Skip to content

Commit 1145042

Browse files
HeahDudeHeahDude
committed
[Security] Various minor fixes in XML config
1 parent e9192ba commit 1145042

10 files changed

+56
-51
lines changed

‎security/custom_authentication_provider.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ the value returned for the expected WSSE information, creates a token using
172172
that information, and passes the token on to the authentication manager. If
173173
the proper information is not provided, or the authentication manager throws
174174
an :class:`Symfony\\Component\\Security\\Core\\Exception\\AuthenticationException`,
175-
a 403 Response is returned.
175+
a 401 Response is returned.
176176

177177
.. note::
178178

@@ -188,7 +188,7 @@ a 403 Response is returned.
188188

189189
Returning prematurely from the listener is relevant only if you want to chain
190190
authentication providers (for example to allow anonymous users). If you want
191-
to forbid access to anonymous users and have a nice 403 error, you should set
191+
to forbid access to anonymous users and have a 404 error, you should set
192192
the status code of the response before returning.
193193

194194
The Authentication Provider

‎security/entity_provider.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -246,9 +246,9 @@ the username and then check the password (more on passwords in a moment):
246246
<!-- ... -->
247247
248248
<provider name="our_db_provider">
249-
<!-- if you're using multiple entity managers, add:
250-
manager-name="customer" -->
251249
<entity class="AppBundle:User" property="username"/>
250+
<!-- if you're using multiple entity managers -->
251+
<entity class="AppBundle:User" property="username" manager-name="customer"/>
252252
</provider>
253253
254254
<firewall name="main" pattern="^/" provider="our_db_provider">

‎security/force_https.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ to use HTTPS then you could use the following configuration:
3333
<config>
3434
<!-- ... -->
3535
36-
<rule path="^/secure" role="ROLE_ADMIN" requires_channel="https"/>
36+
<rule path="^/secure" role="ROLE_ADMIN" requires-channel="https"/>
3737
</config>
3838
</srv:container>
3939
@@ -83,7 +83,7 @@ role:
8383
8484
<rule path="^/login"
8585
role="IS_AUTHENTICATED_ANONYMOUSLY"
86-
requires_channel="https"
86+
requires-channel="https"
8787
/>
8888
</config>
8989
</srv:container>

‎security/guard_authentication.rst

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ Next, make sure you've configured a "user provider" for the user:
116116
<!-- ... -->
117117
118118
<provider name="your_db_provider">
119-
<entity class="AppBundle:User"/>
119+
<entity class="AppBundle:User" property="apiKey"/>
120120
</provider>
121121
122122
<!-- ... -->
@@ -133,6 +133,7 @@ Next, make sure you've configured a "user provider" for the user:
133133
'your_db_provider' => [
134134
'entity' => [
135135
'class' => 'AppBundle:User',
136+
'property' => 'apiKey',
136137
],
137138
],
138139
],
@@ -187,21 +188,18 @@ This requires you to implement several methods::
187188
*/
188189
public function getCredentials(Request $request)
189190
{
190-
return [
191-
'token' => $request->headers->get('X-AUTH-TOKEN'),
192-
];
191+
return $request->headers->get('X-AUTH-TOKEN');
193192
}
194193

195194
public function getUser($credentials, UserProviderInterface $userProvider)
196195
{
197-
$apiKey = $credentials['token'];
198-
199-
if (null === $apiKey) {
196+
if (null === $credentials) {
197+
// The token header was empty, authentication fails with 401
200198
return;
201199
}
202200

203-
// if a User object, checkCredentials() is called
204-
return $userProvider->loadUserByUsername($apiKey);
201+
// if a User is returned, checkCredentials() is called
202+
return $userProvider->loadUserByUsername($credentials);
205203
}
206204

207205
public function checkCredentials($credentials, UserInterface $user)
@@ -222,13 +220,14 @@ This requires you to implement several methods::
222220
public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
223221
{
224222
$data = [
223+
// you may ant to customize or obfuscate the message first
225224
'message' => strtr($exception->getMessageKey(), $exception->getMessageData())
226225

227226
// or to translate this message
228227
// $this->translator->trans($exception->getMessageKey(), $exception->getMessageData())
229228
];
230229

