Wrong example in authenticateToken for SimplePreAuthenticationListener

[s7anley]

In 2nd code example in storing authentication in the session section, it's not possible to get current User with $user = $token->getUser();. SimplePreAuthenticationListener is skipped when current user is not authenticate with AnonymousToken, which in this case is true.

Or maybe I'm missing something?
Thanks.

[weaverryan]

@peterrehm what do you think here?

[peterrehm]

@s7anley: It actually works in my case which I used when creating the docs. What do you mean with the Listener is skipped if you have an AnonymousToken?

[peterrehm]

@s7anley I reconsidered and for now I cannot see any problem. If the token does not contain a valid user it is going through the normal authentication process. Is your authentication working on the first request when you provide credentials?

[peterrehm]

@s7anley Can you provide further information? Or can we close this issue?

[s7anley]

Sorry for my late response. I guess my question is not really well asked and mixed couple issues together. I wrote it during my first deeper investigation of Security component.

So my question is regrading part where instance of User is pulled from Token e.g. if ($user instanceof User) and then used to created PreAuthenticatedToken. In my option this case not occur, because you users is always set as anon.. Still, I just Maybe overlooked something or incorrectly configure Symfony.

[peterrehm]

@s7anley This case occurs on the second request. If you get authenticated on the first request based on the provided credentials the user data will get stored in the token. On the next request the user is unserialized and you can get those data back from the token. (The user needs usually to be refreshed in this step).

It should work properly without any issues. This way was needed since actually the previous example was wrong. The previous example tried to re-authenticate based on credentials, but the credentials are not stored in the token/session due to security concerns.

[s7anley]

@peterrehm And this 2nd request you mentioned is problem what I have described in first post. Once you are authenticated and token is restored from session in ContextListener, the SimplePreAuthenticationListener is skipped.

[peterrehm]

And I cannot confirm this one. Just repoduced this with the following steps:

Firewall Configuration

    main:
        pattern:    ^/
        simple-preauth:
            provider: fos_userbundle
            authenticator: my_bundle.pre_auth_authenticator
        stateless: false
        anonymous: ~

And the Authenticator similar to what is described in the Article.

In the first request I provide the api key.

http://my_app/fancy/?apikey=12345

And I will get authenticated and the user will be stored to the session.

On the next request however the createToken() will not be called any more,
just the authenticateToken(). And the authenticateToken() will get a token of
the type Symfony\Component\Security\Core\Authentication\Token\PreAuthenticatedToken.
From this token you can fetch the user.

Everything is working as expected and working fine. The Listener is not being skipped.
I just tried this again in the actual app without any issues.

Relates to #4076

[peterrehm]

@weaverryan If I am not proven to be wrong this can be closed.

[s7anley]

@peterrehm authenticateToken is not called in 2nd request for me. Not sure how is possible, when ApiKeyAuthenticator is not used. For testing I use Symfony SE 2.5.3, built in server and sessions stored to filesystem. You may close this issue, but I'm not sure about this.

And also it's not necessary to inject userProvider to ApiKeyAuthenticator, because it's also 2nd argument of authenticateToken method.

[peterrehm]

Can you upload a branch of the SE so that I can reproduce the bug? In my App based on 2.5.3 it is working as expected.

[peterrehm]

@s7anley Any news?

[xabbuh]

Is this still an issue or is this also fixed with symfony/symfony#11414 being merged?

[PapyDanone]

hey @peterrehm in your attempt to reproduce this issue does it still work if you remove anonymous: ~ from your firewall?

I'm actually getting an exception on 2nd request too and can somewhat relate to what @s7anley was saying.

I'm on SE 2.6.3.

Here's my security.yml:

secured_area:
     pattern: ^/
     stateless: false
     simple-preauth:
           authenticator: api_key_authenticator

The exception:

Uncaught PHP Exception Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException: "A Token was not found in the SecurityContext." at /Users/jeromeguilbot/Sites/tma-api/vendor/symfony/symfony/src/Symfony/Component/Security/Http/Firewall/AccessListener.php line 53

In my code, the only thing that differs from the example is, in ApiKeyAuthenticator.php:

public function createToken(Request $request, $providerKey)
{
        // look for an apikey query parameter
        $apiKey = $request->query->get('apikey');

        // or if you want to use an "apikey" header, then do something like this:
        // $apiKey = $request->headers->get('apikey');

        if (!$apiKey) {
            return null;
        }

        return new PreAuthenticatedToken(
            'anon.',
            $apiKey,
            $providerKey
        );
}

Basically I want the user to be either authenticated by an API key in the url or a token in the session if it is found, and that for all requests.

Am I missing something?

[peterrehm]

You can omit the anonymous setting, I needed it since you can login either by a form or by the api key. The application supports both.

But if I recall correctly you should not return null, just return an empty apiKey in the PreAuthenticated Token or

public function createToken(Request $request, $providerKey)
{
        // look for an apikey query parameter
        $apiKey = $request->query->get('apikey');

        // or if you want to use an "apikey" header, then do something like this:
        // $apiKey = $request->headers->get('apikey');

        if (!$apiKey) {
            throw new BadCredentialsException('No Auth token found');
        }

        return new PreAuthenticatedToken(
            'anon.',
            $apiKey,
            $providerKey
        );
}

I assume based on the provided error message you somehow have no apiKey and therefore no token is returned.