Renaming the tokens to be clear they are "post" and "pre" auth - also adding an interface

weaverryan · weaverryan · commit 873ed284d26b · 2015-09-20T19:24:20.000-04:00
The reason is that the GuardAuthenticationProvider *must* respond to *all* tokens
created by the system - both "pre auth" and "post auth" tokens. The reason is that
if a "post auth" token becomes not authenticated (e.g. because the user changes between
requests), then it may be passed to the provider system. If no providers respond (which
was the case before this commit), then AuthenticationProviderManager throws an exception.

The next commit will properly handle these "post auth" + "no-longer-authenticated" tokens,
which should cause a log out.
diff --git a/src/Symfony/Component/Security/Guard/AbstractGuardAuthenticator.php b/src/Symfony/Component/Security/Guard/AbstractGuardAuthenticator.php
@@ -3,26 +3,26 @@
 namespace Symfony\Component\Security\Guard;
 
 use Symfony\Component\Security\Core\User\UserInterface;
-use Symfony\Component\Security\Guard\Token\GenericGuardToken;
+use Symfony\Component\Security\Guard\Token\PostAuthenticationGuardToken;
 
 /**
- * An optional base class that creates a GenericGuardToken for you
+ * An optional base class that creates a PostAuthenticationGuardToken for you
  *
  * @author Ryan Weaver <weaverryan@gmail.com>
  */
 abstract class AbstractGuardAuthenticator implements GuardAuthenticatorInterface
 {
     /**
-     * Shortcut to create a GenericGuardToken for you, if you don't really
+     * Shortcut to create a PostAuthenticationGuardToken for you, if you don't really
      * care about which authenticated token you're using
      *
      * @param UserInterface $user
      * @param string $providerKey
-     * @return GenericGuardToken
+     * @return PostAuthenticationGuardToken
      */
     public function createAuthenticatedToken(UserInterface $user, $providerKey)
     {
-        return new GenericGuardToken(
+        return new PostAuthenticationGuardToken(
             $user,
             $providerKey,
             $user->getRoles()
diff --git a/src/Symfony/Component/Security/Guard/Firewall/GuardAuthenticationListener.php b/src/Symfony/Component/Security/Guard/Firewall/GuardAuthenticationListener.php
@@ -6,7 +6,7 @@
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Event\GetResponseEvent;
 use Symfony\Component\Security\Guard\GuardAuthenticatorHandler;
-use Symfony\Component\Security\Guard\Token\NonAuthenticatedGuardToken;
+use Symfony\Component\Security\Guard\Token\PreAuthenticationGuardToken;
 use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
 use Symfony\Component\Security\Guard\GuardAuthenticatorInterface;
 use Psr\Log\LoggerInterface;
@@ -86,7 +86,7 @@ private function executeGuardAuthenticator($uniqueGuardKey, GuardAuthenticatorIn
             }
 
             // create a token with the unique key, so that the provider knows which authenticator to use
-            $token = new NonAuthenticatedGuardToken($credentials, $uniqueGuardKey);
+            $token = new PreAuthenticationGuardToken($credentials, $uniqueGuardKey);
 
             if (null !== $this->logger) {
                 $this->logger->info('Passing guard token information to the GuardAuthenticationProvider', array('firewall_key' => $this->providerKey, 'authenticator' => get_class($guardAuthenticator)));
diff --git a/src/Symfony/Component/Security/Guard/Provider/GuardAuthenticationProvider.php b/src/Symfony/Component/Security/Guard/Provider/GuardAuthenticationProvider.php
@@ -3,15 +3,18 @@
 namespace Symfony\Component\Security\Guard\Provider;
 
