Separate hard dependency on Account class and introduce a interface

[sorenmalling]

Description

Based on the topic form Discuss "Could we build a version of Flow without doctrine orm / database requirement"

This is a umbrella task on the topic "Move the Security account to it's own package"

Steps to be completed

• [ ] Find out what parts we are going to "free" from the core

  • [ ] Authentication (Provider and token classes)
  • [ ] Authorization
    • [ ] What about the Firewall?
  • [ ] Policy/Roles
  • [ ] Domain related stuff (Model, Repository and Factory)

• [ ] Find out what configurations that will be removed and what effects it have on the core application.

  • [ ] Find out if they can be completely avoided
  • [ ] Find out what would be appropriate defaults

• [ ] Create the "common" security package, containing a interface

  • [ ] Find out how to replace the current Account (model) implementation, with a interface without

• [ ] Create a security package, implementing the Account domain model as we know it today

  • [ ] Based on the UsernamePassword Provider & Token, recreate the same functionality.

Some big questions

How do we handle current migrations that has anything to do with the account table?

How do we ensure that a upgrade to ex. Flow 7, where this concept will be introduced, doesn't break any current usage of the Account and security - what migration wizard steps would we have to take?

Are we looking at extending the current configuration for ex. ViewHelper or other places, where the new AccountInterface is being used? For ex. to determine what provider is used

[sorenmalling]

@albe Hey - can we have this added to 6.2 goal? I will put heart and soul in getting this in :)

[albe]

We can put it on the track for now, but be aware that following our timeline, there is less than a month until release! I'll happily push this as far as it can get in a fully b/c way into the next release, but I can't promise it will pass through this time.

I will consult with Christian when we do want to declare our feature freeze and if the current global situation should have effect on our schedule.

[albe]

We at least have the PasswordUsernameToken stuff in 6.2 - and I guess the breaking changes in the AccountInterface change need to be a bit further investigated and tested. Maybe it's still viable for the 6.3 LTS