vendor/symfony/security-guard/Provider/GuardAuthenticationProvider.php line 75

Open in your IDE?
  1. <?php
  2. /*
  3.  * This file is part of the Symfony package.
  4.  *
  5.  * (c) Fabien Potencier <fabien@symfony.com>
  6.  *
  7.  * For the full copyright and license information, please view the LICENSE
  8.  * file that was distributed with this source code.
  9.  */
  10. namespace Symfony\Component\Security\Guard\Provider;
  11. use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
  12. use Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface;
  13. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  14. use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
  15. use Symfony\Component\Security\Core\Exception\AuthenticationException;
  16. use Symfony\Component\Security\Core\Exception\AuthenticationExpiredException;
  17. use Symfony\Component\Security\Core\Exception\BadCredentialsException;
  18. use Symfony\Component\Security\Core\Exception\UserNotFoundException;
  19. use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
  20. use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
  21. use Symfony\Component\Security\Core\User\UserCheckerInterface;
  22. use Symfony\Component\Security\Core\User\UserInterface;
  23. use Symfony\Component\Security\Core\User\UserProviderInterface;
  24. use Symfony\Component\Security\Guard\AuthenticatorInterface;
  25. use Symfony\Component\Security\Guard\PasswordAuthenticatedInterface;
  26. use Symfony\Component\Security\Guard\Token\GuardTokenInterface;
  27. use Symfony\Component\Security\Guard\Token\PreAuthenticationGuardToken;
  28. trigger_deprecation('symfony/security-guard''5.3''The "%s" class is deprecated, use the new authenticator system instead.'GuardAuthenticationProvider::class);
  29. /**
  30.  * Responsible for accepting the PreAuthenticationGuardToken and calling
  31.  * the correct authenticator to retrieve the authenticated token.
  32.  *
  33.  * @author Ryan Weaver <ryan@knpuniversity.com>
  34.  *
  35.  * @deprecated since Symfony 5.3, use the new authenticator system instead
  36.  */
  37. class GuardAuthenticationProvider implements AuthenticationProviderInterface
  38. {
  39.     private $guardAuthenticators;
  40.     private $userProvider;
  41.     private $providerKey;
  42.     private $userChecker;
  43.     private $passwordHasher;
  44.     /**
  45.      * @param iterable<array-key, AuthenticatorInterface> $guardAuthenticators The authenticators, with keys that match what's passed to GuardAuthenticationListener
  46.      * @param string                                      $providerKey         The provider (i.e. firewall) key
  47.      * @param UserPasswordHasherInterface                 $passwordHasher
  48.      */
  49.     public function __construct(iterable $guardAuthenticatorsUserProviderInterface $userProviderstring $providerKeyUserCheckerInterface $userChecker$passwordHasher null)
  50.     {
  51.         $this->guardAuthenticators $guardAuthenticators;
  52.         $this->userProvider $userProvider;
  53.         $this->providerKey $providerKey;
  54.         $this->userChecker $userChecker;
  55.         $this->passwordHasher $passwordHasher;
  56.         if ($passwordHasher instanceof UserPasswordEncoderInterface) {
  57.             trigger_deprecation('symfony/security-core''5.3'sprintf('Passing a "%s" instance to the "%s" constructor is deprecated, use "%s" instead.'UserPasswordEncoderInterface::class, __CLASS__UserPasswordHasherInterface::class));
  58.         }
  59.     }
  60.     /**
  61.      * Finds the correct authenticator for the token and calls it.
  62.      *
  63.      * @param GuardTokenInterface $token
  64.      *
  65.      * @return TokenInterface
  66.      */
  67.     public function authenticate(TokenInterface $token)
  68.     {
  69.         if (!$token instanceof GuardTokenInterface) {
  70.             throw new \InvalidArgumentException('GuardAuthenticationProvider only supports GuardTokenInterface.');
  71.         }
  72.         if (!$token instanceof PreAuthenticationGuardToken) {
  73.             /*
  74.              * The listener *only* passes PreAuthenticationGuardToken instances.
  75.              * This means that an authenticated token (e.g. PostAuthenticationGuardToken)
  76.              * is being passed here, which happens if that token becomes
  77.              * "not authenticated" (e.g. happens if the user changes between
  78.              * requests). In this case, the user should be logged out, so
  79.              * we will return an AnonymousToken to accomplish that.