231-
return new JsonResponse($data, Response::HTTP_FORBIDDEN);
230+
return new JsonResponse($data, Response::HTTP_UNAUTHORIZED);
232231
}
233232

234233
/**
@@ -303,11 +302,11 @@ Finally, configure your ``firewalls`` key in ``security.yml`` to use this authen
303302
<config>
304303
<!-- ... -->
305304
306-
<firewall name="main"
307-
pattern="^/"
308-
anonymous="true"
309-
>
310-
<logoutOjso/>
305+
<!-- if you want, disable storing the user in the session
306+
add 'stateless="true"' to the firewall -->
307+
<firewall name="main" pattern="^/">
308+
<anonymous/>
309+
<logout/>
311310
312311
<guard>
313312
<authenticator>AppBundle\Security\TokenAuthenticator</authenticator>
@@ -336,6 +335,8 @@ Finally, configure your ``firewalls`` key in ``security.yml`` to use this authen
336335
TokenAuthenticator::class,
337336
],
338337
],
338+
// if you want, disable storing the user in the session
339+
// 'stateless' => true,
339340
// ...
340341
],
341342
],

‎security/json_login_setup.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -184,8 +184,8 @@ The security configuration should be:
184184
<firewall name="main">
185185
<anonymous/>
186186
<json-login check-path="login"
187-
username-path="security.credentials.login"
188-
password-path="security.credentials.password"/>
187+
username-path="security.credentials.login"
188+
password-path="security.credentials.password"/>
189189
</firewall>
190190
</config>
191191
</srv:container>

‎security/ldap.rst

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -152,20 +152,19 @@ use the ``ldap`` user provider.
152152
153153
<config>
154154
<provider name="my_ldap">
155-
<ldap
156-
service="Symfony\Component\Ldap\Ldap"
157-
base-dn="dc=example,dc=com"
158-
search-dn="cn=read-only-admin,dc=example,dc=com"
159-
search-password="password"
160-
default-roles="ROLE_USER"
161-
uid-key="uid"
162-
/>
155+
<ldap service="Symfony\Component\Ldap\Ldap"
156+
base-dn="dc=example,dc=com"
157+
search-dn="cn=read-only-admin,dc=example,dc=com"
158+
search-password="password"
159+
default-roles="ROLE_USER"
160+
uid-key="uid"/>
163161
</provider>
164162
</config>
165163
</srv:container>
166164
167165
.. code-block:: php
168166
167+
// app/config/security.php
169168
use Symfony\Component\Ldap\Ldap;
170169
171170
$container->loadFromExtension('security', [
@@ -358,15 +357,15 @@ Configuration example for form login
358357
359358
<config>
360359
<firewall name="main">
361-
<form-login-ldap
362-
service="Symfony\Component\Ldap\Ldap"
363-
dn-string="uid={username},dc=example,dc=com"/>
360+
<form-login-ldap service="Symfony\Component\Ldap\Ldap"
361+
dn-string="uid={username},dc=example,dc=com"/>
364362
</firewall>
365363
</config>
366364
</srv:container>
367365
368366
.. code-block:: php
369367
368+
// app/config/security.php
370369
use Symfony\Component\Ldap\Ldap;
371370
372371
$container->loadFromExtension('security', [
@@ -394,9 +393,8 @@ Configuration example for HTTP Basic
394393
395394
firewalls:
396395
main:
397-
# ...
396+
stateless: true
398397
http_basic_ldap:
399-
# ...
400398
service: Symfony\Component\Ldap\Ldap
401399
dn_string: 'uid={username},dc=example,dc=com'
402400
@@ -411,23 +409,28 @@ Configuration example for HTTP Basic
411409
https://symfony.com/schema/dic/services/services-1.0.xsd">
412410
413411
<config>
412+
<!-- ... -->
413+
414414
<firewall name="main" stateless="true">
415-
<http-basic-ldap service="Symfony\Component\Ldap\Ldap" dn-string="uid={username},dc=example,dc=com"/>
415+
<http-basic-ldap service="Symfony\Component\Ldap\Ldap"
416+
dn-string="uid={username},dc=example,dc=com"/>
416417
</firewall>
417418
</config>
418419
</srv:container>
419420
420421
.. code-block:: php
421422
423+
// app/config/security.php
422424
use Symfony\Component\Ldap\Ldap;
423425
424426
$container->loadFromExtension('security', [
427+
// ...
428+
425429
'firewalls' => [
426430
'main' => [
427431
'http_basic_ldap' => [
428432
'service' => Ldap::class,
429433
'dn_string' => 'uid={username},dc=example,dc=com',
430-
// ...
431434
],
432435
'stateless' => true,
433436
],
@@ -449,7 +452,6 @@ Configuration example for form login and query_string
449452
main:
450453
# ...
451454
form_login_ldap:
452-
# ...
453455
service: Symfony\Component\Ldap\Ldap
454456
dn_string: 'dc=example,dc=com'
455457
query_string: '(&(uid={username})(memberOf=cn=users,ou=Services,dc=example,dc=com))'
@@ -466,10 +468,10 @@ Configuration example for form login and query_string
466468
467469
<config>
468470
<firewall name="main">
469-
<form-login-ldap
470-
service="Symfony\Component\Ldap\Ldap"
471-
dn-string="dc=example,dc=com"
472-
query-string="(&amp;(uid={username})(memberOf=cn=users,ou=Services,dc=example,dc=com))"/>
471+
<!-- ... -->
472+
<form-login-ldap service="Symfony\Component\Ldap\Ldap"
473+
dn-string="dc=example,dc=com"
474+
query-string="(&amp;(uid={username})(memberOf=cn=users,ou=Services,dc=example,dc=com))"/>
473475
</firewall>
474476
</config>
475477
</srv:container>
@@ -482,11 +484,11 @@ Configuration example for form login and query_string
482484
$container->loadFromExtension('security', [
483485
'firewalls' => [
484486
'main' => [
487+
// ...
485488
'form_login_ldap' => [
486489
'service' => Ldap::class,
487490
'dn_string' => 'dc=example,dc=com',
488491
'query_string' => '(&(uid={username})(memberOf=cn=users,ou=Services,dc=example,dc=com))',
489-
// ...
490492
],
491493
],
492494
]

