vendor/symfony/security-bundle/DependencyInjection/MainConfiguration.php line 73

Open in your IDE?
  1. <?php
  3. /*
  4.  * This file is part of the Symfony package.
  5.  *
  6.  * (c) Fabien Potencier <[email protected]>
  7.  *
  8.  * For the full copyright and license information, please view the LICENSE
  9.  * file that was distributed with this source code.
  10.  */
  12. namespace Symfony\Bundle\SecurityBundle\DependencyInjection;
  14. use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AbstractFactory;
  15. use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AuthenticatorFactoryInterface;
  16. use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface;
  17. use Symfony\Component\Config\Definition\Builder\ArrayNodeDefinition;
  18. use Symfony\Component\Config\Definition\Builder\TreeBuilder;
  19. use Symfony\Component\Config\Definition\ConfigurationInterface;
  20. use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
  21. use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
  22. use Symfony\Component\Security\Http\Event\LogoutEvent;
  23. use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategy;
  25. /**
  26.  * SecurityExtension configuration structure.
  27.  *
  28.  * @author Johannes M. Schmitt <[email protected]>
  29.  */
  30. class MainConfiguration implements ConfigurationInterface
  31. {
  32.     /** @internal */
  33.     public const STRATEGY_AFFIRMATIVE = 'affirmative';
  34.     /** @internal */
  35.     public const STRATEGY_CONSENSUS = 'consensus';
  36.     /** @internal */
  37.     public const STRATEGY_UNANIMOUS = 'unanimous';
  38.     /** @internal */
  39.     public const STRATEGY_PRIORITY = 'priority';
  41.     private $factories;
  42.     private $userProviderFactories;
  44.     /**
  45.      * @param array<array-key, SecurityFactoryInterface|AuthenticatorFactoryInterface> $factories
  46.      */
  47.     public function __construct(array $factories, array $userProviderFactories)
  48.     {
  49.         if (\is_array(current($factories))) {
  50.             trigger_deprecation('symfony/security-bundle', '5.4', 'Passing an array of arrays as 1st argument to "%s" is deprecated, pass a sorted array of factories instead.', __METHOD__);
  52.             $factories = array_merge(...array_values($factories));
  53.         }
  55.         $this->factories = $factories;
  56.         $this->userProviderFactories = $userProviderFactories;
  57.     }
  59.     /**
  60.      * Generates the configuration tree builder.
  61.      *
  62.      * @return TreeBuilder
  63.      */
  64.     public function getConfigTreeBuilder()
  65.     {
  66.         $tb = new TreeBuilder('security');
  67.         $rootNode = $tb->getRootNode();
  69.         $rootNode
  70.             ->beforeNormalization()
  71.                 ->ifTrue(function ($v) {
  72.                     if ($v['encoders'] ?? false) {
  73.                         trigger_deprecation('symfony/security-bundle', '5.3', 'The child node "encoders" at path "security" is deprecated, use "password_hashers" instead.');
  75.                         return true;
  76.                     }
  78.                     return $v['password_hashers'] ?? false;
  79.                 })
  80.                 ->then(function ($v) {
  81.                     $v['password_hashers'] = array_merge($v['password_hashers'] ?? [], $v['encoders'] ?? []);
  82.                     $v['encoders'] = $v['password_hashers'];
  84.                     return $v;
  85.                 })
  86.             ->end()
  87.             ->children()
  88.                 ->scalarNode('access_denied_url')->defaultNull()->example('/foo/error403')->end()
  89.                 ->enumNode('session_fixation_strategy')
  90.                     ->values([SessionAuthenticationStrategy::NONE, SessionAuthenticationStrategy::MIGRATE, SessionAuthenticationStrategy::INVALIDATE])
  91.                     ->defaultValue(SessionAuthenticationStrategy::MIGRATE)
  92.                 ->end()
  93.                 ->booleanNode('hide_user_not_found')->defaultTrue()->end()
  94.                 ->booleanNode('always_authenticate_before_granting')
  95.                     ->defaultFalse()
  96.                     ->setDeprecated('symfony/security-bundle', '5.4')
  97.                 ->end()
  98.                 ->booleanNode('erase_credentials')->defaultTrue()->end()
  99.                 ->booleanNode('enable_authenticator_manager')->defaultFalse()->info('Enables the new Symfony Security system based on Authenticators, all used authenticators must support this before enabling this.')->end()
  100.                 ->arrayNode('access_decision_manager')
  101.                     ->addDefaultsIfNotSet()
  102.                     ->children()
  103.                         ->enumNode('strategy')
  104.                             ->values($this->getAccessDecisionStrategies())
  105.                         ->end()
  106.                         ->scalarNode('service')->end()
  107.                         ->scalarNode('strategy_service')->end()
  108.                         ->booleanNode('allow_if_all_abstain')->defaultFalse()->end()
  109.                         ->booleanNode('allow_if_equal_granted_denied')->defaultTrue()->end()
  110.                     ->end()
  111.                     ->validate()
  112.                         ->ifTrue(function ($v) { return isset($v['strategy'], $v['service']); })
  113.                         ->thenInvalid('"strategy" and "service" cannot be used together.')
