[RTM] Use Symfony Security for authentication purposes in Contao #685

bytehead · 2017-01-24T16:33:44Z

This is a working draft to replace the current simple_preauth mechanism to login backend users and frontend members with the form_login from the Symfony Security Component.

Please review and mention all missed topics.

ToDos:

Fixes needed:

~~Backend login redirect: Simple test: login, go somewhere, delete your session cookie.~~
UserProvider refreshUser without credentials
Provide exception messages
Replace usage of static legacy class methods (e.g. Config, Environment)
Call importUser only on POST request
Additional check with UserChecker in Frontend
Implement the EquatableInterface on User to compare the token object and DB object
on BackendUser::getInstance check if there is a valid _security_contao_backend token in the actual session to restore the user from
on FrontendUser::getInstance check if there is a valid _security_contao_frontend token in the actual session to restore the user from

Nice to have (possibly future PRs):

use DoctrineTokenProvider for persistent remember me tokens

Possible new features (future PRs):

Allow login also with the email address (not only username)
Allow some user action via command like activate, change-password or similar

…symfony-authentication-2

aschempp · 2017-04-25T09:20:01Z

src/Resources/contao/dca/tl_user.php

 	 */
 	public function switchUser($row, $href, $label, $title, $icon)
 	{
+		@trigger_error('Using tl_user->switchUser() has been deprecated and will no longer work in Contao 5.0. Use the switch_user_button_generator service instead', E_USER_DEPRECATED);
+


The rest of this method should be removed or replaces by the new switch user stuff.

aschempp · 2017-04-25T09:20:42Z

src/EventListener/SwitchUserListener.php

+        /** @var BackendUser $targetUser */
+        $targetUser = $event->getTargetUser();
+
+        $this->logger->info(sprintf("User %s has switched to user %s.", $user->username, $targetUser->username));


The only purpose of this listener is to log the action? If that's a replacement of an existing log, we should log with a ContaoContext to make it appear in the backend log.

That should be the replacement of the existing log, but I didn't get it how it's done to make it appear in the backend.

core-bundle/src/Resources/contao/library/Contao/System.php

Line 246 in 7f746f4

$logger->log($level, $strText, array('contao' => new ContaoContext($strFunction, $strCategory)));

Ah, thank you! I'll update it later.

aschempp · 2017-04-25T09:21:17Z

src/Resources/config/services.yml

+            - "@contao.framework"
+
+    contao.security.switch_user_button_generator:
+        class: Contao\CoreBundle\Security\User\SwitchUserButtonGenerator


To me this is an event (callback) listener and should be in the according namespace.

aschempp · 2017-04-25T09:32:07Z

src/Resources/contao/controllers/BackendMain.php

+
+		if ($authorizationChecker->isGranted('ROLE_PREVIOUS_ADMIN')) {
+			$logoutLink = $router->generate('contao_backend', [
+				'_switch_user' => '_exit',


this is a new feature, right? Previously a login just logged out whatever user was currently in. Might be confusing if we don't change the logout label to "switch back to X".

Good point :)

The current label is Close the current session and thus not wrong in my opinion.

Changed in e2bed63.

aschempp · 2017-04-25T09:33:05Z

src/Security/User/SwitchUserButtonGenerator.php

+        $stmt->execute();
+
+        if (0 === $stmt->rowCount()) {
+            throw new UserNotFoundException('Invalid user ID' . $row['id']);


This should never happen, so I would simply return empty string (remove action) in this case and not add a new exception for a never-happening case :)

aschempp · 2017-04-25T09:34:06Z

src/Security/User/SwitchUserButtonGenerator.php

+            '_switch_user' => $user->username
+        ]);
+
+        return $this->twig->render('@ContaoCore/Backend/switch_user.html.twig', [


Do we need a twig template for this? Generally good, but there are so many places where we currently don't…

Yes IMHO we need exactly that. Otherwise we will end up like the DCA classes are right now with template code in the logic parts. And we have to start using (twig) templates at some point.

ok, but then this should be a general button template, right?

Good idea. Should be discussed with the others probably?

bytehead · 2017-12-12T10:08:36Z

src/Resources/contao/dca/tl_member.php

-	 *
-	 * @param DataContainer $dc
-	 */
-	public function checkRemoveSession($dc)


No BC break if you remove a public method?

It is a BC break for sure. The question is whether out BC promise includes DCA files, which I think they don't.

bytehead · 2017-12-12T10:09:07Z

src/Resources/views/Backend/switch_user.html.twig

@@ -1 +0,0 @@
-<a href="{{ url }}" title="{{ title }}">{{ image | raw }}</a>


bytehead · 2017-12-12T10:11:42Z

src/Security/User/SwitchUserButtonGenerator.php

-            'title' => $title,
-            'image' => Image::getHtml($icon, $label),
-        ]);
+        return sprintf('<a href="%s" title="%s">%s</a>', $url, $title, Image::getHtml($icon, $label));


I'm totally against to remove the template. Now we have again html somewhere in the logic.

leofeyer · 2017-12-12T10:22:23Z

The PR is almost ready to merge. There are two open issues:

Do we want to log impersonations?
Do we need to change any private variables or methods to protected so people can overwrite certain things?

