djoos / EscapeWSSEAuthenticationBundle

Symfony bundle to implement WSSE authentication
http://symfony.com/doc/current/cookbook/security/custom_authentication_provider.html
137 stars 59 forks source link

Enable specific provider for WSSE authentication. #55

Closed xelaris closed 9 years ago

xelaris commented 9 years ago

This pull request adds the 'provider' configuration node, to use a specific provider for WSSE authentication. See example at http://symfony.com/doc/current/book/security.html#using-multiple-user-providers, where a specific provider is used for http_basic authentication.

The configuration is utilized by \Symfony\Bundle\SecurityBundle\DependencyInjection\SecurityExtension::createAuthenticationListeners() (line 399 in SF 2.6.1)

$userProvider = isset($firewall[$key]['provider']) ? $this->getUserProviderId($firewall[$key]['provider']) : $defaultProvider;

E.g. this configuration node is added by \Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AbstractFactory for form based authentication (FormLoginFactory and SimpleFormFactory) and by HttpBasicFactory.

Since the password for WSSE has to be stored unhashed, as against to other authentication mechanisms like http basic, the same user provider can not be used for both mechanisms and thus it would be worthwhile to separate the providers.

djoos commented 9 years ago

Thanks for the PR @xelaris! This was actually the last bit I was still needing to address in #54...

Kind regards, David

djoos commented 9 years ago

Thanks for your contribution @xelaris!

Kind regards, David