last day (15 days later) » 

9:31 PM
4
Q: Symfony2 entity user provider overrides custom auth provider

Montgomery JeanMy Symfony2 custom authentication provider now appears to be working. User Provider I almost used the FOSUserBundle but I don't even have email addresses for my users and I don't need the added functionality or complication. So instead I'm just using the entity provider. I set my encoder to p...

 
The form_login service pretty much assumes you need a password. So make yourself an encoder which says that no password is fine. That should get you one step further.
 
Cerad, actually it seems that the problem is coming from the UserAuthenticationProvider, as the "Bad credentials." error suggests. Although its a complete mystery to me why that provider is being loaded! I don't think the encoder is the issue.
 
The AuthProvider load a user via the user provider and then authenticates the user by checking the password using the encoder. If you are not using the form_login service at all then take it out. But it sure seems like /play_check is being handled by the default auth handler.
 
Ah, then that's the problem! I want play_check to be handled by the custom auth provider! I thought the form_login was simply the generic way of declaring a login block, which used a form, I didn't realize it had implications. If not "form_login", what does one use?
 
return $this->httpUtils->checkRequestPath($request, '/play'); Change play to play_check in your auth listener. That should kick things off for you.
 
9:31 PM
Good eyes! I made this change, and now neither the user provider (good!), nor the auth provider (still bad) are called when the form is submitted. Xdebug breakpoints don't fire. This is progress, I think.
 
Yep. You are doing all the form login stuff yourself so make the form_login block go away as it just confuses things. I would add the firewall provider key back into your listener and then to the token. Not sure how much that is really needed. Make sure your login form is posting to play_check and not play. die() also works well for tracing this sort of stuff.
 
I take it back, I was in a detached head at an earlier commit. The user manager is still yielding "Bad credentials." I'm not sure about removing the "form_login" service -- I've been told this is the proper way to go about things.
 
Fair enough. Probably should get whomever told you that to explain how two form login services can coexist for the same firewall and process the same routes. You don't have an entry point in your factory so any time a user tries to access a protected resource then the form_login stuff will kick in.
 
What exactly do you mean by "entry point in your factory"?
 
Maybe we should move this to chat? The entry point tells the system what to do when an unauthenticated user tries to access a controlled url such as play. It redirects the user to login_path. It's just an example of how having the form_login will interfere with your system once you get it working.
 
9:31 PM
Done!
 
But I am assuming that your login form is being displayed. You are entering a user name and password and pressing submit. The form is being submitted to /play_check. At a minimum, change the form_login.check_path to something different so we know it's listener is not grabbing it. Then verify that your listener's attemptAuthentication is being called
 
If you look at my most recent edit of the question, "EDIT 2", I established that my listener is being instantiated, but attemptAuthentication and requiresAuthentication are not being called.
 
Probably because the form_login service is grabbing the stuff. In your security file:
Not sure how to make a pretty post. Add the ckeck_path option to your firewall in the security.yml file. By default it's going to be /login_check.
 
There's one of those already, actually: github.com/freen/wordrot/blob/master/app/config/…
 
Nope. That only applies to the form_login service. Each service is completely independent. That is what I am trying to explain. Maybe for testing purposes I could convince you to delete the form_login entries? You can always add it back in.
 
9:45 PM
Haha ok! So I'll comment out the whole form_login block and see what happens.
Ok for starters, now it is suddenly calling WordnikFactory#createListener
Oh my goodness, new things are happening.
 
And put a die() statement in your requiresAuthentication just to verify it is being called. You don't actually even need that method since by extending from the AbstractAuthListener you get it for free. Just set check_path to whatever your want i.i. play_check.
 
