FOSFacebookBundle : Choose username before registration - symfony

I installed FOSUserBundle and FOSFacebookBundle using this method : How to make a separate url for signin via Facebook using FOSFacebookBundle in Symfony2. Actually I didn't really understand the whole security thing process, but it is working fine now.
When someone is using facebook signup, I would like the possibility to choose an username before being registred (instead of the facebook id as username)... what I do is that I send a POST parameter to the facebook login route but I can't find the controller where the registration is being processed.
What would be the best practise ? Where should I retrieve the username (the POST param) and set it ?
Here is my configuration in security.yml :
firewalls:
public:
pattern: ^/
fos_facebook:
app_url: "http://www.appName.com"
server_url: "http://local.appName.com/app_dev.php/"
login_path: /login
check_path: /login_check/facebook
provider: appName.facebook.provider
form_login:
login_path: /login
check_path: /login_check/form
provider: fos_userbundle
csrf_provider: form.csrf_provider
and here is the routing I use to signup with facebook :
_security_check_facebook:
pattern: /login_check/facebook

There is no controller processing authentication, ever authentication method add a listener that will trigger on check_path, and do the trick.
Authentication process shouldn't be responsible to add custom user data. If you followed FOSFacebookBundle documentation you should have a custom user provider that store the user on database, this may confuse a bit but this is not a registration step, is an authentication step. Adding a username is much similar to a profile editing.
To help you i should see your implementation (how do you send post parameter ? ) but you could try something like this:
send post parameter to a custom controller (implemented by you)
temporary store username (maybe user session data ?)
trigger authentication process (this depend on your implementation but essentially we are talking about authenticate on facebook and then post to login_check path)
add username at the authenticated user
This could work, but I never did something like this.

Old question, but I was working on a similar problem. I wanted to add a role to a user when they were registered on the first time they connected with Facebook.
If you follower these steps from the FOSFacebookBundle documentation, then you can tap into the Facebook connected user's "registration", take a look at the FacebookProvider class.
In loadUserByUsername method there is this part:
if (!empty($fbdata)) {
if (empty($user)) {
$user = $this->userManager->createUser();
$user->setEnabled(true);
$user->setPassword('');
}
$user->setFBData($fbdata);
...
After the setPassword within the if is where I added the role for my user.
For your original problem of choosing the username... notice that call to setFBData?
In the User entity the method looks like this:
public function setFBData($fbdata)
{
if (isset($fbdata['id'])) {
$this->setFacebookId($fbdata['id']);
$this->addRole('ROLE_FACEBOOK');
}
if (isset($fbdata['first_name'])) {
$this->setFirstname($fbdata['first_name']);
}
if (isset($fbdata['last_name'])) {
$this->setLastname($fbdata['last_name']);
}
if (isset($fbdata['email'])) {
$this->setEmail($fbdata['email']);
}
}
and setFacebookId() looks like this:
public function setFacebookId($facebookId)
{
$this->facebookId = $facebookId;
$this->setUsername($facebookId);
}
So that's where the username comes from. I guess that is a flow where you could plug your chosen username into and set it instead of the $facebookId.

I did another way for this.
I used GraphAPI.
public function setFacebookId($facebookId)
{
$this->facebookId = $facebookId;
$username = json_decode(file_get_contents('http://graph.facebook.com/'.$this->facebookId))->username;
$this->setUsername($username);
}
It takes the Facebook username, an unique one.

Related

Symfony2 How to authenticate a user with two different user names to access different url

