[Security][Acl] security identity username change

[giorrrgio]

I didn't find any way to update security identity username in Acl, I think it should be very useful to include in MutableAclProvider a method to do this.
Consider these scenarios:

• a user changes his unsername and loses all his ACEs;
• a user changes his username and loses all his ACEs, while another user signs up with the first user's username and gains all the first user ACEs!

Another method for removing all ACEs from a SecurityIdentity would be useful too.

[dupuchba]

I had the same issue and I don't know how to update the username without loosing ACLs...

[leopro]

Same issue

[kampfgnu]

same here...
why not use the unique id of the user instead the username?
i don't know whats the reason that the username is used.
i changed the file UserSecurityIdentity.php to work with the userid + adjusted the getters in MutableAclProvider.php to use getUserId().
thats all and it works because i can now change the username without loosing the permissions.
cheers

[Barfly]

Same issue here,
acl should implement user_id instead of username.

[omgnull]

@Barfly acl should not depend on any user property. Application must provide unique user property to depend on. And like to see something like getUserIdentity() instead of getUsername()

[brentc]

Have also discovered this issue after implementing a 'change user' feature into my application.

[mmenozzi]

Same issue here. In my application the username is the e-mail address so if the user wants to change it he loses all ACLs.

[tommygnr]

ping @schmittjoh

[archie18]

Same here.

[dupuchba]

Anyone has find a solution? even a tricky one @stof ?

[stof]

I don't have one. I'm not using the ACL system in my projects

[dupuchba]

@stof Do you know anyone who is able to make it progress?

[dupuchba]

@schmittjoh in Symfony/Component/Security/Acl/Domain/UserSecurityIdentity you create a UserSecurityIdentity from the UserName field.
We are kind of stuck here because we want our users to be able to change their username and still have access to their content.
Do you have any idea how to update the username without breaking ACLs?

Thx

[dupuchba]

So, I tried what @giorrrgio said e.g change getUsername by getId but I think that's not the right way to do it because UserInterface never implements getId and in my opinion, we should never implement stuff based on ids...

As I looked thought MutableAclProvider, it's quite clear that securityidentity is constructed with usernames which indeed can be tricky if our users change their username/email...

I am triing to find a way to update ACLs with the new username. @fabpot , do you have any idea of it's the right way to do it?

Thx

[JavierGrinon]

Same issue!

[dupuchba]

One trick that we use in order to never loose ACL is to generate unique id for the username and make people loged in with email for example. Old user can still connect with there username.

The id never change but users can still change everything else!

[JavierGrinon]

I do not really understand... What property you set in providers?

providers:
users:
entity: { class: Project\UserBundle\Entity\User, property: email }

And How to be created after the objectidentity?

$idObject = ObjectIdentity::fromDomainObject($user);

I do not know if I should ask here or open a new issue.. You'd know tell me about how to delete row in the table acl_security_identities, for example when user is unsubscribe. Example: http://stackoverflow.com/questions/16904285/remove-update-security-identities-acl-symfony2

[lavoiesl]

I asked a similar question on the Symfony group without much more answer.

My problem was to delete a security identity when a user is deleted, but you could push the solution further to apply it to username changes as well.

https://groups.google.com/forum/#!topic/symfony2/mGTXlTWiMs8/discussion

Beware: this solution is pretty dirty, but since @dupuchba asked for one, here it is !

cc: @stof

[vpassapera]

This still an issue? :(

[lemoinem]

@vpassapera Yes, up to now, this is still an open issue. I just sent another PR, hoping to provide a clean fix for this.

[Codepadawan]

I think this, combined with no easy way to pull back multiple records from large tables using a user's security credentials indicates that Symfony's security really hasn't been well thought out or completed. Security is as basic a component of any web application.

[fabpot]

@Codepadawan You are only talking about the ACL part of the Symfony Security.

[Codepadawan]

@fabpot True. Maybe my comment was too harsh then. To me the simplest solution seems to be (and I haven't tried it yet) is make another field in my user table for a username (eg. "loginName") which as far as the user is concerned is the "username" they login with; they could change this whenever they wanted; alter loadUserByUsername() in my User repository to search by that field instead, and store another value in Username which cannot be changed by the user - perhaps the id? Does that sound like a reasonable workaround?

[fabpot]

I know nothing about the ACL sub-system and that's probably the main issue here ;) I use voters instead. That's why I've just created #8848

[sstok]

Because I need to use multiple user-systems in the application I'm planning on using using UUID for the user's id so I can uniquely identify them. Maybe this is also a good idea to implement in Symfony Security Component ACL?

[Codepadawan]

Having looked at it more deeply, I think its actually quite simple. When you change a user's username you simply update the identifier field in acl_security_identities. Just some direct SQL will suffice.

[lemoinem]

@Codepadawan please refer to #8650 The code is ready. However, I'm missing a bit of time to right the tests and update the PR to fit the template. However, the solution has been tested and is already in use in the current project I'm working on.

I'll update the PR as soon as I have the time.