider');
 
 $accessToken = $facebookProvider->getAccessToken(
 'authorization_code',
 ['code' => $authorizationCode]
 );
 
 /** @var FacebookUser $facebookUser */
 $facebookUser = $facebookProvider->getResourceOwner($accessToken);
 
 // ...
 } @weaverryan
Now, have some hot chocolate! @weaverryan
public function getUser($credentials, …)
 { // ... 
 /** @var FacebookUser $facebookUser */
 $facebookUser = $facebookProvider->getResourceOwner($accessToken);
 
 // ...
 $em = $this->container->get('doctrine')->getManager();
 
 // 1) have they logged in with Facebook before? Easy!
 $user = $em->getRepository('AppBundle:User')
 ->findOneBy(array('email' => $facebookUser->getEmail())); 
 if ($user) {
 return $user;
 } 
 // ...
 } @weaverryan
public function getUser($credentials, ...)
 {
 // ...
 
 // 2) no user? Perhaps you just want to create one
 // (or redirect to a registration)
 $user = new User();
 $user->setUsername($facebookUser->getName());
 $user->setEmail($facebookUser->getEmail());
 $em->persist($user);
 $em->flush(); return $user;
 } @weaverryan
public function checkCredentials($credentials, UserInterface $user)
 {
 // nothing to do here!
 }
 
 public function onAuthenticationFailure(Request $request ...)
 {
 // redirect to login
 }
 
 public function onAuthenticationSuccess(Request $request ...)
 {
 // redirect to homepage / last page
 } @weaverryan
Extra Treats (no coal) @weaverryan
Can I control the error message? @weaverryan
@weaverryan If authentication failed, it is because an AuthenticationException (or sub-class) was thrown (This has nothing to do with Guard)
public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
 {
 return new JsonResponse([
 'message' => $exception->getMessageKey()
 ], 401);
 } @weaverryan Christmas miracle! The exception is passed when authentication fails AuthenticationException has a hardcoded getMessageKey() “safe” string Invalid credentials.
public function getCredentials(Request $request)
 {
 }
 
 public function getUser($credentials, UserProviderInterface $userProvider)
 {
 }
 
 public function checkCredentials($credentials, UserInterface $user)
 {
 }
 Throw an AuthenticationException at any time in these 3 methods
How can I customize the message? @weaverryan Create a new sub-class of AuthenticationException for each message and override getMessageKey()
CustomUserMessageAuthenticationException @weaverryan
public function getUser($credentials, ...)
 {
 $apiToken = $credentials;
 
 $user = $this->em
 ->getRepository('AppBundle:User')
 ->findOneBy(['apiToken' => $apiToken]);
 
 if (!$user) {
 throw new CustomUserMessageAuthenticationException(
 'That API token is not very jolly'
 );
 }
 
 return $user;
 } @weaverryan
I need to manually authenticate my user @weaverryan
public function registerAction(Request $request)
 {
 $user = new User();
 $form = // ...
 
 if ($form->isValid()) {
 // save the user
 
 $guardHandler = $this->container
 ->get('security.authentication.guard_handler');
 
 $guardHandler->authenticateUserAndHandleSuccess(
 $user,
 $request,
 $this->get('form_login_authenticator'),
 'main' // the name of your firewall
 );
 // redirect
 }
 // ...
 }
I want to save a lastLoggedInAt field on my user no matter *how* they login @weaverryan
Chill… that was already possible SecurityEvents::INTERACTIVE_LOGIN @weaverryan
class LastLoginSubscriber implements EventSubscriberInterface
 {
 public function onInteractiveLogin(InteractiveLoginEvent $event)
 {
 /** @var User $user */
 $user = $event->getAuthenticationToken()->getUser();
 $user->setLastLoginTime(new DateTime());
 $this->em->persist($user);
 $this->em->flush($user);
 }
 
 public static function getSubscribedEvents()
 {
 return [
 SecurityEvents::INTERACTIVE_LOGIN => 'onInteractiveLogin'
 ];
 }
 }
 @weaverryan
All of these features are available now! @weaverryan Thanks 2.8!
KnpUGuardBundle @weaverryan For those on 2.7
knpuniversity.com/guard
@weaverryan Ok, what just happened?
1. User implements UserInterface @weaverryan
2. UserProvider @weaverryan
3. Create your authenticator(s) @weaverryan
Authentication# @weaverryan
@weaverryan PHP & Symfony Video Tutorials KnpUniversity.com Thank You!

