FriendsOfSymfony / FOSUserBundle

Provides user management for your Symfony project. Compatible with Doctrine ORM & ODM, and custom storages.
https://symfony.com/doc/master/bundles/FOSUserBundle/index.html
MIT License
3.24k stars 1.57k forks source link

The token storage contains no authentication token. #2038

Closed xorgxx closed 8 years ago

xorgxx commented 8 years ago

Hi i have probleme with fos:user:create testuser test@example.com password eatch time i get this error : 2016-01-17_18-08-54

My configue :

composer.json

{
    "name": "zorg/.checkout",
    "license": "proprietary",
    "type": "project",
    "autoload": {
        "psr-4": {
            "": "src/"
        },
        "files": [
            "app/AppKernel.php"
        ]
    },
    "require": {
        "php": ">=5.3.9",
        "symfony/symfony": "2.8.*",
        "doctrine/orm": "^2.4.8",
        "doctrine/doctrine-bundle": "~1.4",
        "symfony/swiftmailer-bundle": "~2.3",
        "symfony/monolog-bundle": "~2.4",
        "sensio/distribution-bundle": "~5.0",
        "sensio/framework-extra-bundle": "^3.0.2",
        "incenteev/composer-parameter-handler": "~2.0",
        "friendsofsymfony/user-bundle": "~2.0@dev",
        "jms/i18n-routing-bundle": "2.0.0",
        "jms/translation-bundle": "1.1.0",
        "sonata-project/seo-bundle": "2.0.x-dev",
        "stof/doctrine-extensions-bundle": "1.2.x-dev",
        "egeloen/ckeditor-bundle": "4.0.1",
        "helios-ag/fm-elfinder-bundle": "5.3",
        "knplabs/knp-menu-bundle": "2.1.x-dev",
        "twig/extensions": "v1.3.0",
        "friendsofsymfony/rest-bundle": "dev-master",
        "jms/serializer-bundle": "dev-master",
        "nelmio/cors-bundle": "dev-master",
        "jms/di-extra-bundle": "dev-master",
        "jms/security-extra-bundle": "dev-master",
        "friendsofsymfony/jsrouting-bundle": "dev-master",
        "liip/imagine-bundle": "dev-master",
        "stephanecollot/datetimepicker-bundle": "dev-master"

    },
    "require-dev": {
        "sensio/generator-bundle": "~3.0",
        "symfony/phpunit-bridge": "~2.7"
    },
    "scripts": {
        "post-install-cmd": [
            "Incenteev\\ParameterHandler\\ScriptHandler::buildParameters",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::buildBootstrap",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::clearCache",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::installAssets",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::installRequirementsFile",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::prepareDeploymentTarget"
        ],
        "post-update-cmd": [
            "Incenteev\\ParameterHandler\\ScriptHandler::buildParameters",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::buildBootstrap",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::clearCache",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::installAssets",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::installRequirementsFile",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::prepareDeploymentTarget"
        ]
    },
    "config": {
        "bin-dir": "bin",
        "component-dir": "web/assets"
    },
    "extra": {
        "symfony-app-dir": "app",
        "symfony-web-dir": "web",
        "symfony-assets-install": "relative",
        "incenteev-parameters": {
            "file": "app/config/parameters.yml"
        }
    }
}

Security.yml

security:
    access_denied_url:    ~ # Example: /foo/error403

    # strategy can be: none, migrate, invalidate
    session_fixation_strategy           :  migrate
    hide_user_not_found                 :  true
    always_authenticate_before_granting :  false
    erase_credentials                   :  true
    access_decision_manager:
        strategy                        :  affirmative
        allow_if_all_abstain            :  false
        allow_if_equal_granted_denied   :  true
    encoders:
        FOS\UserBundle\Model\UserInterface    : #sha512
            algorithm:            pbkdf2
            hash_algorithm:       sha512
            encode_as_base64:     true
            iterations:           1000

    providers:
        fos_userbundle:
            id                                : fos_user.user_provider.username

    firewalls:
        dev:
            pattern                           : ^/(_(profiler|wdt)|css|images|js)/
            security                          : false
        login:
            # Les adresses de ces pages sont login, register et resetting
            pattern                           : ^/(login$|register|resetting)
            # On autorise bien évidemment les anonymes sur ces pages !
            anonymous                         : true

