IBX-2880: Added PasswordExpiredException

[mateuszbieniek]

Question	Answer
JIRA issue	IBX-2880
Type	bug
Target Ibexa version	v3.3
BC breaks	no

CredentialsExpiredListener expects CredentialsExpiredException which will never happen, as the Exception is immediately replaced with BadCredentialsException in https://github.com/symfony/security-core/blob/5.4/Authentication/Provider/UserAuthenticationProvider.php#L90

This PR adds a new PasswordExpiredException exception which extends CustomUserMessageAccountStatusException which allows for it to be propagated to the top so CredentialsExpiredListener can act properly when it happens.

AdminUI part of PR: ezsystems/ezplatform-admin-ui#2045

Checklist:

• Provided PR description.
• Tested the solution manually.
• Checked that target branch is set correctly (master for features, the oldest supported for bugs).
• Ran PHP CS Fixer for new PHP code (use $ composer fix-cs).
• Asked for a review (ping @ezsystems/engineering-team).

[Steveb-p]

To be frank I'm not convinced that we should introduce a dedicated exception for something that already has it's own exception in the framework. Developers will need to respect both after this patch is added, which adds to the complexity and knowledge required to properly handle our library.

Instead I would propose to check Exception::getPreviousException() type as a "fallback" measure, in the admin-ui package itself.

We also need to ensure that we are not exposing user account existence when credentials are expired. That's the purpose of the Symfony code. If we're always redirecting to the password refresh page, we might introduce a security issue.

[mateuszbieniek]

Unfortunately, we cannot use previous on last authentication exception, as for this case it is always null - I guess when an exception is serialized and stored in session this data is lost.
Also, there is no security issue, as the exception is thrown at the "postAuth" stage - therefore, for expired password info to be presented, first, proper login and password have to be provided.

[Steveb-p]

Following private discussion we concluded that this is actually the proper solution.

[konradoboza]

+1 apart from @Steveb-p suggestions.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication