Symfony Authentication Token lost after redirect - symfony

Question

First of all, don't bother to copy this code. This will be available on my github soon. (I'll update this post just in case someone will need it)
Hi. I'm trying to use Steam to connect in my application. So, I've tried to create a custom user provider and a custom authentication. After I click Log In button, my user (I've added one by myself) is loaded from database and I'm redirected to my custom page. In that page, my debug toolbar is telling me that I'm authenticated with my custom Token and Firewall. If I move to another page, "/search" for example, my debug toolbar is telling me that I'm not authenticated anymore...
What am I doing wrong?
I'm using Symfony 4.0.6. Thank you !
P.S.: This script is inspired by this one: https://github.com/SirWaddles/SteamAuthBundle
P.P.S: If I missed any file and you need it, please reply.
P.P.P.S: I think it's a problem with serialize() and unserialize(), but I don't know exactly.
Player.php
<?php
namespace App\Entity;
use App\Service\SteamAuth\User\SteamUserInterface;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\User\AdvancedUserInterface;
use Symfony\Component\Security\Core\User\EquatableInterface;
use Symfony\Component\Security\Core\User\UserInterface;
/**
* Class Player
* #package App\Entity
*
* #ORM\Entity(repositoryClass="App\Repository\PlayerRepository")
* #ORM\Table(name="players")
*/
class Player implements UserInterface, SteamUserInterface, AdvancedUserInterface, EquatableInterface, \Serializable
{
/**
* #ORM\Id
* #ORM\GeneratedValue
* #ORM\Column(type="integer")
*
* #var int
*/
private $id;
/**
* #ORM\Column(type="string", length=255, )
*
* #var string
*/
private $username;
/**
* #ORM\Column(type="string", length=255)
*
* #var string
*/
private $name;
/**
* #ORM\Column(type="string", length=255)
*
* #var string
*/
private $password;
/**
* #ORM\Column(type="string", length=255, nullable=true)
*
* #var null|string
*/
private $avatar;
/**
* #var array
*
* #ORM\Column(type="array")
*/
private $roles;
/**
* #var \DateTime|null
*
* #ORM\Column(type="datetime", nullable=true)
*/
private $lastSync;
/**
* #var bool
*
* #ORM\Column(type="boolean")
*/
private $enabled;
/**
* #return int
*/
public function getId(): int
{
return $this->id;
}
/**
* #param int $id
*
* #return Player
*/
public function setId(int $id): Player
{
$this->id = $id;
return $this;
}
/**
* #return string
*/
public function getUsername(): string
{
return $this->username;
}
/**
* #param string $username
*
* #return Player
*/
public function setUsername(string $username): Player
{
$this->username = $username;
return $this;
}
/**
* #return string
*/
public function getName(): string
{
return $this->name;
}
/**
* #param string $name
*
* #return Player
*/
public function setName(string $name): Player
{
$this->name = $name;
return $this;
}
/**
* #return string
*/
public function getPassword()
{
return $this->password;
}
/**
* #return array
*/
public function getRoles()
{
return $this->roles;
}
/**
* #param array $roles
* #return Player
*/
public function setRoles(array $roles): Player
{
$this->roles = $roles;
return $this;
}
/**
* #return \DateTime|null
*/
public function getLastSync(): ?\DateTime
{
return $this->lastSync;
}
/**
* #param \DateTime|null $lastSync
* #return Player
*/
public function setLastSync(?\DateTime $lastSync): Player
{
$this->lastSync = $lastSync;
return $this;
}
/**
* #return null|string
*/
public function getSalt()
{
return null;
}
/**
* #param string $password
* #return Player
*/
public function setPassword(string $password): Player
{
$this->password = $password;
return $this;
}
/**
* #return null|string
*/
public function getAvatar(): ?string
{
return $this->avatar;
}
/**
* #param null|string $avatar
*
* #return Player
*/
public function setAvatar(?string $avatar): Player
{
$this->avatar = $avatar;
return $this;
}
/**
* {#inheritdoc}
*/
public function eraseCredentials()
{
}
/**
* {#inheritdoc}
*/
public function isAccountNonExpired()
{
return true;
}
/**
* {#inheritdoc}
*/
public function isAccountNonLocked()
{
return true;
}
/**
* {#inheritdoc}
*/
public function isCredentialsNonExpired()
{
return true;
}
/**
* {#inheritdoc}
*/
public function isEnabled()
{
return $this->enabled;
}
/**
* #param bool|null $enabled
* #return Player
*/
public function setEnabled(?bool $enabled): Player
{
$this->enabled = $enabled;
return $this;
}
/**
* {#inheritdoc}
*/
public function isEqualTo(UserInterface $user)
{
if ($this->username !== $user->getUsername()) {
return false;
}
return true;
}
/**
* {#inheritdoc}
*/
public function serialize()
{
return serialize([
$this->id,
$this->username,
$this->name,
$this->avatar,
$this->password,
$this->enabled
]);
}
/**
* {#inheritdoc}
*/
public function unserialize($data)
{
list($this->id, $this->username, $this->name, $this->avatar, $this->password, $this->enabled) = unserialize($data);
}
/**
* #return string
*/
public function __toString()
{
return $this->getUsername() ?? '-';
}
}
SteamToken.php
<?php
namespace App\Service\SteamAuth\Token;
use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
/**
* Class SteamToken
* #package App\Service\SteamAuth\Token
*/
class SteamToken extends AbstractToken
{
/**
* {#inheritdoc}
*/
public function __construct(array $roles = [])
{
parent::__construct($roles);
$this->setAuthenticated(count($roles) > 0);
}
/**
* {#inheritdoc}
*/
public function setAttributes(array $attributes)
{
foreach ($attributes as $key => $attribute) {
$key = str_replace("openid_", "openid.", $key);
$this->setAttribute($key, $attribute);
}
return $this;
}
/**
* {#inheritdoc}
*/
public function getCredentials()
{
}
/**
* {#inheritdoc}
*/
public function serialize()
{
return serialize([
$this->getUser(),
$this->isAuthenticated(),
$this->getAttributes()
]);
}
/**
* {#inheritdoc}
*/
public function unserialize($data)
{
$data = unserialize($data);
$this->setUser($data[0]);
$this->setAuthenticated($data[1]);
$this->setAttributes($data[2]);
}
}
SteamListener.php
<?php
namespace App\Service\SteamAuth\Firewall;
use App\Service\SteamAuth\Token\SteamToken;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Http\Firewall\ListenerInterface;
/**
* Class SteamListener
* #package App\Service\SteamAuth
*/
class SteamListener implements ListenerInterface
{
/**
* #var TokenStorageInterface
*/
private $tokenStorage;
/**
* #var AuthenticationManagerInterface
*/
private $authentication;
/**
* SteamListener constructor.
*
* #param TokenStorageInterface $tokenStorage
* #param AuthenticationManagerInterface $authentication
*/
public function __construct(TokenStorageInterface $tokenStorage, AuthenticationManagerInterface $authentication)
{
$this->tokenStorage = $tokenStorage;
$this->authentication = $authentication;
}
public function handle(GetResponseEvent $event)
{
$request = $event->getRequest();
if($request->get('_route') === 'login_check') {
$token = new SteamToken();
$token->setUser(str_replace("http://steamcommunity.com/openid/id/", "", $request->query->get('openid_claimed_id')));
$token->setAttributes($request->query->all());
try {
$authToken = $this->authentication->authenticate($token);
$this->tokenStorage->setToken($authToken);
return;
} catch (AuthenticationException $exception) {
}
}
$response = new Response();
$response->setStatusCode(Response::HTTP_FORBIDDEN);
$event->setResponse($response);
return;
}
}
SteamProvider.php
<?php
namespace App\Service\SteamAuth\Authentication;
use App\Service\SteamAuth\Token\SteamToken;
use GuzzleHttp\Client;
use Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\User\UserProviderInterface;
/**
* Class SteamProvider
* #package App\Service\SteamAuth\Provider
*/
class SteamProvider implements AuthenticationProviderInterface
{
/**
* #var UserProviderInterface
*/
private $userProvider;
/**
* #var Client
*/
private $client;
/**
* SteamProvider constructor.
*
* #param UserProviderInterface $userProvider
* #param Client $client
*/
public function __construct(UserProviderInterface $userProvider, Client $client)
{
$this->userProvider = $userProvider;
$this->client = $client;
}
/**
* {#inheritdoc}
*/
public function authenticate(TokenInterface $token)
{
if ($token->getAttribute('openid.ns') !== "http://specs.openid.net/auth/2.0") {
throw new AuthenticationException("Invalid token !");
}
$checkAuth = $token->getAttributes();
$checkAuth['openid.mode'] = 'check_authentication';
$response = $this->client->request('GET', 'login', ['query' => $checkAuth]);
if ((string)$response->getBody() === "ns:http://specs.openid.net/auth/2.0\nis_valid:true\n") {
$user = $this->userProvider->loadUserByUsername($token->getUsername());
$authToken = new SteamToken($user->getRoles());
$authToken->setUser($user);
return $authToken;
}
throw new AuthenticationException("Invalid token !");
}
/**
* {#inheritdoc}
*/
public function supports(TokenInterface $token)
{
return $token instanceof SteamToken;
}
}
SteamUserProvider.php
<?php
namespace App\Service\SteamAuth\User;
use App\Entity\Player;
use App\Service\SteamAuth\SteamUserService;
use Doctrine\ORM\EntityManager;
use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
/**
* Class SteamUserProvider
* #package App\Service\SteamAuth\User
*/
class SteamUserProvider implements UserProviderInterface
{
/**
* #var EntityManager
*/
private $entityManager;
/**
* #var string
*/
private $userClass;
/**
* #var SteamUserService
*/
private $userService;
/**
* SteamUserProvider constructor.
*
* #param EntityManager $entityManager
* #param SteamUserService $userService
* #param string $userClass
*/
public function __construct(EntityManager $entityManager, SteamUserService $userService, string $userClass)
{
$this->entityManager = $entityManager;
$this->userService = $userService;
$this->userClass = $userClass;
}
/**
* {#inheritdoc}
*/
public function loadUserByUsername($username)
{
$repository = $this->entityManager->getRepository($this->userClass);
$player = $repository->findOneBy(['username' => $username]);
if (!$player) {
/**
* #var $player Player
*/
$player = new $this->userClass();
$player->setUsername($username);
$player->setPassword(md5(random_bytes(15)));
$player->setRoles(['ROLE_USER']);
$player->setEnabled(1);
$player = $this->userService->updateUserEntry($player);
$this->entityManager->persist($player);
$this->entityManager->flush($player);
}
/// if last update....
return $player;
}
/**
* {#inheritdoc}
*/
public function refreshUser(UserInterface $user)
{
if (!$user instanceof SteamUserInterface) {
throw new UnsupportedUserException("User not supported!");
}
return $this->loadUserByUsername($user->getUsername());
}
/**
* {#inheritdoc}
*/
public function supportsClass($class)
{
return $class === $this->userClass;
}
}
services.yaml
services:
...
# Aliases
GuzzleHttp\Client: '#eight_points_guzzle.client.login'
# Log In System
app.steam_user.service:
class: App\Service\SteamAuth\SteamUserService
arguments: ['#eight_points_guzzle.client.steam', '%steam_api_key%']
app.steam_user.provider:
class: App\Service\SteamAuth\User\SteamUserProvider
arguments:
$entityManager: '#doctrine.orm.default_entity_manager'
$userService: '#app.steam_user.service'
$userClass: '%steam_user_class%'
app.steam.provider:
class: App\Service\SteamAuth\Authentication\SteamProvider
arguments:
$userProvider: '#app.steam_user.provider'
$client: '#eight_points_guzzle.client.login'
app.steam.listener:
class: App\Service\SteamAuth\Firewall\SteamListener
security.yaml
security:
# https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
providers:
steamauth:
id: app.steam_user.provider
firewalls:
steam_auth:
pattern: ^/login_check
stateless: true
steam: ~
form_login:
csrf_token_generator: security.csrf.token_manager
remember_me:
secret: '%kernel.secret%'
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
# Easy way to control access for large sections of your site
# Note: Only the *first* access control that matches will be used
access_control:
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/login_check, roles: IS_AUTHENTICATED_ANONYMOUSLY }
EDIT: If I dump($this->get('session')->all()) and that page before refresh, I get this: "_security_steam_auth" => "C:38:"App\Service\SteamAuth\Token\SteamToken":40:{a:4:{i:0;N;i:1;b:0;i:2;a:0:{}i:3;a:0:{}}}"

