[Security] Expose the required roles in AccessDeniedException

[Nicofuma]

Q	A
Branch?	master (or earlier, it is rather small)
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	no
Tests pass?	yes
License	MIT

Nowadays it is more and more common to protect some sensitive actions and part of a website using 2FA or some re-authentication mechanism (per example, on Github you have to enter your password again when you add an ssh key). But currently, in Symfony, it is really hard to implement without having to duplicate the logic, provide an explicit list of URLs to protect or hack into the security component.

A good way to achieve that would be to add a special role (like IS_AUTHENTICATED_FULLY) and use it in the access map. But it requires us to be able to have a custom logic in an ExceptionListener depending on the roles behind an AccessDeniedException.

With this patch we could write an ExceptionListener of this kind (a similar logic could also be used in an AccessDeniedHandler):

    public function onKernelException(GetResponseForExceptionEvent $event)
    {
        $exception = $event->getException();
        do {
            if ($exception instanceof AccessDeniedException) {
                foreach ($exception->getAttributes() as $role) {
                    if ($role === 'IS_AUTHENTICATED_2FA' && !$this->accessDecisionManager->decide($this->tokenStorage->getToken(), $role, $exception->getObject())) {
                        // Start 2FA
                    }
                }
            }
        } while (null !== $exception = $exception->getPrevious());
    }

[stloyd]

This should be array(), not short syntax.

[linaori]

Just a wild brainfart, wouldn't it be easier to register on specific attributes to abstract away the kernel.exception part?

interface VoterExceptionHandlerInterface
    public function handleException(\Throwable $exception): Response;

This interface could be added to your voter. The kernel.exception handler can iterate over the known voters, call "supports" if the attribute/data match and then call handleException on that specific voter.

class YourVoter extends Voter implements VoterExceptionHandlerInterface

[stof]

@Nicofuma it would make sense to call these setters in the FrameworkBundle Controller shortcut too (when they are available)

[stof]

And tests are broken

[stof]

btw, this is a new feature, so it cannot go into 2.8

[Nicofuma]

@iltar you could do that, but I don't think it is the role of the voter. The authenticated voter knows how to tell if the user is authenticated or not but it shouldn't know what to do.

@stof indeed it is a new feature... but it would be sad to have that in 3.2 only and small features (in terms of code and implications) have already been introduced in minor versions in the past.

About the tests (php7, high), I guess the error is related to the security-core dependency in security-http but I don't really know how it is tested and what should be done here.

[fabpot]

@Nicofuma What's the status of this PR?

[fabpot]

@Nicofuma Still here?

[Nicofuma]

Sorry, I was a bit busy and I completely forgot about it. Replaced by #19473 (against maser)