I am working on a symfony project and I have a question in the authentication of users that I would like you to solve, since I am new to this.
My project is about a school, where there are teacher type users that have the username and password attributes in the database. The user name consists of the letter t followed by the personal identification number, for example t48945110. In addition, teachers have a Boolean attribute to indicate which of them is the school principal (there is only one).
The security settings in my project are as follows:
Secutiry.yml
security:
firewalls:
intranet:
pattern: ^/
anonymous: ~
provider: teachers
form_login:
login_path: /login
check_path: /login_check
# use_referer: true
default_target_path: /teacher
logout: ~
access_control:
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: admin/, roles: ROLE_ADMIN }
- { path: /teacher, roles: ROLE_TEACHER }
providers:
teachers:
entity: { class: School\BackendBundle\Entity\Teacher, property: username}
encoders:
School\BackendBundle\Entity\Teacher: { algorithm: sha512 }
With the above, the teacher can accerder to his private part through the login form, but the problem I have when I want to access with the director (teacher with the attribute (director=1) in the database). I would like this teacher to be able to access with another username, but not save it in the database, just changing the main letter, and then in the authentication look for the normal username of the teacher and check if the director to redirect it to / admin instead of /teacher. For example, the head of the school who can access his personal area as a teacher by the user name t48945110 and also can access the administration area of ​​the school with the user name d48945110.
This idea is not to create two different login forms, but to access all the users of the application (students, teachers, director ...).
I do not know if it could be done through Events listeners or otherwise. I appreciate your help for help.
I think you might be overcomplicating things. I'm pretty sure your director does not want to login with different usernames to enter the separate sections. Without knowing more details, what I would recommend is changing the getRoles() in your School\BackendBundle\Entity\Teacher to something like this:
public function getRoles()
{
$roles = array('ROLE_TEACHER');
if ($this->director == 1) {
$roles[] = 'ROLE_DIRECTOR';
$roles[] = 'ROLE_ADMIN';
}
return $roles;
}
This is probably the easiest way to have the user be both a teacher having access to their secured area as well as director having access to the admin area without having to switch accounts.
If for some reason this does not work you could have a look at Security Voters. This could look something like this:
class TeacherIsDirectorVoter extends Voter
{
protected function supports($attribute, $subject)
{
// This voter will always be used
return true;
}
protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
{
$user = $token->getUser();
// This voter will allow access if the currently logged in user is teacher and is a director
return ($user instanceof Teacher && $user->isDirector());
}
}
Again this will grant access for a teacher who is a director without requiring them to log in as a different user. Be careful with this voter as it will always grant access to all sections of your site to the teacher having director=1 with the default voter strategy. There are ways to change this or you could add checks based on the provided attributes and the subject being voted on.
I think for your use case the first option (updating the roles) is probably the easiest and will work well for you.
If you want students, teachers and director to be redirected to different pages after login you could do a little trick. In your SecurityController (or wherever you have your loginAction) create a new targetAction() that is used as target after successful login. In your security.yml assign the form_login's default_target_path to that route, instead of /teacher. That action should be accessible by all 3 user groups. Now just redirect, based on whatever roles your user has:
public function targetAAction()
{
$user = $this->getUser();
if (in_array('ROLE_ADMIN', $user->getRoles())) {
return $this->redirectToRoute('intranet_admin_page');
}
if (in_array('ROLE_TEACHER', $user->getRoles())) {
return $this->redirectToRoute('intranet_teacher_page');
}
return $this->redirectToRoute('generic_page_for_users');
}

