Logowanie użytkowników w REST API na mikroserwisach PHPers Summit 2019

L o g o w a n i e u ż y t k o w n i k ó w w R E S T A P I n a
m i k r o s e r w i s a c h

G R U PA Q P O N Y B L I X
P O N A D 3 0 0 0 0 0 0 U Ż Y T K O W N I K Ó W M I E S I Ę C Z N I E

J s o n W e b T o k e n
JSON Web Token (JWT) is an open standard (RFC 7519) that
defines a compact and self-contained way for securely transmitting
information between parties as a JSON object.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3O
DkwIiwibmFtZSI6IkdyemVnb3J6IiwicGhwZXJzIjoyMDE5LCJpYXQiO
jE1MTYyMzkwMjJ9.fDuS4X19nQ9B3c9QWVsbYJqI4ckBXetARlxZp
RXHOOw

eyJhbGciOiJIUzI1NiIsInR5cCI6
IkpXVCJ9

IkpXVCJ9
{
"alg": "HS256",
"typ": "JWT"
}

IkpXVCJ9
eyJzdWIiOiIxMjM0NTY3ODkwI
iwibmFtZSI6IkdyemVnb3J6Iiwi
cGhwZXJzIjoyMDE5LCJpYXQi
OjE1MTYyMzkwMjJ9
{
"alg": "HS256",
"typ": "JWT"
}

IkpXVCJ9
OjE1MTYyMzkwMjJ9
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "1234567890",
"name": "Grzegorz",
"phpers": 2019,
"iat": 1516239022
}

IkpXVCJ9
OjE1MTYyMzkwMjJ9
fDuS4X19nQ9B3c9QWVsbYJq
I4ckBXetARlxZpRXHOOw
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "1234567890",
"name": "Grzegorz",
"phpers": 2019,
"iat": 1516239022
}

IkpXVCJ9
OjE1MTYyMzkwMjJ9
fDuS4X19nQ9B3c9QWVsbYJq
I4ckBXetARlxZpRXHOOw
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "1234567890",
"name": "Grzegorz",
"phpers": 2019,
"iat": 1516239022
}
HMACSHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
PHPers2019
)

H E A D E R
T y p e A l g o r i t h m
HS256
HS384
HS512
RS256
RS384
RS512
ES256
ES384
ES512
PS256
PS384
PS512
J W T

PAY L O A D
R e g i s t e r e d C l a i m N a m e s

PAY L O A D
Issuer (iss)
Subject (sub)
Audience (aud)
Expiration Time (exp)
Not Before (nbf)
Issued At (iat)
JWT ID (jtd)
R e g i s t e r e d C l a i m N a m e s

PAY L O A D
P u b l i c C l a i m N a m e sP r i v a t e C l a i m N a m e s

S I G N AT U R E
HMACSHA256(
secret)

S I G N AT U R E
RSASHA256(
-----BEGIN PUBLIC KEY-----
...
,
-----BEGIN RSA PRIVATE KEY-----
...
)

A U T H O R I Z AT I O N
Authorization: Bearer eyJhbGci...lxZpRXHOOw

O p e n A u t h o r i z a t i o n

OAuth (Open Authorization) is an open standard for token-based
authentication and authorization on the Internet.

R E M E B E R
A u t h o r i z a t i o nA u t h e n t i c a t i o n

R E M E B E R
W h o a r e y o u ?

R E M E B E R
A r e y o u a l l o w e d t o d o t h a t ?W h o a r e y o u ?

