[cookbook] Error in "custom Authentication Provider" listener code (and proposed fix)

[romaricdrigon]

Hi,

I've just followed this cookbook entry.

However I'm encountering an issue when pretty much exactly following it: an AuthenticationCredentialsNotFoundException is raised.

In my understanding the issue is that we should be doing something, returning prematurely in the listener is relevant only if another firewall is enabled, otherwise we end up having a 500 error.

This is not the case of the tutorial (the firewall is set for a very precise URL pattern): I guess we should be returning a 403 error, isn't it? And eventually adding a note to explain it.

I'm ok about submitting a PR if we agree upon the fix.

[cordoval]

maybe we can ask @matthiasnoback about this since he wrote the security documentation

[wouterj]

I think you are checking for isGranted when not in a page under the firewall, am I correct? Then, it indeed do not work and it's also wanted to fail in that case.

The listener is only executed when in the firewall, so that can't cause the error afaics.

[romaricdrigon]

In my case, I was sticking to using it as authentication provider for a firewall. So yes the page where the errors happened was actually covered by a firewall. Only thing for this firewall anonymous users were disabled.

I guess you'll need more details. Now my code diverged a little bit, if that is needed tomorrow I'll try to post some code snippets.

[wouterj]

Yeah, that will be more than helpfull (you can also push it to github or email me a zip if that's easier for you)

[romaricdrigon]

Hi,

Sorry I took some time, as I could not post my original code, I've made a fresh Symfony-StandardEdition test case:
https://github.com/romaricdrigon/AuthFailExample

Just clone the repo, composer install, and go to /demo/hello/wouter: you have a AuthenticationCredentialsNotFoundException exception (alternatively you could launch PhpUnit tests)

[romaricdrigon]

So now I'm pretty sure we should add a not to the cookbook entry, something like this:

Returning prematurely from the listener is relevant only if you want to chain authentication 
providers (for example to allow anonymous users). If you want to forbid access to 
anonymous users and have a nice 403 error, you should set it before returning.