More Related Content

PDF
Symfony Guard Authentication: Fun with API Token, Social Login, JWT and more
byRyan Weaver
 
PDF
New Symfony Tips & Tricks (SymfonyCon Paris 2015)
byJavier Eguiluz
 
PDF
How Kris Writes Symfony Apps
byKris Wallsmith
 
PDF
How I started to love design patterns
bySamuel ROZE
 
PDF
Design how your objects talk through mocking
byKonstantin Kudryashov
 
PDF
Love and Loss: A Symfony Security Play
byKris Wallsmith
 
PDF
Matters of State
byKris Wallsmith
 
PDF
Symfony & Javascript. Combining the best of two worlds
byIgnacio Martín
 
Symfony Guard Authentication: Fun with API Token, Social Login, JWT and more
byRyan Weaver
 
New Symfony Tips & Tricks (SymfonyCon Paris 2015)
byJavier Eguiluz
 
How Kris Writes Symfony Apps
byKris Wallsmith
 
How I started to love design patterns
bySamuel ROZE
 
Design how your objects talk through mocking
byKonstantin Kudryashov
 
Love and Loss: A Symfony Security Play
byKris Wallsmith
 
Matters of State
byKris Wallsmith
 
Symfony & Javascript. Combining the best of two worlds
byIgnacio Martín
 

What's hot

PDF
Introduction to CQRS and Event Sourcing
bySamuel ROZE
 
ODP
Rich domain model with symfony 2.5 and doctrine 2.5
byLeonardo Proietti
 
PDF
The quest for global design principles (SymfonyLive Berlin 2015)
byMatthias Noback
 
PDF
Symfony Messenger (Symfony Live San Francisco)
bySamuel ROZE
 
PDF
How kris-writes-symfony-apps-london
byKris Wallsmith
 
PDF
Beyond symfony 1.2 (Symfony Camp 2008)
byFabien Potencier
 
PDF
How Kris Writes Symfony Apps
byKris Wallsmith
 
PDF
Decoupling with Design Patterns and Symfony2 DIC
byKonstantin Kudryashov
 
PDF
Advanced symfony Techniques
byKris Wallsmith
 
ODP
Symfony2, creare bundle e valore per il cliente
byLeonardo Proietti
 
PDF
Symfony tips and tricks
byMariusz Kozłowski
 
PDF
Decoupling the Ulabox.com monolith. From CRUD to DDD
byAleix Vergés
 
PDF
Symfony2 revealed
byFabien Potencier
 
PPTX
Dealing with Continuous Data Processing, ConFoo 2012
byMichael Peacock
 
PDF
Symfony 2
byKris Wallsmith
 
PDF
The Coolest Symfony Components you’ve never heard of - DrupalCon 2017
byRyan Weaver
 
PPTX
Speed up your developments with Symfony2
byHugo Hamon
 
PDF
Symfony 2.0 on PHP 5.3
byFabien Potencier
 
PDF
Running a Scalable And Reliable Symfony2 Application in Cloud (Symfony Sweden...
byVille Mattila
 
PPTX
Real time voice call integration - Confoo 2012
byMichael Peacock
 
Introduction to CQRS and Event Sourcing
bySamuel ROZE
 
Rich domain model with symfony 2.5 and doctrine 2.5
byLeonardo Proietti
 
The quest for global design principles (SymfonyLive Berlin 2015)
byMatthias Noback
 
Symfony Messenger (Symfony Live San Francisco)
bySamuel ROZE
 
How kris-writes-symfony-apps-london
byKris Wallsmith
 
Beyond symfony 1.2 (Symfony Camp 2008)
byFabien Potencier
 
How Kris Writes Symfony Apps
byKris Wallsmith
 
Decoupling with Design Patterns and Symfony2 DIC
byKonstantin Kudryashov
 
Advanced symfony Techniques
byKris Wallsmith
 
Symfony2, creare bundle e valore per il cliente
byLeonardo Proietti
 
Symfony tips and tricks
byMariusz Kozłowski
 
Decoupling the Ulabox.com monolith. From CRUD to DDD
byAleix Vergés
 
Symfony2 revealed
byFabien Potencier
 
Dealing with Continuous Data Processing, ConFoo 2012
byMichael Peacock
 
Symfony 2
byKris Wallsmith
 
The Coolest Symfony Components you’ve never heard of - DrupalCon 2017
byRyan Weaver
 
Speed up your developments with Symfony2
byHugo Hamon
 
Symfony 2.0 on PHP 5.3
byFabien Potencier
 
Running a Scalable And Reliable Symfony2 Application in Cloud (Symfony Sweden...
byVille Mattila
 
Real time voice call integration - Confoo 2012
byMichael Peacock
 

Viewers also liked

PDF
Symfony: Your Next Microframework (SymfonyCon 2015)
byRyan Weaver
 
PDF
Doctrine2 sf2Vigo
byIgnacio Martín
 
PPTX
Electrify your code with PHP Generators
byMark Baker
 
PDF
Finally, Professional Frontend Dev with ReactJS, WebPack & Symfony (Symfony C...
byRyan Weaver
 
PDF
Keeping the frontend under control with Symfony and Webpack
byIgnacio Martín
 
ODP
PHP5.5 is Here
byjulien pauli
 
PDF
High Quality Symfony Bundles tutorial - Dutch PHP Conference 2014
byMatthias Noback
 