Get user’s data
Client App Resource Server

Get user’s data
Return user’s data

Access Token

Access Token
Get user’s data

Access Token
Access Token
Get user’s data

Access Token
Access Token
Get user’s data
Access Token

Access Token
Access Token
Get user’s data
Access Token
Verify

Client App Authorization Server

Access Token
G
enerate

Issue Access Token
Access Token
G
enerate

Issue Access Token
Access Token Access Token
G
enerate

Client App
Resource Server
Authorization Server

Client App
Resource Server
Access Token
G
enerate

Client App
Resource Server
Issue Access Token
Access Token
G
enerate

Client App
Resource Server
Access Token
Issue Access Token
Access Token
G
enerate

Client App
Resource Server
Access Token
Get user’s data
Issue Access Token
Access Token
G
enerate

Client App
Resource Server
Access Token
Access Token
Get user’s data
Issue Access Token
Access Token
G
enerate

Client App
Resource Server
Access Token
Access Token
Get user’s data Access Token
Issue Access Token
Access Token
G
enerate

Client App
Resource Server
Access Token
Access Token
Verify
Issue Access Token
Access Token
G
enerate

G o o g l e S i g n I n F l o w

1. Mobile: Użytkownik klika przycisk Zaloguj z Google

2. Mobile: Otwieramy formularz logowania Google z parametrem requestIdToken(serverClientId) żeby
dostać ID Token

dostać ID Token
3. Mobile: User poprawnie loguje się profilem Google

dostać ID Token
4. Mobile: W odpowiedzi na poprawne zalogowanie otrzymujemy ID Token, który wysyłamy do API

dostać ID Token
5. Backend: Odbiera ID Token i sprawdza jego poprawność

dostać ID Token
6. Backend: Jeśli token jest poprawny to można z niego wyciągnąć dane o użytkowniku i na tej podstawie
stworzyć konto/albo nową sesję

dostać ID Token
stworzyć konto/albo nową sesję
7. Mobile: API zwraca odpowiedź, że logowanie jest poprawne lub niepoprawne (+ tokeny refresh/access)

F a c e b o o k S i g n I n F l o w

1. Mobile: Użytkownik klika przycisk Zaloguj z Facebook

2. Mobile: Otwieramy formularz logowania Facebook z Facebook SDK (w zależności od tego czy jest
zainstalowana aplikacja FB to będzie formularz natywny, jeśli nie jest zainstalowana to PopUp z WebView)

3. Mobile: User poprawnie loguje się profilem Facebook

4. Mobile: W odpowiedzi na poprawne zalogowanie otrzymujemy AccessToken, który wysyłamy do API

5. Backend: Odbiera AccessToken, sprawdza jego poprawność z wykorzystaniem endpointu /user z
parametrem me jako user-id (czyli /v3.2/me) oraz dla bezpieczeństwa parametrem appsecret_proof

stworzyć konto/albo nową sesję.

stworzyć konto/albo nową sesję.
7. Mobile: Otrzymujemy odpowiedź, że logowanie jest poprawne lub niepoprawne (+ tokeny refresh/access)

$ composer require lexik/jwt-authentication-bundle

lexik_jwt_authentication:
secret_key: 'secret'
token_ttl: 3600
encoder:
signature_algorithm: 'HS512'

api_login_check:
path: /api/login_check

security:
providers:
in_memory:
memory:
users:
admin: # Test dummy user
password: password
roles: 'ROLE_ADMIN'
encoders:
SymfonyComponentSecurityCoreUserUser: plaintext
firewalls:
login:
pattern: ^/api/login
stateless: true
anonymous: true
json_login:
check_path: /api/login_check
success_handler: lexik_jwt_authentication.handler.authentication_success
failure_handler: lexik_jwt_authentication.handler.authentication_failure
provider: in_memory
api:
pattern: ^/api
stateless: true
guard:
authenticators: [lexik_jwt_authentication.jwt_token_authenticator]
access_control:
- { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/api, roles: IS_AUTHENTICATED_FULLY }

curl -X POST
https://example.com/api/login_check
-H 'Content-Type: application/json'
-d '{"username":"admin","password":"password"}'

