[Security] Fix loading user from UserBadge

[guillaumesmo]

Q	A
Branch?	6.3
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	Fix #50511
License	MIT
Doc PR	none

Fixed a breaking change from https://github.com/symfony/symfony/pull/48272/files#diff-de9707bb338188f62878f2ebd42e7a7bf9547f6d0bf07a4fcd9c386c263c601b

[carsonbot]

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has a contribution guide which I suggest you to read.

In short:

• Always add tests
• Keep backward compatibility (see https://symfony.com/bc).
• Bug fixes must be submitted against the lowest maintained branch where they apply (see https://symfony.com/releases)
• Features and deprecations must be submitted against the 6.4 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

[guillaumesmo]

The fix is less clean than expected because the new OIDC feature relies on this bug.

The Badge user loader used to have priority over the firewall user provider. This was changed so that the OIDC Badge user loader only kicks in when no user provider is set (not sure how, however).

So the priorities are now as follows:

1. Provided user loader in the new Badge constructor
2. Firewall user provider
3. OIDC user loader

Alternative solutions:

• add a configuration to oidc to enable the default user loader
• add a property to UserBadge to indicate the loader must not override the firewall user loader, instead of the callable wrapper

[nicolas-grekas]

Can you add a test case please?

@vincentchalamon can you have a look please?

[vincentchalamon]

Nice catch! (and sorry for the bug introduced in my PR)

In addition to my review, can you also add a non-regression functional test on AccessTokenTest please?

[guillaumesmo]

Hi all, what can I do to move this PR forward?

[nicolas-grekas]

"BC break" is not a proper description when fixing a regression. It doesn't tell which case is solved.
Can you please figure out something a bit more descriptive?

[guillaumesmo]

"BC break" is not a proper description when fixing a regression. It doesn't tell which case is solved. Can you please figure out something a bit more descriptive?

Sure, done

[wouterj]

Looks good to me.

[fabpot]

Thank you @guillaumesmo.