RAB-1149: Add manager_authentication support (#2)

* RAB-1149: Add support of new symfony authentication_manager

* RAB-1149: Fix depreciation

Co-authored-by: Grégoire Houssard <ghoussard@protonmail.com>

Author: StevenVAIDIE

DependencyInjection/FOSOAuthServerExtension.php

@@ -104,7 +104,7 @@ public function load(array $configs, ContainerBuilder $container)
     /**
      * {@inheritdoc}
      */
-    public function getAlias()
+    public function getAlias(): string
     {
         return 'fos_oauth_server';
     }

DependencyInjection/Security/Factory/OAuthFactory.php

@@ -13,6 +13,7 @@
 
 namespace FOS\OAuthServerBundle\DependencyInjection\Security\Factory;
 
+use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AuthenticatorFactoryInterface;
 use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface;
 use Symfony\Component\Config\Definition\Builder\NodeDefinition;
 use Symfony\Component\DependencyInjection\ChildDefinition;
@@ -24,8 +25,21 @@
  *
  * @author Arnaud Le Blanc <arnaud.lb@gmail.com>
  */
-class OAuthFactory implements SecurityFactoryInterface
+class OAuthFactory implements AuthenticatorFactoryInterface, SecurityFactoryInterface
 {
+    public function createAuthenticator(ContainerBuilder $container, string $id, array $config, string $userProviderId)
+    {
+        $providerId = 'fos_oauth_server.security.authentication.authenticator.'.$id;
+        $container
+            ->setDefinition($providerId, new ChildDefinition('fos_oauth_server.security.authentication.authenticator'))
+            ->replaceArgument(0, new Reference('fos_oauth_server.server'))
+            ->replaceArgument(1, new Reference('security.user_checker.'.$id))
+            ->replaceArgument(2, new Reference($userProviderId))
+        ;
+
+        return $providerId;
+    }
+
     /**
      * {@inheritdoc}
      */

Resources/config/security.xml

@@ -17,6 +17,12 @@
             <argument type="service" id="security.user_checker" />
         </service>
 
+        <service id="fos_oauth_server.security.authentication.authenticator" class="FOS\OAuthServerBundle\Security\Authentication\Authenticator\OAuthAuthenticator" public="false">
+            <argument type="service" id="fos_oauth_server.server" />
+            <argument type="service" id="security.user_checker" />
+            <argument /> <!-- user provider -->
+        </service>
+
         <service id="fos_oauth_server.security.authentication.listener" class="%fos_oauth_server.security.authentication.listener.class%" public="false">
             <argument type="service" id="security.token_storage"/>
             <argument type="service" id="security.authentication.manager" />

Security/Authentication/Authenticator/OAuthAuthenticator.php

@@ -0,0 +1,128 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the FOSOAuthServerBundle package.
+ *
+ * (c) FriendsOfSymfony <http://friendsofsymfony.github.com/>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace FOS\OAuthServerBundle\Security\Authentication\Authenticator;
+
+use FOS\OAuthServerBundle\Security\Authentication\Token\OAuthToken;
+use OAuth2\OAuth2;
+use OAuth2\OAuth2AuthenticateException;
+use OAuth2\OAuth2ServerException;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Security\Http\Authenticator\AuthenticatorInterface;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+use Symfony\Component\Security\Http\Authenticator\Passport\PassportInterface;
+use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
+
+class OAuthAuthenticator implements AuthenticatorInterface
+{
+    public function __construct(
+        private OAuth2 $oauthService,
+    ) {
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function authenticate(Request $request): Passport
+    {
+        $tokenString = $this->oauthService->getBearerToken($request, true);
+
+        try {
+            $accessToken = $this->oauthService->verifyAccessToken($tokenString);
+        } catch (OAuth2AuthenticateException $e) {
+            throw new AuthenticationException('OAuth2 authentication failed', 0, $e);
+        }
+
+        $scope = $accessToken->getScope();
+        $user = $accessToken->getUser();
+        $username = $user instanceof UserInterface ? $user->getUserIdentifier() : '';
+
+        $userBadge = new UserBadge($username);
+
+        return new SelfValidatingPassport($userBadge);
+    }
+
+    /**
+     * @TODO should be removed when Symfony > 6.0
+     * {@inheritdoc}
+     */
+    public function createAuthenticatedToken(PassportInterface $passport, string $firewallName): TokenInterface
+    {
+        if (!$passport instanceof Passport) {
+            throw new \RuntimeException(sprintf('Cannot create a OAuth2 authenticated token. $passport should be a %s', Passport::class));
+        }
+
+        $token = $this->createToken($passport, $firewallName);
+        $token->setAuthenticated(true);
+
+        return $token;
+    }
+
+    public function createToken(Passport $passport, string $firewallName): TokenInterface
+    {
+        $roles = $passport->getUser()->getRoles();
+
+        $token = new OAuthToken($roles);
+        $token->setUser($passport->getUser());
+
+        /** @TODO should be removed when Symfony > 6.0 */
+        if (method_exists(AuthenticatorInterface::class, 'createAuthenticatedToken') && !method_exists(AuthenticatorInterface::class, 'createToken')) {
+            $token->setAuthenticated(true, false);
+        }
+
+        return $token;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
+    {
+        return null;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
+    {
+        if ($exception instanceof OAuth2ServerException) {
+            return new Response($exception->getMessage(), (int) $exception->getHttpCode(), $exception->getResponseHeaders());
+        }
+
+        $responseException = new OAuth2AuthenticateException(
+            (string) Response::HTTP_UNAUTHORIZED,
+            OAuth2::TOKEN_TYPE_BEARER,
+            $this->oauthService->getVariable(OAuth2::CONFIG_WWW_REALM),
+            'access_denied',
+            $exception->getMessage()
+        );
+
+        return $responseException->getHttpResponse();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function supports(Request $request): ?bool
+    {
+        $tokenString = $this->oauthService->getBearerToken($request);
+
+        return is_string($tokenString) && !empty($tokenString);
+    }
+}

composer.json

@@ -20,7 +20,7 @@
         }
     ],
     "require": {
-        "php": "^7.2 || ^8.0",
+        "php": "^8.0",
         "friendsofsymfony/oauth2-php": "~1.1",
         "symfony/dependency-injection": "^4.4 || ^5.1",
         "symfony/framework-bundle": "^4.4 || ^5.1",