{
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpYXQiOjE1NjY0NjgzODQsImV4cCI6MTU2N
jQ3MTk4NCwicm9sZXMiOlsiUk9MRV9BRE1JTiJdLCJ1c2VybmFtZSI6ImFkbWluIn0.TJST6ZifM4jIZiuejvMkd0PZ
vwZWlgS6MKsloNBEUHmYTTGyZlcsJx-ol04U-cn2uAzisfv-oHLw7I7k1sqVY5V28RjUg-OBN-CtEzEAh_OL-a-
kweuO0q4KCsv5Pm1R77rahfZ2rZ1Z0j3A6SmOTqEjpVBIOBHO76Gy6hGY7uHiyVgi4hfxhBUV-
Pd1zBxule77upXX9AgWwFnvltbSD3GioUTIlu8k5kizX7_IteZAhXRs7-o0jE3oMPQi0TCQbp7wf_-bSfGmtV-
XoPnxT-
jmvWPGGjAI50_BEgwif8vwXPEn7gHN4nzwrOJd9YjVfn_9l8bsmx_ruqXX0C_FMUlDkcABDsApNJzo3dpeAnEdMYPKo
_jnVMfaV0QcBPrcfBTvldCDW67WaMDC7T9kNUAj4weB48rnjDzveyg6ymzoLanMTMq567pFBWfiVRrQluQ0QKnTtXQD
-qbg4k8wuTlNxZvd1zJ2HPa7U3gH9ZVrwK27P3_7hZzZghPFlhNh-
J_vm7nVd0H4EVIlFj6mtPjnCiXyRugM4g8HYEc_Kx_UnbL4EBkWPpzrT2X9tYQvXnWtyxeWNubHGoizPlxYOAoIZeGT
Lp0HKKSecvvrZLNjea_GP_Fo6KOCC6N4o4cy2FsFdM06Zk6pC_0R-xzOUtqc3-dBkdBrhTyVFc3gbgU"
}

{
"iat":1566468384,
"exp":1566471984,
"roles":["ROLE_ADMIN"],
"username":"admin"
}

$ composer require symfony/security-guard

interface AuthenticatorInterface
{
public function supports(Request $request): bool;
public function getCredentials(Request $request);
public function getUser($credentials, UserProviderInterface $userProvider): ?UserInterface;
public function checkCredentials($credentials, UserInterface $user): bool;
public function createAuthenticatedToken(UserInterface $user, $providerKey): GuardTokenInterface;
public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response;
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey): ?Response;
public function supportsRememberMe(): bool;
}

$ composer require league/oauth2-google

class GoogleAuthenticator implements AuthenticatorInterface
{
…
}

public function supportsRememberMe(): bool
{
return true;
}
public function checkCredentials($credentials, UserInterface $user): bool
{
return true;
}
public function supports(Request $request): bool
{
return $request->attributes->get('_route') === 'api_login_check';
}

public function getUser($credentials, UserProviderInterface $userProvider): UserInterface
{
$googleUser = $this->getClient()->fetchUserFromCredentials($credentials);
$existingUser = $this->repository->findOneBy(['googleId' => $googleUser->getId()]);
if ($existingUser) {
return $existingUser;
}
$user = $this->createUser($googleUser);
$this->em->persist($user);
$this->em->flush();
return $user;
}

protected function createUser(GoogleUser $googleUser): User
{
$user = new User();
$user->setEmail($googleUser->getEmail());
$user->setGoogleEmail($googleUser->getEmail());
$user->setGoogleId($googleUser->getId());
$user->setFirstName($googleUser->getFirstName());
$user->setLastName($googleUser->getLastName());
return $user;
}

protected function getClient(): GoogleClient
{
return $this->clients['google'];
}
public function getCredentials(Request $request): array
{
return $this->getClient()->getCredentialsFromIdToken($request->query->get('id_token', ''));
}
protected function fetchUserFromCredentials(array $credentials): GoogleUser
{
return $this->getClient()->fetchUserFromCredentials($credentials);
}

public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey): ?Response
{
// LexikBundleJWTAuthenticationBundleSecurityHttpAuthenticationAuthenticationSuccessHandler
return $this->authenticationSuccessHandler->onAuthenticationSuccess($request, $token);
}
public function onAuthenticationFailure(Request $request, AuthenticationException $authException): ?Response
{
// LexikBundleJWTAuthenticationBundleSecurityHttpAuthenticationAuthenticationFailureHandler
return $this->authenticationFailureHandler->onAuthenticationFailure($request, $authException);
}