When I set check_path I get this error: InvalidConfigurationException: Unrecognized options "check_path" under "security.firewalls.wordnik_secured"
My breakpoint on WordnikListener#requiresAuthentication is firing
So that's good.
Ok this is great! Everything is flowing properly again, and the AuthProvider is yielding the right responses to correct and incorrect API credentials.
But, something I've seen previously is happening again: correct credentials return me to the main page, incorrect credentials are reported as incorrect.
This is new, however: when I access the protected path "/play", I get this:
A Token was not found in the SecurityContext.
500 Internal Server Error - AuthenticationCredentialsNotFoundException
 
Is this when you try to get to /play without being authenticated or is it after you logged in?
 
The check_path is already being loaded properly, probably because the response from requiresAuthentication now contains the correct one.
So that shouldn't be a problem.
It's when I try to go to /play after successful credentials are passed.
I'm going to try setting it on the security context manually
 
Ok. Use the toolbar to look at your session. Is there a security context in there and does it contain your token? If so, does the token have the USER_ROLE in it?
 
10:00 PM
It says I'm not authenticated.
Where is the security context suppose to register the token? Isn't this supposed to happen automatically?
The only way to set the token on the context manually is to pass the service container into the listener.
 
All your attemptAuthentication method needs to do is return an authenticated token. The rest is handled by the system. So check your authenticationResult and make sure it's a valid token.
 
If I var_dump this token it looks right to me.
This is the attemptAuthentication return : github.com/freen/wordrot/blob/master/src/WordRot/PlayBundle/…
Here's the var_dump'ed token : gist.github.com/freen/c7ffb3feb667c07dc712
(Dumped right before being returned from attemptAuthentication)
 
Might be the lack of a provider key. Probably not but try it. Just hardcode the key in for now. Later you should inject it into your auth manager.
And maybe copy/paste what your session looks like after signing in.
 
I hard-coded the providerKey as "wordnik", confirmed it came through, and the same error bubbled up.
The profiler says there aren't any session attributes.
Oh check this out:
DEBUG - Read SecurityContext from the session
DEBUG - Reloading user from user provider.
DEBUG - SELECT t0.id AS id1, t0.username AS username2, t0.third_party_id AS third_party_id3, t0.user_signature AS user_signature4, t0.auth_token AS auth_token5 FROM wordnik_user t0 WHERE t0.username IS NULL LIMIT 1
WARNING - Username "" could not be found.
Maybe all of that is simply because there's no token, however.
 
10:20 PM
Hmm. The refreshUser in the user provider gets called on every request. So that is where the select is coming from.
But again, you bring up your login form, login and it takes you to the welcome page? But at that point the session is empty? If your attemptAuthentication is returning a valid token then I'm not sure what to try next.
 
Yeah that's right.
Well you've been really helpful already, thanks
Do you care to summarize this process in an answer, for the accept + bounty?
 
Lets get it working first. I noticed that you are only serializing the user.id property. So none of your other user properties will survive. That might be the problem. If the token has a user object then getUsername calls user->getUsername which in turn is used to refresh the user. You need to serialize the username as well as the authenticated property.
 
Oh that sounds right. Let's try
Holy shit that did something
So now I can access /play, and the view template outputs my username correctly
Which is huge.
On the other hand, the profiler bar still says I'm not authenticated.
It says there's no security token, however the session has this key/value:
"C:65:\"WordRot\PlayBundle\Security\Authentication\Token\WordnikUserToken\":357:‌​{a:4:{i:0;C:30:\"WordRot\PlayBundle\Entity\User\":147:{a:5:{i:0;i:1;i:1;s:5:\"fre‌​en\";i:2;i:1105371;i:3;s:32:\"*****\";i:4;s:47:\"******\";}}i:1;b:1;i:2;a:1:{i:0;O:41:\"Sy‌​mfony\Component\Security\Core\Role\Role\":1:{s:47:\"\0Symfony\Component\Security\‌​Core\Role\Role\0role\";s:9:\"ROLE_USER\";}}i:3;a:0:{}}}"
That's the value, the key is `_security_wordnik_secured1
_security_wordnik_secured*
 
10:39 PM
So the token is making it into the session. Try deleting your dev cache if you have not done so in a bit. Sometimes it can get confused.
And your token object is overriding getUsername and not using the user object at all. So not storing user.username in the session is probably not the problem.
 
