[Security] Remove everything related to the deprecated authentication manager #41613

wouterj · 2021-06-08T11:02:56Z

Q	A
Branch?	6.0
Bug fix?	no
New feature?	no
Deprecations?	no
Tickets	-
License	MIT
Doc PR	-

This PR removes all deprecations from the security packages.

Some previously deprecated methods are now marked as @internal (e.g. loadUserByUsername() in the LDAP user provider) in order to remain compatible with Symfony 5.4.

...Bundle/SecurityBundle/DependencyInjection/Security/Factory/AuthenticatorFactoryInterface.php

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

src/Symfony/Component/Security/Core/Authorization/AuthorizationChecker.php

src/Symfony/Component/Security/Core/Authorization/ExpressionLanguageProvider.php

src/Symfony/Component/Security/Core/Authorization/Voter/AuthenticatedVoter.php

src/Symfony/Component/HttpFoundation/Response.php

src/Symfony/Bundle/SecurityBundle/DataCollector/SecurityDataCollector.php

src/Symfony/Bundle/SecurityBundle/Command/DebugFirewallCommand.php

src/Symfony/Component/Security/Http/Firewall/AccessListener.php

src/Symfony/Component/Security/Core/Authentication/Token/AnonymousToken.php

src/Symfony/Component/Security/Core/Tests/Authorization/ExpressionLanguageTest.php

src/Symfony/Component/Security/Http/EntryPoint/FormAuthenticationEntryPoint.php

src/Symfony/Bundle/SecurityBundle/Security/FirewallConfig.php

chalasr

🎉🎉🎉 Thanks Wouter!

Some minor comments below.
Let's split and share the deprecation work that needs to be done for 5.4 before merging this one.
Some minor comments

src/Symfony/Bundle/SecurityBundle/Resources/views/Collector/security.html.twig

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

…ion on no token" (wouterj) This PR was merged into the 5.4 branch. Discussion ---------- [Security] Deprecate "always authenticate" and "exception on no token" | Q | A | ------------- | --- | Branch? | 5.4 | Bug fix? | no | New feature? | no | Deprecations? | yes | Tickets | Ref #41613 | License | MIT | Doc PR | n/a Commits ------- 4bba287 [Security] Deprecate "always authenticate" and "exception on no token"

…)` (chalasr) This PR was merged into the 5.4 branch. Discussion ---------- [Security] Deprecate `TokenInterface::isAuthenticated()` | Q | A | ------------- | --- | Branch? | 5.4 | Bug fix? | no | New feature? | yes | Deprecations? | no | Tickets | - | License | MIT | Doc PR | todo From #41613 (comment) > all unauthenticated token use-cases have been replaced with passports (and the removal of anonymous). This means that if you have a token, it should always be authenticated. Commits ------- 33b8fbd [Security] Deprecate `TokenInterface::isAuthenticated()` and `setAuthenticated()`

…)` (chalasr) This PR was merged into the 5.4 branch. Discussion ---------- [Security] Deprecate `TokenInterface::isAuthenticated()` | Q | A | ------------- | --- | Branch? | 5.4 | Bug fix? | no | New feature? | yes | Deprecations? | no | Tickets | - | License | MIT | Doc PR | todo From symfony/symfony#41613 (comment) > all unauthenticated token use-cases have been replaced with passports (and the removal of anonymous). This means that if you have a token, it should always be authenticated. Commits ------- 33b8fbdd8a [Security] Deprecate `TokenInterface::isAuthenticated()` and `setAuthenticated()`

src/Symfony/Component/Security/Core/Authentication/AuthenticationTrustResolverInterface.php

…rity factories (wouterj) This PR was merged into the 5.4 branch. Discussion ---------- [SecurityBundle] Create a smooth upgrade path for security factories | Q | A | ------------- | --- | Branch? | 5.4 | Bug fix? | no | New feature? | yes | Deprecations? | yes | Tickets | Ref #41613 (comment) | License | MIT | Doc PR | - This change allows removing `SecurityFactoryInterface` in Symfony 6. I've also changed the discrete ordering using "listener positions" to the much more common continuous ordering using priorities. I feel like priorities are much more self-explanatory. Commits ------- 7385fd5 [SecurityBundle] Create a smooth upgrade path for security factories

This PR was merged into the 5.4 branch. Discussion ---------- [Security] Deprecate legacy signatures | Q | A | ------------- | --- | Branch? | 5.4 | Bug fix? | no | New feature? | no | Deprecations? | yes | Tickets | Ref #41613 | License | MIT | Doc PR | n/a Deprecates the left-over legacy constructor signatures in the Security system. Commits ------- bbc00c8 [Security] Deprecate legacy signatures

wouterj · 2021-08-17T16:44:23Z

🟢 !

