Adding & Checking the User's Password

Assuming i'm using Symfony 3.4, i need to migrate some old hashed password to a new one. As the brand new migrate_from is not an option to this version, where would be a good place to put this logic?

I do have only one Authenticator and i'm looking to put the logic inside checkCredentials().

What about something like this implementation?

`

            public function checkCredentials($credentials, UserInterface $customer)
            {
                     // Check plain password against 'old' encoder
                $isValidFromOldEncoder = $this->customPassEncoder->isPasswordValid($customer->getPassword(), $credentials['password'], $customer->getSalt());
                
                // Password valid from old Encoder
                if ($isValidFromOldEncoder) {
                    // Upgrade current encoded password within the new ArgoEncoder
                    $encoded = $this->argoEncoder->encodePassword($credentials['password'], $customer->getSalt());

                    // TODO: move it to CustomerManager
                    $customer->setPassword($encoder);
                    $this->em->flush();

                    return true;
                }

                // When password is not valid from old encoder, try it within the new ArgoEncoder
                return $this->argoEncoder->isPasswordValid($customer->getPassword(), $credentials['password'], $customer->getSalt());
            
            }

`

Anything im missing?

Hi guys.

I made similar LoginFormAuthenticator and it works really good.
But my client ask for a change: the authentification is now with email and a barcode.

Barcode is a similar property in my User entity: string of 6 char.
So I made some changes.
<b>In short:</b>

update the login form and change the password input and have the barcode
update the LoginFormAuthenticator:

`

public function getCredentials(Request $request) {

    $credentials =
        [
            'email_address' => $request->request->get('email_address'),
            'barcode'       => $request->request->get('barcode'),
            'csrf_token'    => $request->request->get('_csrf_token')
        ];
        // ......

}
`

But when I try to login, it seems that it's still the password who is checked.
I think I have to change some stuff in the checkCredentials function but I don't know what to do fo checking the combination email_adresse > barcode.

Some help ?

I copied over the code from BaseFixture and UserFixture from the source code to my own project. at UserFixture.php it says:
use App\Entity\ApiToken. Undifined ApiToken. Is the path outdated?

Why does symfony not support pepper? Would that be inconvenient? If I would like to have two spices, one global, should I write my own encoder based on one of standard encoders or is there some other approach more recommended?

Hello everyone !
A simple "logical or best pratice" question about the password encoder : is it possible to use it inside the User entity, directly in the setPassword() function ?
Because you have to set up this encoder in every controllers, unit test or fixture test you need it... :(

Cheers !

Hi SF Team, thank you for your outstanding work!

Why is the password string different on my local machine vs my production server?
(After a new user registration)

Local machine password string in DB (PHP 7.4.1):

$argon2id$v=19$m=65536,t=4,p=1$XWMkl2KbtwT0ROg6b+bRaw$LRHoTCUrVZ62wkuw3YWQgCmuumTYQXuoaHbfSTUIwMw

Production machine password string in DB (PHP 7.4.1):

$2y$13$vyDR81RZwiDlef4HMSZizuO9Ct4cYwUIs2kB28ayZUdVZGhdywdEG

At first I thought the reason is the environment, defined inside the .env file, but that's not the case.
The production server always creates passwords with this "type" of password string whereas the local machine always creates the other type of password string.

Why is that? (Both have PHP 7.4.1)
And is it important?
(The local machine password string ($argon2id$...) could be better, because SF can detect which type of algorithm was used for future "password encryption upgrades"? (whereas this is not possible with the "short password string" the production server produces?)

UDPATE://
After some research I found out that the local PHP 7.4.1 was build with Sodium support and the production PHP 7.4.1 build doesn't have Sodium support.
And the production server password "type" looks like a bcrypt string, correct?

But why chooses SF bcrypt instead of the stronger argon2id hashing algorithm on the production server (which should be implemented in every PHP 7.4 build?)?
The Symfony Docs tells me that it chooses argon2id over bcrypt if possible.
Is this possibly a bug inside Symfony?

My security.yaml of course contains this auto algorithm config:

security:
encoders:
App\Entity\User:
algorithm: auto

Uodate2://
After digging deeper, I found out that the production php build is configured without libsodium/argon2 support. Thats why I think SF falls back to bcrypt
What a pity that PHP doesn't support the "latest" algorithms out of the box, only if you configure it manually to do so.

