Symfony 3 authenticating against pages under firewall - php

Question

the problem that I am experiencing is that I am trying to autologin users towards the profile section of my website but since it is protected by symfony's firewall the users get redirected to the login page before the autologin system kicks in.
So I was wondering if there is an event that gets triggered when the user tries to access a page under firewall which I could listen to or eventually another mechanism I could put in play to solve this scenario.
At the moment the fix I went for was to create a custom redirect controller which I send my users to with the autologin hash and a path parameter containing the final location to send the user to, so after authenticating them I redirect them to the final destination.
What I am trying to achieve is to be able to autologin users directly to those pages behind firewall without having a custom controller which autologin users and then redirect them to the desired page.
Thank you.
D.

Answer 1

Basically, you have three options:
1. Create a custom authentication provider
If you want to really listen to the firewall, you need to create a custom authentication provider, which is rather a challenging task.
You can follow this guide in the documentation: http://symfony.com/doc/current/security/custom_authentication_provider.html
or http://sirprize.me/scribble/under-the-hood-of-symfony-security/
The point here is to create your own firewall listener, which decides whether or not to authenticate the user. A firewall can have multiple listeners.
2. Listen to every request
Alternatively, you can listen to the kernel.request event, possibly manually checking if you are on the secured path, and if so, authenticate the user manually by a helper method. Example:
namespace AppBundle\Subscriber;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;
use Symfony\Component\Security\Http\Event\InteractiveLoginEvent;
use Symfony\Component\Security\Http\SecurityEvents;
class RequestSubscriber implements EventSubscriberInterface
{
private $tokenStorage;
private $eventDispatcher;
public function __construct(TokenStorageInterface $tokenStorage, EventDispatcherInterface $eventDispatcher)
{
$this->tokenStorage = $tokenStorage;
$this->eventDispatcher = $eventDispatcher;
}
public static function getSubscribedEvents()
{
return [ KernelEvents::REQUEST => 'onRequest' ];
}
public function onRequest(GetResponseEvent $event)
{
// only master requests and not authenticated users
if (!$event->isMasterRequest() || $this->isUserLoggedIn()) {
return;
}
// add your own logic for creating or loading a User object
// and filtering secured routes
/* ... */
// wohoo, user is going to be logged in manually!
$this->authenticate($user, $event->getRequest(), 'secured_area');
}
protected function authenticate(UserInterface $user, Request $request, String $provider) : Bool
{
// password doesn't matter in this case
$token = new UsernamePasswordToken($user, null, $provider, $user->getRoles());
// actual authenticating
$this->tokenStorage->setToken($token);
// dispatch the authentication event, so event listeners can do stuff
$loggedUser = $token->getUser();
if ($loggedUser instanceof UserInterface && $loggedUser->isAccountNonLocked() &&
$loggedUser->isEnabled()) {
$this->eventDispatcher
->dispatch(
SecurityEvents::INTERACTIVE_LOGIN,
new InteractiveLoginEvent($request, $token)
);
return true;
}
return false;
}
protected function isUserLoggedIn()
{
$token = $this->tokenStorage->getToken();
if (!$token) {
return false;
}
return ($token->getUser() instanceof UserInterface);
}
}
And don't forget to add it to the app/config/services.yml:
app.request_subscriber:
class: AppBundle\Subscriber\RequestSubscriber
tags:
- { name: kernel.event_subscriber }
arguments: ['#security.token_storage', '#event_dispatcher']
3. Turn off the authorization
(Probably not a solution for you, since you want to authenticate, not authorize users, but I still mention it for others.)
In app/config/security.yml, change the access control settings so that everyone can access the secured area:
# ...
access_control:
- { path: ^/secured-area$, role: IS_AUTHENTICATED_ANONYMOUSLY }