0

I have an issue using escapewsseauthenticationbundle to secure my API (using FOSRestBundle and FOSUserBundle). With my security.yml, the login always failed and return a 401 status code.

I'm using chrome rest console and Teria's wsse header generator to authenticate and access my resource.

app/security.yml

encoders:
    FOS\UserBundle\Model\UserInterface: sha512

providers:
    fos_userbundle:
        id: fos_user.user_provider.username

wsse_secured:
      pattern:   ^/api/.*
      wsse:
        lifetime: 300 #lifetime of nonce
        realm: "Secured API" #identifies the set of resources to which the authentication information will apply (WWW-Authenticate)
        profile: "UsernameToken" #WSSE profile (WWW-Authenticate)
        encoder: #digest algorithm
            algorithm: sha512
            encodeHashAsBase64: true
            iterations: 1
      anonymous: true
      provider: fos_userbundle

access_control:
    - { path: ^/api.*, role: ROLE_USER }
    - { path: ^/, role: ROLE_USER }

Anybody know how to fix it ?

Thanks !

Maxime Picard
  • 603
  • 5
  • 17
  • Your logs indicate something? How the `SecurityContext` was (or was not) populated? Also I think `anonymous: true` should be removed from your API firewall. – Debreczeni András Jun 13 '14 at 08:06
  • Only "WSSE authentication failed". Yes i forgot to remove it, my bad. What do you want to say about the SecurityContext ? Thanks for your answer ! – Maxime Picard Jun 13 '14 at 08:46
  • I meant for you to look for log entries related to the SecurityContext. But the 'WSSE authentication failed' message seems to be related. – Debreczeni András Jun 13 '14 at 09:05
  • I would start debugging somewhere [here](https://github.com/escapestudios/EscapeWSSEAuthenticationBundle/blob/master/Security/Core/Authentication/Provider/Provider.php#L86) – Debreczeni András Jun 13 '14 at 09:06
  • Shouldn't [the provider be set differently](https://github.com/escapestudios/EscapeWSSEAuthenticationBundle#specify-custom-authentication-classes)? – dbrumann Jun 13 '14 at 09:19
  • Thanks, I try to extends the provider of escape bundle but this don't work anyway... – Maxime Picard Jun 13 '14 at 09:52

0 Answers0