fix login sql : ajout d'un retry sur le login, suppression des options #45
|
@ -32,21 +32,9 @@ class SecurityController extends AbstractController
|
|||
$loginForm->addError(new FormError($trans->trans('error.login', [], 'messages')));
|
||||
$request->getSession()->remove(SQLLoginUserAuthenticator::ERROR_LOGIN);
|
||||
}
|
||||
if ($request->getSession()->has(SQLLoginUserAuthenticator::ERROR_PDO)) {
|
||||
$loginForm->addError(new FormError($trans->trans('error.pdo', [], 'messages')));
|
||||
$request->getSession()->remove(SQLLoginUserAuthenticator::ERROR_PDO);
|
||||
}
|
||||
if ($request->getSession()->has(SQLLoginUserAuthenticator::ERROR_CONFIGURATION)) {
|
||||
$loginForm->addError(new FormError($trans->trans('error.configuration', [], 'messages')));
|
||||
$request->getSession()->remove(SQLLoginUserAuthenticator::ERROR_CONFIGURATION);
|
||||
}
|
||||
if ($request->getSession()->has(SQLLoginUserAuthenticator::ERROR_DATA_TO_FETCH_CONFIGURATION)) {
|
||||
$loginForm->addError(new FormError($trans->trans('error.data_to_fetch_configuration', [], 'messages')));
|
||||
$request->getSession()->remove(SQLLoginUserAuthenticator::ERROR_DATA_TO_FETCH_CONFIGURATION);
|
||||
}
|
||||
if ($request->getSession()->has(SQLLoginUserAuthenticator::ERROR_SECURITY_PATTERN_CONFIGURATION)) {
|
||||
$loginForm->addError(new FormError($trans->trans('error.security_pattern_configuration', [], 'messages')));
|
||||
$request->getSession()->remove(SQLLoginUserAuthenticator::ERROR_SECURITY_PATTERN_CONFIGURATION);
|
||||
if ($request->getSession()->has(SQLLoginUserAuthenticator::TECHNICAL_ERROR)) {
|
||||
$loginForm->addError(new FormError($trans->trans('error.technical', [], 'messages')));
|
||||
$request->getSession()->remove(SQLLoginUserAuthenticator::TECHNICAL_ERROR);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
@ -3,14 +3,20 @@
|
|||
namespace App\Hydra;
|
||||
|
||||
use App\Hydra\Exception\InvalidChallengeException;
|
||||
use Exception;
|
||||
use Symfony\Contracts\HttpClient\HttpClientInterface;
|
||||
use Symfony\Contracts\HttpClient\ResponseInterface;
|
||||
|
||||
class Client
|
||||
{
|
||||
protected $client;
|
||||
|
||||
protected $hydraAdminBaseUrl;
|
||||
private HttpClientInterface $client;
|
||||
private const MAX_RETRY = 3;
|
||||
private const SLEEP_TIME = [
|
||||
5,
|
||||
500,
|
||||
5000,
|
||||
];
|
||||
private string $hydraAdminBaseUrl;
|
||||
|
||||
public function __construct(HttpClientInterface $client, string $hydraAdminBaseUrl)
|
||||
{
|
||||
|
@ -22,11 +28,11 @@ class Client
|
|||
{
|
||||
$response = $this->client->request(
|
||||
'GET',
|
||||
$this->hydraAdminBaseUrl . '/oauth2/auth/requests/login',
|
||||
$this->hydraAdminBaseUrl.'/oauth2/auth/requests/login',
|
||||
[
|
||||
'query' => [
|
||||
'login_challenge' => $loginChallenge,
|
||||
]
|
||||
],
|
||||
]
|
||||
);
|
||||
|
||||
|
@ -35,7 +41,6 @@ class Client
|
|||
throw new InvalidChallengeException();
|
||||
}
|
||||
|
||||
|
||||
return $response;
|
||||
}
|
||||
|
||||
|
@ -43,11 +48,11 @@ class Client
|
|||
{
|
||||
$response = $this->client->request(
|
||||
'GET',
|
||||
$this->hydraAdminBaseUrl . '/oauth2/auth/requests/logout',
|
||||
$this->hydraAdminBaseUrl.'/oauth2/auth/requests/logout',
|
||||
[
|
||||
'query' => [
|
||||
'logout_challenge' => $logoutChallenge,
|
||||
]
|
||||
],
|
||||
]
|
||||
);
|
||||
|
||||
|
@ -56,27 +61,38 @@ class Client
|
|||
throw new InvalidChallengeException();
|
||||
}
|
||||
|
||||
|
||||
return $response;
|
||||
}
|
||||
|
||||
public function fetchConsentRequestInfo(string $consentChallenge): ResponseInterface
|
||||
{
|
||||
$attempt = 0;
|
||||
while ($attempt < self::MAX_RETRY) {
|
||||
