当我想使用Symfony创建的REST API对使用WSSE的用户进行身份验证时,我遇到了问题。 我按照网站symfony wsse身份验证(http://symfony.com/doc/current/cookbook/security/custom_authentication_provider.html)上的指南完成了教程(http://obtao.com/blog/2013/06/configure-wsse-on-symfony-with-fosrestbundle/),并使用FOSUserBundle处理用户管理。
默认情况下,我会验证访问资源/ api的请求。 所以我在我的security.yml
security:
encoders:
FOS\UserBundle\Model\UserInterface: sha512
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: ROLE_ADMIN
providers:
fos_userbundle:
id: fos_user.user_provider.username
firewalls:
wsse_secured:
pattern: /api/.*
stateless: true
wsse: true
anonymous : false
#dev:
# pattern: ^/(_(profiler|wdt)|css|images|js)/
# security: false
main:
pattern: ^/
form_login:
provider: fos_userbundle
csrf_provider: form.csrf_provider
logout: true
anonymous: true
access_control:
- { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/, role: ROLE_ADMIN }
要访问我的资源/ api / hello,我添加到我的请求标题:
Authorization: Authorization profile=”UsernameToken”
x-wsse: UsernameToken Username="foo", PasswordDigest="9/dyW92Vp+mWEbyXeblRMqTQSJc=", Nonce="MDc1MGNkZjAwMjNmZjk2YQ==", Created="2014-04-17T16:18:34Z"
但是在发送查询后,我收到了一个错误,并返回给我:
WSSE Login failed for foo. Why? No Authentication Provider found for token of class "Acme \ UserBundle \ Security \ Authentication \ Token \ WsseUserToken".
此错误消息是我的WsseListener类中引发的异常:
try {
$authToken = $this->authenticationManager->authenticate($token);
$this->securityContext->setToken($authToken);
return;
} catch (AuthenticationException $failed) {
$failedMessage = 'WSSE Login failed for '.$token->getUsername().'. Why ? '.$failed->getMessage();
// Deny authentication with a '403 Forbidden' HTTP response
$response = new Response();
$response->setStatusCode(403);
$response->setContent($failedMessage);
$event->setResponse($response);
return;
}
答案 0 :(得分:1)
好的,我刚发现问题......
在我的身份验证方法(WsseProvider Class)中,我确实没有返回任何内容!
之前(没有效果):
public function authenticate(TokenInterface $token)
{
$user = $this->userProvider->loadUserByUsername($token->getUsername());
if(!$user){
throw new AuthenticationException("Bad credentials... Did you forgot your username ?");
}
if ($user &&
$this->validateDigest($token->digest, $token->nonce, $token->created, $user->getPassword())) {
}
}
在(作品):
public function authenticate(TokenInterface $token)
{
$user = $this->userProvider->loadUserByUsername($token->getUsername());
if(!$user){
throw new AuthenticationException("Bad credentials... Did you forgot your username ?");
}
if ($user && $this->validateDigest($token->digest, $token->nonce, $token->created, $user->getPassword())) {
$authenticatedToken = new WsseUserToken($user->getRoles());
$authenticatedToken->setUser($user);
return $authenticatedToken;
}
throw new AuthenticationException('The WSSE authentication failed.');
}
现在一切都好!
答案 1 :(得分:0)
确保apache没有剥离授权标头(默认情况下将其删除)。
您可以通过在.htaccess文件中添加以下行来强制它:
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]