  80.              */
  81.             // this should never happen - but technically, the token is
  82.             // authenticated... so it could just be returned
  83.             if ($token->isAuthenticated(false)) {
  84.                 return $token;
  85.             }
  86.             // this causes the user to be logged out
  87.             throw new AuthenticationExpiredException();
  88.         }
  89.         $guardAuthenticator $this->findOriginatingAuthenticator($token);
  90.         if (null === $guardAuthenticator) {
  91.             throw new AuthenticationException(sprintf('Token with provider key "%s" did not originate from any of the guard authenticators of provider "%s".'$token->getGuardProviderKey(), $this->providerKey));
  92.         }
  93.         return $this->authenticateViaGuard($guardAuthenticator$token);
  94.     }
  95.     private function authenticateViaGuard(AuthenticatorInterface $guardAuthenticatorPreAuthenticationGuardToken $token): GuardTokenInterface
  96.     {
  97.         // get the user from the GuardAuthenticator
  98.         $user $guardAuthenticator->getUser($token->getCredentials(), $this->userProvider);
  99.         if (null === $user) {
  100.             $e = new UserNotFoundException(sprintf('Null returned from "%s::getUser()".'get_debug_type($guardAuthenticator)));
  101.             // @deprecated since Symfony 5.3, change to $token->getUserIdentifier() in 6.0
  102.             $e->setUserIdentifier(method_exists($token'getUserIdentifier') ? $token->getUserIdentifier() : $token->getUsername());
  103.             throw $e;
  104.         }
  105.         if (!$user instanceof UserInterface) {
  106.             throw new \UnexpectedValueException(sprintf('The "%s::getUser()" method must return a UserInterface. You returned "%s".'get_debug_type($guardAuthenticator), get_debug_type($user)));
  107.         }
  108.         if ($guardAuthenticator instanceof PasswordAuthenticatedInterface && !$user instanceof PasswordAuthenticatedUserInterface) {
  109.             trigger_deprecation('symfony/security-guard''5.3''Not implementing the "%s" interface in class "%s" while using password-based guard authenticators is deprecated.'PasswordAuthenticatedUserInterface::class, get_debug_type($user));
  110.         }
  111.         $this->userChecker->checkPreAuth($user);
  112.         if (true !== $checkCredentialsResult $guardAuthenticator->checkCredentials($token->getCredentials(), $user)) {
  113.             if (false !== $checkCredentialsResult) {
  114.                 throw new \TypeError(sprintf('"%s::checkCredentials()" must return a boolean value.'get_debug_type($guardAuthenticator)));
  115.             }
  116.             throw new BadCredentialsException(sprintf('Authentication failed because "%s::checkCredentials()" did not return true.'get_debug_type($guardAuthenticator)));
  117.         }
  118.         if ($this->userProvider instanceof PasswordUpgraderInterface && $guardAuthenticator instanceof PasswordAuthenticatedInterface && null !== $this->passwordHasher && (null !== $password $guardAuthenticator->getPassword($token->getCredentials())) && $this->passwordHasher->needsRehash($user)) {
  119.             if ($this->passwordHasher instanceof UserPasswordEncoderInterface) {
  120.                 // @deprecated since Symfony 5.3
  121.                 $this->userProvider->upgradePassword($user$this->passwordHasher->encodePassword($user$password));
  122.             } else {
  123.                 $this->userProvider->upgradePassword($user$this->passwordHasher->hashPassword($user$password));
  124.             }
  125.         }
  126.         $this->userChecker->checkPostAuth($user);
  127.         // turn the UserInterface into a TokenInterface
  128.         $authenticatedToken $guardAuthenticator->createAuthenticatedToken($user$this->providerKey);
  129.         if (!$authenticatedToken instanceof TokenInterface) {
  130.             throw new \UnexpectedValueException(sprintf('The "%s::createAuthenticatedToken()" method must return a TokenInterface. You returned "%s".'get_debug_type($guardAuthenticator), get_debug_type($authenticatedToken)));
  131.         }
  132.         return $authenticatedToken;
  133.     }
  134.     private function findOriginatingAuthenticator(PreAuthenticationGuardToken $token): ?AuthenticatorInterface
  135.     {
  136.         // find the *one* GuardAuthenticator that this token originated from
  137.         foreach ($this->guardAuthenticators as $key => $guardAuthenticator) {
  138.             // get a key that's unique to *this* guard authenticator
  139.             // this MUST be the same as GuardAuthenticationListener
  140.             $uniqueGuardKey $this->providerKey.'_'.$key;
  141.             if ($uniqueGuardKey === $token->getGuardProviderKey()) {
  142.                 return $guardAuthenticator;
  143.             }
  144.         }
  145.         // no matching authenticator found - but there will be multiple GuardAuthenticationProvider
  146.         // instances that will be checked if you have multiple firewalls.
  147.         return null;
  148.     }
  149.     public function supports(TokenInterface $token)
  150.     {
  151.         if ($token instanceof PreAuthenticationGuardToken) {
  152.             return null !== $this->findOriginatingAuthenticator($token);
  153.         }
  154.         return $token instanceof GuardTokenInterface;
  155.     }
  156. }