 use Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface;
+use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
 use Symfony\Component\Security\Guard\GuardAuthenticatorInterface;
-use Symfony\Component\Security\Guard\Token\NonAuthenticatedGuardToken;
+use Symfony\Component\Security\Guard\Token\GuardTokenInterface;
+use Symfony\Component\Security\Guard\Token\PreAuthenticationGuardToken;
 use Symfony\Component\Security\Core\User\UserCheckerInterface;
 use Symfony\Component\Security\Core\User\UserInterface;
 use Symfony\Component\Security\Core\User\UserProviderInterface;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 
 /**
- * Responsible for accepting the NonAuthenticatedGuardToken and calling
+ * Responsible for accepting the PreAuthenticationGuardToken and calling
  * the correct authenticator to retrieve the authenticated token
  *
  * @author Ryan Weaver <weaverryan@gmail.com>
@@ -43,12 +46,12 @@ public function __construct(array $guardAuthenticators, UserProviderInterface $u
     /**
      * Finds the correct authenticator for the token and calls it
      *
-     * @param NonAuthenticatedGuardToken $token
+     * @param GuardTokenInterface $token
      * @return TokenInterface
      */
     public function authenticate(TokenInterface $token)
     {
-        if (!$token instanceof NonAuthenticatedGuardToken) {
+        if (!$this->supports($token)) {
             throw new \InvalidArgumentException('GuardAuthenticationProvider only supports NonAuthenticatedGuardToken');
         }
 
@@ -69,7 +72,7 @@ public function authenticate(TokenInterface $token)
         ));
     }
 
-    private function authenticateViaGuard(GuardAuthenticatorInterface $guardAuthenticator, NonAuthenticatedGuardToken $token)
+    private function authenticateViaGuard(GuardAuthenticatorInterface $guardAuthenticator, PreAuthenticationGuardToken $token)
     {
         // get the user from the GuardAuthenticator
         $user = $guardAuthenticator->authenticate($token->getCredentials(), $this->userProvider);
@@ -101,6 +104,6 @@ private function authenticateViaGuard(GuardAuthenticatorInterface $guardAuthenti
 
     public function supports(TokenInterface $token)
     {
-        return $token instanceof NonAuthenticatedGuardToken;
+        return $token instanceof GuardTokenInterface;
     }
 }
diff --git a/src/Symfony/Component/Security/Guard/Tests/Firewall/GuardAuthenticationListenerTest.php b/src/Symfony/Component/Security/Guard/Tests/Firewall/GuardAuthenticationListenerTest.php
@@ -14,7 +14,7 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Security\Guard\Firewall\GuardAuthenticationListener;
-use Symfony\Component\Security\Guard\Token\NonAuthenticatedGuardToken;
+use Symfony\Component\Security\Guard\Token\PreAuthenticationGuardToken;
 use Symfony\Component\Security\Core\Exception\AuthenticationException;
 
 /**
@@ -44,7 +44,7 @@ public function testHandleSuccess()
 
         // a clone of the token that should be created internally
         $uniqueGuardKey = 'my_firewall_0';
-        $nonAuthedToken = new NonAuthenticatedGuardToken($credentials, $uniqueGuardKey);
+        $nonAuthedToken = new PreAuthenticationGuardToken($credentials, $uniqueGuardKey);
 
         $this->authenticationManager
             ->expects($this->once())
diff --git a/src/Symfony/Component/Security/Guard/Tests/Provider/GuardAuthenticationProviderTest.php b/src/Symfony/Component/Security/Guard/Tests/Provider/GuardAuthenticationProviderTest.php
@@ -20,7 +20,7 @@ class GuardAuthenticationProviderTest extends \PHPUnit_Framework_TestCase
 {
     private $userProvider;
     private $userChecker;
-    private $nonAuthedToken;
+    private $preAuthenticationToken;
 
     public function testAuthenticate()
     {
@@ -32,7 +32,7 @@ public function testAuthenticate()
         $authenticators = array($authenticatorA, $authenticatorB, $authenticatorC);
 
         // called 2 times - for authenticator A and B (stops on B because of match)
-        $this->nonAuthedToken->expects($this->exactly(2))
+        $this->preAuthenticationToken->expects($this->exactly(2))
             ->method('getGuardProviderKey')
             // it will return the "1" index, which will match authenticatorB
             ->will($this->returnValue('my_cool_firewall_1'));
@@ -41,7 +41,7 @@ public function testAuthenticate()
             'username' => '_weaverryan_test_user',
             'password' => 'guard_auth_ftw',
         );
-        $this->nonAuthedToken->expects($this->once())
+        $this->preAuthenticationToken->expects($this->once())
             ->method('getCredentials')
             ->will($this->returnValue($enteredCredentials));
 
