Skip to content

Commit ed2ce98

Browse files
schebscheb
committed
Inject listener into the firewall context to handle access control "2fa in progress" phase
1 parent c637dfe commit ed2ce98

File tree

9 files changed

+500
-1
lines changed

9 files changed

+500
-1
lines changed

‎src/bundle/DependencyInjection/Compiler/AccessListenerCompilerPass.php

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace Scheb\TwoFactorBundle\DependencyInjection\Compiler;
6+
7+
use Symfony\Component\DependencyInjection\Argument\IteratorArgument;
8+
use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
9+
use Symfony\Component\DependencyInjection\ContainerBuilder;
10+
use Symfony\Component\DependencyInjection\Exception\InvalidArgumentException;
11+
use Symfony\Component\DependencyInjection\Reference;
12+
13+
/**
14+
* Injects a listener into the firewall to handle access control during the "2fa in progress" phase.
15+
*/
16+
class AccessListenerCompilerPass implements CompilerPassInterface
17+
{
18+
public function process(ContainerBuilder $container): void
19+
{
20+
$taggedServices = $container->findTaggedServiceIds('scheb_two_factor.access_listener');
21+
foreach ($taggedServices as $id => $attributes) {
22+
if (!isset($attributes[0]['firewall'])) {
23+
throw new InvalidArgumentException('Tag "scheb_two_factor.access_listener" requires attribute "firewall" to be set.');
24+
}
25+
26+
$firewallContextId = 'security.firewall.map.context.'.$attributes[0]['firewall'];
27+
$firewallContextDefinition = $container->getDefinition($firewallContextId);
28+
$listenersIterator = $firewallContextDefinition->getArgument(0);
29+
if (!($listenersIterator instanceof IteratorArgument)) {
30+
throw new InvalidArgumentException(sprintf('Cannot inject access listener, argument 0 of "%s" must be instance of IteratorArgument.', $firewallContextId));
31+
}
32+
33+
$listeners = $listenersIterator->getValues();
34+
$listeners[] = new Reference($id);
35+
$listenersIterator->setValues($listeners);
36+
}
37+
}
38+
}

‎src/bundle/DependencyInjection/Factory/Security/TwoFactorFactory.php

+14
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ class TwoFactorFactory implements SecurityFactoryInterface
3737
public const PROVIDER_PREPARATION_LISTENER_ID_PREFIX = 'security.authentication.provider_preparation_listener.two_factor.';
3838
public const AUTHENTICATION_SUCCESS_EVENT_SUPPRESSOR_ID_PREFIX = 'security.authentication.authentication_success_event_suppressor.two_factor.';
3939
public const KERNEL_EXCEPTION_LISTENER_ID_PREFIX = 'security.authentication.kernel_exception_listener.two_factor.';
40+
public const KERNEL_ACCESS_LISTENER_ID_PREFIX = 'security.authentication.access_listener.two_factor.';
4041

4142
public const PROVIDER_DEFINITION_ID = 'scheb_two_factor.security.authentication.provider';
4243
public const LISTENER_DEFINITION_ID = 'scheb_two_factor.security.authentication.listener';
@@ -47,6 +48,7 @@ class TwoFactorFactory implements SecurityFactoryInterface
4748
public const PROVIDER_PREPARATION_LISTENER_DEFINITION_ID = 'scheb_two_factor.security.provider_preparation_listener';
4849
public const AUTHENTICATION_SUCCESS_EVENT_SUPPRESSOR_DEFINITION_ID = 'scheb_two_factor.security.authentication_success_event_suppressor';
4950
public const KERNEL_EXCEPTION_LISTENER_DEFINITION_ID = 'scheb_two_factor.security.kernel_exception_listener';
51+
public const KERNEL_ACCESS_LISTENER_DEFINITION_ID = 'scheb_two_factor.security.access_listener';
5052

5153
public function addConfiguration(NodeDefinition $node): void
5254
{
@@ -94,6 +96,7 @@ public function create(ContainerBuilder $container, $id, $config, $userProvider,
9496
$authRequiredHandlerId = $this->createAuthenticationRequiredHandler($container, $id, $config, $twoFactorFirewallConfigId);
9597
$providerId = $this->createAuthenticationProvider($container, $id, $twoFactorFirewallConfigId);
9698
$this->createKernelExceptionListener($container, $id, $authRequiredHandlerId);
99+
$this->createAccessListener($container, $id, $twoFactorFirewallConfigId);
97100
$this->createProviderPreparationListener($container, $id, $config);
98101
$this->createAuthenticationSuccessEventSuppressor($container, $id);
99102