PDF
Hexagonal architecture message-oriented software design
byMatthias Noback
 
PDF
Top tips my_sql_performance
byafup Paris
 
PDF
Understanding Craftsmanship SwanseaCon2015
byMarcello Duarte
 
PDF
Desarrollo código mantenible en WordPress utilizando Symfony
byAsier Marqués
 
PDF
Mocking Demystified
byMarcello Duarte
 
PDF
WordCamp Cantabria - Código mantenible con WordPress
byAsier Marqués
 
PDF
Get Soaked - An In Depth Look At PHP Streams
byDavey Shafik
 
ODP
Elastic Searching With PHP
byLea Hänsenberger
 
PDF
Diving deep into twig
byMatthias Noback
 
PDF
Automation using-phing
byRajat Pandit
 
PDF
Why elasticsearch rocks!
bytlrx
 
PDF
The Wonderful World of Symfony Components
byRyan Weaver
 
PDF
Techniques d'accélération des pages web
byJean-Pierre Vincent
 
Symfony: Your Next Microframework (SymfonyCon 2015)
byRyan Weaver
 
Doctrine2 sf2Vigo
byIgnacio Martín
 
Electrify your code with PHP Generators
byMark Baker
 
Finally, Professional Frontend Dev with ReactJS, WebPack & Symfony (Symfony C...
byRyan Weaver
 
Keeping the frontend under control with Symfony and Webpack
byIgnacio Martín
 
PHP5.5 is Here
byjulien pauli
 
High Quality Symfony Bundles tutorial - Dutch PHP Conference 2014
byMatthias Noback
 
Hexagonal architecture message-oriented software design
byMatthias Noback
 
Top tips my_sql_performance
byafup Paris
 
Understanding Craftsmanship SwanseaCon2015
byMarcello Duarte
 
Desarrollo código mantenible en WordPress utilizando Symfony
byAsier Marqués
 
Mocking Demystified
byMarcello Duarte
 
WordCamp Cantabria - Código mantenible con WordPress
byAsier Marqués
 
Get Soaked - An In Depth Look At PHP Streams
byDavey Shafik
 
Elastic Searching With PHP
byLea Hänsenberger
 
Diving deep into twig
byMatthias Noback
 
Automation using-phing
byRajat Pandit
 
Why elasticsearch rocks!
bytlrx
 
The Wonderful World of Symfony Components
byRyan Weaver
 
Techniques d'accélération des pages web
byJean-Pierre Vincent
 

Similar to Guard Authentication: Powerful, Beautiful Security

PDF
Data Validation models
byMarcin Czarnecki
 
PDF
Dependency injection in PHP 5.3/5.4
byFabien Potencier
 
PDF
You Shall Not Pass - Security in Symfony
byThe Software House
 
KEY
Symfony2 security layer
byManuel Baldassarri
 
KEY
Phpne august-2012-symfony-components-friends
byMichael Peacock
 
PDF
Dependency injection-zendcon-2010
byFabien Potencier
 
PDF
Dependency Injection
byFabien Potencier
 
PDF
Dependency Injection - ConFoo 2010
byFabien Potencier
 
PDF
Dependency Injection IPC 201
byFabien Potencier
 
PDF
Dependency injection - phpday 2010
byFabien Potencier
 
PDF
Building Modern and Secure PHP Applications – Codementor Office Hours with Be...
byArc & Codementor
 
PDF
Dependency Injection with PHP and PHP 5.3
byFabien Potencier
 
PDF
Dependency Injection with PHP 5.3
byFabien Potencier
 
PDF
The state of Symfony2 - SymfonyDay 2010
byFabien Potencier
 
PDF
Build powerfull and smart web applications with Symfony2
byHugo Hamon
 
KEY
IoC with PHP
byChris Weldon
 
PDF
Using API Platform to build ticketing system #symfonycon
byAntonio Peric-Mazar
 
PDF
Alexander Makarov "Let’s talk about code"
byFwdays
 
PDF
Code decoupling from Symfony (and others frameworks) - PHP Conference Brasil ...
byMiguel Gallardo
 
PPTX
SymfonyCon 2015 - A symphony of developers
byRadu Murzea
 
Data Validation models
byMarcin Czarnecki
 
Dependency injection in PHP 5.3/5.4
byFabien Potencier
 
You Shall Not Pass - Security in Symfony
byThe Software House
 
Symfony2 security layer
byManuel Baldassarri
 
Phpne august-2012-symfony-components-friends
byMichael Peacock
 
Dependency injection-zendcon-2010
byFabien Potencier
 
Dependency Injection
byFabien Potencier
 
Dependency Injection - ConFoo 2010
byFabien Potencier
 
Dependency Injection IPC 201
byFabien Potencier
 
Dependency injection - phpday 2010
byFabien Potencier
 
Building Modern and Secure PHP Applications – Codementor Office Hours with Be...
byArc & Codementor
 
Dependency Injection with PHP and PHP 5.3
byFabien Potencier
 
Dependency Injection with PHP 5.3
byFabien Potencier
 
The state of Symfony2 - SymfonyDay 2010
byFabien Potencier
 
Build powerfull and smart web applications with Symfony2
byHugo Hamon
 
IoC with PHP
byChris Weldon
 
Using API Platform to build ticketing system #symfonycon
byAntonio Peric-Mazar
 
Alexander Makarov "Let’s talk about code"
byFwdays
 
Code decoupling from Symfony (and others frameworks) - PHP Conference Brasil ...
byMiguel Gallardo
 
