Refactor authentication system (#2602)

Make auth configuration available via UI, remove FOSUserBundle and SAML-Bundle dependency

config/bundles.php

@@ -15,7 +15,6 @@ return [
     DAMA\DoctrineTestBundle\DAMADoctrineTestBundle::class => ['test' => true],
     KevinPapst\AdminLTEBundle\AdminLTEBundle::class => ['all' => true],
     JMS\SerializerBundle\JMSSerializerBundle::class => ['all' => true],
-    FOS\UserBundle\FOSUserBundle::class => ['all' => true],
     FOS\RestBundle\FOSRestBundle::class => ['all' => true],
     Nelmio\ApiDocBundle\NelmioApiDocBundle::class => ['all' => true],
     Nelmio\CorsBundle\NelmioCorsBundle::class => ['all' => true],

config/packages/fos_user.yaml

@@ -1,15 +0,0 @@
-fos_user:
-    db_driver: orm
-    firewall_name: secured_area
-    user_class: App\Entity\User
-    from_email:
-        address: '%env(MAILER_FROM)%'
-        sender_name: "Kimai 2"
-    registration:
-        confirmation:
-            enabled: false
-    resetting:
-        retry_ttl: 7200
-        token_ttl: 86400
-    service:
-        mailer: App\Mail\UserMails

config/packages/jms_serializer.yaml

@@ -10,16 +10,11 @@ jms_serializer:
         xml_serialization:
             format_output: '%kernel.debug%'
     metadata:
-        directories:
-            FOSUB:
-                namespace_prefix: "FOS\\UserBundle"
-                path: "%kernel.root_dir%/../config/serializer/FOS/UserBundle"
         warmup:
             paths:
                 included:
                     - "%kernel.root_dir%/Entity/"
                     - "%kernel.root_dir%/API/Model/"
-                    - "%kernel.root_dir%/../vendor/kimai/user-bundle/Model"
                 excluded: []
     property_naming:
         id: 'jms_serializer.identical_property_naming_strategy'

config/packages/security.yaml

@@ -5,7 +5,7 @@ security:
     providers:
         chain_provider:
             chain:
-                providers: [kimai_internal]
+                providers: [kimai_ldap,kimai_internal]
         kimai_ldap:
             id: App\Ldap\LdapUserProvider
         kimai_internal:
@@ -17,6 +17,8 @@ security:
             security: false
 
         secured_area:
+            kimai_saml: ~
+            kimai_ldap: ~
             pattern: ^/
             user_checker: App\Security\UserChecker
             anonymous: true

config/routes/annotations.yaml

@@ -12,7 +12,16 @@ app.api:
     type: rest
     prefix: /api
 
-security:
+auth:
     resource: '../../src/Controller/Auth/'
     type: annotation
     prefix: /auth
+
+security:
+    resource: '../../src/Controller/Security/'
+    type: annotation
+    prefix: /{_locale}
+    requirements:
+        _locale: '%app_locales%'
+    defaults:
+        _locale: '%locale%'

config/routes/fos_user.yaml

@@ -1,12 +0,0 @@
-# Expose security related features like login and logout
-fos_user_security:
-    prefix: /{_locale}
-    resource: "@FOSUserBundle/Resources/config/routing/security.xml"
-
-# The features "user registration" and "password-reset" are enabled by default.
-#
-# You can disable them by setting the config keys in file "config/kimai.yaml":
-#   - kimai.user.registration: false
-#   - kimai.user.password_reset: false
-#
-# The routes for these functions are added dynamically in src/Kernel.php

config/serializer/FOS/UserBundle/Model.User.yml

@@ -1,35 +0,0 @@
-FOS\UserBundle\Model\User:
-    exclusion_policy: All
-    properties:
-        username:
-            include: true
-            groups: [Default]
-        enabled:
-            include: true
-            groups: [Default]
-        roles:
-            type: array<string>
-            include: true
-            groups: [User_Entity]
-        groups:
-            exclude: true
-        email:
-            exclude: true
-        emailCanonical:
-            exclude: true
-        usernameCanonical:
-            exclude: true
-        password:
-            exclude: true
-        plainPassword:
-            exclude: true
-        registeredAt:
-            exclude: true
-        lastLogin:
-            exclude: true
-        confirmationToken:
-            exclude: true
-        passwordRequestedAt:
-            exclude: true
-        salt:
-            exclude: true

config/services-saml.yaml

@@ -1,32 +1,18 @@
+# ================================================================================
+# SAML Services
+# ================================================================================
 
 services:
 