        # Firewall principal pour le reste de notre site
        main:
            pattern                           : ^/ # ^/ = tout ce qui commence par / = tout notre site

            form_login:
                # On définit notre méthode d'authentification
                provider                      : fos_userbundle

                # On lit l'authentification au provider définit plus haut
#                csrf_provider                 : form.csrf_provider
                csrf_token_generator          : security.csrf.token_manager

                # On active la possibilité du "Se souvenir de moi" (désactivé par défaut)
                remember_me                   : true

                # the user is redirected here when he/she needs to login
                login_path                    : fos_user_security_login

                # if true, forward the user to the login form instead of redirecting
                use_forward                   : false

                # submit the login form here
                check_path                    : fos_user_security_check

                # by default, the login form *must* be a POST, not a GET
                post_only                     : true

                # login success redirecting options (read further below)
                always_use_default_target_path: true
#                default_target_path           : member_homepage
                target_path_parameter         : _target_path
                use_referer                   : true

                # login failure redirecting options (read further below)
                #failure_path                 : fos_user_security_login
                failure_forward               : false

                success_handler               : redirect.after.login
                # ccdn config burte force attack
#                success_handler               : ccdn_user_security.component.authentication.handler.login_success_handler
#                failure_handler               : ccdn_user_security.component.authentication.handler.login_failure_handler
#                failure_path                  : null

                # field names for the username and password fields
                username_parameter            : _username
                password_parameter            : _password

                # csrf token options
                csrf_parameter                : _csrf_token
#                intention                     : authenticate

            remember_me:
                # On définit la clé pour le remember_me (%secret% est un parametre de parameters.ini)
                key                           : %secret%

            # On autorise les utilisateurs anonymes (non identifiés)
            anonymous                         : true

            logout:
                path                          : fos_user_security_logout
                target                        : ~ #fos_user_security_login
                success_handler               : redirect.after.logout
#                success_handler               : ccdn_user_security.component.authentication.handler.logout_success_handler
            switch_user                       : true

#        member:
#             pattern                          : ^/
#             http_basic                       : true
#             form_login                       : true
#             anonymous                        : true
#
#        admin:
#             pattern                          : ^/
#             http_basic                       : true
#             form_login                       : true
#             anonymous                        : true
#        api:
#            pattern: ^/                                # All URLs are protected
##            fos_oauth: true                            # OAuth2 protected resource
#            stateless: true                            # Do no set session cookies
#            anonymous: false                           # Anonymous access is not allowed
    role_hierarchy:
        ROLE_ADMIN        :      [ROLE_USER, ROLE_MODERATOR, ROLE_EDITOR]
        ROLE_SUPER_ADMIN  :      [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
        ROLE_MODERATOR    :      [ROLE_USER]
        ROLE_EDITOR       :      [ROLE_USER]

    access_control:
        - { path: ^/(login$|register|resetting) , role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/_internal/secure, roles: IS_AUTHENTICATED_ANONYMOUSLY, ip: 127.0.0.1 }
        - { path: /member , roles: ROLE_USER}
        - { path: /admin , roles: ROLE_ADMIN}
        - { path: /member , roles: ROLE_MODERATOR}
        - { path: /editor , roles: ROLE_EDITOR}
        - { path: ^/efconnect, role: ROLE_EDITOR }
        - { path: ^/elfinder, role: ROLE_EDITOR }

the think very strange is that this fos:user:promote xorg ROLE_ADMIN work well. i try to delete all the database and re-create the same probleme, i try commande line in cmd (Admin) the same, try to clear:cache, to restart apache, restart computer [...] style same probleme.

can you give same help.

thank's

xorgxx commented 8 years ago

2016-01-17_18-54-01

2016-01-17_19-06-31

xabbuh commented 8 years ago

Looks like your ItemsStatusUpdater listener performs checks with isGranted() during the Doctrine persistence lifecycle letting your application fail when there is no security token (for example, on the command-line).

xorgxx commented 8 years ago

yes, thank. but what can i do to fix this ? go back to symfony 2.3 or maybe extend all controller FosuserBundle.

stof commented 8 years ago

@xorgxx fix your own code to handle the case where there is no token in the storage. the bug is in your ItemsStatusUpdater, not in FOSUserBundle.

xorgxx commented 8 years ago

thank. now i know more abort in symfony. i find the probleme in MY CODE and i will fix.