Skip to content

[Cookbook/security] Added missing formats #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 18, 2013
Merged

[Cookbook/security] Added missing formats #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
147 changes: 107 additions & 40 deletions cookbook/security/custom_authentication_provider.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -354,13 +354,13 @@ to service ids that do not exist yet: ``wsse.security.authentication.provider``

# src/Acme/DemoBundle/Resources/config/services.yml
services:
wsse.security.authentication.provider:
class: Acme\DemoBundle\Security\Authentication\Provider\WsseProvider
arguments: ['', %kernel.cache_dir%/security/nonces]
wsse.security.authentication.provider:
class: Acme\DemoBundle\Security\Authentication\Provider\WsseProvider
arguments: ['', %kernel.cache_dir%/security/nonces]

wsse.security.authentication.listener:
class: Acme\DemoBundle\Security\Firewall\WsseListener
arguments: [@security.context, @security.authentication.manager]
wsse.security.authentication.listener:
class: Acme\DemoBundle\Security\Firewall\WsseListener
arguments: [@security.context, @security.authentication.manager]


.. code-block:: xml
Expand All @@ -370,19 +370,19 @@ to service ids that do not exist yet: ``wsse.security.authentication.provider``
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">

<services>
<service id="wsse.security.authentication.provider"
class="Acme\DemoBundle\Security\Authentication\Provider\WsseProvider" public="false">
<argument /> <!-- User Provider -->
<argument>%kernel.cache_dir%/security/nonces</argument>
</service>

<service id="wsse.security.authentication.listener"
class="Acme\DemoBundle\Security\Firewall\WsseListener" public="false">
<argument type="service" id="security.context"/>
<argument type="service" id="security.authentication.manager" />
</service>
</services>
<services>
<service id="wsse.security.authentication.provider"
class="Acme\DemoBundle\Security\Authentication\Provider\WsseProvider" public="false">
<argument /> <!-- User Provider -->
<argument>%kernel.cache_dir%/security/nonces</argument>
</service>

<service id="wsse.security.authentication.listener"
class="Acme\DemoBundle\Security\Firewall\WsseListener" public="false">
<argument type="service" id="security.context"/>
<argument type="service" id="security.authentication.manager" />
</service>
</services>
</container>

.. code-block:: php
Expand All @@ -392,17 +392,22 @@ to service ids that do not exist yet: ``wsse.security.authentication.provider``
use Symfony\Component\DependencyInjection\Reference;

$container->setDefinition('wsse.security.authentication.provider',
new Definition(
'Acme\DemoBundle\Security\Authentication\Provider\WsseProvider',
array('', '%kernel.cache_dir%/security/nonces')
));
new Definition(
'Acme\DemoBundle\Security\Authentication\Provider\WsseProvider', array(
'',
'%kernel.cache_dir%/security/nonces',
)
)
);

$container->setDefinition('wsse.security.authentication.listener',
new Definition(
'Acme\DemoBundle\Security\Firewall\WsseListener', array(
new Reference('security.context'),
new Reference('security.authentication.manager'))
));
new Definition(
'Acme\DemoBundle\Security\Firewall\WsseListener', array(
new Reference('security.context'),
new Reference('security.authentication.manager'),
)
)
);

Now that your services are defined, tell your security context about your
factory. Factories must be included in an individual configuration file,
Expand Down Expand Up @@ -435,6 +440,20 @@ factory service, tagged as ``security.listener.factory``:
</services>
</container>

.. code-block:: php

// src/Acme/DemoBundle/Resources/config/security_factories.php
use Symfony\Component\DependencyInjection\Definition;
use Symfony\Component\DependencyInjection\Reference;

$definition = new Definition('Acme\DemoBundle\DependencyInjection\Security\Factory\WsseFactory', array(
'',
'%kernel.cache_dir%/security/nonces',
));
$definition->addTag('security.listener.factory');

$container->setDefinition('security.authentication.factory.wsse', $definition);

Now, import the factory configuration via the the ``factories`` key in your
security configuration:

Expand Down Expand Up @@ -467,13 +486,36 @@ security configuration:

You are finished! You can now define parts of your app as under WSSE protection.

.. code-block:: yaml
.. configuration-block::

security:
firewalls:
wsse_secured:
pattern: /api/.*
wsse: true
.. code-block:: yaml

security:
firewalls:
wsse_secured:
pattern: /api/.*
wsse: true

.. code-block:: xml

<config>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't it <security:config> ?

