Description
I have non-stateless authentication with x509 and want to enable user switching.
Expected that user switching should work.
Actual result: current user remains active
Bug detailed description:
Current user is authenticated with x509 certificate, so in the security context there is a PreAuthenticatedToken and session store it. Next step is to switch user. When user is switching then SwitchUserListener replaces existing PreAuthenticatedToken with UsernamePasswordToken and stores it in the security context and in the session, after that we have redirect to our page. We have valid token on the next request, however x509 authentication listener will be invoked again and it overrides existing UsernamePasswordToken.
How to fix that bug:
AbstractPreAuthenticatedListener class should not override existing authenticated tokens in the security context.
// AbstractPreAuthenticatedListener:64-68
if (null !== $token = $this->securityContext->getToken()) {
if ($token->isAuthenticated()) {
return;
}
}