Deprecated: Constant E_STRICT is deprecated in /home/pastorz/old-espace-client/vendor/symfony/error-handler/ErrorHandler.php on line 58

Deprecated: Constant E_STRICT is deprecated in /home/pastorz/old-espace-client/vendor/symfony/error-handler/ErrorHandler.php on line 76
Symfony Profiler

vendor/symfony/security-http/Authentication/AuthenticatorManager.php line 61

Open in your IDE?
  1. <?php
  3. /*
  4.  * This file is part of the Symfony package.
  5.  *
  6.  * (c) Fabien Potencier <fabien@symfony.com>
  7.  *
  8.  * For the full copyright and license information, please view the LICENSE
  9.  * file that was distributed with this source code.
  10.  */
  12. namespace Symfony\Component\Security\Http\Authentication;
  14. use Psr\Log\LoggerInterface;
  15. use Symfony\Component\HttpFoundation\Request;
  16. use Symfony\Component\HttpFoundation\Response;
  17. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  18. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  19. use Symfony\Component\Security\Core\AuthenticationEvents;
  20. use Symfony\Component\Security\Core\Event\AuthenticationSuccessEvent;
  21. use Symfony\Component\Security\Core\Exception\AccountStatusException;
  22. use Symfony\Component\Security\Core\Exception\AuthenticationException;
  23. use Symfony\Component\Security\Core\Exception\BadCredentialsException;
  24. use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
  25. use Symfony\Component\Security\Core\Exception\UserNotFoundException;
  26. use Symfony\Component\Security\Core\User\UserInterface;
  27. use Symfony\Component\Security\Http\Authenticator\AuthenticatorInterface;
  28. use Symfony\Component\Security\Http\Authenticator\Debug\TraceableAuthenticator;
  29. use Symfony\Component\Security\Http\Authenticator\InteractiveAuthenticatorInterface;
  30. use Symfony\Component\Security\Http\Authenticator\Passport\Badge\BadgeInterface;
  31. use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
  32. use Symfony\Component\Security\Http\Authenticator\Passport\PassportInterface;
  33. use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
  34. use Symfony\Component\Security\Http\Event\AuthenticationTokenCreatedEvent;
  35. use Symfony\Component\Security\Http\Event\CheckPassportEvent;
  36. use Symfony\Component\Security\Http\Event\InteractiveLoginEvent;
  37. use Symfony\Component\Security\Http\Event\LoginFailureEvent;
  38. use Symfony\Component\Security\Http\Event\LoginSuccessEvent;
  39. use Symfony\Component\Security\Http\SecurityEvents;
  40. use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
  42. /**
  43.  * @author Wouter de Jong <wouter@wouterj.nl>
  44.  * @author Ryan Weaver <ryan@symfonycasts.com>
  45.  * @author Amaury Leroux de Lens <amaury@lerouxdelens.com>
  46.  */
  47. class AuthenticatorManager implements AuthenticatorManagerInterface, UserAuthenticatorInterface
  48. {
  49.     private $authenticators;
  50.     private $tokenStorage;
  51.     private $eventDispatcher;
  52.     private $eraseCredentials;
  53.     private $logger;
  54.     private $firewallName;
  55.     private $hideUserNotFoundExceptions;
  56.     private $requiredBadges;
  58.     /**
  59.      * @param iterable<mixed, AuthenticatorInterface> $authenticators
  60.      */
  61.     public function __construct(iterable $authenticators, TokenStorageInterface $tokenStorage, EventDispatcherInterface $eventDispatcher, string $firewallName, LoggerInterface $logger = null, bool $eraseCredentials = true, bool $hideUserNotFoundExceptions = true, array $requiredBadges = [])
  62.     {
  63.         $this->authenticators = $authenticators;
  64.         $this->tokenStorage = $tokenStorage;
  65.         $this->eventDispatcher = $eventDispatcher;
  66.         $this->firewallName = $firewallName;
  67.         $this->logger = $logger;
  68.         $this->eraseCredentials = $eraseCredentials;
  69.         $this->hideUserNotFoundExceptions = $hideUserNotFoundExceptions;
  70.         $this->requiredBadges = $requiredBadges;
  71.     }
  73.     /**
  74.      * @param BadgeInterface[] $badges Optionally, pass some Passport badges to use for the manual login
  75.      */
  76.     public function authenticateUser(UserInterface $user, AuthenticatorInterface $authenticator, Request $request, array $badges = []): ?Response
  77.     {
  78.         // create an authentication token for the User
  79.         // @deprecated since Symfony 5.3, change to $user->getUserIdentifier() in 6.0
  80.         $passport = new SelfValidatingPassport(new UserBadge(method_exists($user, 'getUserIdentifier') ? $user->getUserIdentifier() : $user->getUsername(), function () use ($user) { return $user; }), $badges);
  81.         $token = method_exists($authenticator, 'createToken') ? $authenticator->createToken($passport, $this->firewallName) : $authenticator->createAuthenticatedToken($passport, $this->firewallName);
  83.         // announce the authentication token
  84.         $token = $this->eventDispatcher->dispatch(new AuthenticationTokenCreatedEvent($token, $passport))->getAuthenticatedToken();
  86.         // authenticate this in the system
  87.         return $this->handleAuthenticationSuccess($token, $passport, $request, $authenticator, $this->tokenStorage->getToken());
  88.     }
  90.     public function supports(Request $request): ?bool
  91.     {
  92.         if (null !== $this->logger) {
  93.             $context = ['firewall_name' => $this->firewallName];
  95.             if ($this->authenticators instanceof \Countable || \is_array($this->authenticators)) {
  96.                 $context['authenticators'] = \count($this->authenticators);
  97.             }
  99.             $this->logger->debug('Checking for authenticator support.', $context);
  100.         }
  102.         $authenticators = [];
  103.         $skippedAuthenticators = [];
  104.         $lazy = true;
  105.         foreach ($this->authenticators as $authenticator) {
