Security Upgrades

Hello everybody, I'm trying to implement security with no user table and authentication authorization all through an API, but I'm a little bit confused about what is the best way to implement it. Firstly I created the user with the make user method and Symfony creates the User class and a UserProvider class, then I check the course and learned about LoginFormAutheticator. I am already getting the response from the API with this piece of code in the class UserProvider implements UserProviderInterface, PasswordUpgraderInterface. But this method should return UserInterface and not a Passport. Do I have to implement the LoginFormAuthenticator instead of this method? What I'm missing is creating the user, the roles and processing the login. The User class created by Symfony implements UserInterface. Maybe is only an issue of filling the methods setUsername and setRoles and I can add there anything I need to store user information. Thanks for your help.

public function loadUserByIdentifier($identifier): UserInterface
{
    $user = $this->api->validateCredentials();

    dd($user->getContent());

    // Load a User object from your data source or throw UserNotFoundException.
    // The $identifier argument may not actually be a username:
    // it is whatever value is being returned by the getUserIdentifier()
    // method in your User class.
    throw new \Exception('TODO: fill in loadUserByIdentifier() inside ' . __FILE__);
}

Hi,

I already had the authenticate method in Symfony 5, however after upgrading to 6 I get this error when a user is not found or types in an incorrect password:

Symfony\Component\HttpFoundation\Exception\ BadRequestException
Input value "login_form" contains a non-scalar value.

<?php
use App\Kernel;
require_once dirname(__DIR__).'/vendor/autoload_runtime.php';
return function (array $context) {
    return new Kernel($context['APP_ENV'], (bool) $context['APP_DEBUG']);
};

This is the code I use:

public function authenticate(Request $request): Passport
    {
        $email = $request->get('login_form')['_username'];
        $password = $request->get('login_form')['_password'];
        return new Passport(
            new UserBadge($email, function($userIdentifier) {
                // optionally pass a callback to load the User manually
                $user = $this->em->getRepository(User::class)->findOneBy(['email' => $userIdentifier]);
                if (!$user) throw new UserNotFoundException();
                if (!$user->isEnabled()) throw new CustomUserMessageAuthenticationException('The account is deactivated.');
                if ($user->isLocked()) throw new CustomUserMessageAuthenticationException('The account is blocked.');
                return $user;
            }),
            new PasswordCredentials($password),
            [
                new CsrfTokenBadge(
                    'authenticate',
                    $request->request->get('_csrf_token')
                ),
                (new RememberMeBadge())->enable(),
            ]
        );
    }

Any idea what might cause this? It seems to not like the Exceptions I defined in the UserBadge.

Hello MolloKhan,

Thank you for the quick response.

We only use http_basic_ldap.
It goes wrong when i want to start a session, when we have no PHP_AUTH_USER.
If i turn of enable_authenticator_manager everything works fine.

When I start a session and should get a popup for username, password, i get this error:

An exception has been thrown during the rendering of a template 
("Cannot autowire argument $user of "App\Controller\<controller>": it references 
interface "Symfony\Component\Security\Core\User\UserInterface" but no such service exists. Did you 
create a class that implements this interface?").

This is our services.yaml

 Symfony\Component\Ldap\Ldap:
    arguments: [ '@Symfony\Component\Ldap\Adapter\ExtLdap\Adapter' ]
    tags:
      - ldap

  Symfony\Component\Ldap\Adapter\ExtLdap\Adapter:
    arguments:
      - connection_string: 'ldap://%env(LDAP_URL)%:389'
        options:
          protocol_version: 3
          referrals: false

And this is our security.yaml

security:
  enable_authenticator_manager: true
  providers:
    my_ldap:
      ldap:
        service: Symfony\Component\Ldap\Ldap
        base_dn: ...
        search_dn: ...
        search_password: 
        default_roles: ROLE_USER

  firewalls:
    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false
    main:
      stateless: true
      provider: my_ldap
      http_basic_ldap:
        service: Symfony\Component\Ldap\Ldap
        dn_string:...

Thanks for your help

Hi Symfony Casts,

Again, great work people, thank you very much for making these videos.
Finally got my employers to invest in its developers and arrange a team account for symfony casts !!!

My question is:
We use ldap for authentication and authorization in symfony 5.4.
This works fine as long as we do not set 'enable_authenticator_manager' to true.
We want to use the LdapAuthenticator class of course, but the code first goes to HttpBasicAuthenticator.
There the support function gives us a false because of course we do not use PHP_AUTH_USER.
If i hack this function and let it always return true, it will get to LdapAuthenticator.
When i do a dump in the AuthenticatorManager class in the constructor of $this->authenticators i get:

0 => Symfony ...\LdapAuthenticator {
    authenticator: Symfony ..\HttpBasicAuthenticator { // is this HttpBasicAuth... correct??
        userProvider: Symfo..LdapUserProvider
        ......
  }
}

Thank you very much for your help. Hope to hear from you soon, we are upgrading to sf 6!

Kind regards,

Annemieke Buijs