@@ -71,15 +71,15 @@ public function testAuthenticate()
             ->with($mockedUser);
 
         $provider = new GuardAuthenticationProvider($authenticators, $this->userProvider, $providerKey, $this->userChecker);
-        $actualAuthedToken = $provider->authenticate($this->nonAuthedToken);
+        $actualAuthedToken = $provider->authenticate($this->preAuthenticationToken);
         $this->assertSame($authedToken, $actualAuthedToken);
     }
 
     protected function setUp()
     {
         $this->userProvider = $this->getMock('Symfony\Component\Security\Core\User\UserProviderInterface');
         $this->userChecker = $this->getMock('Symfony\Component\Security\Core\User\UserCheckerInterface');
-        $this->nonAuthedToken = $this->getMockBuilder('Symfony\Component\Security\Guard\Token\NonAuthenticatedGuardToken')
+        $this->preAuthenticationToken = $this->getMockBuilder('Symfony\Component\Security\Guard\Token\PreAuthenticationGuardToken')
             ->disableOriginalConstructor()
             ->getMock();
     }
@@ -88,6 +88,6 @@ protected function tearDown()
     {
         $this->userProvider = null;
         $this->userChecker = null;
-        $this->nonAuthedToken = null;
+        $this->preAuthenticationToken = null;
     }
 }
diff --git a/src/Symfony/Component/Security/Guard/Token/GuardTokenInterface.php b/src/Symfony/Component/Security/Guard/Token/GuardTokenInterface.php
@@ -0,0 +1,15 @@
+<?php
+
+namespace Symfony\Component\Security\Guard\Token;
+
+/**
+ * An empty interface that both guard tokens implement
+ *
+ * This interface is used by the GuardAuthenticationProvider to know
+ * that a token belongs to its system.
+ *
+ * @author Ryan Weaver <weaverryan@gmail.com>
+ */
+interface GuardTokenInterface
+{
+}
diff --git a/src/Symfony/Component/Security/Guard/Token/PostAuthenticationGuardToken.php b/src/Symfony/Component/Security/Guard/Token/PostAuthenticationGuardToken.php
@@ -7,17 +7,14 @@
 use Symfony\Component\Security\Core\User\UserInterface;
 
 /**
- * A generic token used by the AbstractGuardAuthenticator
+ * Used as an "authenticated" token, though it could be set to not-authenticated later.
  *
- * This is meant to be used as an "authenticated" token, though it
- * could be set to not-authenticated later.
- *
- * You're free to use this (it's simple) or use any other token for
- * your authenticated token
+ * If you're using Guard authentication, you *must* use a class that implements
+ * GuardTokenInterface as your authenticated token (like this class).
  *
  * @author Ryan Weaver <weaverryan@gmail.com>
  */
-class GenericGuardToken extends AbstractToken
+class PostAuthenticationGuardToken extends AbstractToken implements GuardTokenInterface
 {
     private $providerKey;
 
diff --git a/src/Symfony/Component/Security/Guard/Token/PreAuthenticationGuardToken.php b/src/Symfony/Component/Security/Guard/Token/PreAuthenticationGuardToken.php
@@ -13,7 +13,7 @@
  *
  * @author Ryan Weaver <weaverryan@gmail.com>
  */
-class NonAuthenticatedGuardToken extends AbstractToken
+class PreAuthenticationGuardToken extends AbstractToken implements GuardTokenInterface
 {
     private $credentials;
     private $guardProviderKey;
@@ -51,6 +51,6 @@ public function getCredentials()
 