  106.             if (null !== $this->logger) {
  107.                 $this->logger->debug('Checking support on authenticator.', ['firewall_name' => $this->firewallName, 'authenticator' => \get_class($authenticator)]);
  108.             }
  110.             if (false !== $supports = $authenticator->supports($request)) {
  111.                 $authenticators[] = $authenticator;
  112.                 $lazy = $lazy && null === $supports;
  113.             } else {
  114.                 if (null !== $this->logger) {
  115.                     $this->logger->debug('Authenticator does not support the request.', ['firewall_name' => $this->firewallName, 'authenticator' => \get_class($authenticator)]);
  116.                 }
  117.                 $skippedAuthenticators[] = $authenticator;
  118.             }
  119.         }
  121.         if (!$authenticators) {
  122.             return false;
  123.         }
  125.         $request->attributes->set('_security_authenticators', $authenticators);
  126.         $request->attributes->set('_security_skipped_authenticators', $skippedAuthenticators);
  128.         return $lazy ? null : true;
  129.     }
  131.     public function authenticateRequest(Request $request): ?Response
  132.     {
  133.         $authenticators = $request->attributes->get('_security_authenticators');
  134.         $request->attributes->remove('_security_authenticators');
  135.         $request->attributes->remove('_security_skipped_authenticators');
  137.         if (!$authenticators) {
  138.             return null;
  139.         }
  141.         return $this->executeAuthenticators($authenticators, $request);
  142.     }
  144.     /**
  145.      * @param AuthenticatorInterface[] $authenticators
  146.      */
  147.     private function executeAuthenticators(array $authenticators, Request $request): ?Response
  148.     {
  149.         foreach ($authenticators as $authenticator) {
  150.             // recheck if the authenticator still supports the listener. supports() is called
  151.             // eagerly (before token storage is initialized), whereas authenticate() is called
  152.             // lazily (after initialization).
  153.             if (false === $authenticator->supports($request)) {
  154.                 if (null !== $this->logger) {
  155.                     $this->logger->debug('Skipping the "{authenticator}" authenticator as it did not support the request.', ['authenticator' => \get_class($authenticator instanceof TraceableAuthenticator ? $authenticator->getAuthenticator() : $authenticator)]);
  156.                 }
  158.                 continue;
  159.             }
  161.             $response = $this->executeAuthenticator($authenticator, $request);
  162.             if (null !== $response) {
  163.                 if (null !== $this->logger) {
  164.                     $this->logger->debug('The "{authenticator}" authenticator set the response. Any later authenticator will not be called', ['authenticator' => \get_class($authenticator instanceof TraceableAuthenticator ? $authenticator->getAuthenticator() : $authenticator)]);
  165.                 }
  167.                 return $response;
  168.             }
  169.         }
  171.         return null;
  172.     }
  174.     private function executeAuthenticator(AuthenticatorInterface $authenticator, Request $request): ?Response
  175.     {
  176.         $passport = null;
  177.         $previousToken = $this->tokenStorage->getToken();
  179.         try {
  180.             // get the passport from the Authenticator
  181.             $passport = $authenticator->authenticate($request);
  183.             // check the passport (e.g. password checking)
  184.             $event = new CheckPassportEvent($authenticator, $passport);
  185.             $this->eventDispatcher->dispatch($event);
  187.             // check if all badges are resolved
  188.             $resolvedBadges = [];
  189.             foreach ($passport->getBadges() as $badge) {
  190.                 if (!$badge->isResolved()) {
  191.                     throw new BadCredentialsException(sprintf('Authentication failed: Security badge "%s" is not resolved, did you forget to register the correct listeners?', get_debug_type($badge)));
  192.                 }
  194.                 $resolvedBadges[] = \get_class($badge);
  195.             }
  197.             $missingRequiredBadges = array_diff($this->requiredBadges, $resolvedBadges);
  198.             if ($missingRequiredBadges) {
  199.                 throw new BadCredentialsException(sprintf('Authentication failed; Some badges marked as required by the firewall config are not available on the passport: "%s".', implode('", "', $missingRequiredBadges)));
  200.             }
  202.             // create the authentication token
  203.             $authenticatedToken = method_exists($authenticator, 'createToken') ? $authenticator->createToken($passport, $this->firewallName) : $authenticator->createAuthenticatedToken($passport, $this->firewallName);
  205.             // announce the authentication token
  206.             $authenticatedToken = $this->eventDispatcher->dispatch(new AuthenticationTokenCreatedEvent($authenticatedToken, $passport))->getAuthenticatedToken();
  208.             if (true === $this->eraseCredentials) {
  209.                 $authenticatedToken->eraseCredentials();
  210.             }
  212.             $this->eventDispatcher->dispatch(new AuthenticationSuccessEvent($authenticatedToken), AuthenticationEvents::AUTHENTICATION_SUCCESS);
  214.             if (null !== $this->logger) {
  215.                 $this->logger->info('Authenticator successful!', ['token' => $authenticatedToken, 'authenticator' => \get_class($authenticator instanceof TraceableAuthenticator ? $authenticator->getAuthenticator() : $authenticator)]);
  216.             }
  217.         } catch (AuthenticationException $e) {
  218.             // oh no! Authentication failed!