SymfonyCon 2015 - A symphony of developers
byRadu Murzea
 

More from Ryan Weaver

PDF
Hands-on with the Symfony2 Framework
byRyan Weaver
 
PDF
Twig: Friendly Curly Braces Invade Your Templates!
byRyan Weaver
 
PDF
Drupal 8: Huge wins, a Bigger Community, and why you (and I) will Love it
byRyan Weaver
 
PDF
A PHP Christmas Miracle - 3 Frameworks, 1 app
byRyan Weaver
 
PDF
The Art of Doctrine Migrations
byRyan Weaver
 
PDF
Dependency Injection: Make your enemies fear you
byRyan Weaver
 
PDF
Webpack Encore Symfony Live 2017 San Francisco
byRyan Weaver
 
PDF
Master the New Core of Drupal 8 Now: with Symfony and Silex
byRyan Weaver
 
PDF
Cool like a Frontend Developer: Grunt, RequireJS, Bower and other Tools
byRyan Weaver
 
PDF
Grand Rapids PHP Meetup: Behavioral Driven Development with Behat
byRyan Weaver
 
PDF
Silex: Microframework y camino fácil de aprender Symfony
byRyan Weaver
 
PDF
Being Dangerous with Twig
byRyan Weaver
 
PDF
Being Dangerous with Twig (Symfony Live Paris)
byRyan Weaver
 
PDF
Symony2 A Next Generation PHP Framework
byRyan Weaver
 
PDF
Doctrine2 In 10 Minutes
byRyan Weaver
 
PDF
Symfony2: Get your project started
byRyan Weaver
 
Hands-on with the Symfony2 Framework
byRyan Weaver
 
Twig: Friendly Curly Braces Invade Your Templates!
byRyan Weaver
 
Drupal 8: Huge wins, a Bigger Community, and why you (and I) will Love it
byRyan Weaver
 
A PHP Christmas Miracle - 3 Frameworks, 1 app
byRyan Weaver
 
The Art of Doctrine Migrations
byRyan Weaver
 
Dependency Injection: Make your enemies fear you
byRyan Weaver
 
Webpack Encore Symfony Live 2017 San Francisco
byRyan Weaver
 
Master the New Core of Drupal 8 Now: with Symfony and Silex
byRyan Weaver
 
Cool like a Frontend Developer: Grunt, RequireJS, Bower and other Tools
byRyan Weaver
 
Grand Rapids PHP Meetup: Behavioral Driven Development with Behat
byRyan Weaver
 
Silex: Microframework y camino fácil de aprender Symfony
byRyan Weaver
 
Being Dangerous with Twig
byRyan Weaver
 
Being Dangerous with Twig (Symfony Live Paris)
byRyan Weaver
 
Symony2 A Next Generation PHP Framework
byRyan Weaver
 
Doctrine2 In 10 Minutes
byRyan Weaver
 
Symfony2: Get your project started
byRyan Weaver
 

Recently uploaded

PDF
Coding Assessment Tools .pdf
byCodexpro
 
PDF
Solved First Semester B.C.A. C Programming Question Paper – Jan/Feb 2025
byKuvempu University
 
PPTX
Code Assessment Tools .pptx
byCodexpro
 
PPTX
ScalaF: Functional Refactoring and Automated Code Transformations
byhelloshrikha
 
PDF
Kiến trúc hướng dịch vụ UET!!!!!!!!!!!!!!!!!!!!!!!
bydoquangminh962004
 
PDF
Revolutionising-SQL-Data-Modelling-with-SqlDBM.pdf
bySQL DBM
 
PDF
DSD-INT 2025 Latest Developments for HydroMT and wflow - Meshgi
byDeltares
 
PDF
How Modern Custom Software is Revolutionizing Mortgage Lending Processes -Ma...
byMatellio
 
PPTX
Cyber_Security_and_Safety_for Class 9 Student
bymailerswifttest080
 
PPTX
Custom chat gpt integration services.pptx
byChetu
 
PDF
TNG_Architecting Green Software - An Introduction_Nils-Oliver Linden&Alexande...
byQAware GmbH
 
PPTX
OTT Content Analytics Enhanced by ALTBalaji Data Scraping.pptx
byyashpatric
 
PDF
Custom Software Development Company in Delhi
byMilleniance Softnet Private Limited
 
PDF
Unit-II Asymptotic Notations and Basic Efficiency Classes (DAA) BCA SEP SEM-III
byKuvempu University
 
PPTX
1_MIL_Introduction_Influence-of-Media-and-Information-on-Communication (1).pptx
byDeltaDomsMamas1
 
PDF
C Unit-III: Arrays, Structures and Unions
byKuvempu University
 
PDF
How to Overcome 6 Common Oracle NetSuite Implementation Challenges
byTechWize
 
PDF
DSD-INT 2025 Integrating Nature-Based Solutions into Hydrological Models A Li...
byDeltares
 
PDF
DSD-INT 2025 Managing low flows in the International Meuse Basin with Nature-...
byDeltares
 
