how to access request object in Sym2 FOSUserBundle custom UserChecker - php

Question

I am using Synfony2 with FOSUserBundle and I have a custom userChecker where I want to validate the host of the user (we have several hosts pointing to the same IP). My problem is that inside my custom userChecker I can't access REQUEST, thus not the HOST of the request.
This is my user checker code
/*
* This file is part of the Symfony package.
*
* (c) Fabien Potencier <fabien#symfony.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
//Override by Mattias
namespace BizTV\UserBundle\Controller;
//namespace Symfony\Component\Security\Core\User;
use Symfony\Component\Security\Core\Exception\CredentialsExpiredException;
use Symfony\Component\Security\Core\Exception\LockedException;
use Symfony\Component\Security\Core\Exception\DisabledException;
use Symfony\Component\Security\Core\Exception\AccountExpiredException;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserChecker as OriginalUserChecker;
use Symfony\Component\HttpFoundation\Request as Request; //ADDED BY MW
/**
* UserChecker checks the user account flags.
*
* #author Fabien Potencier <fabien#symfony.com>
*/
class UserCheckerNew extends OriginalUserChecker
{
/**
* {#inheritdoc}
*/
public function checkPreAuth(UserInterface $user)
{
/*
//Test for companylock...
if ( !$user->getCompany()->getActive() ) {
throw new LockedException('The company of this user is locked.', $user);
}
if ( $user->getLocked() ) {
throw new LockedException('The admin of this company has locked this user.', $user);
}
*/
if (!$user instanceof AdvancedUserInterface) {
return;
}
if (!$user->isCredentialsNonExpired()) {
throw new CredentialsExpiredException('User credentials have expired.', $user);
}
}
/**
* {#inheritdoc}
*/
public function checkPostAuth(UserInterface $user)
{
//Test for companylock...
if ( !$user->getCompany()->getActive() ) {
throw new LockedException('The company of this user is locked.');
}
if ( $user->getLocked() ) {
throw new LockedException('The admin of this company has locked this user.');
}
/*
Validate HOST here
*/
if (!$user instanceof AdvancedUserInterface) {
return;
}
if (!$user->isAccountNonLocked()) {
throw new LockedException('User account is locked.', $user);
}
if (!$user->isEnabled()) {
throw new DisabledException('User account is disabled.', $user);
}
if (!$user->isAccountNonExpired()) {
throw new AccountExpiredException('User account has expired.', $user);
}
}
}
In the checkPostAuth function I tried different things like passing the request
public function checkPostAuth(UserInterface $user, Request $request)
Error saying my override must conform to the original/interface.
Trying to get the request as in a controller
$this->container->get('request_stack')->getCurrentRequest();
or like this
$currentHost = $request->getHost();
or like this
$cont = $this->getContainer();
or like this
$request = $this->getRequest();
or like this
$request = $container->get('request');
Yet no luck =) I'm no Symfony2 guru, as you can tell, I'm shooting from the hip here =)
Added parameters to config.yml according to gp-sflover's answer, my config.yml now looks like this:
services:
security.user_checker:
class: BizTV\UserBundle\Controller\UserCheckerNew
arguments: [ "#request" ]
scope: request
public: true
The error delivered before scope:request was added to the config was:
Scope Widening Injection detected: The definition "security.user_checker" references the service "request" which belongs to a narrower scope. Generally, it is safer to either move "security.user_checker" to scope "request" or alternatively rely on the provider pattern by injecting the container itself, and requesting the service "request" each time it is needed. In rare, special cases however that might not be necessary, then you can set the reference to strict=false to get rid of this error.'
When adding scope: request a very similar error is returned
Scope Widening Injection detected: The definition "security.authentication.provider.dao.main" references the service "security.user_checker" which belongs to a narrower scope. Generally, it is safer to either move "security.authentication.provider.dao.main" to scope "request" or alternatively rely on the provider pattern by injecting the container itself, and requesting the service "security.user_checker" each time it is needed. In rare, special cases however that might not be necessary, then you can set the reference to strict=false to get rid of this error
Adding public: true doesn't seem to make a difference. Also, I don't know what this public stuff really means, perhaps a security issue? The word public is always scary =)

