Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

[Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED#31189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
fabpot merged 1 commit intosymfony:masterfromwouterj:security/is-impersonator
Feb 24, 2020

Conversation

wouterj
Copy link
Member

@wouterjwouterj commentedApr 20, 2019•
edited
Loading

QA
Branch?master
Bug fix?no
New feature?yes
BC breaks?no
Deprecations?yes
Tests pass?yes
Fixed tickets#29848
LicenseMIT
Doc PRsymfony/symfony-docs#11487

This continues work of@HeahDude and finally finishes one of the code PRs I've been working on during the ⭐️ EUFOSSA Hackathon.

Changes

The PRs modifies some of the attributes used by theAuthenticatedVoter:

  • NewIS_IMPERSONATOR,IS_ANONYMOUS andIS_REMEMBERED attributes are introduced to indicate the user either impersonated, anonymous or rembered.
  • IS_AUTHENTICATED_ANONYMOUSLY actually meant "is authenticated, either anonymous or fully". As this is confusing, it is replaced byIS_AUTHENTICATED.
  • Allis_*() functions in expressions are deprecated in favor ofis_granted('IS_*'). It's not worth duplicating theAuthenticatedVoter logic in two places now we have shorterIS_* attributes

Before

if ($authorizationChecker->isGranted('ROLE_PREVIOUS_ADMIN')) {// ...}
security:# ...access_control:    -{ path: ^/protected, roles: 'IS_AUTHENTICATED_ANONYMOUSLY' }

After

if ($authorizationChecker->isGranted('IS_IMPERSONATOR')) {// ...}
security:# ...access_control:    -{ path: ^/protected, roles: 'IS_AUTHENTICATED' }

Discussion

The only thing I'm wondering is how we combine this with theis_authenticated() expression function:

newExpressionFunction('is_authenticated',function () {
return'$token && !$trust_resolver->isAnonymous($token)';
},function (array$variables) {
return$variables['token'] && !$variables['trust_resolver']->isAnonymous($variables['token']);
}),

As you can see, theIS_AUTHENTICATED attribute andis_authenticated() expression function do not have the same meaning. Should we somehow deprecate the current behavior ofis_authenticated() or should we find another name forIS_AUTHENTICATED (that would be a shame imo).

Simperfit, ro0NL, vudaltsov, stephanvierkant, sstok, romaricdrigon, jvasseur, and dmaicher reacted with thumbs up emojiyceruto, vudaltsov, and sstok reacted with hooray emoji
@chalasr
Copy link
Member

Looks great, thanks.
About the expression function, we could add a$allowAnonymous (or better name) argument to it and deprecate not passing it asfalse explicitly (usingfunc_num_args() etc for detection), the argument would default totrue in 5.0 to match the newIS_AUTHENTICATED attr for access controls.

@chalasrchalasr added this to thenext milestoneApr 20, 2019
@wouterjwouterjforce-pushed thesecurity/is-impersonator branch from234dc0d to48d4813CompareApril 20, 2019 18:10
@wouterj
Copy link
MemberAuthor

Thanks for the suggestion@chalasr! I've updated the PR. Also realized that I forgot to do the same forIS_AUTHENTICATED_REMEMBERED, so added that as well.

@wouterjwouterjforce-pushed thesecurity/is-impersonator branch 2 times, most recently from19ed26f to7b9b167CompareApril 20, 2019 18:28
@wouterj
Copy link
MemberAuthor

Actually, I've decided to take another step and deprecate allis_*() functions except fromis_granted(). Nowis_granted() is introduced in Symfony 4.2 and the attribute names are shorter & easier, I think it is not worth duplicating all logic ofAuthenticatedVoter in the expression language provider.

@chalasr
Copy link
Member

chalasr commentedApr 20, 2019•
edited
Loading

AbstractController::isGranted() doesn't have such shortcuts, dropping them for expressions seems consistent. Works for me 👍

@wouterj
Copy link
MemberAuthor

Didn't realize 4.3 release was soo close. I've updated the PR to 4.4 and added a documentation PR. Ready for review when 4.3 is released

@nicolas-grekas
Copy link
Member

nicolas-grekas commentedSep 27, 2019•
edited
Loading

IS_AUTHENTICATED_ANONYMOUSLY actually meant "is authenticated, either anonymous or fully". As this is confusing, it is replaced by IS_AUTHENTICATED.

