Authentication with 2 entites that implements UserInterface - php

Question

Is it possible to have 2 entities that implement UserInterface?
How to use it on my guard to make it check in both classes and with the same firewall?
The idea is that companies can have their own CVTheque or shared it (CVTheque has a OneToMany relationship with Company).
I would like to have Candidate and User entities.
CVTheque -> OneToMany -> Candidate
User -> ManyToOne -> Company.
Candidate and User will used the same login form to be authenticated on the app. So I don't know if it's possible and how to implement this on my guard authenticator.
They will be redirected to their own dashboard depending to instance of connected user (Candidate or User).

Answer 1

Recently handled a similar scenario.
In my case, just created a chain_provider to encapsulate all entities needed:
providers:
chain_provider:
chain:
providers: [provider_one, provider_two]
provider_one:
entity:
class: App\Entity\ProviderOne
property: username
provider_two:
entity:
class: App\Entity\ProviderTwo
property: email
security:
firewalls:
secured_area:
# ...
pattern: ^/login
provider: chain_provider

Answer 2

I believe it is possible, let's take basic user authentication and try to tweak it
<?php
namespace App\Security;
use App\Entity\User;
use Doctrine\ORM\EntityManagerInterface;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Security\Core\Security;
use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\EventDispatcher\GenericEvent;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Http\Util\TargetPathTrait;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException;
use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
use Symfony\Component\Security\Guard\Authenticator\AbstractFormLoginAuthenticator;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
class LoginAuthenticator extends AbstractFormLoginAuthenticator
{
use TargetPathTrait;
private $entityManager;
private $urlGenerator;
private $csrfTokenManager;
private $encoder;
public function __construct(
EntityManagerInterface $entityManager,
UrlGeneratorInterface $urlGenerator,
CsrfTokenManagerInterface $csrfTokenManager,
UserPasswordEncoderInterface $encoder)
{
$this->entityManager = $entityManager;
$this->urlGenerator = $urlGenerator;
$this->csrfTokenManager = $csrfTokenManager;
$this->encoder = $encoder;
$this->eventDispatcher = $eventDispatcher;
}
public function supports(Request $request)
{
return (
'login' === $request->attributes->get('_route')&& $request->isMethod('POST') // here you need to specify the other login route if you want to have 2 seperate ones
);
}
public function getCredentials(Request $request)
{
$credentials = [
'username' => $request->request->get('username'),
'password' => $request->request->get('password'),
'csrf_token' => $request->request->get('_csrf_token'),
];
$request->getSession()->set(
Security::LAST_USERNAME,
$credentials['username']
);
return $credentials;
}
public function getUser($credentials, UserProviderInterface $userProvider)
{
$token = new CsrfToken('authenticate', $credentials['csrf_token']);
if (!$this->csrfTokenManager->isTokenValid($token)) {
throw new InvalidCsrfTokenException();
}
$user = $this->entityManager->getRepository(User::class)->findOneBy(['username' => $credentials['username']]);
if (!$user) { // here look for user in the 2nd entity, if it will still be null throw the exception
// fail authentication with a custom error
throw new CustomUserMessageAuthenticationException('Username could not be found.');
}
return $user;
}
public function checkCredentials($credentials, UserInterface $user)
{
return $this->encoder->isPasswordValid($user, $credentials['password'], $user->getSalt());
}
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
{
if ($targetPath = $this->getTargetPath($request->getSession(), $providerKey)) {
return new RedirectResponse($targetPath);
}
return new RedirectResponse($this->urlGenerator->generate('account_index'));
}
protected function getLoginUrl()
{
return $this->urlGenerator->generate('login');
}
}
And that's probably it, we change the authenticator to support 2 routes (login one, login two), and if the first entity does not match username and password try to find user in the other one, you might as well add a hidden input or add attribute in request listener based on the route retrieve it using RequestStack or however you want to indicate each entity.