@@ -234,6 +237,17 @@ private function createKernelExceptionListener(ContainerBuilder $container, stri
234237
->addTag('kernel.event_subscriber');
235238
}
236239

240+
private function createAccessListener(ContainerBuilder $container, string $firewallName, string $twoFactorFirewallConfigId): void
241+
{
242+
$firewallConfigId = self::KERNEL_ACCESS_LISTENER_ID_PREFIX.$firewallName;
243+
$container
244+
->setDefinition($firewallConfigId, new ChildDefinition(self::KERNEL_ACCESS_LISTENER_DEFINITION_ID))
245+
->replaceArgument(0, new Reference($twoFactorFirewallConfigId))
246+
// The SecurityFactory doesn't have access to the service definitions from the security bundle. Therefore we
247+
// tag the definition so we can find it in a compiler pass inject it into the firewall context.
248+
->addTag('scheb_two_factor.access_listener', ['firewall' => $firewallName]);
249+
}
250+
237251
public function getPosition(): string
238252
{
239253
return 'form';

‎src/bundle/Resources/config/security.xml

+7
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,13 @@
7676
<!-- <tag name="kernel.event_subscriber" /> -->
7777
</service>
7878

79+
<service id="scheb_two_factor.security.access_listener" class="Scheb\TwoFactorBundle\Security\Http\Firewall\TwoFactorAccessListener" abstract="true">
80+
<argument /> <!-- Two-factor firewall config -->
81+
<argument type="service" id="security.token_storage"/>
82+
<argument type="service" id="scheb_two_factor.security.access.access_decider"/>
83+
<argument type="service" id="event_dispatcher" />
84+
</service>
85+
7986
<service id="scheb_two_factor.security.authentication.success_handler" class="Scheb\TwoFactorBundle\Security\Http\Authentication\DefaultAuthenticationSuccessHandler" abstract="true">
8087
<argument type="service" id="security.http_utils" />
8188
<argument type="string" /> <!-- Firewall name -->

‎src/bundle/SchebTwoFactorBundle.php

+2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
namespace Scheb\TwoFactorBundle;
66

7+
use Scheb\TwoFactorBundle\DependencyInjection\Compiler\AccessListenerCompilerPass;
78
use Scheb\TwoFactorBundle\DependencyInjection\Compiler\AuthenticationProviderDecoratorCompilerPass;
89
use Scheb\TwoFactorBundle\DependencyInjection\Compiler\MailerCompilerPass;
910
use Scheb\TwoFactorBundle\DependencyInjection\Compiler\RememberMeServicesDecoratorCompilerPass;
@@ -22,6 +23,7 @@ public function build(ContainerBuilder $container): void
2223

2324
$container->addCompilerPass(new AuthenticationProviderDecoratorCompilerPass());
2425
$container->addCompilerPass(new RememberMeServicesDecoratorCompilerPass());
26+
$container->addCompilerPass(new AccessListenerCompilerPass());
2527
$container->addCompilerPass(new TwoFactorProviderCompilerPass());
2628
$container->addCompilerPass(new TwoFactorFirewallConfigCompilerPass());
2729
$container->addCompilerPass(new MailerCompilerPass());