I'm not sure the new version is more clear: having role inheritance in mind, the current wording is clear to me. The new one might make me think one is authenticatednot-anonymously.

@wouterj
Copy link
MemberAuthor

wouterj commentedSep 27, 2019•
edited
Loading

Hmm, I completely forgot about this PR. Sorry! Let's see how we can continue and what we manage to get into 4.4/5.0 before the freeze:

The PRs modifies some of the attributes used by theAuthenticatedVoter:

  1. NewIS_IMPERSONATOR,IS_ANONYMOUS andIS_REMEMBERED attributes are introduced to indicate the user either impersonated, anonymous or rembered.
  2. IS_AUTHENTICATED_ANONYMOUSLY actually meant "is authenticated, either anonymous or fully". As this is confusing, it is replaced byIS_AUTHENTICATED.
  3. Allis_*() functions in expressions are deprecated in favor ofis_granted('IS_*'). It's not worth duplicating theAuthenticatedVoter logic in two places now we have shorterIS_* attributes

From what I see above, people seem to agree on (1) and (3). So let's remove change (2) from this PR, to allow this to be merged?

(2) seems up for debate and now I think about this, I think it's indeed a confusing change, people would maybe think thatIS_AUTHENTICATED isIS_AUTHENTICATED_FULLY.@HeahDude as you made this change in your first commit to the branch, can you maybe share your ideas?

@nicolas-grekasnicolas-grekas modified the milestones:next,4.4Oct 27, 2019
@nicolas-grekas
Copy link
Member

Moving to milestone "next", meaning for 5.1 or later.

@nicolas-grekasnicolas-grekas modified the milestones:4.4,nextNov 5, 2019
@fabpot
Copy link
Member

@wouterj I'd like that we move forward with all your PRs/issues/big plans related to security. Whenever you have time, ping me and we will see how to make it work for 5.1.

@wouterj
Copy link
MemberAuthor

Travis build seems failing with low deps

Yeah, the bundle requires^4.4|^5.0. As the functional tests usedis_anonymous(), there are 2 options: Change requirement to^5.1 (only to make the tests pass, the bundle still supports 4.4) or use the deprecated function in the functional tests. What do you want me to do?

@wouterjwouterjforce-pushed thesecurity/is-impersonator branch from28606e1 to4038d6cCompareFebruary 22, 2020 17:18
@chalasr
Copy link
Member

@wouterj Bumping to^5.1 looks good to me.

wouterj reacted with thumbs up emoji

@wouterjwouterjforce-pushed thesecurity/is-impersonator branch from4038d6c tofda7e0aCompareFebruary 22, 2020 18:30
@wouterj
Copy link
MemberAuthor

wouterj commentedFeb 22, 2020•
edited
Loading

Thanks for the quick response. I've bumped the requirement. The tests should now pass

@wouterj
Copy link
MemberAuthor

status: needs review

Copy link
Contributor

@HeahDudeHeahDude left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Looks good, thanks for finishing this

@wouterjwouterjforce-pushed thesecurity/is-impersonator branch fromfda7e0a to6c522a7CompareFebruary 23, 2020 16:37
@wouterjwouterj changed the title[Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED and deprecated is_*() expression functions[Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBEREDFeb 23, 2020
@fabpot
Copy link
Member

Thank you@wouterj.

