diff --git a/docs/reference/two_step_validation.rst b/docs/reference/two_step_validation.rst index 280c2268c..81cd0c520 100644 --- a/docs/reference/two_step_validation.rst +++ b/docs/reference/two_step_validation.rst @@ -35,12 +35,12 @@ Edit the configuration file: google_authenticator: enabled: true server: yourserver.com - ip_white_list: + trusted_ip_list: - 127.0.0.1 forced_for_role: - ROLE_ADMIN -Also, if you want to use ``ip_white_list`` and ``forced_for_role`` +Also, if you want to use ``trusted_ip_list`` and ``forced_for_role`` configuration nodes for automatically setting the secret to user (secret - a connection between user and device that will scans QR-code) and showing QR-code in login form, you need to set the success handler diff --git a/src/DependencyInjection/Configuration.php b/src/DependencyInjection/Configuration.php index 60f2ab848..1d236bde8 100644 --- a/src/DependencyInjection/Configuration.php +++ b/src/DependencyInjection/Configuration.php @@ -69,6 +69,11 @@ public function getConfigTreeBuilder() ->scalarNode('server')->cannotBeEmpty()->end() ->scalarNode('enabled')->defaultFalse()->end() ->arrayNode('ip_white_list') + ->prototype('scalar')->end() + ->info('IPs for which 2FA will be skipped.') + ->setDeprecated('The "%node%" option is deprecated. Use "trusted_ip_list" instead with the same values.') + ->end() + ->arrayNode('trusted_ip_list') ->prototype('scalar')->end() ->defaultValue(['127.0.0.1']) ->info('IPs for which 2FA will be skipped.') diff --git a/src/DependencyInjection/SonataUserExtension.php b/src/DependencyInjection/SonataUserExtension.php index 7f682ecb6..b73c3e63c 100644 --- a/src/DependencyInjection/SonataUserExtension.php +++ b/src/DependencyInjection/SonataUserExtension.php @@ -174,11 +174,22 @@ public function configureGoogleAuthenticator($config, ContainerBuilder $containe if (!class_exists('Google\Authenticator\GoogleAuthenticator') && !class_exists('Sonata\GoogleAuthenticator\GoogleAuthenticator')) { - throw new \RuntimeException('Please add ``sonata-project/google-authenticator`` package'); + throw new \RuntimeException('Please add "sonata-project/google-authenticator" package'); } $container->setParameter('sonata.user.google.authenticator.forced_for_role', $config['google_authenticator']['forced_for_role']); - $container->setParameter('sonata.user.google.authenticator.ip_white_list', $config['google_authenticator']['ip_white_list']); + + // NEXT_MAJOR: Remove this checks and only set the `trusted_ip_list`. + if (\count($config['google_authenticator']['ip_white_list']) > 0 && $config['google_authenticator']['trusted_ip_list'] !== ['127.0.0.1']) { + throw new \LogicException('Please use only "trusted_ip_list" parameter, "ip_white_list" is deprecated.'); + } + $trustedIpList = $config['google_authenticator']['trusted_ip_list']; + if (\count($config['google_authenticator']['ip_white_list']) > 0) { + $trustedIpList = $config['google_authenticator']['ip_white_list']; + } + // NEXT_MAJOR: Remove `sonata.user.google.authenticator.ip_white_list` parameter. + $container->setParameter('sonata.user.google.authenticator.ip_white_list', $trustedIpList); + $container->setParameter('sonata.user.google.authenticator.trusted_ip_list', $trustedIpList); $container->getDefinition('sonata.user.google.authenticator.provider') ->replaceArgument(0, $config['google_authenticator']['server']); diff --git a/src/GoogleAuthenticator/Helper.php b/src/GoogleAuthenticator/Helper.php index 918baaec5..1b5dea49f 100644 --- a/src/GoogleAuthenticator/Helper.php +++ b/src/GoogleAuthenticator/Helper.php @@ -39,7 +39,7 @@ class Helper /** * @var string[] */ - private $ipWhiteList; + private $trustedIpList; /** * @var AuthorizationCheckerInterface @@ -47,20 +47,20 @@ class Helper private $authorizationChecker; /** - * @param string[] $ipWhiteList IPs that will bypass 2FA authorization + * @param string[] $trustedIpList IPs that will bypass 2FA authorization */ public function __construct( $server, BaseGoogleAuthenticator $authenticator, AuthorizationCheckerInterface $authorizationChecker, array $forcedForRoles = [], - array $ipWhiteList = [] + array $trustedIpList = [] ) { $this->server = $server; $this->authenticator = $authenticator; $this->authorizationChecker = $authorizationChecker; $this->forcedForRoles = $forcedForRoles; - $this->ipWhiteList = $ipWhiteList; + $this->trustedIpList = $trustedIpList; } /** @@ -99,7 +99,7 @@ public function getSessionKey(UsernamePasswordToken $token) public function needToHaveGoogle2FACode(Request $request): bool { - if (\in_array($request->getClientIp(), $this->ipWhiteList, true)) { + if (\in_array($request->getClientIp(), $this->trustedIpList, true)) { return false; } diff --git a/src/Resources/config/google_authenticator.xml b/src/Resources/config/google_authenticator.xml index c68a9a594..485ffa451 100644 --- a/src/Resources/config/google_authenticator.xml +++ b/src/Resources/config/google_authenticator.xml @@ -9,7 +9,7 @@ %sonata.user.google.authenticator.forced_for_role% - %sonata.user.google.authenticator.ip_white_list% + %sonata.user.google.authenticator.trusted_ip_list% diff --git a/tests/DependencyInjection/ConfigurationTest.php b/tests/DependencyInjection/ConfigurationTest.php index fde0397ec..54a005b8f 100644 --- a/tests/DependencyInjection/ConfigurationTest.php +++ b/tests/DependencyInjection/ConfigurationTest.php @@ -42,7 +42,8 @@ public function testDefault(): void ], 'google_authenticator' => [ 'enabled' => false, - 'ip_white_list' => ['127.0.0.1'], + 'ip_white_list' => [], + 'trusted_ip_list' => ['127.0.0.1'], 'forced_for_role' => ['ROLE_ADMIN'], ], 'manager_type' => 'orm', diff --git a/tests/DependencyInjection/SonataUserExtensionTest.php b/tests/DependencyInjection/SonataUserExtensionTest.php index ea9472c83..1b1d5b595 100644 --- a/tests/DependencyInjection/SonataUserExtensionTest.php +++ b/tests/DependencyInjection/SonataUserExtensionTest.php @@ -256,7 +256,7 @@ public function testConfigureGoogleAuthenticatorEnabled(): void { $this->expectDeprecation('The \'Google\Authenticator\' namespace is deprecated in sonata-project/GoogleAuthenticator since version 2.1 and will be removed in 3.0.'); - $this->load(['google_authenticator' => ['enabled' => true, 'forced_for_role' => ['ROLE_USER'], 'ip_white_list' => ['0.0.0.1'], + $this->load(['google_authenticator' => ['enabled' => true, 'forced_for_role' => ['ROLE_USER'], 'trusted_ip_list' => ['0.0.0.1'], 'server' => 'bar', ]]); $this->assertContainerBuilderHasParameter('sonata.user.google.authenticator.enabled', true); @@ -265,7 +265,7 @@ public function testConfigureGoogleAuthenticatorEnabled(): void $this->assertContainerBuilderHasService('sonata.user.google.authenticator.interactive_login_listener'); $this->assertContainerBuilderHasService('sonata.user.google.authenticator.request_listener'); $this->assertContainerBuilderHasParameter('sonata.user.google.authenticator.forced_for_role', ['ROLE_ADMIN', 'ROLE_USER']); - $this->assertContainerBuilderHasParameter('sonata.user.google.authenticator.ip_white_list', ['127.0.0.1', '0.0.0.1']); + $this->assertContainerBuilderHasParameter('sonata.user.google.authenticator.trusted_ip_list', ['127.0.0.1', '0.0.0.1']); $this->assertContainerBuilderHasServiceDefinitionWithArgument('sonata.user.google.authenticator.provider', 0, 'bar'); } diff --git a/tests/EventListener/TwoFactorLoginSuccessHandlerTest.php b/tests/EventListener/TwoFactorLoginSuccessHandlerTest.php index d65c351b0..5efe3d094 100644 --- a/tests/EventListener/TwoFactorLoginSuccessHandlerTest.php +++ b/tests/EventListener/TwoFactorLoginSuccessHandlerTest.php @@ -105,8 +105,8 @@ private function createTestClass(?string $secret, string $userRole, ?string $rem $routerMock = $this->createMock(UrlGeneratorInterface::class); $routerMock->method('generate')->willReturn('/admin/dashboard'); $forcedRoles = ['ROLE_ADMIN']; - $ipWhiteList = ['127.0.0.1']; - $helper = new Helper('site.tld', new GoogleAuthenticator(), $authChecker, $forcedRoles, $ipWhiteList); + $trustedIpList = ['127.0.0.1']; + $helper = new Helper('site.tld', new GoogleAuthenticator(), $authChecker, $forcedRoles, $trustedIpList); $this->testClass = new TwoFactorLoginSuccessHandler( $templateEngineMock, $helper,