~~The remaining deps=high failures are unrelated to changes in this PR.~~ Also updated the PR description, this is no longer a todo list :)
Happy reviewing! 😉

nicolas-grekas

Only minor things on my side after a quick review.
Thank you so much for working on this!

...Bundle/SecurityBundle/DependencyInjection/Security/Factory/AuthenticatorFactoryInterface.php

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

src/Symfony/Bundle/SecurityBundle/SecurityBundle.php

...ecurityBundle/Tests/Functional/Bundle/RememberMeBundle/Security/UserChangingUserProvider.php

src/Symfony/Component/PasswordHasher/Tests/Hasher/UserPasswordHasherTest.php

… manager

nicolas-grekas · 2021-08-18T13:00:30Z

Thank you @wouterj.

wouterj · 2021-08-18T13:21:27Z

🎉 thank you for eviewing and merging!

This PR was merged into the 6.0 branch. Discussion ---------- [SecurityBundle] Remove forgotten unused code | Q | A | ------------- | --- | Branch? | 6.0 | Bug fix? | no | New feature? | no | Deprecations? | no | Tickets | - | License | MIT | Doc PR | - Forgotten in #41613 Commits ------- 9d35f00 [SecurityBundle] Remove forgotten unused code

…ute from the XSD (MatTheCat) This PR was merged into the 6.4 branch. Discussion ---------- [SecurityBundle] Remove unused memory users’ `name` attribute from the XSD | Q | A | ------------- | --- | Branch? | 6.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Issues | N/A | License | MIT The related config has been deprecated in #40403 and removed in #41613. Commits ------- 656f498 [SecurityBundle] Remove unused memory users’ `name` attribute from the XSD

…ibute from the XSD (MatTheCat) This PR was merged into the 6.4 branch. Discussion ---------- [SecurityBundle] Remove unused memory users’ `name` attribute from the XSD | Q | A | ------------- | --- | Branch? | 6.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Issues | Fix cdb8354 | License | MIT #57520 has been reverted because > [The] change […] risks that someone receives errors on the next patch release if their XML config still makes use of the now removed attribute. But nobody could use it since v6.0: as #41613 removed the BC layer, the config would crash. Keeping `name` in the XSD for 6.4, 7.0 and 7.1 branches means people using these versions would have their IDE suggesting an attribute which would make their app crash. Commits ------- ed5c26c [SecurityBundle] Remove unused memory users’ `name` attribute from the XSD

…tTheCat) This PR was merged into the 6.4 branch. Discussion ---------- [SecurityBundle] Remove `AnonymousFactory` leftovers | Q | A | ------------- | --- | Branch? | 6.4 | Bug fix? | no | New feature? | no | Deprecations? | no | Issues | N/A | License | MIT The `AnonymousFactory` was removed in #41613 but the related configuration was still referenced in the `SecurityExtension`. (Not sure about the target branch since this isn’t a bugfix.) Commits ------- 0bd8eb2 [SecurityBundle] Remove `AnonymousFactory` leftovers

wouterj added this to the 6.0 milestone Jun 8, 2021

wouterj requested a review from chalasr as a code owner June 8, 2021 11:02

carsonbot added Status: Needs Work Status: Needs Review Security labels Jun 8, 2021

carsonbot changed the title ~~[WIP][Security] Remove everything related to the deprecated authentication manager~~ [Security] [WIP] Remove everything related to the deprecated authentication manager Jun 8, 2021

wouterj commented Jun 8, 2021

View reviewed changes

src/Symfony/Component/Security/Core/Authentication/Token/AnonymousToken.php Show resolved Hide resolved

src/Symfony/Component/Security/Core/Tests/Authorization/ExpressionLanguageTest.php Outdated Show resolved Hide resolved

wouterj force-pushed the security/remove-authenticator-deprecations branch from db6d1bc to 133675b Compare June 8, 2021 11:18

wouterj commented Jun 8, 2021

View reviewed changes

src/Symfony/Component/Security/Http/EntryPoint/FormAuthenticationEntryPoint.php Show resolved Hide resolved

wouterj force-pushed the security/remove-authenticator-deprecations branch from 133675b to ea1395b Compare June 8, 2021 12:28

wouterj commented Jun 8, 2021

View reviewed changes

src/Symfony/Bundle/SecurityBundle/Security/FirewallConfig.php Show resolved Hide resolved

wouterj force-pushed the security/remove-authenticator-deprecations branch from ea1395b to c5d60fb Compare June 8, 2021 12:30

chalasr reviewed Jun 13, 2021

View reviewed changes

src/Symfony/Bundle/SecurityBundle/Resources/views/Collector/security.html.twig Show resolved Hide resolved