Answer 1

I had a similar problem.
I had a missing attribute in a my serialization process: isActive
I never understand why, but when this attribute is my serialization/unserialization process, it works fine, and when not, it don't work at all.
here is my source: https://github.com/matthieuleorat/documentManager/blob/master/src/Entity/User.php#L253
The doc: http://symfony.com/doc/current/security/entity_provider.html#security-serialize-equatable
Hope it help.

Answer 2

Do you have module_suhosin7 enabled?
We experienced problems on session with suhosin7 enabled.
In fact it adds some rules on session and cookie management.
If enabled, try and disable it and check if it works.
There is a known issue about session encryption with suhosin7 :
https://github.com/sektioneins/suhosin7/issues/21

Answer 3

This lines in SteamListener.php prevents any other routes to work.
$request = $event->getRequest();
if($request->get('_route') === 'login_check') {
[...]
}
$response = new Response();
$response->setStatusCode(Response::HTTP_FORBIDDEN);
$event->setResponse($response);
Security Firewall handle() function is called each times you navigate to a page, so if you set other pages status as forbidden, you won't be able to navigate on other pages than login.
This should work by removing it. Let me know if problem solved

Answer 4

After a lot of work, I decided to make a research again for a Steam Authentication bundle and I found one for Symfony 4 and I confirm that it works.
Link: https://github.com/knojector/SteamAuthenticationBundle