This tutorial has a new version, check it out!
> APIs > Symfony RESTful API: Authentication with JWT (Course 4)
Login to bookmark this video
Buy Access to Course
08.

Registering the Authenticator (Part 2)

Share this awesome video!

|

Keep on Learning!

Start your All-Access Pass

With a Subscription, click any sentence in the script to jump to that part of the video!

Login Subscribe

The authenticator class is done - well done enough to see it working. Next, we need to register it as a service. Open up app/config/services.yml to add it: call it jwt_token_authenticator. Set its class to AppBundle\Security\JwtTokenAuthenticator:

39 lines | app/config/services.yml
// ... lines 1 - 5
services:
// ... lines 7 - 35
jwt_token_authenticator:
class: AppBundle\Security\JwtTokenAuthenticator
autowire: true

And instead of adding an arguments key: here's your permission to be lazy! Set autowire to true to make Symfony guess the arguments for us.

Finally, copy the service name and head into security.yml. Under the firewall, add a guard key, add authenticators below that and paste the service name:

32 lines | app/config/security.yml
security:
// ... lines 2 - 8
firewalls:
main:
// ... lines 11 - 20
guard:
authenticators:
- 'jwt_token_authenticator'
// ... lines 24 - 32

As soon as you do that, Symfony will call getCredentials() on the authenticator on every request. If we send a request that has an Authorization header, it should work its magic.

Let's try it! Run our original testPOSTProgrammerWorks() test: this is sending a valid JSON web token.

./vendor/bin/phpunit --filter testPOSTProgrammerWorks

And this time... it passes!

Hold on, that's pretty amazing! The authenticator automatically decodes the token and authenticates the user. By the time ProgrammerController is executed, our user is logged in. In fact, there's one other spot we can finally fix.

Down on line 37, we originally had to make it look like every programmer was being created by weaverryan:

193 lines | src/AppBundle/Controller/Api/ProgrammerController.php
// ... lines 1 - 18
class ProgrammerController extends BaseController
{
// ... lines 21 - 24
public function newAction(Request $request)
{
// ... lines 27 - 36
$programmer->setUser($this->findUserByUsername('weaverryan'));
// ... lines 38 - 50
}
// ... lines 52 - 191
}

Without authentication, we didn't know who was actually making the API requests, and since every Programmer needs an owner, this hack was born.

Replace this with $this->getUser():

193 lines | src/AppBundle/Controller/Api/ProgrammerController.php
// ... lines 1 - 18
class ProgrammerController extends BaseController
{
// ... lines 21 - 24
public function newAction(Request $request)
{
// ... lines 27 - 36
$programmer->setUser($this->getUser());
// ... lines 38 - 50
}
// ... lines 52 - 191
}

That's it.

Our controller doesn't know or care how we were authenticated: it just cares that $this->getUser() returns the correct user object.

Run the test again.

./vendor/bin/phpunit --filter testPOSTProgrammerWorks

It still passes! Welcome to our beautiful JWT authentication system. Now, time to lock down every endpoint: I don't want other users messing with my code battlers.