$response = $this->client->request(
|
||||
'GET',
|
||||
$this->hydraAdminBaseUrl . '/oauth2/auth/requests/consent',
|
||||
$this->hydraAdminBaseUrl.'/oauth2/auth/requests/consent',
|
||||
[
|
||||
'query' => [
|
||||
'consent_challenge' => $consentChallenge,
|
||||
]
|
||||
],
|
||||
]
|
||||
);
|
||||
|
||||
switch ($response->getStatusCode()) {
|
||||
$status = $response->getStatusCode();
|
||||
if (503 === $status) {
|
||||
++$attempt;
|
||||
usleep(1000 * self::SLEEP_TIME[$attempt] + rand(1, 5) * 1000);
|
||||
continue;
|
||||
}
|
||||
switch ($status) {
|
||||
case 404:
|
||||
throw new InvalidChallengeException();
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
if (self::MAX_RETRY === $attempt) {
|
||||
throw new Exception(sprintf('Fetch consent a rencontré une erreur %s après %s tentatives', $response->getStatusCode(), self::MAX_RETRY));
|
||||
}
|
||||
|
||||
return $response;
|
||||
}
|
||||
|
@ -85,13 +101,13 @@ class Client
|
|||
{
|
||||
$response = $this->client->request(
|
||||
'PUT',
|
||||
$this->hydraAdminBaseUrl . '/oauth2/auth/requests/login/accept',
|
||||
$this->hydraAdminBaseUrl.'/oauth2/auth/requests/login/accept',
|
||||
[
|
||||
'query' => [
|
||||
'login_challenge' => $loginChallenge,
|
||||
],
|
||||
'headers' => [
|
||||
'Content-Type' => 'application/json'
|
||||
'Content-Type' => 'application/json',
|
||||
],
|
||||
'body' => json_encode($payload),
|
||||
]
|
||||
|
@ -104,13 +120,13 @@ class Client
|
|||
{
|
||||
$response = $this->client->request(
|
||||
'PUT',
|
||||
$this->hydraAdminBaseUrl . '/oauth2/auth/requests/consent/accept',
|
||||
$this->hydraAdminBaseUrl.'/oauth2/auth/requests/consent/accept',
|
||||
[
|
||||
'query' => [
|
||||
'consent_challenge' => $consentChallenge,
|
||||
],
|
||||
'headers' => [
|
||||
'Content-Type' => 'application/json'
|
||||
'Content-Type' => 'application/json',
|
||||
],
|
||||
'body' => json_encode($payload),
|
||||
]
|
||||
|
@ -123,13 +139,13 @@ class Client
|
|||
{
|
||||
$response = $this->client->request(
|
||||
'PUT',
|
||||
$this->hydraAdminBaseUrl . '/oauth2/auth/requests/logout/accept',
|
||||
$this->hydraAdminBaseUrl.'/oauth2/auth/requests/logout/accept',
|
||||
[
|
||||
'query' => [
|
||||
'logout_challenge' => $logoutChallenge,
|
||||
],
|
||||
'headers' => [
|
||||
'Content-Type' => 'application/json'
|
||||
'Content-Type' => 'application/json',
|
||||
],
|
||||
]
|
||||
);
|
||||
|
|
|
@ -4,6 +4,6 @@ namespace App\SQLLogin\Exception;
|
|||
|
||||
use Exception;
|
||||
|
||||
class DatabaseConnectionException extends Exception
|
||||
class EmptyResultException extends Exception
|
||||
{
|
||||
}
|
|
@ -1,9 +0,0 @@
|
|||
<?php
|
||||
|
||||
namespace App\SQLLogin\Exception;
|
||||
|
||||
use Exception;
|
||||
|
||||
class InvalidSQLLoginAlgoException extends Exception
|
||||
{
|
||||
}
|
|
@ -1,9 +0,0 @@
|
|||
<?php
|
||||
|
||||
namespace App\SQLLogin\Exception;
|
||||
|
||||
use Exception;
|
||||
|
||||
class LoginElementsConfigurationException extends Exception
|
||||
{
|
||||
}
|
|
@ -1,9 +0,0 @@
|
|||
<?php
|
||||
|
||||
namespace App\SQLLogin\Exception;
|
||||
|
||||
use Exception;
|
||||
|
||||
class NullPasswordColumnNameException extends Exception
|
||||
{
|
||||
}
|
|
@ -24,12 +24,6 @@ class SQLLoginConnect extends AbstractController
|
|||
|
||||
public function connect($urlDatabase, $dbUser, $dbPassword): PDO
|
||||
{
|
||||
$options = [
|
||||
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
|
||||
PDO::ATTR_TIMEOUT => 5,
|
||||
PDO::ATTR_PERSISTENT => false,
|
||||
];
|
||||
|
||||
return new PDO($urlDatabase, $dbUser, $dbPassword, $options);
|
||||
return new PDO($urlDatabase, $dbUser, $dbPassword);
|
||||
}
|
||||
}
|
||||
|