Hello,
I'm updated User entity by adding password field, but when i run "make:migration" command, i got this warning "[WARNING] No database changes were detected." after that, i deleted file migration manually but still same warning!

Hello there,

Not sure what went wrong, but I always get "Invalid credentials" not sure where to debug it, can you please point me?

Thanks so much!

Hello,
how can I add a check, if the user is active?
In my user class I have the field active. A login should only be possible, if active = true.

Where I have to add this?

Hello! How to encode password in User->setPassword? setPassword store only plain password in database

Hi! I have done the registration who send a confirmation token through email, but I still don't understand how redirect works..
Check this:

/**
     * @Route("/confirm/{token}", name="app_confirm_email")
     *
     */
    public function confirmRegistration($token, EntityManagerInterface $em, Request $request, UserPasswordEncoderInterface $passwordEncoder){
        $repositoryToken = $em->getRepository(Confirmationtoken::class);
        $repositoryUser = $em->getRepository(User::class);

        $form = $this->createForm(SetupFirstPasswordForm::class);
        $form->handleRequest($request);
        $confirmationtoken = $repositoryToken->findOneBy(['value' => $token]);
        if($confirmationtoken != null){
            $confirmedUser = $repositoryUser->findOneBy(['id' => $confirmationtoken->getAssociatedUser()]);

            if ($form->isSubmitted() && $form->isValid()) {

                $confirmedUser->setPassword($passwordEncoder->encodePassword(
                    $confirmedUser,
                    $form['password']->getData()
                ));
                $confirmedUser->setActive(true);

                $em->persist($confirmedUser);
                $em->flush();

                $em->remove($confirmationtoken);
                $em->flush();

                $this->addFlash('success', 'Password Impostata con successo!');
                return $this->redirectToRoute('app_login');
            }

            return $this->render('account/setfirstpassword.html.twig', [
                'form' => $form->createView(),
                'token' => $token,
            ]);

        }

After the setup of the first password I get to login thanks to the redirect but when i press login I get redirected to https://localhost:8000/account/confirm/12345678
Why?

You said that Argon2i is recommended for PHP 7.2=<

security:
    encoders:
        App\Entity\User:
            algorithm: argon2i

Since Argon2id is implemented into PHP 7.3, is Argon2id now the recommended algorithm?

Strange... Just after the post, I have a 302...

Hi SymfonyCasts Crew!

I was rolling along perfect with Symfony Security: Beautiful Authentication, Powerful Authorization until Chapter 12 - Checking the User’s Password.

When I set up the password field in the User entity and try the Login functions, I’m getting the PHP Fatal error in PhpStorm: Allowed memory size of 268435456 bytes exhausted (tried to allocators 262144 bytes …. Blah blah fun stuff! My browser locks up with HTTP 500 error…!

I know has nothing with the tutorial code but rather a problem with my AMP setup, but I’m wondering if you might have some tips on how to correct for this error. I’m on iMac with Mohave running PHP version 7.1.19. My php.ini has memory_limit set to 256mb and using PhpStorm with built in server.

Not sure if anyone has run across this type of memory error but any ideas for a fix would be welcome! Thanks in advance! Rob

Hi,
the faker isn't filling the database and also this error is being shown
An exception occurred while executing 'ALTER TABLE user ADD COLUMN password VARCHAR(255) NOT NULL':

SQLSTATE[HY000]: General error: 1 Cannot add a NOT NULL column with default value NULL
while following exactly your steps

Hello !
First things first, THANK YOU for all your work, it is just awesome !

Now the question ;-)
Is it me missing something or we actually do not logout, when reaching login, nor on failed login attempt ?
Especially if there is already a session for the failed email ?
I tried to invalidate session but it appears to be a abd idea as it makes fail the csrf check

So , what do you think is the best way to handle that ?

Thank you in advance for your advice !

I have an authenticator problem.
When I try different passwords in my login page, none of them passes the authenticator, even with "engage".

I tried to copy and paste the code for LoginFormAuthenticator from the folder "finish" but it still doesn't work.
Can you help me ?