  114.                     ->end()
  115.                     ->validate()
  116.                         ->ifTrue(function ($v) { return isset($v['strategy'], $v['strategy_service']); })
  117.                         ->thenInvalid('"strategy" and "strategy_service" cannot be used together.')
  118.                     ->end()
  119.                     ->validate()
  120.                         ->ifTrue(function ($v) { return isset($v['service'], $v['strategy_service']); })
  121.                         ->thenInvalid('"service" and "strategy_service" cannot be used together.')
  122.                     ->end()
  123.                 ->end()
  124.             ->end()
  125.         ;
  127.         $this->addEncodersSection($rootNode);
  128.         $this->addPasswordHashersSection($rootNode);
  129.         $this->addProvidersSection($rootNode);
  130.         $this->addFirewallsSection($rootNode, $this->factories);
  131.         $this->addAccessControlSection($rootNode);
  132.         $this->addRoleHierarchySection($rootNode);
  134.         return $tb;
  135.     }
  137.     private function addRoleHierarchySection(ArrayNodeDefinition $rootNode)
  138.     {
  139.         $rootNode
  140.             ->fixXmlConfig('role', 'role_hierarchy')
  141.             ->children()
  142.                 ->arrayNode('role_hierarchy')
  143.                     ->useAttributeAsKey('id')
  144.                     ->prototype('array')
  145.                         ->performNoDeepMerging()
  146.                         ->beforeNormalization()->ifString()->then(function ($v) { return ['value' => $v]; })->end()
  147.                         ->beforeNormalization()
  148.                             ->ifTrue(function ($v) { return \is_array($v) && isset($v['value']); })
  149.                             ->then(function ($v) { return preg_split('/\s*,\s*/', $v['value']); })
  150.                         ->end()
  151.                         ->prototype('scalar')->end()
  152.                     ->end()
  153.                 ->end()
  154.             ->end()
  155.         ;
  156.     }
  158.     private function addAccessControlSection(ArrayNodeDefinition $rootNode)
  159.     {
  160.         $rootNode
  161.             ->fixXmlConfig('rule', 'access_control')
  162.             ->children()
  163.                 ->arrayNode('access_control')
  164.                     ->cannotBeOverwritten()
  165.                     ->prototype('array')
  166.                         ->fixXmlConfig('ip')
  167.                         ->fixXmlConfig('method')
  168.                         ->children()
  169.                             ->scalarNode('requires_channel')->defaultNull()->end()
  170.                             ->scalarNode('path')
  171.                                 ->defaultNull()
  172.                                 ->info('use the urldecoded format')
  173.                                 ->example('^/path to resource/')
  174.                             ->end()
  175.                             ->scalarNode('host')->defaultNull()->end()
  176.                             ->integerNode('port')->defaultNull()->end()
  177.                             ->arrayNode('ips')
  178.                                 ->beforeNormalization()->ifString()->then(function ($v) { return [$v]; })->end()
  179.                                 ->prototype('scalar')->end()
  180.                             ->end()
  181.                             ->arrayNode('methods')
  182.                                 ->beforeNormalization()->ifString()->then(function ($v) { return preg_split('/\s*,\s*/', $v); })->end()
  183.                                 ->prototype('scalar')->end()
  184.                             ->end()
  185.                             ->scalarNode('allow_if')->defaultNull()->end()
  186.                         ->end()
  187.                         ->fixXmlConfig('role')
  188.                         ->children()
  189.                             ->arrayNode('roles')
  190.                                 ->beforeNormalization()->ifString()->then(function ($v) { return preg_split('/\s*,\s*/', $v); })->end()