‎src/bundle/Security/Http/Firewall/TwoFactorAccessListener.php

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace Scheb\TwoFactorBundle\Security\Http\Firewall;
6+
7+
use Scheb\TwoFactorBundle\Security\Authentication\Token\TwoFactorTokenInterface;
8+
use Scheb\TwoFactorBundle\Security\Authorization\TwoFactorAccessDecider;
9+
use Scheb\TwoFactorBundle\Security\TwoFactor\Event\TwoFactorAuthenticationEvent;
10+
use Scheb\TwoFactorBundle\Security\TwoFactor\Event\TwoFactorAuthenticationEvents;
11+
use Scheb\TwoFactorBundle\Security\TwoFactor\TwoFactorFirewallConfig;
12+
use Symfony\Component\HttpFoundation\Request;
13+
use Symfony\Component\HttpKernel\Event\RequestEvent;
14+
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
15+
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
16+
use Symfony\Component\Security\Http\Firewall\AbstractListener;
17+
use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
18+
19+
/**
20+
* Handles access control in the "2fa in progress" phase.
21+
*/
22+
class TwoFactorAccessListener extends AbstractListener
23+
{
24+
/**
25+
* @var TwoFactorFirewallConfig
26+
*/
27+
private $twoFactorFirewallConfig;
28+
29+
/**
30+
* @var TokenStorageInterface
31+
*/
32+
private $tokenStorage;
33+
34+
/**
35+
* @var TwoFactorAccessDecider
36+
*/
37+
private $twoFactorAccessDecider;
38+
39+
/**
40+
* @var EventDispatcherInterface
41+
*/
42+
private $eventDispatcher;
43+
44+
public function __construct(
45+
TwoFactorFirewallConfig $twoFactorFirewallConfig,
46+
TokenStorageInterface $tokenStorage,
47+
TwoFactorAccessDecider $twoFactorAccessDecider,
48+
EventDispatcherInterface $eventDispatcher
49+
) {
50+
$this->twoFactorFirewallConfig = $twoFactorFirewallConfig;
51+
$this->tokenStorage = $tokenStorage;
52+
$this->twoFactorAccessDecider = $twoFactorAccessDecider;
53+
$this->eventDispatcher = $eventDispatcher;
54+
}
55+
56+
public function supports(Request $request): ?bool
57+
{
58+
$token = $this->tokenStorage->getToken();
59+
60+
// No need to check for firewall name here, the listener is bound to the firewall context
61+
return $token instanceof TwoFactorTokenInterface;
62+
}
63+
64+
public function authenticate(RequestEvent $requestEvent): void
65+
{
66+
/** @var TwoFactorTokenInterface $token */
67+
$token = $this->tokenStorage->getToken();
68+
$request = $requestEvent->getRequest();
69+
if ($this->twoFactorFirewallConfig->isCheckPathRequest($request)) {
70+
return;
71+
}
72+
73+
if ($this->twoFactorFirewallConfig->isAuthFormRequest($request)) {
74+
$event = new TwoFactorAuthenticationEvent($request, $token);
75+
$this->eventDispatcher->dispatch($event, TwoFactorAuthenticationEvents::FORM);
76+
77+
return;
78+
}
79+
80+
if (!$this->twoFactorAccessDecider->isAccessible($request, $token)) {
81+
$exception = new AccessDeniedException('User is in a two-factor authentication process.');
82+
$exception->setSubject($request);
83+
84+
throw $exception;
85+
}
86+
}
87+
}

‎tests/DependencyInjection/Compiler/AccessListenerCompilerPassTest.php

+124
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace Scheb\TwoFactorBundle\Tests\DependencyInjection\Compiler;
6+
7+
use Scheb\TwoFactorBundle\DependencyInjection\Compiler\AccessListenerCompilerPass;
8+
use Scheb\TwoFactorBundle\Tests\TestCase;
9+
use Symfony\Bundle\SecurityBundle\Security\FirewallContext;
10+
use Symfony\Component\DependencyInjection\Argument\IteratorArgument;
11+
use Symfony\Component\DependencyInjection\ContainerBuilder;
12+
use Symfony\Component\DependencyInjection\Definition;
13+
use Symfony\Component\DependencyInjection\Exception\InvalidArgumentException;
14+
use Symfony\Component\DependencyInjection\Reference;
15+
16+
class AccessListenerCompilerPassTest extends TestCase
17+
{
18+
/**
19+
* @var AccessListenerCompilerPass
20+
*/
21+
private $compilerPass;
22+
23+
/**
24+
* @var ContainerBuilder
25+
*/
26+
private $container;
27+
28+
/**
29+
* @var Definition
30+
*/
31+
private $firewallContextDefinition;
32+
33+
protected function setUp(): void
34+
{
35+
$this->container = new ContainerBuilder();
36+
$this->compilerPass = new AccessListenerCompilerPass();
37+
38+
$this->firewallContextDefinition = new Definition(FirewallContext::class);
39+
$this->container->setDefinition('security.firewall.map.context.firewallName', $this->firewallContextDefinition);
40+
}
41+
42+
private function stubTaggedContainerService(array $taggedServices): void
43+
{
44+
foreach ($taggedServices as $id => $tags) {
45+
$definition = $this->container->register($id);
46+
47+
foreach ($tags as $attributes) {
48+
$definition->addTag('scheb_two_factor.access_listener', $attributes);
49+
}
50+
}
51+
}
52+
53+
private function stubFirewallContextListeners($listenersArg): void
54+
{
55+
$this->firewallContextDefinition->setArgument(0, $listenersArg);
56+
}
57+
58+
private function assertFirewallContextListeners(IteratorArgument $expected): void
59+
{
60+
$listenersArgument = $this->firewallContextDefinition->getArgument(0);
61+
$this->assertEquals($expected, $listenersArgument);
62+
}
63+
64+
/**
65+
* @test
66+
*/
67+
public function process_missingAlias_throwException(): void
68+
{
69+
$taggedServices = [
70+
'serviceId' => [
71+
0 => [],
72+
],
73+
];
74+
$this->stubTaggedContainerService($taggedServices);
75+
76+
$this->expectException(InvalidArgumentException::class);
77+
$this->expectExceptionMessage('Tag "scheb_two_factor.access_listener" requires attribute "firewall" to be set');
78+
$this->compilerPass->process($this->container);
79+
}
80+
81+
/**
82+
* @test
83+
*/
84+
public function process_invalidListenersArgument_throwException(): void
85+
{
86+
$taggedServices = [
87+
'serviceId' => [
88+
0 => ['firewall' => 'firewallName'],
89+
],
90+
];
91+
$this->stubTaggedContainerService($taggedServices);
92+
$this->stubFirewallContextListeners([]);
93+
94+
$this->expectException(InvalidArgumentException::class);
95+
$this->expectExceptionMessage('Cannot inject access listener');
96+
$this->compilerPass->process($this->container);
97+
}
98+
99+
/**
100+
* @test
101+
*/
102+
public function process_requirementsFulfilled_addAccessListener(): void
103+
{
104+
$taggedServices = [
105+
'serviceId' => [
106+
0 => ['firewall' => 'firewallName'],
107+
],
108+
];
109+
110+
$this->stubTaggedContainerService($taggedServices);
111+
$this->stubFirewallContextListeners(new IteratorArgument([
112+
new Reference('firewallListener1'),
113+
new Reference('firewallListener2'),
114+
]));
115+
116+
$this->compilerPass->process($this->container);
117+
118+
$this->assertFirewallContextListeners(new IteratorArgument([
119+
new Reference('firewallListener1'),
120+
new Reference('firewallListener2'),
121+
new Reference('serviceId'),
122+
]));
123+
}
124+
}