PDF
C UNIT-I :Unit-I: Problem solving with a Computer
byKuvempu University
 
Coding Assessment Tools .pdf
byCodexpro
 
Solved First Semester B.C.A. C Programming Question Paper – Jan/Feb 2025
byKuvempu University
 
Code Assessment Tools .pptx
byCodexpro
 
ScalaF: Functional Refactoring and Automated Code Transformations
byhelloshrikha
 
Kiến trúc hướng dịch vụ UET!!!!!!!!!!!!!!!!!!!!!!!
bydoquangminh962004
 
Revolutionising-SQL-Data-Modelling-with-SqlDBM.pdf
bySQL DBM
 
DSD-INT 2025 Latest Developments for HydroMT and wflow - Meshgi
byDeltares
 
How Modern Custom Software is Revolutionizing Mortgage Lending Processes -Ma...
byMatellio
 
Cyber_Security_and_Safety_for Class 9 Student
bymailerswifttest080
 
Custom chat gpt integration services.pptx
byChetu
 
TNG_Architecting Green Software - An Introduction_Nils-Oliver Linden&Alexande...
byQAware GmbH
 
OTT Content Analytics Enhanced by ALTBalaji Data Scraping.pptx
byyashpatric
 
Custom Software Development Company in Delhi
byMilleniance Softnet Private Limited
 
Unit-II Asymptotic Notations and Basic Efficiency Classes (DAA) BCA SEP SEM-III
byKuvempu University
 
1_MIL_Introduction_Influence-of-Media-and-Information-on-Communication (1).pptx
byDeltaDomsMamas1
 
C Unit-III: Arrays, Structures and Unions
byKuvempu University
 
How to Overcome 6 Common Oracle NetSuite Implementation Challenges
byTechWize
 
DSD-INT 2025 Integrating Nature-Based Solutions into Hydrological Models A Li...
byDeltares
 
DSD-INT 2025 Managing low flows in the International Meuse Basin with Nature-...
byDeltares
 
C UNIT-I :Unit-I: Problem solving with a Computer
byKuvempu University
 

Guard Authentication: Powerful, Beautiful Security

  • 1.
    Guard Authentication: Powerful, BeautifulSecurity by your friend: Ryan Weaver @weaverryan
  • 2.
    KnpUniversity.com github.com/weaverryan Who is thisguy? > Lead for the Symfony documentation
 > KnpLabs US - Symfony Consulting, training & general Kumbaya > Writer for KnpUniversity.com Tutorials > Husband of the much more talented @leannapelham
  • 3.
  • 4.
  • 5.
    What’s the hardest partof Symfony? @weaverryan
  • 6.
  • 7.
    Authorization Do you haveaccess to do X? @weaverryan
  • 8.
  • 9.
  • 10.
    1) Grab informationfrom the request @weaverryan
  • 11.
    2) Load aUser @weaverryan
  • 12.
    3) Validate ifthe credentials are valid @weaverryan
  • 13.
  • 14.
    5) authentication failure… dang, now what?! @weaverryan
  • 15.
    6) How dowe “ask” the user to login? @weaverryan
  • 16.
    6 Steps 5 DifferentClasses @weaverryan
  • 17.
    security:
 firewalls:
 main:
 anonymous: ~
 logout: ~
 
 form_login:~
 http_basic: ~
 some_invented_system_i_created: ~
 Each activates a system of these 5 classes @weaverryan
  • 18.
  • 19.
    interface GuardAuthenticatorInterface
 {
 public functiongetCredentials(Request $request);
 
 public function getUser($credentials, $userProvider);
 
 public function checkCredentials($credentials, UserInterface $user);
 
 public function onAuthenticationFailure(Request $request);
 
 public function onAuthenticationSuccess(Request $request, $token);
 public function start(Request $request); 
 public function supportsRememberMe();
 }
 @weaverryan
  • 20.
  • 21.
    It’s getting coalfor Christmas!
  • 22.
    You still haveto do work (sorry Laravel people) @weaverryan
  • 23.
    But it willbe simple @weaverryan https://github.com/knpuniversity/guard-presentation
  • 24.
    You need aUser class (This has nothing to do with Guard) @weaverryan
  • 25.
  • 26.
    class User implementsUserInterface
 {
 private $username;
 
 public function __construct($username)
 {
 $this->username = $username;
 }
 
 public function getUsername()
 {
 return $this->username;
 }
 
 public function getRoles()
 {
 return ['ROLE_USER'];
 }
 
 // …
 } a unique identifier (not really used anywhere)
  • 27.
    @weaverryan class User implementsUserInterface
 {
 // … 
 public function getPassword()
 {
 }
 public function getSalt()
 {
 }
 public function eraseCredentials()
 {
 }
 } These are only used for users that have an encoded password
  • 28.
    The Hardest ExampleEver: Form Login @weaverryan
  • 29.
    A traditional loginform setup @weaverryan
  • 30.
    class SecurityController extendsController
 {
 /**
 * @Route("/login", name="security_login")
 */
 public function loginAction()
 {
 return $this->render('security/login.html.twig');
 }
 