  191.                                 ->prototype('scalar')->end()
  192.                             ->end()
  193.                         ->end()
  194.                     ->end()
  195.                 ->end()
  196.             ->end()
  197.         ;
  198.     }
  200.     /**
  201.      * @param array<array-key, SecurityFactoryInterface|AuthenticatorFactoryInterface> $factories
  202.      */
  203.     private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $factories)
  204.     {
  205.         $firewallNodeBuilder = $rootNode
  206.             ->fixXmlConfig('firewall')
  207.             ->children()
  208.                 ->arrayNode('firewalls')
  209.                     ->isRequired()
  210.                     ->requiresAtLeastOneElement()
  211.                     ->disallowNewKeysInSubsequentConfigs()
  212.                     ->useAttributeAsKey('name')
  213.                     ->prototype('array')
  214.                         ->fixXmlConfig('required_badge')
  215.                         ->children()
  216.         ;
  218.         $firewallNodeBuilder
  219.             ->scalarNode('pattern')->end()
  220.             ->scalarNode('host')->end()
  221.             ->arrayNode('methods')
  222.                 ->beforeNormalization()->ifString()->then(function ($v) { return preg_split('/\s*,\s*/', $v); })->end()
  223.                 ->prototype('scalar')->end()
  224.             ->end()
  225.             ->booleanNode('security')->defaultTrue()->end()
  226.             ->scalarNode('user_checker')
  227.                 ->defaultValue('security.user_checker')
  228.                 ->treatNullLike('security.user_checker')
  229.                 ->info('The UserChecker to use when authenticating users in this firewall.')
  230.             ->end()
  231.             ->scalarNode('request_matcher')->end()
  232.             ->scalarNode('access_denied_url')->end()
  233.             ->scalarNode('access_denied_handler')->end()
  234.             ->scalarNode('entry_point')
  235.                 ->info(sprintf('An enabled authenticator name or a service id that implements "%s"', AuthenticationEntryPointInterface::class))
  236.             ->end()
  237.             ->scalarNode('provider')->end()
  238.             ->booleanNode('stateless')->defaultFalse()->end()
  239.             ->booleanNode('lazy')->defaultFalse()->end()
  240.             ->scalarNode('context')->cannotBeEmpty()->end()
  241.             ->arrayNode('logout')
  242.                 ->treatTrueLike([])
  243.                 ->canBeUnset()
  244.                 ->children()
  245.                     ->scalarNode('csrf_parameter')->defaultValue('_csrf_token')->end()
  246.                     ->scalarNode('csrf_token_generator')->cannotBeEmpty()->end()
  247.                     ->scalarNode('csrf_token_id')->defaultValue('logout')->end()
  248.                     ->scalarNode('path')->defaultValue('/logout')->end()
  249.                     ->scalarNode('target')->defaultValue('/')->end()
  250.                     ->scalarNode('success_handler')->setDeprecated('symfony/security-bundle', '5.1', sprintf('The "%%node%%" at path "%%path%%" is deprecated, register a listener on the "%s" event instead.', LogoutEvent::class))->end()
  251.                     ->booleanNode('invalidate_session')->defaultTrue()->end()
  252.                 ->end()
  253.                 ->fixXmlConfig('delete_cookie')
  254.                 ->children()
  255.                     ->arrayNode('delete_cookies')
  256.                         ->normalizeKeys(false)
  257.                         ->beforeNormalization()
  258.                             ->ifTrue(function ($v) { return \is_array($v) && \is_int(key($v)); })
  259.                             ->then(function ($v) { return array_map(function ($v) { return ['name' => $v]; }, $v); })
  260.                         ->end()
  261.                         ->useAttributeAsKey('name')
  262.                         ->prototype('array')
  263.                             ->children()
  264.                                 ->scalarNode('path')->defaultNull()->end()
  265.                                 ->scalarNode('domain')->defaultNull()->end()