‎tests/DependencyInjection/Factory/Security/TwoFactorFactoryTest.php

+15
Original file line numberDiff line numberDiff line change
@@ -351,6 +351,21 @@ public function create_createForFirewall_createExceptionListener(): void
351351
$this->assertEquals('firewallName', $definition->getArgument(0));
352352
$this->assertEquals(new Reference('security.authentication.authentication_required_handler.two_factor.firewallName'), $definition->getArgument(2));
353353
}
354+
355+
/**
356+
* @test
357+
*/
358+
public function create_createForFirewall_createAccessListener(): void
359+
{
360+
$this->callCreateFirewall();
361+
362+
$this->assertTrue($this->container->hasDefinition('security.authentication.access_listener.two_factor.firewallName'));
363+
$definition = $this->container->getDefinition('security.authentication.access_listener.two_factor.firewallName');
364+
$this->assertEquals(new Reference('security.firewall_config.two_factor.firewallName'), $definition->getArgument(0));
365+
$this->assertTrue($definition->hasTag('scheb_two_factor.access_listener'));
366+
$tag = $definition->getTag('scheb_two_factor.access_listener');
367+
$this->assertEquals(['firewall' => 'firewallName'], $tag[0]);
368+
}
354369
}
355370

356371
// Helper class to process config

‎tests/SchebTwoFactorBundleTest.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
namespace Scheb\TwoFactorBundle\Tests;
66

7+
use Scheb\TwoFactorBundle\DependencyInjection\Compiler\AccessListenerCompilerPass;
78
use Scheb\TwoFactorBundle\DependencyInjection\Compiler\AuthenticationProviderDecoratorCompilerPass;
89
use Scheb\TwoFactorBundle\DependencyInjection\Compiler\MailerCompilerPass;
910
use Scheb\TwoFactorBundle\DependencyInjection\Compiler\RememberMeServicesDecoratorCompilerPass;
@@ -25,11 +26,12 @@ public function build_initializeBundle_addCompilerPass(): void
2526

2627
//Expect compiler pass to be added
2728
$containerBuilder
28-
->expects($this->exactly(5))
29+
->expects($this->exactly(6))
2930
->method('addCompilerPass')
3031
->with($this->logicalOr(
3132
$this->isInstanceOf(AuthenticationProviderDecoratorCompilerPass::class),
3233
$this->isInstanceOf(RememberMeServicesDecoratorCompilerPass::class),
34+
$this->isInstanceOf(AccessListenerCompilerPass::class),
3335
$this->isInstanceOf(TwoFactorProviderCompilerPass::class),
3436
$this->isInstanceOf(TwoFactorFirewallConfigCompilerPass::class),
3537
$this->isInstanceOf(MailerCompilerPass::class)

0 commit comments

Comments
 (0)