     public function setAuthenticated($authenticated)
     {
-        throw new \Exception('The NonAuthenticatedGuardToken is *always* not authenticated');
+        throw new \Exception('The PreAuthenticationGuardToken is *always* not authenticated');
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -3,15 +3,18 @@`
`3`	`3`	`namespace Symfony\Component\Security\Guard\Provider;`
`4`	`4`
`5`	`5`	`use Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface;`
	`6`	`+use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;`
	`7`	`+use Symfony\Component\Security\Core\Exception\AuthenticationException;`
`6`	`8`	`use Symfony\Component\Security\Guard\GuardAuthenticatorInterface;`
`7`		`-use Symfony\Component\Security\Guard\Token\NonAuthenticatedGuardToken;`
	`9`	`+use Symfony\Component\Security\Guard\Token\GuardTokenInterface;`
	`10`	`+use Symfony\Component\Security\Guard\Token\PreAuthenticationGuardToken;`
`8`	`11`	`use Symfony\Component\Security\Core\User\UserCheckerInterface;`
`9`	`12`	`use Symfony\Component\Security\Core\User\UserInterface;`
`10`	`13`	`use Symfony\Component\Security\Core\User\UserProviderInterface;`
`11`	`14`	`use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;`
`12`	`15`
`13`	`16`	`/**`
`14`		`- * Responsible for accepting the NonAuthenticatedGuardToken and calling`
	`17`	`+ * Responsible for accepting the PreAuthenticationGuardToken and calling`
`15`	`18`	`* the correct authenticator to retrieve the authenticated token`
`16`	`19`	`*`
`17`	`20`	`* @author Ryan Weaver <[email protected]>`
`@@ -43,12 +46,12 @@ public function __construct(array $guardAuthenticators, UserProviderInterface $u`
`43`	`46`	`/**`
`44`	`47`	`* Finds the correct authenticator for the token and calls it`
`45`	`48`	`*`
`46`		`- * @param NonAuthenticatedGuardToken $token`
	`49`	`+ * @param GuardTokenInterface $token`
`47`	`50`	`* @return TokenInterface`
`48`	`51`	`*/`
`49`	`52`	`public function authenticate(TokenInterface $token)`
`50`	`53`	`{`
`51`		`- if (!$token instanceof NonAuthenticatedGuardToken) {`
	`54`	`+ if (!$this->supports($token)) {`
`52`	`55`	`throw new \InvalidArgumentException('GuardAuthenticationProvider only supports NonAuthenticatedGuardToken');`
`53`	`56`	`}`
`54`	`57`
`@@ -69,7 +72,7 @@ public function authenticate(TokenInterface $token)`
`69`	`72`	`));`
`70`	`73`	`}`
`71`	`74`
`72`		`- private function authenticateViaGuard(GuardAuthenticatorInterface $guardAuthenticator, NonAuthenticatedGuardToken $token)`
	`75`	`+ private function authenticateViaGuard(GuardAuthenticatorInterface $guardAuthenticator, PreAuthenticationGuardToken $token)`
`73`	`76`	`{`
`74`	`77`	`// get the user from the GuardAuthenticator`
`75`	`78`	`$user = $guardAuthenticator->authenticate($token->getCredentials(), $this->userProvider);`
`@@ -101,6 +104,6 @@ private function authenticateViaGuard(GuardAuthenticatorInterface $guardAuthenti`
`101`	`104`
`102`	`105`	`public function supports(TokenInterface $token)`
`103`	`106`	`{`
`104`		`- return $token instanceof NonAuthenticatedGuardToken;`
	`107`	`+ return $token instanceof GuardTokenInterface;`
`105`	`108`	`}`
`106`	`109`	`}`
Original file line number	Diff line number	Diff line change
`@@ -20,7 +20,7 @@ class GuardAuthenticationProviderTest extends \PHPUnit_Framework_TestCase`
`20`	`20`	`{`