Yea I tried clearing cache, unfortunately didn't work
Should the token use the user object?
To yield these values I mean?
 
The AbstractToken object does. But they should always be identical. So I don't think it matters.
 
Is there perhaps somewhere that _security_wordnik_secured is not getting registered as the session security Token key?
 
I don't think so. On a fresh request the kernel knows that /play is managed by the wordnik_secured firewall so that is where it will look for a token.
So it seems to be working exept the profile toolbar says it is not?
 
That's exactly right. For all intents and purposes I'm inclined to believe that from the application's perspective the problem is solved.
But the profiler isn't convinced.
My username is being output in the layout, using the app.user variable.
 
10:51 PM
Try signing you and see what happens. The default logout code should clear the token. If it complains then that might be a clue.
I meant signing out.
 
gotcha lets try that
Hm no dice.
Oh!
maybe it's because the profiler isn't behind the firewall?
because only /play is secured ?
 
Maybe. I would put the dev firewall back in the security.yml file.
And set anonymous to try for now under wordnik_secured. You can always reset it later when things are working. And what path did you use to logout?
 
For logout I used /play/logout
 
Set anon = true. My spelling is going down hill.
 
So I did those things. Dev firewall back. anonymous: true under wordnik_secured. Behavior is identical.
I'm thinking maybe I could do something like this: stackoverflow.com/questions/10707828/…
 
11:05 PM
Did you set the logout: path in your security.yml file?
 
Where the whole application is behind the firewall. That'd work fine for me.
    wordnik_secured:
        pattern: ^/play
        anonymous: true
        wordnik: true
        provider: wordnik_users
        logout:
            path:   /play/logout
            target: /login
Yea its right there.
 
Later on, make named routes for all your routes and use the names in place of the actual routes. I think it's required for 2.2
 
ok sure
 
So when you do /play/logout frm the browser does it redirect to /login?
 
yea it does
It works too. I then get a 403 when I go to /play
 
11:07 PM
But the session still has the token in it?
 
Well actually it's a 500 with an InsufficientAccessException
Let's see
Haha strangely enough, for the first time the "auth" section of the profiler is green, saying I'm authenticated as anonymous.
Session is empty
 
The /play when not logged in errors are a different problem. Veirfy that the logout works first.
 
Since session is empty, logout seems to be working properly.
 
Try it one more time then we can address the /play issue.
 
Login with correct API credentials, redirects me to index, which says I'm not logged in.
I navigate to /play, the template knows my username, the profiler thinks I'm not authenticated.
So this is where security.yml is currently at: github.com/freen/wordrot/blob/master/app/config/security.yml
 
11:14 PM
Add a default_target_path property to your secutiry.yml file.
firewalls:
wordnik_secured:
........wordnik:
............default_target-path: /play
 
Ah I had tried that, but it didn't work; beneath wordnik makes more sense.
 
I know you had trouble when you tried to add check_path but if the syntax is right then the system should take the option. Once the option is set then successfully signing in should redirect you to /play
 
Cool, setting check_path beneath wordnik works like a charm.
 
Good. Then just delete the requiresAuthentication from your listener. It will automatically try to authenticate whatever check_path is set to.
 
Sure enough.
 
11:23 PM
Need to leave for a bit.
However, in order to get /play to automatically redirect you to the login form when the user is not yet loggeed required an entry point.
 
Okay sure I'll look into that, thanks.
I'm also on #symfony @ freenode as "aldmy"
Thanks again, this was a huge help.
 
You need to add a createEntryPoint method to your factory. Then make a simple EntryPoint object and a service. You will then add a login_path to your firewall and it should all work. Use the form_login factory as an example.
 
Cool :) I'll have a look!
 
And move yur provider attribute so it is under wordnik:
 

  last day (15 days later) »