 /**
 * @Route("/login_check", name="login_check")
 */
 public function loginCheckAction()
 {
 // will never be executed
 }
 }

  • 31.
    <form action="{{ path('login_check')}}” method="post">
 <div>
 <label for="username">Username</label>
 <input name="_username" />
 </div>
 
 <div>
 <label for="password">Password:</label>
 <input type="password" name="_password" />
 </div>
 
 <button type="submit">Login</button>
 </form>
  • 32.
  • 33.
    class FormLoginAuthenticator extendsAbstractGuardAuthenticator
 {
 public function getCredentials(Request $request)
 {
 }
 
 public function getUser($credentials, UserProviderInterface $userProvider)
 {
 }
 
 public function checkCredentials($credentials, UserInterface $user)
 {
 }
 
 public function onAuthenticationFailure(Request $request)
 {
 }
 
 public function onAuthenticationSuccess(Request $request, TokenInterface $token)
 {
 }
 
 public function start(Request $request, AuthenticationException $e = null)
 {
 }
 
 public function supportsRememberMe()
 {
 }
 }
  • 34.
    public function getCredentials(Request$request)
 {
 if ($request->getPathInfo() != '/login_check') {
 return;
 }
 
 return [
 'username' => $request->request->get('_username'),
 'password' => $request->request->get('_password'),
 ];
 } Grab the “login” credentials! @weaverryan
  • 35.
    public function getUser($credentials,UserProviderInterface $userProvider)
 {
 $username = $credentials['username'];
 
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 } Create/Load that User! @weaverryan
  • 36.
    public function checkCredentials($credentials,UserInterface $user)
 {
 $password = $credentials['password'];
 if ($password == 'santa' || $password == 'elves') {
 return;
 }
 
 return true;
 } Are the credentials correct? @weaverryan
  • 37.
    public function onAuthenticationFailure(Request$request, AuthenticationException $exception)
 {
 $url = $this->router->generate('security_login');
 
 return new RedirectResponse($url);
 } Crap! Auth failed! Now what!? @weaverryan
  • 38.
    public function onAuthenticationSuccess(Request$request, TokenInterface $token, $providerKey)
 {
 $url = $this->router->generate('homepage');
 
 return new RedirectResponse($url);
 } Amazing. Auth worked. Now what? @weaverryan
  • 39.
    public function start(Request$request)
 {
 $url = $this->router->generate('security_login');
 
 return new RedirectResponse($url);
 } Anonymous user went to /admin now what? @weaverryan
  • 40.
    Register as aservice services:
 form_login_authenticator:
 class: AppBundleSecurityFormLoginAuthenticator
 arguments: [‘@router’]
 @weaverryan
  • 41.
    Activate in yourfirewall security:
 firewalls:
 main:
 anonymous: ~
 logout: ~
 guard:
 authenticators:
 - form_login_authenticator @weaverryan
  • 42.
    AbstractFormLoginAuthenticator Free login formauthenticator code @weaverryan
  • 43.
    User Providers (This hasnothing to do with Guard) @weaverryan
  • 44.
    Every App hasa User class @weaverryan And the Christmas spirit
  • 45.
    Each User ClassNeeds 1 User Provider @weaverryan
  • 46.
    class FestiveUserProvider implementsUserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 // "load" the user - e.g. load from the db
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 }
 
 public function refreshUser(UserInterface $user)
 {
 return $user;
 }
 
 public function supportsClass($class)
 {
 return $class == 'AppBundleEntityUser';
 }
 }
  • 47.
  • 48.
    security:
 providers:
 elves:
 id: festive_user_provider
 
 firewalls:
 main:
 anonymous: ~
 logout:~
 # this is optional as there is only 1 provider
 provider: elves
 guard:
 authenticators: [form_login_authenticator]
 Boom! Optional Boom!
  • 49.
    class FestiveUserProvider implementsUserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 // "load" the user - e.g. load from the db
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 }
 
 public function refreshUser(UserInterface $user)
 {
 return $user;
 }
 
 public function supportsClass($class)
 {
 return $class == 'AppBundleEntityUser';
 }
 } But why!?
  • 50.
    class FestiveUserProvider implementsUserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 // "load" the user - e.g. load from the db
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 }
 
 public function refreshUser(UserInterface $user)
 {
 return $user;
 }
 
 public function supportsClass($class)
 {
 return $class == 'AppBundleEntityUser';
 }
 } refresh from the session
  • 51.
    class FestiveUserProvider implementsUserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 // "load" the user - e.g. load from the db
 $user = new User();
 $user->setUsername($username);
 
 return $user;
 }
 
 public function refreshUser(UserInterface $user)
 {
 return $user;
 }
 
 public function supportsClass($class)
 {
 return $class == 'AppBundleEntityUser';
 }
 } switch_user, remember_me
  • 52.
    Slightly more wonderful: Loadinga User from the Database @weaverryan
  • 53.
    class FestiveUserProvider implementsUserProviderInterface
 {
 public function loadUserByUsername($username)
 {
 $user = $this->em->getRepository('AppBundle:User')
 ->findOneBy(['username' => $username]);
 