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php Outdated Show resolved Hide resolved

wouterj mentioned this pull request Jun 20, 2021

[SecurityBundle] Create a smooth upgrade path for security factories #41754

Merged

wouterj mentioned this pull request Jul 3, 2021

[Security] Deprecate "always authenticate" and "exception on no token" #41965

Merged

chalasr mentioned this pull request Jul 10, 2021

[Security] Deprecate TokenInterface::isAuthenticated() #42050

Merged

chalasr reviewed Jul 14, 2021

View reviewed changes

src/Symfony/Component/Security/Core/Authentication/AuthenticationTrustResolverInterface.php Show resolved Hide resolved

wouterj mentioned this pull request Aug 7, 2021

[Security] Deprecate legacy signatures #42420

Merged

wouterj mentioned this pull request Aug 8, 2021

[Security] Deprecate AnonymousToken, non-UserInterface users, and token credentials #42423

Merged

nicolas-grekas mentioned this pull request Aug 12, 2021

Add return types everywhere possible #42496

Closed

wouterj force-pushed the security/remove-authenticator-deprecations branch from c5d60fb to 199c99c Compare August 12, 2021 10:31

wouterj force-pushed the security/remove-authenticator-deprecations branch 2 times, most recently from 1c241ff to 37ea08f Compare August 17, 2021 16:38

wouterj changed the title ~~[Security] [WIP] Remove everything related to the deprecated authentication manager~~ [Security] Remove everything related to the deprecated authentication manager Aug 17, 2021

wouterj force-pushed the security/remove-authenticator-deprecations branch 3 times, most recently from 026a480 to c242a87 Compare August 18, 2021 09:33

nicolas-grekas approved these changes Aug 18, 2021

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels Aug 18, 2021

wouterj force-pushed the security/remove-authenticator-deprecations branch 2 times, most recently from 4934d38 to 24ad008 Compare August 18, 2021 12:49

[Security] Remove everything related to the deprecated authentication…

922c131

… manager

nicolas-grekas force-pushed the security/remove-authenticator-deprecations branch from 24ad008 to 922c131 Compare August 18, 2021 13:00

nicolas-grekas mentioned this pull request Aug 18, 2021

[Security] Remove everything related to the deprecated authentication m… symfony/symfony-docs#15724

Closed

nicolas-grekas merged commit 61cf95e into symfony:6.0 Aug 18, 2021

wouterj deleted the security/remove-authenticator-deprecations branch August 18, 2021 13:20

fabpot mentioned this pull request Nov 5, 2021

Release v6.0.0-BETA1 #43939

Merged

fancyweb mentioned this pull request Apr 20, 2022

[SecurityBundle] Remove forgotten unused code #46130

Merged

jmikola mentioned this pull request Feb 22, 2023

Add Symfony 6 support jmikola/AutoLogin#26

Closed

Seb33300 mentioned this pull request Aug 9, 2023

Deprecate require_previous_session firewall option #51318

Closed

MatTheCat mentioned this pull request Jun 25, 2024

[SecurityBundle] Remove unused memory users’ name attribute from the XSD #57520

Merged

MatTheCat mentioned this pull request Jun 28, 2024

[SecurityBundle] Remove unused memory users’ name attribute from the XSD #57578

Merged

MatTheCat mentioned this pull request Jun 1, 2025

[SecurityBundle] Remove AnonymousFactory leftovers #60613

Merged

Uh oh!

[Security] Remove everything related to the deprecated authentication manager #41613

[Security] Remove everything related to the deprecated authentication manager #41613

Uh oh!

Conversation

wouterj commented Jun 8, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chalasr left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wouterj commented Aug 17, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicolas-grekas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nicolas-grekas commented Aug 18, 2021

Uh oh!

wouterj commented Aug 18, 2021

Uh oh!

Uh oh!

wouterj commented Jun 8, 2021 •

edited

Loading

chalasr left a comment •

edited

Loading

wouterj commented Aug 17, 2021 •

edited

Loading