Password entered in custom login form doesn't get encoded

[bsus]

Hi,

I have the issue that I the Symfony Security System doesn't accept my entered password.

I have a registered user in the database with salt and password. Password got encoded via the encoderFactory and seems valid (checked with online hash tool).

The Security System gets the user object from an custom user provider, similar to the one in the cookbook:

Code: Select all

<?php

namespace Acme\WebserviceUserBundle\Security\User;

use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
use Symfony\Component\Security\Core\Exception\UnsupportedUserException;

class WebserviceUserProvider implements UserProviderInterface
{
    public function loadUserByUsername($username)
    {
        // make a call to your webservice here
        // $userData = ...
        // pretend it returns an array on success, false if there is no user

        if ($userData) {
            // $password = '...';
            // ...

            return new WebserviceUser($username, $password, $salt, $roles)
        } else {
            throw new UsernameNotFoundException(sprintf('Username "%s" does not exist.', $username));
        }
    }

    public function refreshUser(UserInterface $user)
    {
        if (!$user instanceof WebserviceUser) {
            throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', get_class($user)));
        }

        return $this->loadUserByUsername($user->getUsername());
    }

    public function supportsClass($class)
    {
        return $class === 'Acme\WebserviceUserBundle\Security\User\WebserviceUser';
    }
}

This is the security.yml

Code: Select all

security:
    encoders:
        KSR\SecurityBundle\Model\UserInterface:
            algorithm: sha512
            encode_as_base64: false
            iterations: 1

    providers:
        service:
            id: security.user_provider

    firewalls:
        main:
            pattern: ^/
            form_login:
                provider: service
#                csrf_provider: form.csrf_provider
            logout: true
            anonymous: true

Anyone some suggestions where to start debugging?

Regards,
bsus

[bsus]

I var_dumped the encoder:

Code: Select all

object(Symfony\Component\Security\Core\Encoder\MessageDigestPasswordEncoder)#39 (3) { ["algorithm":"Symfony\Component\Security\Core\Encoder\MessageDigestPasswordEncoder":private]=> string(6) "sha512" ["encodeHashAsBase64":"Symfony\Component\Security\Core\Encoder\MessageDigestPasswordEncoder":private]=> bool(true) ["iterations"]=> int(5000) }


Than I dumped the errors in the loginAction of the SecurityController:

Code: Select all

        if ($request->attributes->has(SecurityContext::AUTHENTICATION_ERROR)) {
            $error = $request->attributes->get(SecurityContext::AUTHENTICATION_ERROR);
        } else {
            $error = $session->get(SecurityContext::AUTHENTICATION_ERROR);
            $session->remove(SecurityContext::AUTHENTICATION_ERROR);
        }

        var_dump($error)

and found the same encoder settings,

So the encoder works fine.

But what goes than wrong?

[bsus]

So finally solved the issue...


When updating the user the password starts to encode the password again out of the empty plainPassword property