 if (!$user) {
 throw new UsernameNotFoundException();
 }
 
 return $user;
 }
 } @weaverryan (of course, the “entity” user provider does this automatically)
  • 54.
    public function getUser($credentials,UserProviderInterface $userProvider)
 {
 $username = $credentials['username'];
 //return $userProvider->loadUserByUsername($username);
 
 return $this->em
 ->getRepository('AppBundle:User')
 ->findOneBy(['username' => $username]);
 } FormLoginAuthenticator you can use this if you want to … or don’t!
  • 55.
    Easiest Example ever: ApiToken Authentication @weaverryan Jolliest
  • 56.
    1) Client sendsa token on an X- API-TOKEN header 2) We load a User associated with that token class User implements UserInterface
 {
 /**
 * @ORMColumn(type="string")
 */
 private $apiToken;
 
 // ...
 }
  • 57.
    class ApiTokenAuthenticator extendsAbstractGuardAuthenticator
 {
 public function getCredentials(Request $request)
 {
 }
 
 public function getUser($credentials, UserProviderInterface $userProvider)
 {
 }
 
 public function checkCredentials($credentials, UserInterface $user)
 {
 }
 
 public function onAuthenticationFailure(Request $request)
 {
 }
 
 public function onAuthenticationSuccess(Request $request, TokenInterface $token)
 {
 }
 
 public function start(Request $request, AuthenticationException $e = null)
 {
 }
 
 public function supportsRememberMe()
 {
 }
 }
  • 58.
    public function getCredentials(Request$request)
 {
 return $request->headers->get('X-API-TOKEN');
 } @weaverryan
  • 59.
    public function getUser($credentials,UserProviderInterface $userProvider)
 {
 $apiToken = $credentials;
 
 return $this->em
 ->getRepository('AppBundle:User')
 ->findOneBy(['apiToken' => $apiToken]);
 } @weaverryan
  • 60.
    OR If you useJWT, get the payload from the token and load the User from it @weaverryan
  • 61.
    public function checkCredentials($credentials,UserInterface $user)
 {
 // no credentials to check
 return true;
 }
 @weaverryan
  • 62.
    public function onAuthenticationFailure(Request$request, AuthenticationException $exception)
 {
 return new JsonResponse([
 'message' => $exception->getMessageKey()
 ], 401);
 } @weaverryan
  • 63.
    public function onAuthenticationSuccess(Request$request, TokenInterface $token, $providerKey)
 {
 // let the request continue to the controller
 return;
 } @weaverryan
  • 64.
    Register as aservice services:
 api_token_authenticator:
 class: AppBundleSecurityApiTokenAuthenticator
 arguments:
 - '@doctrine.orm.entity_manager' @weaverryan
  • 65.
    Activate in yourfirewall security:
 # ...
 firewalls:
 main:
 # ...
 guard:
 authenticators:
 - form_login_authenticator
 - api_token_authenticator
 entry_point: form_login_authenticator
 which “start” method should be called
  • 66.
    curl http://localhost:8000/secure <!DOCTYPE html> <html> <head> <metacharset="UTF-8" /> <meta http-equiv="refresh" content="1;url=/login" /> <title>Redirecting to /login</title> </head> <body> Redirecting to <a href="/login">/login</a>. </body> </html> @weaverryan
  • 67.
    curl --header "X-API-TOKEN:BAD" http://localhost:8000/secure {"message":"Username could not be found."} @weaverryan
  • 68.
    curl --header "X-API-TOKEN:GOOD" http://localhost:8000/secure {"message":"Hello from the secureAction!"} @weaverryan
  • 69.
  • 70.
  • 71.
  • 72.
    @weaverryan services:
 app.facebook_provider:
 class: LeagueOAuth2ClientProviderFacebook
 arguments:
 -
 clientId: %facebook_app_id%
 clientSecret:%facebook_app_secret%
 graphApiVersion: v2.3
 redirectUri: "..."
 @=service('router').generate('connect_facebook_check', {}, true)
  • 73.
    @weaverryan public function connectFacebookAction()
 {
 //redirect to Facebook
 $facebookOAuthProvider = $this->get('app.facebook_provider');
 
 $url = $facebookOAuthProvider->getAuthorizationUrl([
 // these are actually the default scopes
 'scopes' => ['public_profile', 'email'],
 ]);
 
 return $this->redirect($url);
 }
 
 /**
 * @Route("/connect/facebook-check", name="connect_facebook_check")
 */
 public function connectFacebookActionCheck()
 {
 // will not be reached!
 }
  • 74.
    class FacebookAuthenticator extendsAbstractGuardAuthenticator
 {
 public function getCredentials(Request $request)
 {
 }
 
 public function getUser($credentials, UserProviderInterface $userProvider)
 {
 }
 
 public function checkCredentials($credentials, UserInterface $user)
 {
 }
 
 public function onAuthenticationFailure(Request $request)
 {
 }
 
 public function onAuthenticationSuccess(Request $request, TokenInterface $token)
 {
 }
 
 public function start(Request $request, AuthenticationException $e = null)
 {
 }
 
 public function supportsRememberMe()
 {
 }
 }
  • 75.
    public function getCredentials(Request$request)
 {
 if ($request->getPathInfo() != '/connect/facebook-check') {
 return;
 }
 
 return $request->query->get('code');
 } @weaverryan
  • 76.
    public function getUser($credentials,…)
 {
 $authorizationCode = $credentials;
 