Login in symfony2

I'm trying to implement very basic authentication in Symfony2. Here are main parts of the code I really don't see any problem
EDIT
complete security.yml
jms_security_extra:
secure_all_services: false
expressions: true
security:
encoders:
Symfony\Component\Security\Core\User\User: plaintext
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
in_memory:
memory:
users:
user: { password: userpass, roles: [ 'ROLE_USER' ] }
admin: { password: adminpass, roles: [ 'ROLE_ADMIN' ] }
firewalls:
login:
pattern: ^/login
anonymous: ~
secured_area:
pattern: ^/
stateless: true
form_login:
login_path: /login
check_path: /login_check
access_control:
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: ROLE_USER }
This works fine, anonymous user is always redirected to loginAction controller.
EDIT
Here is the complete code
<?php
namespace AcmeBundle\Controller;
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
class SecurityController extends Controller {
public function loginAction() {
$providerKey = 'secured_area';
$token = new UsernamePasswordToken('test', 'test', $providerKey, array('ROLE_USER'));
$this->container->get('security.context')->setToken($token);
return $this->redirect($this->generateUrl('fronthomepage'));
}
}
I don't see any problem, anonymous user is redirected to loginAction, there is created authenticated user, saved to token and than redirected to secured area as an authenticated user. Unfortunately my code ends with redirect loop which looks like security firewall doesn't accept user as authenticated. Do you see any problem?
Well, your controller job is to render just form but not to populate security context. Symfony2 security firewall will do that for you automatically. You don't need to handle it unless you want to build you own custom authentication.
In other words, your job is to display the login form and any login
errors that may have occurred, but the security system itself takes
care of checking the submitted username and password and
authenticating the user.
Please read this document for clear picture.
If you want to do some custom stuff when a user logs in, in Symfony2 you have to add an event listener that will fire after the user successfully logged in. The event that is fired is security.interactive_login and to hook to it you have to specify this in services.yml file form your bundle Resources/config directory:
Pretty sure you need an actual user object before setting an authenticated user. I did something like this:
class BaseController
protected function setUser($userName)
{
if (is_object($userName)) $user = $userName;
else
{
$userProvider = $this->get('zayso_core.user.provider');
// Need try/catch here
$user = $userProvider->loadUserByUsername($userName);
}
$providerKey = 'secured_area';
$providerKey = $this->container->getParameter('zayso_core.provider.key'); // secured_area
$token = new UsernamePasswordToken($user, null, $providerKey, $user->getRoles());
$this->get('security.context')->setToken($token);
return $user;
}
However doing something like this bypasses much of the security system and is not recommended. I also wanted to use a 3rd party authentication system (Janrain). I looked at the authentication system and initially could not make heads or tails out of it. This was before the cookbook entry existed.
I know it seems overkill but once you work through things then it starts to make more sense. And you get access to a bunch of nifty security functions. It took me quite some time to start to understand the authentication system but it was worth it in the end.
Hints:
1. Work through the cook book backward. I had a real hard time understanding what was going on but I started with adding a new firewall to security.yml and then adding the alias for my security factory. I then sort of traced through what the factory was being asked to do. From there I got the listener to fire up and again traced through the calls. Finally the authentication manager comes into play. Again, time consuming, but worth it in the end. Learned a lot.
One thing that drove me crazy is that classes are scattered all over the place. And the naming leaves something to be desired. Very hard to get an overview. I ended up making my own authentication bundle then putting everything under security.
If you want another example of a working bundle then take a look at: https://github.com/cerad/cerad/tree/master/src/Cerad/Bundle/JanrainBundle

Symfony 2 inconsistency in logout route: logout redirect to login?

I'd like to solve this inconsistency in my Symfony 2 application: when user is not authenticated path /app/logout redirects to /app/login. Instead, user not authenticated should view an error page (maybe 403).
Here is the security configuration. The IS_AUTHENTICATED_FULLY seems mandatory, as an user can do logout only if it's previously authenticated fully:
access_control:
- { path: ^/app/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/app/logout, roles: IS_AUTHENTICATED_FULLY }
And the logout action of my AccessController:
/**
* #Extra\Route("logout")
* #Extra\Template
*/
public function logoutAction()
{
// Set the token to null and invalidate the session
$this->getSecurityContext()->setToken(null);
$this->getSession()->invalidate();
// Redirect url and seconds (window.location)
$seconds = 5;
$redirect = $this->getRouter()->generate('access_login');
return array('seconds' => $seconds, 'redirect' => $redirect);
}
One solution would be removing the route /app/logout from access control and then throwing an exception if user it's not fully authenticated:
if(false === $this->getSecurityContext()->isGranted('IS_AUTHENTICATED_FULLY'))
throw new AccessDeniedException();
But this way /app/logout would be accessible even from not authenticated users! Anyone knows a better solution?
Just remove the logout path from access_control. Nothing bad is going to happen if a not authenticated user goes to the logout page — it's safe. Don't overengineer this stuff. ;)
BTW, why aren't you using the Symfony's built-in logout controller? You could create a logout handler to put your custom code in it instead of reinventing the wheel by handling all the logout stuff yourself.

