Symfony 3.4 : How to force de-authentication - symfony

Question

My security user is fully authenticated with some roles got from some system. I want to check if one of the Roles exists and if it does not, I want to force de-authentication of the user.
In my event listener on the login I do this :
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
class SecurityEventSubscriber implements EventSubscriberInterface {
private $token;
private $checker;
private $container;
private $session;
public function __construct(TokenStorageInterface $token, AuthorizationCheckerInterface $checker, ContainerInterface $container, SessionInterface $session) {
$this->token = $token;
$this->checker = $checker;
$this->container = $container;
$this->session = $session;
}
public function login() {
if(!$this->checker->isGranted('IS_AUTHENTICATED_FULLY')) {
$this->session->invalidate();
$this->token->setToken(null);
throw new AccessDeniedException();
} else {
$user = $this->token->getToken()->getUser();
$roles = $user->getRoles();
$found = false;
foreach ($roles as $role) {
if($role->getRole() === $this->container->getParameter('role_expected')) {
$found = true;
break;
}
}
if(!$found) {
$this->session->invalidate();
$this->token->setToken(null);
throw new AccessDeniedException();
} else {
$user->removeAllRoles();
}
}
}
}
As you can see I tried to use the setToken to null but it does not work (Exception).
HGow should I ask to de-authenticate the user ?

Answer 1

Instead of checking the user permissions in your controller, you could create a custom User Checker that could deny the authentication based on your custom logic.
Sample User Checker
namespace AppBundle\Security;
use AppBundle\Security\User as AppUser;
use Symfony\Component\Security\Core\User\UserCheckerInterface;
use Symfony\Component\Security\Core\User\UserInterface;
class UserChecker implements UserCheckerInterface
{
public function checkPreAuth(UserInterface $user)
{
if (!$user instanceof AppUser) {
return;
}
if (!in_array('SOME_ROLE', $user->getRoles())) {
// throw an AccountStatusException exception here
}
}
}
If you also want to run a check against the user roles after user has been logged in (if his roles could change during his session) you can use the checkPostAuth() method.
You also have to mention the use of your custom User Checker in your app/config/security.yml file.
security:
firewalls:
main:
pattern: ^/
user_checker: AppBundle\Security\UserChecker
More informations here

Answer 2

The easiest way is to redirect your user to your logout route.
Sadly there does not seem to be a dedicated method that will simply handle the whole logout process for you.
Except maybe if you manage to call this method in a valid instance of Symfony\Component\Security\Http\Firewall\LogoutListener.
Symfony logout works like that:
It is handled by this listener
Listener is called on each request
Listener checks if requested route === logout route
If requested route === logout route, listener logs out the user