@fabpotfabpot merged commit6178c63 intosymfony:masterFeb 24, 2020
@wouterjwouterj deleted the security/is-impersonator branchFebruary 24, 2020 16:10
fabpot added a commit that referenced this pull requestFeb 25, 2020
…guage functions (wouterj)This PR was merged into the 5.1-dev branch.Discussion----------[Security] Use new IS_* attributes in the expression language functions| Q             | A| ------------- | ---| Branch?       | master| Bug fix?      | no| New feature?  | no| Deprecations? | no| Tickets       | n/a| License       | MIT| Doc PR        | n/a#31189 has been merged which introduces some new attributes (`IS_ANONYMOUS` & friends). We can now modify the code behind the `is_*()` expression language functions to use these new attributes. This avoids any possibility of having them out of sync.In case you - just like me - are interested why `isGranted("IS_AUTHENTICATED_FULLY")` wasn't used before: These functions were implemented without `auth_checker` being available. The auth checker  variable was introduced in 4.2 by#27305, so now we can use this.Commits-------3f0c599 Use new IS_* attributes in the expression language functions
fabpot added a commit that referenced this pull requestFeb 25, 2020
This PR was merged into the 5.1-dev branch.Discussion----------[Security] Deprecated ROLE_PREVIOUS_ADMIN| Q             | A| ------------- | ---| Branch?       | master| Bug fix?      | no| New feature?  | no| Deprecations? | yes| Tickets       | n/a| License       | MIT| Doc PR        |symfony/symfony-docs#11487`ROLE_PREVIOUS_ADMIN` is added to the token roles if the session is an impersonation. Since#31189 we have the `IS_IMPERSONATOR` attribute which can be used for the same reason. I propose to deprecate the `ROLE_PREVIOUS_ADMIN`:* This is not what roles are for ([resulting in hacking this exception in `AbstractToken`](https://github.com/symfony/symfony/blob/5.0/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php#L275-L277))* The role isn't very descriptive* I don't like having 2 ways of doing exactly the same thing* While every application with impersonation enabled probably needs to be updated, the update is as simple as replacing `ROLE_PREVIOUS_ADMIN` with `IS_IMPERSONATOR`: `find ./ -type f -exec sed -i 's/ROLE_PREVIOUS_ADMIN/IS_IMPERSONATOR/g' {} +`---I'm a bit unsure on how to deprecate this role, but I think having it in `RoleVoter` is probably the safest (`isGranted()` and variants + `AccessDecisionManager#decide()` all use this voter to check if the token has this role).Commits-------dce55f3 Deprecated ROLE_PREVIOUS_ADMIN
symfony-splitter pushed a commit to symfony/security-core that referenced this pull requestFeb 25, 2020
This PR was merged into the 5.1-dev branch.Discussion----------[Security] Deprecated ROLE_PREVIOUS_ADMIN| Q             | A| ------------- | ---| Branch?       | master| Bug fix?      | no| New feature?  | no| Deprecations? | yes| Tickets       | n/a| License       | MIT| Doc PR        |symfony/symfony-docs#11487`ROLE_PREVIOUS_ADMIN` is added to the token roles if the session is an impersonation. Sincesymfony/symfony#31189 we have the `IS_IMPERSONATOR` attribute which can be used for the same reason. I propose to deprecate the `ROLE_PREVIOUS_ADMIN`:* This is not what roles are for ([resulting in hacking this exception in `AbstractToken`](https://github.com/symfony/symfony/blob/5.0/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php#L275-L277))* The role isn't very descriptive* I don't like having 2 ways of doing exactly the same thing* While every application with impersonation enabled probably needs to be updated, the update is as simple as replacing `ROLE_PREVIOUS_ADMIN` with `IS_IMPERSONATOR`: `find ./ -type f -exec sed -i 's/ROLE_PREVIOUS_ADMIN/IS_IMPERSONATOR/g' {} +`---I'm a bit unsure on how to deprecate this role, but I think having it in `RoleVoter` is probably the safest (`isGranted()` and variants + `AccessDecisionManager#decide()` all use this voter to check if the token has this role).Commits-------dce55f352a Deprecated ROLE_PREVIOUS_ADMIN
wouterj added a commit to symfony/symfony-docs that referenced this pull requestFeb 28, 2020
…S and IS_REMEMBERED attributes (wouterj)This PR was merged into the master branch.Discussion----------[Security] Documented new IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED attributesChanges the documentation to no longer use security attributes/functions that will be deprecated insymfony/symfony#31189 . It's funny to see how the docs were also confusing about the old attributes, as wrong attributes were used.While doing these changes, I've also rewritten some parts to no longer talk about attributes as something the users have (like roles), but instead as something the user is matched against.Commits-------0e2b406 Documented new security attributes
@nicolas-grekasnicolas-grekas modified the milestones:next,5.1May 4, 2020
@fabpotfabpot mentioned this pull requestMay 5, 2020
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@nicolas-grekasnicolas-grekasnicolas-grekas left review comments

@HeahDudeHeahDudeHeahDude left review comments

@linaorilinaorilinaori requested changes

@fabpotfabpotfabpot approved these changes

@chalasrchalasrchalasr approved these changes

@xabbuhxabbuhAwaiting requested review from xabbuh

Assignees
No one assigned
Projects
None yet
Milestone
5.1
Development

Successfully merging this pull request may close these issues.

7 participants
@wouterj@chalasr@nicolas-grekas@fabpot@linaori@HeahDude@carsonbot
[8]ページ先頭
©2009-2025 Movatter.jp