Skip to content

[4.4][Security] Password migration with guards #12853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 1, 2020
Merged

[4.4][Security] Password migration with guards #12853

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 29 additions & 2 deletions security/password_migration.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,14 +119,41 @@ Upgrade the Password

Upon successful login, the Security system checks whether a better algorithm
is available to hash the user's password. If it is, it'll hash the correct
password using the new hash. You can enable this behavior by implementing how
this newly hashed password should be stored:
password using the new hash. If you use a Guard authenticator, you first need to
`provide the original password to the Security system <Provide the Password when using Guards>`_.

You can enable the upgrade behavior by implementing how this newly hashed
password should be stored:

* `When using Doctrine's entity user provider <Upgrade the Password when using Doctrine>`_
* `When using a custom user provider <Upgrade the Password when using a custom User Provider>`_

After this, you're done and passwords are always hashed as secure as possible!

Provide the Password when using Guard
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

When you're using a custom :doc:`guard authenticator </security/guard_authentication>`,
you need to implement :class:`Symfony\\Component\\Security\\Guard\\PasswordAuthenticatedInterface`.
This interface defines a ``getPassword()`` method that returns the password
for this login request. This password is used in the migration process::

// src/Security/CustomAuthenticator.php
namespace App\Security;

use Symfony\Component\Security\Guard\PasswordAuthenticatedInterface;
// ...
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing the use of AbstractGuardAuthenticator no?


class CustomAuthenticator extends AbstractGuardAuthenticator implements PasswordAuthenticatedInterface
{
// ...

public function getPassword($credentials): ?string
{
return $credentials['password'];
}
}

Upgrade the Password when using Doctrine
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Expand Down