Next major version 2 with PHP 8.1, Symfony 6, Tabler UI, 2FA ... (#2902)

config/packages/security.yaml

@@ -1,15 +1,18 @@
 security:
-    encoders:
+    enable_authenticator_manager: true
+
+    password_hashers:
         App\Entity\User: auto
 
     providers:
         chain_provider:
             chain:
                 providers: [kimai_internal,kimai_ldap]
+        kimai_internal:
+            entity:
+                class: App\Entity\User
         kimai_ldap:
             id: App\Ldap\LdapUserProvider
-        kimai_internal:
-            id: App\Security\DoctrineUserProvider
 
     firewalls:
         dev:
@@ -17,43 +20,47 @@ security:
             security: false
 
         api:
-            request_matcher: App\Security\ApiRequestMatcher
+            request_matcher: App\API\Authentication\ApiRequestMatcher
             user_checker: App\Security\UserChecker
-            anonymous: false
             stateless: true
             remember_me: false
             provider: chain_provider
-            guard:
-                authenticators:
-                    - App\Security\TokenAuthenticator
+            custom_authenticators:
+                - App\API\Authentication\TokenAuthenticator
 
         secured_area:
-            kimai_saml: ~
             kimai_ldap: ~
             pattern: ^/
             user_checker: App\Security\UserChecker
-            anonymous: true
             stateless: false
 
-            guard:
-                authenticators:
-                    - App\Security\ApiAuthenticator
+            entry_point: form_login
+
+            custom_authenticators:
+                - App\API\Authentication\SessionAuthenticator
+                - App\Saml\SamlAuthenticator
 
             remember_me:
-                secret:   '%kernel.secret%'
+                secret: '%kernel.secret%'
                 lifetime: 604800
-                path:     /
+                path: /
+                always_remember_me: true
 
             # activate all configured user provider
             provider: chain_provider
 
             form_login:
-                check_path: fos_user_security_check
-                login_path: fos_user_security_login
-                csrf_token_generator: security.csrf.token_manager
+                check_path: security_check
+                login_path: login
+                enable_csrf: true
+
+            two_factor:
+                auth_form_path: 2fa_login
+                check_path: 2fa_login_check
+                remember_me_sets_trusted: true
 
             logout:
-                path: fos_user_security_logout
+                path: logout
                 target: homepage
 
     access_decision_manager:
@@ -67,11 +74,28 @@ security:
         ROLE_SUPER_ADMIN: ROLE_ADMIN
 
     access_control:
-        - { path: '^/auth', roles: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)$', role: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)/auth', role: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)/login', role: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)/register', role: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)/resetting', role: IS_AUTHENTICATED_ANONYMOUSLY }
+        - { path: '^/auth/2fa', role: IS_AUTHENTICATED_2FA_IN_PROGRESS }
+        - { path: '^/auth', roles: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)$', role: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)/auth', role: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)/login', role: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)/register', role: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)/resetting', role: PUBLIC_ACCESS }
         - { path: '^/(%app_locales%)/', roles: ROLE_USER }
         - { path: '^/api', roles: IS_AUTHENTICATED_REMEMBERED }
+
+when@test:
+    # this configuration simplifies testing URLs protected by the security mechanism
+    # See https://symfony.com/doc/current/cookbook/testing/http_authentication.html
+    security:
+        password_hashers:
+            App\Entity\User:
+                algorithm: auto
+                # see https://github.com/symfony/recipes/pull/1026
+                cost: 4 # Lowest possible value for bcrypt
+                time_cost: 3 # Lowest possible value for argon
+                memory_cost: 10 # Lowest possible value for argon
+
+        firewalls:
+            secured_area:
+                http_basic: ~