  266.                                 ->scalarNode('secure')->defaultFalse()->end()
  267.                                 ->scalarNode('samesite')->defaultNull()->end()
  268.                             ->end()
  269.                         ->end()
  270.                     ->end()
  271.                 ->end()
  272.                 ->fixXmlConfig('handler')
  273.                 ->children()
  274.                     ->arrayNode('handlers')
  275.                         ->prototype('scalar')->setDeprecated('symfony/security-bundle', '5.1', sprintf('The "%%node%%" at path "%%path%%" is deprecated, register a listener on the "%s" event instead.', LogoutEvent::class))->end()
  276.                     ->end()
  277.                 ->end()
  278.             ->end()
  279.             ->arrayNode('switch_user')
  280.                 ->canBeUnset()
  281.                 ->children()
  282.                     ->scalarNode('provider')->end()
  283.                     ->scalarNode('parameter')->defaultValue('_switch_user')->end()
  284.                     ->scalarNode('role')->defaultValue('ROLE_ALLOWED_TO_SWITCH')->end()
  285.                 ->end()
  286.             ->end()
  287.             ->arrayNode('required_badges')
  288.                 ->info('A list of badges that must be present on the authenticated passport.')
  289.                 ->validate()
  290.                     ->always()
  291.                     ->then(function ($requiredBadges) {
  292.                         return array_map(function ($requiredBadge) {
  293.                             if (class_exists($requiredBadge)) {
  294.                                 return $requiredBadge;
  295.                             }
  297.                             if (false === strpos($requiredBadge, '\\')) {
  298.                                 $fqcn = 'Symfony\Component\Security\Http\Authenticator\Passport\Badge\\'.$requiredBadge;
  299.                                 if (class_exists($fqcn)) {
  300.                                     return $fqcn;
  301.                                 }
  302.                             }
  304.                             throw new InvalidConfigurationException(sprintf('Undefined security Badge class "%s" set in "security.firewall.required_badges".', $requiredBadge));
  305.                         }, $requiredBadges);
  306.                     })
  307.                 ->end()
  308.                 ->prototype('scalar')->end()
  309.             ->end()
  310.         ;
  312.         $abstractFactoryKeys = [];
  313.         foreach ($factories as $factory) {
  314.             $name = str_replace('-', '_', $factory->getKey());
  315.             $factoryNode = $firewallNodeBuilder->arrayNode($name)
  316.                 ->canBeUnset()
  317.             ;
  319.             if ($factory instanceof AbstractFactory) {
  320.                 $abstractFactoryKeys[] = $name;
  321.             }
  323.             $factory->addConfiguration($factoryNode);
  324.         }
  326.         // check for unreachable check paths
  327.         $firewallNodeBuilder
  328.             ->end()
  329.             ->validate()
  330.                 ->ifTrue(function ($v) {
  331.                     return true === $v['security'] && isset($v['pattern']) && !isset($v['request_matcher']);
  332.                 })
  333.                 ->then(function ($firewall) use ($abstractFactoryKeys) {
  334.                     foreach ($abstractFactoryKeys as $k) {
  335.                         if (!isset($firewall[$k]['check_path'])) {
  336.                             continue;
  337.                         }
  339.                         if (str_contains($firewall[$k]['check_path'], '/') && !preg_match('#'.$firewall['pattern'].'#', $firewall[$k]['check_path'])) {
  340.                             throw new \LogicException(sprintf('The check_path "%s" for login method "%s" is not matched by the firewall pattern "%s".', $firewall[$k]['check_path'], $k, $firewall['pattern']));
  341.                         }
  342.                     }
  344.                     return $firewall;
  345.                 })