Answer 1

Instead of extend the "OriginalUserChecker" class you can override the security.user_checker service to be able to inject the request_stack as argument and then retrieve it in your UserChecker class like this simple example:
service.xml
// Symfony >=2.6
<service id="security.user_checker"
class="Your\Bundle\Path\ToYour\UserCheckerClass">
<argument type="service" id="request_stack"/>
</service>
// Symfony <2.6
<service id="security.user_checker"
class="Your\Bundle\Path\ToYour\UserCheckerClass">
<argument type="service" id="request" public="true" scope="request"/>
</service>
UserCheckerClass
use Symfony\Component\Security\Core\User\UserCheckerInterface;
// Symfony >=2.6
use Symfony\Component\HttpFoundation\RequestStack;
// Symfony <2.6
use Symfony\Component\HttpFoundation\Request;
class UserChecker implements UserCheckerInterface
{
private $request;
public function __construct(
// Symfony >=2.6
RequestStack $request
// Symfony <2.6
Request $request
) {
$this->request = $request;
}
public function checkPreAuth(UserInterface $user)
{
// your checks here
}
public function checkPostAuth(UserInterface $user)
{
// your checks here
}
}

Answer 2

I never did get the request injection to work. I did however get an injection of the entire service container to work.
This is how I ended up doing it, with guidance from gp_sflover (if you post an answer with this code I will check yours as the correct answer, I don't want to steal cred, just get the truth out there ;] )
services:
security.user_checker:
#class: BizTV\UserBundle\Controller\UserChecker
class: BizTV\UserBundle\Controller\UserCheckerNew
arguments: ["#service_container"]
namespace BizTV\UserBundle\Controller;
use Symfony\Component\Security\Core\User\UserCheckerInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\Exception\CredentialsExpiredException;
use Symfony\Component\Security\Core\Exception\LockedException;
use Symfony\Component\Security\Core\Exception\DisabledException;
use Symfony\Component\Security\Core\Exception\AccountExpiredException;
class UserCheckerNew implements UserCheckerInterface
{
protected $container;
public function __construct(ContainerInterface $container)
{
$this->container = $container;
}
public function checkPreAuth(UserInterface $user)
{
if (!$user instanceof AdvancedUserInterface) {
return;
}
if (!$user->isCredentialsNonExpired()) {
throw new CredentialsExpiredException('User credentials have expired.', $user);
}
}
/**
* {#inheritdoc}
*/
public function checkPostAuth(UserInterface $user)
{
//Validate HOST here, make it look as though account doesn't exist if on wrong host
$host = $this->container->get('request')->getHost();
if ($host != "localhost") { //bypass all checks when on localhost
$brandedHost = $user->getCompany()->getBrandedHost();
if ( $brandedHost == "" ) { //if unset assume main
$brandedHost = "login.mydomain.se";
}
if ( $host != $brandedHost ) {
throw new LockedException('Invalid username or password.'); //dot added for debug
}
}
// end of host validation
//Test for companylock...
if ( !$user->getCompany()->getActive() ) {
throw new LockedException('The company of this user is locked.');
}
if ( $user->getLocked() ) {
throw new LockedException('The admin of this company has locked this user.');
}
if (!$user instanceof AdvancedUserInterface) {
return;
}
if (!$user->isAccountNonLocked()) {
throw new LockedException('User account is locked.', $user);
}
if (!$user->isEnabled()) {
throw new DisabledException('User account is disabled.', $user);
}
if (!$user->isAccountNonExpired()) {
throw new AccountExpiredException('User account has expired.', $user);
}
}
}