The security component tackles the complex problems of authentication and authorization by spreading concerns across a number of single responsibility objects. This is a flexible design, but difficult for beginners to navigate. This presentation will bring the security component to life for us all to understand! Join us to see some of your favorite members of the Symfony community perform the security component in a series of scenes, interspliced with some technical descriptions of what's going on.

1. Love & Loss
A Symfony Security Play

2. brewcycleportland.com

3. @kriswallsmith

4. assetic

5. Buzz

6. Spork

9. “…the current implementation of the Security
Component is … not easily accessible”
http://www.testically.org/2011/03/14/why-i-gave-up-on-the-symfony2-security-component/

10. “I would rather see Symfony2 postponed again
or the Security Component removed …
I don’t think it is even near of being usable to
the community outside the core.”
http://www.testically.org/2011/03/14/why-i-gave-up-on-the-symfony2-security-component/

11. “The past few days I have really be struggling
with the Symfony2 security component.
It is the most complex component of
Symfony2 if you ask me!”
http://blog.vandenbrand.org/2012/06/19/symfony2-authentication-provider-authenticate-against-webservice/

12. “(I’m) wondering if I should just work around
rather than work with the framework”
https://groups.google.com/forum/#!msg/symfony2/AZpgbEk4Src/73P99zOmq2YJ

15. Enhance your
PHPfun!

16. http://curiouscomedy.org

19. HttpKernel
kernel.exception
kernel.request kernel.terminatekernel.controller kernel.view kernel.response

20. kernel.request kernel.controller kernel.view kernel.response kernel.terminate
kernel.exception
HttpKernel

21. kernel.request kernel.controller kernel.view kernel.response kernel.terminate
kernel.exception
HttpKernel

22. HttpKernel
Get the response and get out

23. kernel.request
Routeretc…
Firewall

24. Firewall
Just another listener

25. class YesFirewall
{
public function handle($event)
{
// always say yes
}
}

26. use SymfonyComponentHttpFoundationResponse;
class NoFirewall
{
public function handle($event)
{
// always say no
$event->setResponse(
new Response('go away', 401)
);
}
}

27. use SymfonyComponentHttpFoundationResponse;
class PickyFirewall
{
public function handle($event)
{
$request = $event->getRequest();
$user = $request->headers->get('PHP_AUTH_USER');
// only names that start with "Q"
if ('Q' == $user[0]) return;
$event->setResponse(new Response('go away', 401));
}
}

28. Security Listeners
The firewall’s henchmen

29. Firewall
Listeners
kernel.request

30. class Firewall
{
public $listeners = array();
public function handle($event)
{
foreach ($this->listeners as $listener) {
$listener->handle($event);
if ($event->hasResponse()) return;
}
}
}

31. class YesListener
{
public function handle($event)
{
// always say yes
}
}

32. use SymfonyComponentHttpFoundationResponse;
class NoListener
{
public function handle($event)
{
// always say no
$event->setResponse(
new Response('go away', 401)
);
}
}

33. use SymfonyComponentHttpFoundationResponse;
class PickyListener
{
public function handle($event)
{
$request = $event->getRequest();
$user = $request->headers->get('PHP_AUTH_USER');
// only names that start with "Q"
if ('Q' == $user[0]) return;
$event->setResponse(new Response('go away', 401));
}
}

34. Authentication
Are you who you say you are?

35. Authorization
Are you allowed to ____?

36. Tokens
The Language of Security

37. Authentication Listeners
Map from request to token

38. Request
Response (?) Token
CoreHTTP

41. Authentication
Listener A
Authentication
Listener B
Authentication
Manager
Firewall

42. class AuthenticationListener
{
public $authMan, $context;
public function handle($e)
{
$r = $e->getRequest();
$u = $r->headers->get('PHP_AUTH_USER');
$t = new AnonToken($u);
$t = $this->authMan->authenticate($t);
$this->context->setToken($t);
}
}

43. class AuthenticationManager
{
public function authenticate($t)
{
// always say no
}
}

44. class AuthenticationManager
{
public function authenticate($t)
{
// always say yes
return new AuthToken($t->getUser());
}
}

45. class AuthenticationManager
{
public function authenticate($t)
{
$u = $t->getUser();
// only names that start with "Q"
if ('Q' == $u[0]) {
return new AuthToken($u);
}
}
}

46. Authentication Manager
Responsible for authenticating
the token

47. Authentication Providers
Do the actual authentication work

48. User
Providers
Authentication
Providers
Authentication
Listener A
Authentication
Listener B
Authentication
Manager

49. User Providers
Access the repository of users

50. class AuthenticationManager
{
public $providers = array();
public function authenticate($t)
{
foreach ($this->providers as $p) {
if ($p->supports($t)) {
return $p->authenticate($t);
}
}
}
}

51. class AuthenticationProvider
{
public $up;
public function authenticate($t)
{
$u = $t->getUser();
$u = $this->up->loadUserByUsername($u);
if ($u) return new AuthToken($u);
}
}

52. class UserProvider
{
public $repo;
public function loadUserByUsername($u)
{
return ($this->repo->find(array(
'username' => $u,
)));
}
}

53. Authentication

54. Authentication Listeners
• Map client data from request to
token
• Pass token to authentication
manager
• Update state of security context

55. Authentication Manager
• Responsible for authenticating the
token
• Calls the appropriate
authentication provider
• Handles exceptions

56. Authentication Providers
• Performs authentication using client
data in the token
• Marks the token as authenticated
• Attaches the user object to the
token

57. User Providers
• Retrieves the user from the database

58. Authorization

59. class AuthorizationListener
{
public function handle($e)
{
// always say yes
}
}

60. use SymfonyComponentHttpFoundationResponse;
class AuthorizationListener
{
public function handle($e)
{
// always say no
$e->setResponse(
new Response('go away', 403)
);
}
}

61. Access Map
Looks at a request and determines
token requirements

62. Access Decision Manager
The gatekeeper

63. Voters
Decision
Manager
Listener Map

64. use SymfonyComponentHttpFoundationResponse;
class AccessListener
{
public $context, $map, $decider;
public function handle($e)
{
$r = $e->getRequest();
$t = $this->context->getToken();
$reqs = $this->map->getRequirements($r);
if (!$this->decider->decide($t, $reqs)) {
$e->setResponse(
new Response('go away', 403)
);
}
}
}

65. class AccessMap
{
public function getRequirements($r)
{
$path = $r->getPathInfo();
if (0 === strpos($path, '/admin')) {
return array('ADMIN');
}
}
}

66. class AccessDecisionManager
{
public $voters;
public function decide($t, $reqs)
{
foreach ($this->voters as $v) {
if ($v->vote($t, null, $reqs)) {
return true;
}
}
return false;
}
}

67. class AccessVoter
{
public function vote($t, $obj, $reqs)
{
foreach ($reqs as $req) {
if (!$t->hasAttribute($req)) {
return false;
}
}
return true;
}
}

68. Authorization

69. Extension Points

70. The firewall has many listeners

71. The authentication manager has
many authentication providers

72. Which MAY rely on
user providers

73. The access decision manager
has many voters
Authenticated
Roles
ACL

74. Questions?

75. is hiring

77. “Horrible”
“Worst talk ever”
“Go back to high school”
https://joind.in/8665