  219.             $response = $this->handleAuthenticationFailure($e, $request, $authenticator, $passport);
  220.             if ($response instanceof Response) {
  221.                 return $response;
  222.             }
  224.             return null;
  225.         }
  227.         // success! (sets the token on the token storage, etc)
  228.         $response = $this->handleAuthenticationSuccess($authenticatedToken, $passport, $request, $authenticator, $previousToken);
  229.         if ($response instanceof Response) {
  230.             return $response;
  231.         }
  233.         if (null !== $this->logger) {
  234.             $this->logger->debug('Authenticator set no success response: request continues.', ['authenticator' => \get_class($authenticator instanceof TraceableAuthenticator ? $authenticator->getAuthenticator() : $authenticator)]);
  235.         }
  237.         return null;
  238.     }
  240.     private function handleAuthenticationSuccess(TokenInterface $authenticatedToken, PassportInterface $passport, Request $request, AuthenticatorInterface $authenticator, ?TokenInterface $previousToken): ?Response
  241.     {
  242.         // @deprecated since Symfony 5.3
  243.         $user = $authenticatedToken->getUser();
  244.         if ($user instanceof UserInterface && !method_exists($user, 'getUserIdentifier')) {
  245.             trigger_deprecation('symfony/security-core', '5.3', 'Not implementing method "getUserIdentifier(): string" in user class "%s" is deprecated. This method will replace "getUsername()" in Symfony 6.0.', get_debug_type($authenticatedToken->getUser()));
  246.         }
  248.         $this->tokenStorage->setToken($authenticatedToken);
  250.         $response = $authenticator->onAuthenticationSuccess($request, $authenticatedToken, $this->firewallName);
  251.         if ($authenticator instanceof InteractiveAuthenticatorInterface && $authenticator->isInteractive()) {
  252.             $loginEvent = new InteractiveLoginEvent($request, $authenticatedToken);
  253.             $this->eventDispatcher->dispatch($loginEvent, SecurityEvents::INTERACTIVE_LOGIN);
  254.         }
  256.         $this->eventDispatcher->dispatch($loginSuccessEvent = new LoginSuccessEvent($authenticator, $passport, $authenticatedToken, $request, $response, $this->firewallName, $previousToken));
  258.         return $loginSuccessEvent->getResponse();
  259.     }
  261.     /**
  262.      * Handles an authentication failure and returns the Response for the authenticator.
  263.      */
  264.     private function handleAuthenticationFailure(AuthenticationException $authenticationException, Request $request, AuthenticatorInterface $authenticator, ?PassportInterface $passport): ?Response
  265.     {
  266.         if (null !== $this->logger) {
  267.             $this->logger->info('Authenticator failed.', ['exception' => $authenticationException, 'authenticator' => \get_class($authenticator instanceof TraceableAuthenticator ? $authenticator->getAuthenticator() : $authenticator)]);
  268.         }
  270.         // Avoid leaking error details in case of invalid user (e.g. user not found or invalid account status)
  271.         // to prevent user enumeration via response content comparison
  272.         if ($this->hideUserNotFoundExceptions && ($authenticationException instanceof UserNotFoundException || ($authenticationException instanceof AccountStatusException && !$authenticationException instanceof CustomUserMessageAccountStatusException))) {
  273.             $authenticationException = new BadCredentialsException('Bad credentials.', 0, $authenticationException);
  274.         }
  276.         $response = $authenticator->onAuthenticationFailure($request, $authenticationException);
  277.         if (null !== $response && null !== $this->logger) {
  278.             $this->logger->debug('The "{authenticator}" authenticator set the failure response.', ['authenticator' => \get_class($authenticator instanceof TraceableAuthenticator ? $authenticator->getAuthenticator() : $authenticator)]);
  279.         }
  281.         $this->eventDispatcher->dispatch($loginFailureEvent = new LoginFailureEvent($authenticationException, $authenticator, $request, $response, $this->firewallName, $passport));
  283.         // returning null is ok, it means they want the request to continue
  284.         return $loginFailureEvent->getResponse();
  285.     }
  286. }