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ricardclau, as far as I know, the security file uses very rare XML elements which don't use namespaces. for instance, see this security configuration example

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Then http://symfony.com/doc/2.0/reference/configuration/security.html seems to be wrong... I am not 100% sure to be honest, I've always used YML for security config :)

<firewall name="wsse_secured"
pattern="/api/.*"
wsse="true"
/>
</config>

.. code-block:: php

$container->loadFromExtension('security', array(
'firewalls' => array(
'wsse_secured' => array(
'pattern' => '/api/.*',
'wsse' => true,
),
),
));


Congratulations! You have written your very own custom security authentication
provider!
Expand Down Expand Up @@ -546,13 +588,38 @@ in order to put it to use.
The lifetime of each wsse request is now configurable, and can be
set to any desirable value per firewall.

.. code-block:: yaml
.. configuration-block::

.. code-block:: yaml

security:
firewalls:
wsse_secured:
pattern: /api/.*
wsse: { lifetime: 30 }

.. code-block:: xml

<config>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, etc...

<firewall name="wsse_secured"
pattern="/api/.*"
>
<wsse lifetime="30" />
</firewall>
</config>

security:
firewalls:
wsse_secured:
pattern: /api/.*
wsse: { lifetime: 30 }
.. code-block:: php

$container->loadFromExtension('security', array(
'firewalls' => array(
'wsse_secured' => array(
'pattern' => '/api/.*',
'wsse' => array(
'lifetime' => 30,
),
),
),
));

The rest is up to you! Any relevant configuration items can be defined
in the factory and consumed or passed to the other classes in the container.
Expand Down
109 changes: 88 additions & 21 deletions cookbook/security/custom_provider.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,26 +206,66 @@ Now you make the user provider available as a service:
Modify ``security.yml``
-----------------------

In ``/app/config/security.yml`` everything comes together. Add the user provider
Everything comes together in your security configuration. Add the user provider
to the list of providers in the "security" section. Choose a name for the user provider
(e.g. "webservice") and mention the id of the service you just defined.

.. code-block:: yaml
.. configuration-block::

.. code-block:: yaml

// app/config/security.yml
security:
providers:
webservice:
id: webservice_user_provider

.. code-block:: xml

security:
providers:
webservice:
id: webservice_user_provider
<!-- app/config/security.xml -->
<config>
<provider name="webservice" id="webservice_user_provider" />
</config>

.. code-block:: php

// app/config/security.php
$container->loadFromExtension('security', array(
'providers' => array(
'webservice' => array(
'id' => 'webservice_user_provider',
),
),
));

Symfony also needs to know how to encode passwords that are supplied by website
users, e.g. by filling in a login form. You can do this by adding a line to the
"encoders" section in ``/app/config/security.yml``.
"encoders" section in your security configuration:

.. configuration-block::

.. code-block:: yaml

.. code-block:: yaml
# app/config/security.yml
security:
encoders:
Acme\WebserviceUserBundle\Security\User\WebserviceUser: sha512

security:
encoders:
Acme\WebserviceUserBundle\Security\User\WebserviceUser: sha512
.. code-block:: xml

<!-- app/config/security.xml -->
<config>
<encoder class="Acme\WebserviceUserBundle\Security\User\WebserviceUser">sha512</encoder>
</config>

.. code-block:: php

// app/config/security.php
$container->loadFromExtension('security', array(
'encoders' => array(
'Acme\WebserviceUserBundle\Security\User\WebserviceUser' => 'sha512',
),
));

The value here should correspond with however the passwords were originally
encoded when creating your users (however those users were created). When
Expand All @@ -252,15 +292,42 @@ options, the password may be encoded multiple times and encoded to base64.

Additionally, the hash, by default, is encoded multiple times and encoded
to base64. For specific details, see `MessageDigestPasswordEncoder`_.
To prevent this, configure it in ``security.yml``:

.. code-block:: yaml

security:
encoders:
Acme\WebserviceUserBundle\Security\User\WebserviceUser:
algorithm: sha512
encode_as_base64: false
iterations: 1
To prevent this, configure it in your configuration file:

.. configuration-block::

.. code-block:: yaml

# app/config/security.yml
security:
encoders:
Acme\WebserviceUserBundle\Security\User\WebserviceUser:
algorithm: sha512
encode_as_base64: false
iterations: 1

.. code-block:: xml

<!-- app/config/security.xml -->
<config>
<encoder class="Acme\WebserviceUserBundle\Security\User\WebserviceUser"
algorithm="sha512"
encode-as-base64="false"
iterations="1"
/>
</config>

.. code-block:: php

// app/config/security.php
$container->loadFromExtension('security', array(
'encoders' => array(
'Acme\WebserviceUserBundle\Security\User\WebserviceUser' => array(
'algorithm' => 'sha512',
'encode_as_base64' => false,
'iterations' => 1,
),
),
));

.. _MessageDigestPasswordEncoder: https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Security/Core/Encoder/MessageDigestPasswordEncoder.php
Loading