|
|
@ -88,7 +88,7 @@ class PasswordEncoder implements LegacyPasswordHasherInterface
|
|||
foreach ($this->securityPattern as $term) {
|
||||
if (self::PEPPER_PATTERN !== $term && self::PASSWORD_PATTERN !== $term && self::SALT_PATTERN !== $term) {
|
||||
$this->loggerInterface->critical('La configuration du security pattern est invalide, les termes autorisés sont : '.self::PASSWORD_PATTERN.', '.self::SALT_PATTERN.' et '.self::PEPPER_PATTERN);
|
||||
throw new SecurityPatternConfigurationException();
|
||||
throw new SecurityPatternConfigurationException('La configuration du security pattern est invalide, les termes autorisés sont : '.self::PASSWORD_PATTERN.', '.self::SALT_PATTERN.' et '.self::PEPPER_PATTERN);
|
||||
}
|
||||
}
|
||||
$completedPlainPassword = '';
|
||||
|
|
|
@ -5,12 +5,12 @@ namespace App\Security;
|
|||
use App\Entity\User;
|
||||
use App\Security\Hasher\PasswordEncoder;
|
||||
use App\Service\SQLLoginService;
|
||||
use App\SQLLogin\Exception\DatabaseConnectionException;
|
||||
use App\SQLLogin\Exception\DataToFetchConfigurationException;
|
||||
use App\SQLLogin\Exception\EmptyResultException;
|
||||
use App\SQLLogin\Exception\InvalidSQLPasswordException;
|
||||
use App\SQLLogin\Exception\LoginElementsConfigurationException;
|
||||
use App\SQLLogin\Exception\SecurityPatternConfigurationException;
|
||||
use App\SQLLogin\SQLLoginRequest;
|
||||
use PDOException;
|
||||
use Symfony\Component\HttpFoundation\RedirectResponse;
|
||||
use Symfony\Component\HttpFoundation\Request;
|
||||
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
|
||||
|
@ -25,11 +25,7 @@ class SQLLoginUserAuthenticator extends AbstractLoginFormAuthenticator
|
|||
{
|
||||
public const LOGIN_ROUTE = 'app_login';
|
||||
public const ERROR_LOGIN = 'error_login';
|
||||
public const ERROR_PDO = 'error_pdo';
|
||||
public const ERROR_SQL_LOGIN = 'error_sql_login';
|
||||
public const ERROR_CONFIGURATION = 'error_configuration';
|
||||
public const ERROR_DATA_TO_FETCH_CONFIGURATION = 'error_data_to_fetch_configuration';
|
||||
public const ERROR_SECURITY_PATTERN_CONFIGURATION = 'error_security_pattern_configuration';
|
||||
public const TECHNICAL_ERROR = 'technical_error';
|
||||
|
||||
private string $baseUrl;
|
||||
|
||||
|
@ -76,6 +72,14 @@ class SQLLoginUserAuthenticator extends AbstractLoginFormAuthenticator
|
|||
$session = $request->getSession();
|
||||
try {
|
||||
$datas = $this->sqlLoginService->fetchPasswordAndDatas($login);
|
||||
} catch (EmptyResultException $e) {
|
||||
$session->set(self::ERROR_LOGIN, true);
|
||||
throw new AuthenticationException();
|
||||
} catch (DataToFetchConfigurationException|PDOException $e) {
|
||||
\Sentry\captureException($e);
|
||||
$session->set(self::TECHNICAL_ERROR, true);
|
||||
throw new AuthenticationException();
|
||||
}
|
||||
$remoteHashedPassword = $datas[$this->sqlLoginRequest->getPasswordColumnName()];
|
||||
unset($datas[$this->sqlLoginRequest->getPasswordColumnName()]);
|
||||
$remoteSalt = null;
|
||||
|
@ -83,23 +87,20 @@ class SQLLoginUserAuthenticator extends AbstractLoginFormAuthenticator
|
|||
$remoteSalt = $datas[$this->sqlLoginRequest->getSaltColumnName()];
|
||||
unset($datas[$this->sqlLoginRequest->getSaltColumnName()]);
|
||||
}
|
||||
} catch (DatabaseConnectionException $e) {
|
||||
$session->set(self::ERROR_PDO, true);
|
||||
throw new AuthenticationException();
|
||||
} catch (LoginElementsConfigurationException $e) {
|
||||
$session->set(self::ERROR_CONFIGURATION, true);
|
||||
throw new AuthenticationException();
|
||||
} catch (DataToFetchConfigurationException $e) {
|
||||
$session->set(self::ERROR_DATA_TO_FETCH_CONFIGURATION, true);
|
||||