  346.             ->end()
  347.         ;
  348.     }
  350.     private function addProvidersSection(ArrayNodeDefinition $rootNode)
  351.     {
  352.         $providerNodeBuilder = $rootNode
  353.             ->fixXmlConfig('provider')
  354.             ->children()
  355.                 ->arrayNode('providers')
  356.                     ->example([
  357.                         'my_memory_provider' => [
  358.                             'memory' => [
  359.                                 'users' => [
  360.                                     'foo' => ['password' => 'foo', 'roles' => 'ROLE_USER'],
  361.                                     'bar' => ['password' => 'bar', 'roles' => '[ROLE_USER, ROLE_ADMIN]'],
  362.                                 ],
  363.                             ],
  364.                         ],
  365.                         'my_entity_provider' => ['entity' => ['class' => 'SecurityBundle:User', 'property' => 'username']],
  366.                     ])
  367.                     ->requiresAtLeastOneElement()
  368.                     ->useAttributeAsKey('name')
  369.                     ->prototype('array')
  370.         ;
  372.         $providerNodeBuilder
  373.             ->children()
  374.                 ->scalarNode('id')->end()
  375.                 ->arrayNode('chain')
  376.                     ->fixXmlConfig('provider')
  377.                     ->children()
  378.                         ->arrayNode('providers')
  379.                             ->beforeNormalization()
  380.                                 ->ifString()
  381.                                 ->then(function ($v) { return preg_split('/\s*,\s*/', $v); })
  382.                             ->end()
  383.                             ->prototype('scalar')->end()
  384.                         ->end()
  385.                     ->end()
  386.                 ->end()
  387.             ->end()
  388.         ;
  390.         foreach ($this->userProviderFactories as $factory) {
  391.             $name = str_replace('-', '_', $factory->getKey());
  392.             $factoryNode = $providerNodeBuilder->children()->arrayNode($name)->canBeUnset();
  394.             $factory->addConfiguration($factoryNode);
  395.         }
  397.         $providerNodeBuilder
  398.             ->validate()
  399.                 ->ifTrue(function ($v) { return \count($v) > 1; })
  400.                 ->thenInvalid('You cannot set multiple provider types for the same provider')
  401.             ->end()
  402.             ->validate()
  403.                 ->ifTrue(function ($v) { return 0 === \count($v); })
  404.                 ->thenInvalid('You must set a provider definition for the provider.')
  405.             ->end()
  406.         ;
  407.     }
  409.     private function addEncodersSection(ArrayNodeDefinition $rootNode)
  410.     {
  411.         $rootNode
  412.             ->fixXmlConfig('encoder')
  413.             ->children()
  414.                 ->arrayNode('encoders')
  415.                     ->example([
  416.                         'App\Entity\User1' => 'auto',
  417.                         'App\Entity\User2' => [
  418.                             'algorithm' => 'auto',
  419.                             'time_cost' => 8,
  420.                             'cost' => 13,
  421.                         ],
  422.                     ])
  423.                     ->requiresAtLeastOneElement()
  424.                     ->useAttributeAsKey('class')
  425.                     ->prototype('array')
  426.                         ->canBeUnset()
  427.                         ->performNoDeepMerging()
  428.                         ->beforeNormalization()->ifString()->then(function ($v) { return ['algorithm' => $v]; })->end()
  429.                         ->children()
  430.                             ->scalarNode('algorithm')
  431.                                 ->cannotBeEmpty()
  432.                                 ->validate()
  433.                                     ->ifTrue(function ($v) { return !\is_string($v); })
  434.                                     ->thenInvalid('You must provide a string value.')