`21`	`21`	`private $userProvider;`
`22`	`22`	`private $userChecker;`
`23`		`- private $nonAuthedToken;`
	`23`	`+ private $preAuthenticationToken;`
`24`	`24`
`25`	`25`	`public function testAuthenticate()`
`26`	`26`	`{`
`@@ -32,7 +32,7 @@ public function testAuthenticate()`
`32`	`32`	`$authenticators = array($authenticatorA, $authenticatorB, $authenticatorC);`
`33`	`33`
`34`	`34`	`// called 2 times - for authenticator A and B (stops on B because of match)`
`35`		`- $this->nonAuthedToken->expects($this->exactly(2))`
	`35`	`+ $this->preAuthenticationToken->expects($this->exactly(2))`
`36`	`36`	`->method('getGuardProviderKey')`
`37`	`37`	`// it will return the "1" index, which will match authenticatorB`
`38`	`38`	`->will($this->returnValue('my_cool_firewall_1'));`
`@@ -41,7 +41,7 @@ public function testAuthenticate()`
`41`	`41`	`'username' => '_weaverryan_test_user',`
`42`	`42`	`'password' => 'guard_auth_ftw',`
`43`	`43`	`);`
`44`		`- $this->nonAuthedToken->expects($this->once())`
	`44`	`+ $this->preAuthenticationToken->expects($this->once())`
`45`	`45`	`->method('getCredentials')`
`46`	`46`	`->will($this->returnValue($enteredCredentials));`
`47`	`47`
`@@ -71,15 +71,15 @@ public function testAuthenticate()`
`71`	`71`	`->with($mockedUser);`
`72`	`72`
`73`	`73`	`$provider = new GuardAuthenticationProvider($authenticators, $this->userProvider, $providerKey, $this->userChecker);`
`74`		`- $actualAuthedToken = $provider->authenticate($this->nonAuthedToken);`
	`74`	`+ $actualAuthedToken = $provider->authenticate($this->preAuthenticationToken);`
`75`	`75`	`$this->assertSame($authedToken, $actualAuthedToken);`
`76`	`76`	`}`
`77`	`77`
`78`	`78`	`protected function setUp()`
`79`	`79`	`{`
`80`	`80`	`$this->userProvider = $this->getMock('Symfony\Component\Security\Core\User\UserProviderInterface');`
`81`	`81`	`$this->userChecker = $this->getMock('Symfony\Component\Security\Core\User\UserCheckerInterface');`
`82`		`- $this->nonAuthedToken = $this->getMockBuilder('Symfony\Component\Security\Guard\Token\NonAuthenticatedGuardToken')`
	`82`	`+ $this->preAuthenticationToken = $this->getMockBuilder('Symfony\Component\Security\Guard\Token\PreAuthenticationGuardToken')`
`83`	`83`	`->disableOriginalConstructor()`
`84`	`84`	`->getMock();`
`85`	`85`	`}`
`@@ -88,6 +88,6 @@ protected function tearDown()`
`88`	`88`	`{`
`89`	`89`	`$this->userProvider = null;`
`90`	`90`	`$this->userChecker = null;`
`91`		`- $this->nonAuthedToken = null;`
	`91`	`+ $this->preAuthenticationToken = null;`
`92`	`92`	`}`
`93`	`93`	`}`
Original file line number	Diff line number	Diff line change
`@@ -13,7 +13,7 @@`
`13`	`13`	`*`
`14`	`14`	`* @author Ryan Weaver <[email protected]>`
`15`	`15`	`*/`
`16`		`-class NonAuthenticatedGuardToken extends AbstractToken`
	`16`	`+class PreAuthenticationGuardToken extends AbstractToken implements GuardTokenInterface`
`17`	`17`	`{`
`18`	`18`	`private $credentials;`
`19`	`19`	`private $guardProviderKey;`
`@@ -51,6 +51,6 @@ public function getCredentials()`
`51`	`51`
`52`	`52`	`public function setAuthenticated($authenticated)`
`53`	`53`	`{`
`54`		`- throw new \Exception('The NonAuthenticatedGuardToken is always not authenticated');`
	`54`	`+ throw new \Exception('The PreAuthenticationGuardToken is always not authenticated');`
`55`	`55`	`}`
`56`	`56`	`}`