 $facebookProvider = $this->container->get('app.facebook_provider');
 
 $accessToken = $facebookProvider->getAccessToken(
 'authorization_code',
 ['code' => $authorizationCode]
 );
 
 /** @var FacebookUser $facebookUser */
 $facebookUser = $facebookProvider->getResourceOwner($accessToken);
 
 // ...
 } @weaverryan
  • 77.
    Now, have somehot chocolate! @weaverryan
  • 78.
    public function getUser($credentials,…)
 { // ... 
 /** @var FacebookUser $facebookUser */
 $facebookUser = $facebookProvider->getResourceOwner($accessToken);
 
 // ...
 $em = $this->container->get('doctrine')->getManager();
 
 // 1) have they logged in with Facebook before? Easy!
 $user = $em->getRepository('AppBundle:User')
 ->findOneBy(array('email' => $facebookUser->getEmail())); 
 if ($user) {
 return $user;
 } 
 // ...
 } @weaverryan
  • 79.
    public function getUser($credentials,...)
 {
 // ...
 
 // 2) no user? Perhaps you just want to create one
 // (or redirect to a registration)
 $user = new User();
 $user->setUsername($facebookUser->getName());
 $user->setEmail($facebookUser->getEmail());
 $em->persist($user);
 $em->flush(); return $user;
 } @weaverryan
  • 80.
    public function checkCredentials($credentials,UserInterface $user)
 {
 // nothing to do here!
 }
 
 public function onAuthenticationFailure(Request $request ...)
 {
 // redirect to login
 }
 
 public function onAuthenticationSuccess(Request $request ...)
 {
 // redirect to homepage / last page
 } @weaverryan
  • 81.
  • 82.
    Can I controlthe error message? @weaverryan
  • 83.
    @weaverryan If authentication failed,it is because an AuthenticationException (or sub-class) was thrown (This has nothing to do with Guard)
  • 84.
    public function onAuthenticationFailure(Request$request, AuthenticationException $exception)
 {
 return new JsonResponse([
 'message' => $exception->getMessageKey()
 ], 401);
 } @weaverryan Christmas miracle! The exception is passed when authentication fails AuthenticationException has a hardcoded getMessageKey() “safe” string Invalid credentials.
  • 85.
    public function getCredentials(Request$request)
 {
 }
 
 public function getUser($credentials, UserProviderInterface $userProvider)
 {
 }
 
 public function checkCredentials($credentials, UserInterface $user)
 {
 }
 Throw an AuthenticationException at any time in these 3 methods
  • 86.
    How can Icustomize the message? @weaverryan Create a new sub-class of AuthenticationException for each message and override getMessageKey()
  • 87.
  • 88.
    public function getUser($credentials,...)
 {
 $apiToken = $credentials;
 
 $user = $this->em
 ->getRepository('AppBundle:User')
 ->findOneBy(['apiToken' => $apiToken]);
 
 if (!$user) {
 throw new CustomUserMessageAuthenticationException(
 'That API token is not very jolly'
 );
 }
 
 return $user;
 } @weaverryan
  • 89.
    I need tomanually authenticate my user @weaverryan
  • 90.
    public function registerAction(Request$request)
 {
 $user = new User();
 $form = // ...
 
 if ($form->isValid()) {
 // save the user
 
 $guardHandler = $this->container
 ->get('security.authentication.guard_handler');
 
 $guardHandler->authenticateUserAndHandleSuccess(
 $user,
 $request,
 $this->get('form_login_authenticator'),
 'main' // the name of your firewall
 );
 // redirect
 }
 // ...
 }
  • 91.
    I want tosave a lastLoggedInAt field on my user no matter *how* they login @weaverryan
  • 92.
    Chill… that wasalready possible SecurityEvents::INTERACTIVE_LOGIN @weaverryan
  • 93.
    class LastLoginSubscriber implementsEventSubscriberInterface
 {
 public function onInteractiveLogin(InteractiveLoginEvent $event)
 {
 /** @var User $user */
 $user = $event->getAuthenticationToken()->getUser();
 $user->setLastLoginTime(new DateTime());
 $this->em->persist($user);
 $this->em->flush($user);
 }
 
 public static function getSubscribedEvents()
 {
 return [
 SecurityEvents::INTERACTIVE_LOGIN => 'onInteractiveLogin'
 ];
 }
 }
 @weaverryan
  • 94.
    All of thesefeatures are available now! @weaverryan Thanks 2.8!
  • 95.
  • 96.
  • 97.
  • 98.
    1. User implementsUserInterface @weaverryan
  • 99.
  • 100.
    3. Create yourauthenticator(s) @weaverryan
  • 101.
  • 102.
    @weaverryan PHP & SymfonyVideo Tutorials KnpUniversity.com Thank You!