-    # ================================================================================
-    # SAML
-    # ================================================================================
-
-    App\Saml\SamlAuth:
-        alias: onelogin_auth
-
-    OneLogin\Saml2\Auth:
-        alias: onelogin_auth
-
-    onelogin_auth:
-        class: App\Saml\SamlAuth
-        arguments: ['@request_stack', '%kimai.saml.connection%']
-
-    App\Saml\User\SamlUserFactory:
-        arguments: ['%kimai.saml%']
-
     kimai.saml_listener:
-        class: Hslavich\OneloginSamlBundle\Security\Firewall\SamlListener
+        class: App\Saml\Firewall\SamlListener
         parent: security.authentication.listener.abstract
         abstract: true
         calls:
-            - [setOneLoginAuth, ["@onelogin_auth"]]
+            - [setAuth, ['@App\Saml\SamlAuthFactory']]
 
     App\Saml\Provider\SamlProvider:
-        arguments: ['@App\Repository\UserRepository', '', '@App\Saml\SamlTokenFactory', '@App\Saml\User\SamlUserFactory']
+        arguments: ['@App\Repository\UserRepository', '', '@App\Saml\SamlTokenFactory', '@App\Saml\User\SamlUserFactory', '@App\Configuration\SystemConfiguration']
 
     App\Saml\Security\SamlAuthenticationSuccessHandler:
         parent: security.authentication.success_handler

config/services.yaml

@@ -32,6 +32,9 @@ services:
     # APPLICATION CORE
     # ================================================================================
 
+    security.user.provider.chain:
+        class: App\Security\KimaiUserProvider
+
     App\EventSubscriber\RedirectToLocaleSubscriber:
         arguments: ['@router', '%app_locales%', '%locale%']
 
@@ -57,9 +60,6 @@ services:
         arguments:
             $settings: '%kimai.theme%'
 
-    App\Configuration\LdapConfiguration:
-        arguments: ['%kimai.ldap%']
-
     App\Utils\MPdfConverter:
         arguments: ['%kernel.cache_dir%']
 

config/services_test.yaml

@@ -25,5 +25,8 @@ services:
     # required for the importer command test
     App\Importer\ImporterService:
         public: true
-        arguments:
-          [ '@App\Customer\CustomerService', '@App\Project\ProjectService' ]
+        arguments: ['@App\Customer\CustomerService', '@App\Project\ProjectService']
+
+    App\User\UserService:
+        public: true
+        arguments: ['@App\Repository\UserRepository', '@event_dispatcher', '@validator', '@App\Configuration\SystemConfiguration', '@security.password_encoder']

config/validator/validation.yaml

@@ -1,16 +0,0 @@
-App\Entity\User:
-    properties:
-        roles:
-            - App\Validator\Constraints\Role: { groups: [RolesUpdate] }
-        username:
-            - NotBlank: { groups: [Registration, UserCreate, Profile] }
-            - Length: { min: 2, max: 60, groups: [Registration, UserCreate, Profile] }
-        email:
-            - NotBlank: { groups: [Registration, UserCreate, Profile] }
-            - Email: { groups: [Registration, UserCreate, Profile] }
-        plainPassword:
-            - NotBlank: { groups: [Registration, PasswordUpdate, UserCreate] }
-            - Length: { min: 8, max: 60, groups: [Registration, PasswordUpdate, UserCreate] }
-        plainApiToken:
-            - NotBlank: { groups: [ApiTokenUpdate] }
-            - Length: { min: 8, max: 60, groups: [ApiTokenUpdate] }