throw new AuthenticationException();
|
||||
}
|
||||
|
||||
if (null === $remoteHashedPassword) {
|
||||
$remoteHashedPassword = '';
|
||||
}
|
||||
try {
|
||||
// Comparaison remote hash et hash du input password + salt
|
||||
$this->passwordHasher->verify($remoteHashedPassword, $plaintextPassword, $remoteSalt);
|
||||
} catch (InvalidSQLPasswordException $e) {
|
||||
$session->set(self::ERROR_LOGIN, true);
|
||||
throw new AuthenticationException();
|
||||
} catch (SecurityPatternConfigurationException $e) {
|
||||
\Sentry\captureException($e);
|
||||
$session->set(self::TECHNICAL_ERROR, true);
|
||||
throw new AuthenticationException();
|
||||
}
|
||||
$user = new User($login, $remoteHashedPassword, $datas, $rememberMe);
|
||||
$loader = function (string $userIdentifier) use ($user) {
|
||||
return $user->getLogin() == $userIdentifier ? $user : null;
|
||||
|
@ -111,13 +112,6 @@ class SQLLoginUserAuthenticator extends AbstractLoginFormAuthenticator
|
|||
$passport->setAttribute('attributes', $user->getAttributes());
|
||||
|
||||
return $passport;
|
||||
} catch (InvalidSQLPasswordException $e) {
|
||||
$session->set(self::ERROR_LOGIN, true);
|
||||
throw new AuthenticationException();
|
||||
} catch (SecurityPatternConfigurationException $e) {
|
||||
$session->set(self::ERROR_SECURITY_PATTERN_CONFIGURATION, true);
|
||||
throw new AuthenticationException();
|
||||
}
|
||||
}
|
||||
|
||||
protected function getLoginUrl(Request $request): string
|
||||
|
|
|
@ -2,20 +2,16 @@
|
|||
|
||||
namespace App\Service;
|
||||
|
||||
use App\SQLLogin\Exception\DatabaseConnectionException;
|
||||
use App\SQLLogin\Exception\DataToFetchConfigurationException;
|
||||
use App\SQLLogin\Exception\LoginElementsConfigurationException;
|
||||
use App\SQLLogin\Exception\NullDataToFetchException;
|
||||
use App\SQLLogin\Exception\EmptyResultException;
|
||||
use App\SQLLogin\SQLLoginConnect;
|
||||
use App\SQLLogin\SQLLoginRequest;
|
||||
use PDO;
|
||||
use PDOException;
|
||||
use Psr\Log\LoggerInterface;
|
||||
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
||||
|
||||
class SQLLoginService extends AbstractController
|
||||
{
|
||||
private PDO $pdo;
|
||||
public const MAX_RETRY = 3;
|
||||
|
||||
public function __construct(
|
||||
private SQLLoginRequest $sqlLoginRequest,
|
||||
|
@ -23,31 +19,35 @@ class SQLLoginService extends AbstractController
|
|||
) {
|
||||
$this->sqlLoginRequest = $sqlLoginRequest;
|
||||
$this->loggerInterface = $loggerInterface;
|
||||
$this->pdo = $this->getConnection();
|
||||
}
|
||||
|
||||
public function fetchPasswordAndDatas(string $login): array
|
||||
{
|
||||
try {
|
||||
$dataRequest = $this->sqlLoginRequest->getDatasRequest();
|
||||
$datas = $this->executeRequestWithLogin($dataRequest, $login);
|
||||
} catch (NullDataToFetchException $e) {
|
||||
throw new DataToFetchConfigurationException($e->getMessage());
|
||||
} catch (PDOException $e) {
|
||||
$this->loggerInterface->critical($e->getMessage());
|
||||
throw new LoginElementsConfigurationException($e->getMessage());
|
||||
}
|
||||
|
||||
return $datas;
|
||||
}
|
||||
|
||||
private function executeRequestWithLogin(string $request, string $login): array
|
||||
{
|
||||
$query = $this->pdo->prepare($request);
|
||||
$query->bindParam($this->sqlLoginRequest->getLoginColumnName(), $login, PDO::PARAM_STR);
|
||||
$query->execute();
|
||||
$attempt = 0;
|
||||
while ($attempt < self::MAX_RETRY) {
|
||||
$pdo = $this->getConnection();
|
||||
$query = $pdo->prepare($request);
|
||||
$query->execute([$this->sqlLoginRequest->getLoginColumnName() => $login]);
|
||||
$datas = $query->fetch(PDO::FETCH_ASSOC);
|
||||
$query->closeCursor();
|
||||
if (false === $datas) {
|
||||
usleep(3000);
|
||||
++$attempt;
|
||||
} else {
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (self::MAX_RETRY === $attempt) {
|
||||
throw new EmptyResultException();
|
||||
}
|
||||
|
||||
return $datas;
|
||||
}
|
||||
|
@ -55,13 +55,8 @@ class SQLLoginService extends AbstractController
|
|||
private function getConnection(): PDO
|
||||
{
|
||||
// Appel du singleton
|
||||
try {
|
||||
$sqlLogin = SQLLoginConnect::getInstance();
|
||||
$pdo = $sqlLogin->connect($this->sqlLoginRequest->getDatabaseDsn(), $this->sqlLoginRequest->getDbUser(), $this->sqlLoginRequest->getDbPassword());
|
||||
} catch (PDOException $e) {
|
||||
$this->loggerInterface->critical($e->getMessage());
|
||||
throw new DatabaseConnectionException($e->getMessage());
|
||||
}
|
||||
|
||||
return $pdo;
|
||||
}
|
||||
|
|
|
@ -9,25 +9,9 @@
|
|||
<source>error.login</source>
|
||||
<target>Incorrect login or password</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="36t19qm" resname="error.sql_login">
|
||||
<source>error.sql_login</source>
|
||||
<target>Connection to database encountered a problem</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="lBole_G" resname="error.pdo">
|
||||
<source>error.pdo</source>
|
||||
<target>Connection to database encountered a problem</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="1QRR4uA" resname="error.configuration">
|
||||
<source>error.configuration</source>
|
||||
<target>Identification data references do not exist in the database</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="4EPIhsV" resname="error.data_to_fetch_configuration">
|
||||
<source>error.data_to_fetch_configuration</source>
|
||||
<target>Data references to be transmitted do not exist</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="6iuTNs3" resname="error.security_pattern_configuration">
|
||||
<source>error.security_pattern_configuration</source>
|
||||
<target>The security pattern is not allowed</target>
|
||||
<trans-unit id="1QRR4uA" resname="error.technical">
|
||||
<source>error.technical</source>
|
||||
<target>A technical error happened, try again later</target>
|
||||
</trans-unit>
|
||||
</body>
|
||||
</file>
|
||||
|
|
|
@ -9,25 +9,9 @@
|
|||
<source>error.login</source>
|
||||
<target>Login ou mot de passe inconnu</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="36t19qm" resname="error.sql_login">
|
||||
<source>error.sql_login</source>
|
||||
<target>La connexion à la base de données a rencontré un problème</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="lBole_G" resname="error.pdo">
|
||||
<source>error.pdo</source>
|
||||
<target>La connexion à la base de données a rencontré un problème</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="1QRR4uA" resname="error.configuration">
|
||||
<source>error.configuration</source>
|
||||
<target>Les références de données d'identification n'existent pas dans la base de données</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="4EPIhsV" resname="error.data_to_fetch_configuration">
|
||||
<source>error.data_to_fetch_configuration</source>
|
||||
<target>Les références de données à transmettre n'existent pas</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="6iuTNs3" resname="error.security_pattern_configuration">
|
||||
<source>error.security_pattern_configuration</source>
|
||||
<target>Le patron de sécurité n'est pas autorisé</target>
|
||||
<trans-unit id="1QRR4uA" resname="error.technical">
|
||||
<source>error.technical</source>
|
||||
<target>Une erreur technique s'est produite, rééssayez plus tard</target>
|
||||
</trans-unit>
|
||||
</body>
|
||||
</file>
|
||||
|
|
Loading…
Reference in New Issue