User authentication with a db-backed UserProvider in Silex

Question

I am developing a Silex application, and now I'm in the security phase. I've read all the documentation I've found on the net about this subject, but I have many doubts, and I wish someone would help me, if possible.

Basically I followed this tutorial from Johann Reinke.

and naturally the Silex documentation:

Also everything I found on Google.

But still, I think Silex still lacks a lot of documentation, I am lost in many ways.

My code:

 $app->register(new Silex\Provider\SessionServiceProvider(), array(
  'session.storage.save_path' => __DIR__.'/../vendor/sessions',
 ));

$app->register(new Silex\Provider\DoctrineServiceProvider(), array(
'db.options' => array(
'driver'    => 'pdo_mysql',
'host'      => 'localhost',
'dbname'    => 'dbname',
'user'      => 'someuser',
'password'  => 'somepass',
'charset'   => 'utf8',
),
));



$app['security.encoder.digest'] = $app->share(function ($app) {
    return new MessageDigestPasswordEncoder('sha1', false, 1);
});


$app['security.firewalls'] = array(
    'acceso' => array(
    'pattern' => '^/confirmar',
    'form' => array('login_path' => '/acceso', 'check_path' => '/confirmar/comprobar_acceso'),
    'logout' => array('logout_path' => '/confirmar/salir'),
    'users' => $app->share(function() use ($app) {
     return new Acme\User\UserProvider($app['db']);
    }),
),
);


$app->register(new Silex\Provider\SecurityServiceProvider(array(
'security.firewalls' => $app['security.firewalls'],
'security.access_rules' => array(
array('^/confirmar', 'ROLE_USER'),
),
)));

I have so many doubts in the controller:

$app->match('/acceso', function(Request $request) use ($app) {

$username = $request->get('_username');
$password = $request->get('_password');

if ('POST' == $request->getMethod())
    {
    $user = new Acme\User\UserProvider($app['db']);
    $encoder = $app['security.encoder_factory']->getEncoder($user);
    // compute the encoded password
    $encodedPassword = $encoder->encodePassword($password, $user->getSalt());

    // compare passwords
        if ($user->password == $encodedPassword)
            {
            // set security token into security
            $token = new UsernamePasswordToken($user, $password, '', array('ROLE_USER'));
            $app['security']->setToken($token);
           //return $app->redirect('/jander');
           // redirect or give response here
         } else {
         // error feedback
         }

         }


return $app['twig']->render('login.twig', array(
    'error'         => $app['security.last_error']($request),
    'last_username' => $app['session']->get('_security.last_username'),
));
})
->bind('acceso');

This is my class, User Provider:

// src/Acme/User/UserProvider.php
namespace Acme\User;

use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\User;
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
use Doctrine\DBAL\Connection;




class UserProvider implements UserProviderInterface
{
private $conn;

public function __construct(Connection $conn)
{
    $this->conn = $conn;
}

public function loadUserByUsername($username)
{
    $stmt = $this->conn->executeQuery('SELECT * FROM compradores WHERE idemail = ?', array(strtolower($username)));
    if (!$user = $stmt->fetch()) {
        throw new UsernameNotFoundException(sprintf('Username "%s" does not exist.', $username));
    }

    return new User($user['idemail'], $user['pass'], explode(',', $user['roles']), true, true, true, true);
}

public function refreshUser(UserInterface $user)
{
    if (!$user instanceof User) {
        throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', get_class($user)));
    }

    return $this->loadUserByUsername($user->getUsername());
}

public function supportsClass($class)
{
    return $class === 'Symfony\Component\Security\Core\User\User';
}
}

And my form:

<form action="{{ path('confirmar_comprobar_acceso') }}" method="post">
{{ error }}
<input type="text" name="_username" value="{{ last_username }}" />
<input type="password" name="_password" value="" />
<input type="submit" />
</form>

And this is my mysql table:

id          int(15) 
idemail varchar(255)
nombre  varchar(255) 
apellidos   varchar(255)
telefono    int(11)
activo  tinyint(4)
pass    varchar(40)
roles   varchar(255)
iva         tinyint(4)
nifcif      varchar(255)

I always get a "Bad credentials" response when attempt login. Any ideas? Thanks and Cheers!

Answer 1

At 40 characters, your password field "pass" is probably truncating the encrypted passwords. Try changing the field to varchar(255)