Symfony 2 security: account activation - symfony

Question

I'm using Symfony 2 security system.
When some user trying to login, I want to additionally check whether user's field "activated" is true. If not, error message appears: "You have to activate your account first".
How can i implement this feature?

Answer 1

If you're using Doctrine as user provider you can implement the AdvancedUserInterface. This interface (definition visible below) provide the isEnabled() method which is equal to account activation status method. If this method return false, the user will have an error message like Your account is not enabled when he attempt to login.
I use it to provide e-mail validation on subscription.
/*
* This file is part of the Symfony package.
*
* (c) Fabien Potencier <fabien#symfony.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Symfony\Component\Security\Core\User;
/**
* AdvancedUserInterface adds status flags to a regular account.
*
* #author Fabien Potencier <fabien#symfony.com>
*/
interface AdvancedUserInterface extends UserInterface
{
/**
* Checks whether the user's account has expired.
*
* #return Boolean true if the user's account is non expired, false otherwise
*/
function isAccountNonExpired();
/**
* Checks whether the user is locked.
*
* #return Boolean true if the user is not locked, false otherwise
*/
function isAccountNonLocked();
/**
* Checks whether the user's credentials (password) has expired.
*
* #return Boolean true if the user's credentials are non expired, false otherwise
*/
function isCredentialsNonExpired();
/**
* Checks whether the user is enabled.
*
* #return Boolean true if the user is enabled, false otherwise
*/
function isEnabled();
}

Answer 2

i have tried for the first time. but got an error message
"User is locked"
it try to figure it out how to implement form AdvanceUserInterface.
I want to share code how to implement it, here you go :
class User implements AdvancedUserInterface, \Serializable
{
/**
* #ORM\Column(type="integer")
* #ORM\Id
* #ORM\GeneratedValue(strategy="AUTO")
*/
private $id;
/**
* #ORM\Column(type="string", length=25, unique=true)
*/
private $username;
/**
* #ORM\Column(type="string", length=255)
* #Assert\Length(min=8, max=255)
*/
private $password;
/**
* #ORM\Column(type="string", length=60, unique=true)
* #Assert\Email(message = "The email '{{ value }}' is not a valid email.", checkMX = true, checkHost = true)
*/
private $email;
/**
* #ORM\Column(name="is_active", type="boolean")
*/
private $isActive;
/**
* #ORM\ManyToMany(targetEntity="Role", inversedBy="users")
*
*/
private $roles;
private $salt;
public function __construct()
{
$this->isActive = true;
$this->roles = new ArrayCollection();
// may not be needed, see section on salt below
// $this->salt = md5(uniqid(null, true));
}
/**
* #inheritDoc
*/
public function getUsername()
{
return $this->username;
}
/**
* #inheritDoc
*/
public function getSalt()
{
// you *may* need a real salt depending on your encoder
// see section on salt below
return null;
}
/**
* #inheritDoc
*/
public function getPassword()
{
return $this->password;
}
/**
* #inheritDoc
*/
public function getRoles()
{
//return array('ROLE_USER');
return $this->roles->toArray();
}
/**
* #inheritDoc
*/
public function eraseCredentials()
{
}
/**
* #see \Serializable::serialize()
*/
public function serialize()
{
return serialize(array(
$this->id,
$this->username,
$this->password,
// see section on salt below
// $this->salt,
));
}
/**
* #see \Serializable::unserialize()
*/
public function unserialize($serialized)
{
list (
$this->id,
$this->username,
$this->password,
// see section on salt below
// $this->salt
) = unserialize($serialized);
}
/**
* Get id
*
* #return integer
*/
public function getId()
{
return $this->id;
}
/**
* Set username
*
* #param string $username
* #return User
*/
public function setUsername($username)
{
$this->username = $username;
return $this;
}
/**
* Set password
*
* #param string $password
* #return User
*/
public function setPassword($password)
{
$this->password = $password;
return $this;
}
/**
* Set salt
*
* #param string $salt
* #return User
*/
public function setSalt($salt)
{
$this->salt = $salt;
return $this;
}
/**
* Set email
*
* #param string $email
* #return User
*/
public function setEmail($email)
{
$this->email = $email;
return $this;
}
/**
* Get email
*
* #return string
*/
public function getEmail()
{
return $this->email;
}
/**
* Set isActive
*
* #param boolean $isActive
* #return User
*/
public function setIsActive($isActive)
{
$this->isActive = $isActive;
return $this;
}
/**
* Get isActive
*
* #return boolean
*/
public function getIsActive()
{
return $this->isActive;
}
/**
* Add roles
*
* #param \Bsi\BkpmBundle\Entity\Role $roles
* #return User
*/
public function addRole(\Bsi\BkpmBundle\Entity\Role $roles)
{
$this->roles[] = $roles;
return $this;
}
/**
* Remove roles
*
* #param \Bsi\BkpmBundle\Entity\Role $roles
*/
public function removeRole(\Bsi\BkpmBundle\Entity\Role $roles)
{
$this->roles->removeElement($roles);
}
public function isEnabled()
{
return $this->getIsActive();
}
public function isAccountNonExpired()
{
return true;
}
public function isAccountNonLocked()
{
return true;
}
public function isCredentialsNonExpired()
{
return true;
}
}

Answer 3

You can use the same procedure outlined here for handling expired passwords:
How to use the credentials expired property in Symfony AdvancedUserInterface?
Except you will be handling the Locked exception:
http://api.symfony.com/2.5/Symfony/Component/Security/Core/Exception/LockedException.html
Ignore this section. It doesn't apply when using the symfony security code
Just follow http://symfony.com/doc/current/cookbook/service_container/event_listener.html and handle the various security exceptions there:
LockedException
AccountExpiredException
CredentialsExpiredException
DisabledException
When using symfony's security code
You can't listen to kernel.exception events when dealing with form login. The security code handle all of the exceptions internally.
In order to handle security exceptions during login, you need to implement:
AuthenticationFailureHandlerInterface
AuthenticationSuccessHandlerInterface
I am implementing in my code now. There are several articles on the subject, but were difficult to find. I'll post them when I validate them.
The authentication success/failure handlers can't be used to redirect to a change password form since the user is all ready denied when they execute.
Although they turned out to be great places to dispatch events, like 'account_disabled', 'account_locked', 'account_expired', or 'credentials_expired'.
As long as the destination page allows anonymous users, you can redirect a user where ever you want. But if the destination page requires login, you will have a redirect loop.
A custom authentication listener will propably be needed for this. Another possibility would be to implement a doctrine onload listener and auth voter that sets a 'provisional user' flag when the account/credentials are expired and allows access to change user attributes.
I will eventually need to implement some similar solution, but I don't have time currently.
There are probably other ways.