Regarding 1.: We are logging "switch user" actions but not "log in as member" actions. Is this ok or should we log both or none?

bytehead · 2017-12-12T10:42:10Z

I would like to have impersonations logged. I'm fine to log frontend impersonations as well.
I'm against to make just everything private. Makes it unnecessary hard to extend existing stuff.

leofeyer · 2017-12-12T12:45:55Z

src/Resources/contao/controllers/BackendSwitch.php

-						$objTemplate->user = \Input::post('user');
+						/** @var User $user */
+						$user = $token->getUser();
+						$objUser = \MemberModel::findByUsername($user->getUsername());


This is also something that makes me wonder. Shouldn't $token->getUser() return the user object already? Why are we loading the member model?

The getUser() on the token can have a fully loaded user instance, but you cannot be sure.
Normally it holds only the unserialized data from the session storage.

leofeyer · 2017-12-12T12:53:10Z

src/Resources/contao/templates/modules/mod_login.html5

@@ -13,16 +13,19 @@
      <?php endif; ?>
      <input type="hidden" name="FORM_SUBMIT" value="<?= $this->formId ?>">
      <input type="hidden" name="REQUEST_TOKEN" value="{{request_token}}">
+      <?php if ($this->targetPath): ?>
+        <input type="hidden" name="<?= $this->targetName ?>" value="<?= $this->targetPath ?>">


I also wonder if this is prone to manipulation? @ausi /cc

Maybe we should check, if it's an existing page from the installation?

I don't know. It seems it is a hidden field in Symfony, too: https://github.com/symfony/symfony/blob/master/src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/CsrfFormLoginBundle/Form/UserLoginType.php#L47

well you can only manipulate it through the web inspector. Which means the redirect target after login is manipulated. Can't really see an issue in that, it does not send any data to that URL.

htmlspecialchars() is missing for $this->targetPath, either in the template or in ModuleLogin. As it is now it’s vulnerable to XSS.

Fixed in 975070e.

leofeyer · 2017-12-12T19:42:13Z

Thank you, big time @bytehead.

Functionality broke with contao/core-bundle#685 as User->logout uses a RedirectResponseException.

Description ----------- Functionality broke with contao/core-bundle#685 as `User->logout()` uses a RedirectResponseException. Fixes #93. Commits ------- 14f6a80 Respect jump to on close account. da85783 Use System::getContainer() instead of Controller::getContainer()

Description ----------- Functionality broke with #685 as `User->logout()` uses a RedirectResponseException. Fixes #93. Commits ------- 14f6a808 Respect jump to on close account. da85783f Use System::getContainer() instead of Controller::getContainer()

Description ----------- This is a follow-up on #657, #677 and #682. It implements the new template loading by looking up the keys in `TL_CTE`, `TL_FFL` and `FE_MOD` as discussed in Mumble on August 29th. Commits ------- de3089b7 Hide mod_article_list when searching for custom mod_article templates 7b6ce852 Replace "root template" with "bundle template" 1ee232da Support passing an additional mapper array as second argument

bytehead mentioned this pull request Jan 24, 2017

[WIP] Symfony authentication #559

Closed

7 tasks

bytehead force-pushed the feature/symfony-authentication-2 branch from bf65103 to b215304 Compare January 24, 2017 20:47

leofeyer assigned bytehead Jan 24, 2017

leofeyer added the feature label Jan 24, 2017

leofeyer added this to the 4.4.0 milestone Jan 24, 2017

bytehead added 9 commits January 25, 2017 00:46

First draft of refactored symfony authentication (see contao#559)

ac790b4

Don't serialize inverted value

3ea15ca

Author annotation and code optimization

0113a77

Revert ContaoUserProvider, use ContaoBackendUserProvider

2431793

Refactored

78a1897

Code style

39a79f4

Code style

3854353

Check instanceof BackendUser

0789538

Added tests

f3c619d

bytehead force-pushed the feature/symfony-authentication-2 branch from 8ac4255 to f3c619d Compare January 24, 2017 23:47

Fix rebase (changes from @ausi)

5eab0d1

leofeyer removed this from the 4.4.0 milestone Jan 25, 2017

leofeyer changed the title ~~[WIP] Feature/symfony authentication [refactored]~~ [WIP] Feature/symfony authentication refactored Jan 25, 2017

bytehead changed the title ~~[WIP] Feature/symfony authentication refactored~~ [RFC] Feature/symfony authentication refactored Jan 25, 2017

leofeyer force-pushed the develop branch 2 times, most recently from c8f2f0d to 09536d6 Compare January 27, 2017 16:49