public function start(Request $request, AuthenticationException $authException = null): Response
{
$ex = $authException ?? new AuthenticationException('Unknown error');
return $this->authenticationFailureHandler->onAuthenticationFailure($request, $ex);
}

use LeagueOAuth2ClientProviderExceptionIdentityProviderException;
use LeagueOAuth2ClientProviderGoogle;
use LeagueOAuth2ClientProviderGoogleUser;
class GoogleClient
{
public function __construct(string $clientId, string $clientSecret)
{
$this->provider = new Google([
'clientId' => $clientId,
'clientSecret' => $clientSecret,
]);
$this->clientId = $clientId;
}
public function getCredentialsFromIdToken(string $idToken): ?array
{
$request = $this->provider->getRequest('GET', 'https://oauth2.googleapis.com/tokeninfo?id_token=' . $idToken);
$response = $this->provider->getParsedResponse($request);
return $this->validateIdTokenResponse($response) ? $response : null;
}
private function validateIdTokenResponse(array $response): bool
{
return
preg_match('/^(?:https://)?accounts.google.com$/', $response['iss'] ?? '') === 1
&& ($response['aud'] ?? '') === $this->clientId
&& ($response['exp'] ?? 0) > time();
}
public function fetchUserFromCredentials($credentials): GoogleUser
{
return new GoogleUser($credentials);
}
}

AppSecurityAuthenticatorGoogleAuthenticator:
arguments:
- { google: '@AppClientGoogleClient' }
AppClientGoogleClient:
arguments:
- '%env(OAUTH_GOOGLE_ID)%'
- '%env(OAUTH_GOOGLE_SECRET)%'

$ composer require league/oauth2-facebook

class FacebookAuthenticator extends AbstractSocialAuthenticator
{
public function getCredentials(Request $request): FacebookUser {…}
public function getUser($credentials, UserProviderInterface $userProvider): UserInterface {…}
protected function getClient(): FacebookClient {…}
protected function createUser(FacebookUser $facebookUser): User {…}
protected function getService(): string {…}
}

curl -X POST
https://example.com/api/login_check?service=google&id_token=token
curl -X POST
https://example.com/api/login_check?service=facebook&id_token=token

E m a i l / P a s s w o r d L o g I n

security:
firewalls:
base_login:
pattern: ^/api/base_login
stateless: true
anonymous: true
provider: in_memory
form_login:
check_path: /api/base_login/login_check
success_handler: lexik_jwt_authentication.handler.authentication_success
failure_handler: lexik_jwt_authentication.handler.authentication_failure
require_previous_session: false
access_control:
- { path: ^/api/base_login, roles: IS_AUTHENTICATED_ANONYMOUSLY }

api_base_login_check:
path: /api/base_login/login_check

curl -X POST
https://example.com/api/base_login/login_check
-H 'Content-Type: application/x-www-form-urlencoded'
-d '_username=admin&_password=password'

$ composer require gesdinet/jwt-refresh-token-bundle

gesdinet_jwt_refresh_token:
ttl: 2592000 #30 days
ttl_update: true
user_identity_field: username

gesdinet_jwt_refresh_token:
path: /api/token/refresh
defaults: { _controller: gesdinet.jwtrefreshtoken:refresh }

security:
firewalls:
refresh:
pattern: ^/api/token/refresh
stateless: true
anonymous: true
access_control:
- { path: ^/api/token/refresh, roles: IS_AUTHENTICATED_ANONYMOUSLY }

G d z i e t e m i k r o s e r w i s y ?

GRZEGORZ STAWARCZYK
grzegorz.stawarczyk@qpony.pl
@gstawarczyk
D Z I Ę K U J Ę !

Logowanie użytkowników w REST API na mikroserwisach PHPers Summit 2019

More Related Content

Featured

Logowanie użytkowników w REST API na mikroserwisach PHPers Summit 2019