Question

我将HWIOAuthBundle与Symfony 4.1一起使用。

我的自定义用户提供程序被调用并返回有效用户，但是该用户在重定向后未登录。 Web分析器显示：以匿名身份登录；匿名令牌；防火墙主要

为简便起见，我简化了下面的提供程序类，现在仅考虑twitter。 $source周围的条件是，所以我以后可以添加更多。

我已经使用xdebug来确保正在调用loadUserByOauthuserResponse()，并且在新用户的情况下都会创建用户，或者在存在新用户的情况下返回现有用户。

问题：如果loadUserbyOauthUserResponse()返回一个有效的用户实体，那么有什么可能阻止它与该用户创建有效的会话？

<?php

namespace App\Security;

...

class OAuthProvider extends OAuthUserProvider
{
   ...
    public function loadUserByOAuthUserResponse(UserResponseInterface $response): User
    {
        /** @var EntityManager $em */
        $em = $this->container->get('doctrine.orm.entity_manager');
        $repo = $em->getRepository('App:User');

        $source = $response->getResourceOwner()->getName();
        $email = null;
        $data = [];
        $newUser = false;

        // Set email and socialUser.
        if ($source === 'twitter') {
            $data = $response->getData();
            $email = $data['email'];
        }

        // Check if this user already exists in our app.
        $user = $repo->findOneBy(['email' => $email]);

        if ($user === null) {
            $newUser = true;
            $user = new User();
            $user->setPassword($this->strand(32));
        }

        // Set session and user data based on source.
        if ($source === 'twitter') {
            $name = $data['name'];
            if ($newUser) {
                $user->setNickName($name);
                $user->setEmail($email);
                $em->persist($user);
                $em->flush();
            }
        }

        return $user;
    }
}

hwi_oauth.yaml

hwi_oauth:
    # list of names of the firewalls in which this bundle is active, this setting MUST be set
    firewall_names: [main]

    # https://github.com/hwi/HWIOAuthBundle/blob/master/Resources/doc/2-configuring_resource_owners.md
    resource_owners:
        twitter:
            type:                twitter
            client_id:           '%env(TWITTER_ID)%'
            client_secret:       '%env(TWITTER_SECRET)%'
            options:
                include_email: true

services.yaml：

app.oauth_aware.user_provider.service:
    class: App\Security\OAuthProvider
    arguments: ['@service_container']

security.yaml：

security:
    # https://symfony.com/doc/current/book/security.html#where-do-users-come-from-user-providers
    encoders:
        App\Entity\User: bcrypt
    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: ROLE_ADMIN
    providers:
        app_users:
            entity: { class: App\Entity\User, property: email }
        hwi:
            id: app.oauth_aware.user_provider.service
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
            provider: app_users
            anonymous: ~
            remember_me:
                secret: "%env(APP_SECRET)%"
                lifetime: 2592000
                path:  /
            guard:
                authenticators:
                    - App\Security\LoginFormAuthenticator
                entry_point: App\Security\LoginFormAuthenticator
            logout:
                path: /logout
                target: /
            oauth:
                resource_owners:
                    twitter: "/login/check-twitter"
                default_target_path: /
                login_path: /
                failure_path: /user-login
                oauth_user_provider:
                    service: app.oauth_aware.user_provider.service
            switch_user: ~

    access_control:
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/recover, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/, role: ROLE_ADMIN }

Answer 1

我遇到了同样的问题，直到在日志中发现“尝试刷新令牌后，令牌已取消身份验证”。之后，我找到了解决方案。 Token was deauthenticated after trying to refresh it

我添加了isEqualTo，但没有注销我。

HWIOAuthBundle自定义用户提供者将无法登录用户

1 个答案: