I havn't no issue to build an api with api-platform and generate token with LexikJwt and refresh with gedinet bundle. It's easy (thanks a lot, it's a great doc).
I use Symfony 6.1 and try to integrate HWIOAUTH Bundle 2.0 (beta).
My use case : Use Azure (Office 365) to authenticate user on my api.
Currently I've configure 2 providers (Entity and Memory). And I would like use un third : Azure
My security.yml
security:
# https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
password_hashers:
Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
# https://symfony.com/doc/current/security/authenticator_manager.html
enable_authenticator_manager: true
# https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
role_hierarchy:
ROLE_EMPLOYEE: ROLE_USER
ROLE_COMPANY: ROLE_USER
ROLE_ADMIN: [ROLE_EMPLOYEE, ROLE_COMPANY]
ROLE_SUPPORT: [ROLE_USER, ROLE_ALLOWED_TO_SWITCH]
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
# used to reload user from session & other features (e.g. switch_user)
app_user_provider:
entity:
class: App\Entity\User
property: email
support_provider:
memory:
users:
super_admin: { password: 'aPasswordhash', roles: ['ROLE_SUPER_ADMIN'] }
support: { password: 'aPasswordhash', roles: ['ROLE_SUPPORT'] }
chain_provider:
chain:
providers: ['app_user_provider', 'support_provider']
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
main:
stateless: true
provider: chain_provider
entry_point: jwt
json_login:
check_path: /login_check
username_path: email
password_path: password
success_handler: lexik_jwt_authentication.handler.authentication_success
failure_handler: lexik_jwt_authentication.handler.authentication_failure
# https://symfony.com/doc/current/security/impersonating_user.html
switch_user: true
jwt: ~
refresh_jwt:
check_path: /refresh
logout:
path: logout
# activate different ways to authenticate
# https://symfony.com/doc/current/security.html#the-firewall
# Easy way to control access for large sections of your site
# Note: Only the *first* access control that matches will be used
access_control:
- { path: ^/docs, roles: PUBLIC_ACCESS }
- { path: ^/refresh, roles: PUBLIC_ACCESS }
- { path: ^/login_check, roles: PUBLIC_ACCESS }
# - { path: ^/logout, roles: IS_AUTHENTICATED_FULLY }
# - { path: ^/admin, roles: ROLE_ADMIN }
# - { path: ^/profile, roles: ROLE_USER }
when@test:
security:
password_hashers:
# By default, password hashers are resource intensive and take time. This is
# important to generate secure password hashes. In tests however, secure hashes
# are not important, waste resources and increase test times. The following
# reduces the work factor to the lowest possible values.
Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
algorithm: auto
cost: 4 # Lowest possible value for bcrypt
time_cost: 3 # Lowest possible value for argon
memory_cost: 10 # Lowest possible value for argon
The rest of my confiuration follow bundle doc.
I have no idea how I can make them (this 3 providers) work under the same login and save Azure (office365) user into my db! This is my issue.
Do you have any ideas?
I tried to complet my chain_provider with hwi_oauth service. I thought to use an other way (SAML) or a second route to login, but we lost JWT security usage.
