Two-way authentication in Symfony 2 project - php

Question

I need to implement two-way authentication process in one of my Symfony 2 projects according to this algorithm:
User enters his username and password in the authentication form and submits it.
System first check his username and password the default way (all users are stored with Doctrine ORM).
If previous step failed, calling an external API and passing to it username and md5(password).
If previous step succeeded, creating a new User entity and using it as authenticated user.
If step #3 failed, then authentication is considered failed.
I already have a service that can be called to authenticate a user by he's username and password using external API, I'm just looking for a way to use it in authentication process.
What is the simplest way to implement this behavior? I just need to be pointed in the right direction.
Update
Is implementing a "custom authenticator" is a good solution to this problem? Or is there a better approach?
Looking at the documentation, I will have to implement both steps of authentication in my custom authenticator. Is it possible to implement only additional step?

Answer 1

Yes, that's the way to go. If your web service can give you user just by username then you could do it in UserProvider only, since in it's scope you have only username. If you must query by un/pw then you must do it in authenticator since in that scope you have password. So, with simple form it will look something like this
public function authenticateToken(TokenInterface $token, UserProviderInterface $userProvider, $providerKey)
{
try {
$user = $userProvider->loadUserByUsername($token->getUsername());
} catch (UsernameNotFoundException $e) {
throw new AuthenticationException('Invalid username or password');
}
$encoder = $this->encoderFactory->getEncoder($user);
$passwordValid = $encoder->isPasswordValid(
$user->getPassword(),
$token->getCredentials(),
$user->getSalt()
);
if ($passwordValid) {
return new UsernamePasswordToken(
$user,
$user->getPassword(),
$providerKey,
$user->getRoles()
);
}
// remote users fallback
$webUser = $this->externalUserService->getByUsernamePassword(
$token->getUsername(),
$token->getCredentials()
);
if ($webUser) {
return new UsernamePasswordToken(
$webUser,
$token->getCredentials(),
$providerKey,
$webUser->getRoles()
);
}
throw new AuthenticationException('Invalid username or password');
}
Ofc there are too many ifs in this class and it's responsible for more then one thing, so to be tidy you could apply composite pattern and have 3 authenticators, one generic composite, second local db authenticator and third external service authenticator, and build it from the services config like this.
# services.yml
my_app.authenticator.main:
class: MyApp/Security/Core/Authentication/CompisiteAuthenticator
calls:
- [ add, [#my_app.authenticator.locale]]
- [ add, [#my_app.authenticator.remote]]
my_app.authenticator.locale:
class: MyApp/Security/Core/Authentication/LocalAuthenticator
arguments: [#security.encoder_factory]
my_app.authenticator.remote:
class: MyApp/Security/Core/Authentication/RemoteAuthenticator
arguments: [#my_app.remote_user_service]
Composite
<?php
namespace MyApp/Security/Core/;
class CompositeAuthenticator implements SimpleFormAuthenticatorInterface
{
/** #var SimpleFormAuthenticatorInterface[] */
protected $children = array();
public function add(SimpleFormAuthenticatorInterface $authenticator)
{
$this->children[] = $authenticator;
}
public function createToken(Request $request, $username, $password, $providerKey)
{
return new UsernamePasswordToken($username, $password, $providerKey);
}
public function supportsToken(TokenInterface $token, $providerKey)
{
return $token instanceof UsernamePasswordToken
&& $token->getProviderKey() === $providerKey;
}
public function authenticateToken(TokenInterface $token, UserProviderInterface $userProvider, $providerKey)
{
$result = null;
foreach ($this->children as $authenticator)
{
$result = $authenticator->authenticateToken($token, $userProvider, $providerKey);
if ($result) {
return $result;
}
}
throw new AuthenticationException('Invalid username or password');
}
}
And local and remote authenticators are I guess trivial now