Renamed firewalls

876847e

bytehead changed the title ~~[RFC] Feature/symfony authentication refactored~~ [WIP] Feature/symfony authentication refactored Feb 3, 2017

bytehead added 5 commits April 20, 2017 17:38

Merge branch 'develop' of github.com:contao/core-bundle into feature/…

f528fd4

…symfony-authentication-2

Implemented user impersonation / role switcher

360d19b

CS

7dd796c

Fixes

9bce732

Merge branch 'develop' of github.com:contao/core-bundle into feature/…

18084a9

…symfony-authentication-2

aschempp reviewed Apr 25, 2017

View reviewed changes

Replace old code by new user switcher service

200045f

leofeyer force-pushed the feature/symfony-authentication-2 branch from 5cae2cf to 7e9ecad Compare December 11, 2017 14:51

leofeyer added 2 commits December 11, 2017 16:40

Always check if a password needs to be rehashed.

99c1ece

Redirect to the back end login screen when logging out in the back end.

88860b8

leofeyer force-pushed the feature/symfony-authentication-2 branch from 0424c9f to 88860b8 Compare December 11, 2017 16:01

bytehead and others added 3 commits December 11, 2017 17:06

Added LogoutSuccessHandlerTest test case for backend request

77b94f3

Update the README file and add a change log entry.

a3be2b0

Fix the coding style (part 3).

f9fed70

bytehead commented Dec 12, 2017

View reviewed changes

leofeyer added 3 commits December 12, 2017 12:21

Adjust the log messages.

b766f17

Do not add events for old hooks.

3328398

Remove the switch user button generator.

4444e7d

leofeyer reviewed Dec 12, 2017

View reviewed changes

Revert some unrelated changes.

94916b8

leofeyer force-pushed the feature/symfony-authentication-2 branch from 1c252ad to 94916b8 Compare December 12, 2017 13:02

Encode the target path in the login form.

975070e

leofeyer merged commit 01a6845 into contao:develop Dec 12, 2017

bytehead mentioned this pull request Feb 21, 2018

Allow login with username or email address #1393

Closed

bytehead deleted the feature/symfony-authentication-2 branch March 6, 2018 14:36

skolarianer mentioned this pull request Jul 4, 2018

Das autologin-Token sollte gehasht in tl_member gespeichert werden contao/core#8888

Closed

richardhj added a commit to richardhj/contao that referenced this pull request Nov 3, 2018

Respect jump to on close account.

746cb90

Functionality broke with contao/core-bundle#685 as User->logout uses a RedirectResponseException.

richardhj mentioned this pull request Nov 3, 2018

Respect jump to on close account. contao/contao#162

Merged

richardhj added a commit to richardhj/contao that referenced this pull request Nov 3, 2018

Respect jump to on close account.

14f6a80

Functionality broke with contao/core-bundle#685 as User->logout uses a RedirectResponseException.

fritzmg mentioned this pull request Jul 6, 2021

contao_import_user event missing contao/contao#3157

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RTM] Use Symfony Security for authentication purposes in Contao #685

[RTM] Use Symfony Security for authentication purposes in Contao #685

bytehead commented Jan 24, 2017 •

edited

Loading

aschempp Apr 25, 2017

bytehead Apr 25, 2017

aschempp Apr 25, 2017

bytehead Apr 25, 2017

aschempp Apr 25, 2017

bytehead Apr 25, 2017

aschempp Apr 25, 2017

aschempp Apr 25, 2017

bytehead Apr 25, 2017

bytehead Nov 5, 2017

bytehead Dec 8, 2017

aschempp Apr 25, 2017

aschempp Apr 25, 2017

bytehead Apr 25, 2017

aschempp Apr 25, 2017

bytehead Apr 25, 2017

bytehead Dec 12, 2017

leofeyer Dec 12, 2017

bytehead Dec 12, 2017

bytehead Dec 12, 2017

leofeyer commented Dec 12, 2017

bytehead commented Dec 12, 2017

leofeyer Dec 12, 2017

bytehead Dec 12, 2017

leofeyer Dec 12, 2017

bytehead Dec 12, 2017

leofeyer Dec 12, 2017

aschempp Dec 12, 2017

ausi Dec 12, 2017

leofeyer Dec 12, 2017

leofeyer commented Dec 12, 2017

		@@ -1 +0,0 @@
		<a href="{{ url }}" title="{{ title }}">{{ image \| raw }}</a>

[RTM] Use Symfony Security for authentication purposes in Contao #685

[RTM] Use Symfony Security for authentication purposes in Contao #685

Conversation

bytehead commented Jan 24, 2017 • edited Loading

ToDos:

Fixes needed:

Nice to have (possibly future PRs):

Possible new features (future PRs):

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leofeyer commented Dec 12, 2017

bytehead commented Dec 12, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leofeyer commented Dec 12, 2017

bytehead commented Jan 24, 2017 •

edited

Loading