vendor/ibexa/core/src/lib/MVC/Symfony/Security/Authentication/RepositoryAuthenticationProvider.php line 23

Open in your IDE?
  1. <?php
  3. /**
  4.  * @copyright Copyright (C) Ibexa AS. All rights reserved.
  5.  * @license For full copyright and license information view LICENSE file distributed with this source code.
  6.  */
  7. namespace Ibexa\Core\MVC\Symfony\Security\Authentication;
  9. use Ibexa\Bundle\Core\DependencyInjection\Compiler\SecurityPass;
  10. use Ibexa\Contracts\Core\Repository\Exceptions\PasswordInUnsupportedFormatException;
  11. use Ibexa\Contracts\Core\Repository\PermissionResolver;
  12. use Ibexa\Contracts\Core\Repository\UserService;
  13. use Ibexa\Core\MVC\Symfony\Security\UserInterface as IbexaUserInterface;
  14. use Ibexa\Core\Repository\User\Exception\UnsupportedPasswordHashType;
  15. use Psr\Log\LoggerAwareInterface;
  16. use Psr\Log\LoggerAwareTrait;
  17. use Symfony\Component\Security\Core\Authentication\Provider\DaoAuthenticationProvider;
  18. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  19. use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
  20. use Symfony\Component\Security\Core\Exception\BadCredentialsException;
  21. use Symfony\Component\Security\Core\User\UserInterface;
  23. class RepositoryAuthenticationProvider extends DaoAuthenticationProvider implements LoggerAwareInterface
  24. {
  25.     use LoggerAwareTrait;
  27.     /** @var float|null */
  28.     private $constantAuthTime;
  30.     /** @var \Ibexa\Contracts\Core\Repository\PermissionResolver */
  31.     private $permissionResolver;
  33.     /** @var \Ibexa\Contracts\Core\Repository\UserService */
  34.     private $userService;
  36.     public function setConstantAuthTime(float $constantAuthTime)
  37.     {
  38.         $this->constantAuthTime = $constantAuthTime;
  39.     }
  41.     public function setPermissionResolver(PermissionResolver $permissionResolver)
  42.     {
  43.         $this->permissionResolver = $permissionResolver;
  44.     }
  46.     public function setUserService(UserService $userService)
  47.     {
  48.         $this->userService = $userService;
  49.     }
  51.     protected function checkAuthentication(UserInterface $user, UsernamePasswordToken $token)
  52.     {
  53.         if (!$user instanceof IbexaUserInterface) {
  54.             parent::checkAuthentication($user, $token);
  56.             return;
  57.         }
  59.         $apiUser = $user->getAPIUser();
  61.         // $currentUser can either be an instance of UserInterface or just the username (e.g. during form login).
  62.         /** @var \Ibexa\Core\MVC\Symfony\Security\UserInterface|string $currentUser */
  63.         $currentUser = $token->getUser();
  64.         if ($currentUser instanceof UserInterface) {
  65.             if ($currentUser->getAPIUser()->passwordHash !== $apiUser->passwordHash) {
  66.                 throw new BadCredentialsException('The credentials were changed in another session.');
  67.             }
  69.             $apiUser = $currentUser->getAPIUser();
  70.         } else {
  71.             $credentialsValid = $this->userService->checkUserCredentials($apiUser, $token->getCredentials());
  73.             if (!$credentialsValid) {
  74.                 throw new BadCredentialsException('Invalid credentials', 0);
  75.             }
  76.         }
  78.         // Finally inject current user in the Repository
  79.         $this->permissionResolver->setCurrentUserReference($apiUser);
  80.     }
  82.     /**
  83.      * @throws \Ibexa\Contracts\Core\Repository\Exceptions\PasswordInUnsupportedFormatException
  84.      */
  85.     public function authenticate(TokenInterface $token)
  86.     {
  87.         $startTime = $this->startConstantTimer();
  89.         try {
  90.             $result = parent::authenticate($token);
  91.         } catch (UnsupportedPasswordHashType $exception) {
  92.             $this->sleepUsingConstantTimer($startTime);
  93.             throw new PasswordInUnsupportedFormatException($exception);
  94.         } catch (\Exception $e) {
  95.             $this->sleepUsingConstantTimer($startTime);
  96.             throw $e;
  97.         }
  99.         $this->sleepUsingConstantTimer($startTime);
  101.         return $result;
  102.     }
  104.     private function startConstantTimer()
  105.     {
  106.         return microtime(true);
  107.     }
  109.     private function sleepUsingConstantTimer(float $startTime): void
  110.     {
  111.         if ($this->constantAuthTime <= 0.0) {
  112.             return;
  113.         }
  115.         $remainingTime = $this->constantAuthTime - (microtime(true) - $startTime);
  116.         if ($remainingTime > 0) {
  117.             usleep($remainingTime * 1000000);
  118.         } elseif ($this->logger) {
  119.             $this->logger->warning(
  120.                 sprintf(
  121.                     'Authentication took longer than the configured constant time. Consider increasing the value of %s',
  122.                     SecurityPass::CONSTANT_AUTH_TIME_SETTING
  123.                 ),
  124.                 [static::class]
  125.             );
  126.         }
  127.     }
  128. }
  130. class_alias(RepositoryAuthenticationProvider::class, 'eZ\Publish\Core\MVC\Symfony\Security\Authentication\RepositoryAuthenticationProvider');