Commitce1ee74

authored and

committed

[Security] Do not overwrite already stored tokens for REMOTE_USER authentication

1 parent07a891f commitce1ee74Copy full SHA for ce1ee74

File tree

+23

-0

lines changed

+23

-0

lines changed

Lines changed: 11 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -79,6 +79,17 @@ public function supports(Request $request): ?bool`
`79`	`79`	`returnfalse;`
`80`	`80`	`}`
`81`	`81`
	`82`	`+// do not overwrite already stored tokens from the same user (i.e. from the session)`
	`83`	`+$token =$this->tokenStorage->getToken();`
	`84`	`+`
	`85`	`+if ($tokeninstanceof PreAuthenticatedToken &&$this->firewallName ===$token->getFirewallName() &&$token->getUserIdentifier() ===$username) {`
	`86`	`+if (null !==$this->logger) {`
	`87`	`+$this->logger->debug('Skipping pre-authenticated authenticator as the user already has an existing session.', ['authenticator' =>static::class]);`
	`88`	`+ }`
	`89`	`+`
	`90`	`+returnfalse;`
	`91`	`+ }`
	`92`	`+`
`82`	`93`	`$request->attributes->set('_pre_authenticated_username',$username);`
`83`	`94`
`84`	`95`	`returntrue;`

Lines changed: 12 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,7 @@`
`13`	`13`
`14`	`14`	`usePHPUnit\Framework\TestCase;`
`15`	`15`	`useSymfony\Component\HttpFoundation\Request;`
	`16`	`+useSymfony\Component\Security\Core\Authentication\Token\PreAuthenticatedToken;`
`16`	`17`	`useSymfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;`
`17`	`18`	`useSymfony\Component\Security\Core\User\InMemoryUser;`
`18`	`19`	`useSymfony\Component\Security\Core\User\InMemoryUserProvider;`
`@@ -37,6 +38,17 @@ public function testSupportNoUser()`
`37`	`38`	`$this->assertFalse($authenticator->supports($this->createRequest([])));`
`38`	`39`	`}`
`39`	`40`
	`41`	`+publicfunctiontestSupportTokenStorageWithToken()`
	`42`	`+ {`
	`43`	`+$tokenStorage =newTokenStorage();`
	`44`	`+$tokenStorage->setToken(newPreAuthenticatedToken('username','credentials','main'));`
	`45`	`+`
	`46`	`+$authenticator =newRemoteUserAuthenticator(newInMemoryUserProvider(),$tokenStorage,'main');`
	`47`	`+`
	`48`	`+$this->assertFalse($authenticator->supports($this->createRequest(['REMOTE_USER' =>'username'])));`
	`49`	`+$this->assertTrue($authenticator->supports($this->createRequest(['REMOTE_USER' =>'another_username'])));`
	`50`	`+ }`
	`51`	`+`
`40`	`52`	`/**`
`41`	`53`	`* @dataProvider provideAuthenticators`
`42`	`54`	`*/`

Comments

(0)