Symfony 2 FOSFacebookBundle custom redirection before login

i'm using the FOSUserBundle and the FOSFacebookBundle (for version SF 2.0.x) in my project. Additionally, i implemented and custom FacebookProvider as described in the FOSFacebookBundle documentation. I would like to achieve the following workflow:
1.) A user visits my portal the first time
2.) He clicks the Facebook-Login-Button
3.) Now i need to check, if this user, who clicked the Facebook-Login-Button has already Facebook-Friends on my portal.
4.) If he has friends, redirect him to a sign-up page (including information from Facebook like, username, first_name, last_name, etc.) with prefilled input fields.
5.) If he has no Facebook-friends on my portal, redirect him to another page
I've started looking at the Webprofiler, which events are called. I've started creating my own event listener as descried on this page: http://www.dobervich.com/2011/10/13/login-redirection-revisited/ but the profile shows me my listener in the list of "not called listeners": security.interactive_login SecurityListener::onSecurityInteractiveLogin
Does anyone know, how i could customize this pre-login-check and redirect a user to a page?
Would be great to get some help on this.
Thank you,
Ramo
You need to configure a custom authentication success handler. Configure a service that implements AuthenticationSuccessHandlerInterface:
facebook_auth_success_handler:
class: MyHandler
public: false
arguments:
# your dependencies...
Then add this handler to security.yml under your fos_facebook block:
firewalls:
foo:
fos_facebook:
success_handler: facebook_auth_success_handler
The handler itself should look something like this:
public function onAuthenticationSuccess(Request $request, TokenInterface $token)
{
$user = $token->getUser();
$hasFriendsHereAlready = // your logic here
if ($hasFriendsHereAlready) {
$route = 'foo';
} else {
$route = 'bar';
}
return new RedirectResponse($this->router->generate($route));
}

symfony2 login by username or email

I'm using the standard authentication mechanism of Symfony2 and I want to let the user use either his username or email to login, but I can't find out why it's not working. I've tested the repository class and it works as expected. I've followed this how-to.
Here's my user provider class:
<?php
namespace My\UserBundle\Entity;
use Doctrine\ORM\EntityRepository ,
Symfony\Component\Security\Core\User\UserProviderInterface ,
Symfony\Component\Security\Core\User\UserInterface;
/**
* UserRepository
*
* This class was generated by the Doctrine ORM. Add your own custom
* repository methods below.
*/
class UserRepository extends EntityRepository implements UserProviderInterface
{
function loadUserByUsername($username)
{
$qb = $this->createQueryBuilder('u') ;
return
$qb->select('u')
->where(
$qb->expr()->orx(
$qb->expr()->like('u.username' ,':username') ,
$qb->expr()->like('u.email' ,':username')
)
)
//->andWhere($qb->expr()->eq('u.enabled' ,'true') )
->setParameters(array('username' =>$username ) )
->getQuery()
->getResult() ;
}
function refreshUser(UserInterface $user)
{
return $this->loadUserByUsername($user->getUsername() );
}
function supportsClass($class)
{
return $class === 'My\UserBundle\Entity\User';
}
}
I propose a more simple approach that only requires to edit security.yml file.
You must to create two diferent security providers but both using the same User class. The first has username as property and the second has email as property.
Then you create a chain_provider that includes the two providers and use it in your firewall section
security:
providers:
chain_provider:
chain:
providers: [db_username, db_email]
db_username:
entity:
class: MyUserBundle:User
property: username
db_email:
entity:
class: MyUserBundle:User
property: email
firewalls:
default:
anonymous: ~
provider: chain_provider
form_login:
login_path: /login
check_path: /login
I don't know if this approach is a clean practice, but is fast, simple and it works ok.
well guys the thing is in my security.yml i had this
providers:
main:
entity: { class: My\UserBundle\Entity\User ,property : username}
so i had to take off that parameter property :username
Taking off the property: username lets the UserProviderInterface load the user as expected when it logs in, but does not call the refreshUser() method as expected. I put in checks to see if it gets called but it doesn't.
The class that reloads the user on each access is ContextListener::refreshUser(TokenInterface $token) method. In this the interface iterates through the UserProviders and calls the refreshUser that first returns a non-null user.
I could make sure of this because, in the original load, I combine all different entities to make one SQL call instead of 7. And when the user reloads, it calls 7 times.
Also the method EntityUserProvider::refreshUser() doesn't call the repository's method and instead reloads from the database directly.
Your provider class is correct, and you are correct that the problem is in security.yml, however, your solution is incorrect.
According to the documentation, your security.yml file should look like this:
security:
# ...
providers:
administrators:
entity: { class: MyUserBundle:User }
Notice that the class is defined as the Bundle, not the direct class.
The way you have your code right now, symfony is completly ignoring your repository class until you define your security.yml correctly. And as #Anand pointed out, just removing the property does not invoke refreshUser. However, it looks like if you are using your own Repository, you do not need to define the property (since it's being defined in your query).

Resources