‎security/multiple_guard_authenticators.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ This is how your security configuration can look in action:
6868
'default' => [
6969
'anonymous' => null,
7070
'guard' => [
71-
'entry_point' => '',
71+
'entry_point' => LoginFormAuthenticator::class,
7272
'authenticators' => [
7373
LoginFormAuthenticator::class,
7474
FacebookConnectAuthenticator::class,

‎security/multiple_user_providers.rst

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,6 @@ the first provider is always used:
149149
'pattern' => '^/',
150150
'provider' => 'user_db',
151151
'http_basic' => [
152-
// ...
153152
'realm' => 'Secured Demo Area',
154153
'provider' => 'in_memory',
155154
],

‎security/remember_me.rst

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -348,7 +348,7 @@ service you just created:
348348
<!-- ... -->
349349
350350
<remember-me
351-
token_provider="Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider"
351+
token-provider="Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider"
352352
/>
353353
</firewall>
354354
</config>
@@ -357,6 +357,8 @@ service you just created:
357357
.. code-block:: php
358358
359359
// app/config/security.php
360+
use Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider;
361+
360362
$container->loadFromExtension('security', [
361363
// ...
362364
@@ -365,7 +367,7 @@ service you just created:
365367
// ...
366368
'remember_me' => [
367369
// ...
368-
'token_provider' => 'Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider',
370+
'token_provider' => DoctrineTokenProvider::class,
369371
],
370372
],
371373
],

‎security/user_checkers.rst

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,9 @@ is the service id of your user checker:
8989
9090
<config>
9191
<!-- ... -->
92-
<firewall name="main" pattern="^/">
93-
<user-checker>AppBundle\Security\UserChecker</user-checker>
92+
<firewall name="main"
93+
pattern="^/"
94+
user-checker="AppBundle\Security\UserChecker">
9495
<!-- ... -->
9596
</firewall>
9697
</config>
@@ -100,10 +101,10 @@ is the service id of your user checker:
100101
101102
// app/config/security.php
102103
103-
// ...
104104
use AppBundle\Security\UserChecker;
105105
106106
$container->loadFromExtension('security', [
107+
// ...
107108
'firewalls' => [
108109
'main' => [
109110
'pattern' => '^/',

0 commit comments

Comments
 (0)