  435.                                 ->end()
  436.                             ->end()
  437.                             ->arrayNode('migrate_from')
  438.                                 ->prototype('scalar')->end()
  439.                                 ->beforeNormalization()->castToArray()->end()
  440.                             ->end()
  441.                             ->scalarNode('hash_algorithm')->info('Name of hashing algorithm for PBKDF2 (i.e. sha256, sha512, etc..) See hash_algos() for a list of supported algorithms.')->defaultValue('sha512')->end()
  442.                             ->scalarNode('key_length')->defaultValue(40)->end()
  443.                             ->booleanNode('ignore_case')->defaultFalse()->end()
  444.                             ->booleanNode('encode_as_base64')->defaultTrue()->end()
  445.                             ->scalarNode('iterations')->defaultValue(5000)->end()
  446.                             ->integerNode('cost')
  447.                                 ->min(4)
  448.                                 ->max(31)
  449.                                 ->defaultNull()
  450.                             ->end()
  451.                             ->scalarNode('memory_cost')->defaultNull()->end()
  452.                             ->scalarNode('time_cost')->defaultNull()->end()
  453.                             ->scalarNode('id')->end()
  454.                         ->end()
  455.                     ->end()
  456.                 ->end()
  457.             ->end()
  458.         ;
  459.     }
  461.     private function addPasswordHashersSection(ArrayNodeDefinition $rootNode)
  462.     {
  463.         $rootNode
  464.             ->fixXmlConfig('password_hasher')
  465.             ->children()
  466.                 ->arrayNode('password_hashers')
  467.                     ->example([
  468.                         'App\Entity\User1' => 'auto',
  469.                         'App\Entity\User2' => [
  470.                             'algorithm' => 'auto',
  471.                             'time_cost' => 8,
  472.                             'cost' => 13,
  473.                         ],
  474.                     ])
  475.                     ->requiresAtLeastOneElement()
  476.                     ->useAttributeAsKey('class')
  477.                     ->prototype('array')
  478.                         ->canBeUnset()
  479.                         ->performNoDeepMerging()
  480.                         ->beforeNormalization()->ifString()->then(function ($v) { return ['algorithm' => $v]; })->end()
  481.                         ->children()
  482.                             ->scalarNode('algorithm')
  483.                                 ->cannotBeEmpty()
  484.                                 ->validate()
  485.                                     ->ifTrue(function ($v) { return !\is_string($v); })
  486.                                     ->thenInvalid('You must provide a string value.')
  487.                                 ->end()
  488.                             ->end()
  489.                             ->arrayNode('migrate_from')
  490.                                 ->prototype('scalar')->end()
  491.                                 ->beforeNormalization()->castToArray()->end()
  492.                             ->end()
  493.                             ->scalarNode('hash_algorithm')->info('Name of hashing algorithm for PBKDF2 (i.e. sha256, sha512, etc..) See hash_algos() for a list of supported algorithms.')->defaultValue('sha512')->end()
  494.                             ->scalarNode('key_length')->defaultValue(40)->end()
  495.                             ->booleanNode('ignore_case')->defaultFalse()->end()
  496.                             ->booleanNode('encode_as_base64')->defaultTrue()->end()
  497.                             ->scalarNode('iterations')->defaultValue(5000)->end()
  498.                             ->integerNode('cost')
  499.                                 ->min(4)
  500.                                 ->max(31)
  501.                                 ->defaultNull()
  502.                             ->end()
  503.                             ->scalarNode('memory_cost')->defaultNull()->end()
  504.                             ->scalarNode('time_cost')->defaultNull()->end()
  505.                             ->scalarNode('id')->end()
  506.                         ->end()
  507.                     ->end()
  508.                 ->end()
  509.         ->end();
  510.     }
  512.     private function getAccessDecisionStrategies(): array
  513.     {
  514.         return [
  515.             self::STRATEGY_AFFIRMATIVE,
  516.             self::STRATEGY_CONSENSUS,
  517.             self::STRATEGY_UNANIMOUS,
  518.             self::STRATEGY_PRIORITY,
  519.         ];
  520.     }
  521. }