[Security][SecurityBundle] Add is_granted feature for impersonator on AuthorizationChecker #28794

FabienPapet · 2018-10-09T17:23:55Z

Q	A
Branch?	master
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	no
Tests pass?	no test yet
License	MIT
Doc PR	Not yet

This feature adds a new is*Granted function for the user impersonating another user. I may need some help for tests and also for the function naming. A twig extension may be added if you want to (or in another PR).

Todo

Add doc
Add tests

stof · 2018-10-10T10:14:14Z

Adding such a method which is not part of the interface is a bad idea, as it would force to code against the implementation rather than the interface (which is not a supported usage of Symfony, as we allow ourselves to decorate services with a different implementation, and we do it regularly to implement the profiler features for instance).

I think this should be implemented as a separate class (most of the logic is handled by the access decision manager anyway)

FabienPapet · 2018-10-10T11:46:58Z

Agree, where do you think I should put this code ? Do you have any idea about a classname ?
ImpersonatorAccessDecisionManager SwithUserDecisionManager ?

FabienPapet · 2018-10-10T17:14:32Z

edited. ping @stof

OskarStark · 2018-10-10T19:39:48Z

src/Symfony/Component/Security/Core/Authorization/SwitchUserAuthorizationChecker.php

+use Symfony\Component\Security\Core\Role\SwitchUserRole;
+
+/**
+ * SwitchUserAuthorizationChecker.


this line is useless, as it does not provide additional information

OskarStark · 2018-10-10T19:40:27Z

src/Symfony/Component/Security/Core/Authorization/SwitchUserAuthorizationChecker.php

+
+    /**
+     * @param AccessDecisionManagerInterface $accessDecisionManager
+     * @param TokenStorageInterface          $tokenStorage


imo this PHPDoc is not needed, as the arguments are typehinted, not sure about the member vars PHPDoc

OskarStark · 2018-10-10T19:42:20Z

src/Symfony/Component/Security/Core/Authorization/SwitchUserAuthorizationChecker.php

+        $token = $this->getOriginalToken($this->tokenStorage->getToken());
+
+        if (false !== $token) {
+            return $this->accessDecisionManager->decide($token, $attributes, $subject);


maybe checking for === false first and return false? Not sure if its worth to switch

IMO actual is better than switching which would give something like this

$token = $this->getOriginalToken($this->tokenStorage->getToken()); if (false === $token) { return false; } return $this->accessDecisionManager->decide($token, $attributes, $subject);

OskarStark · 2018-10-10T19:42:53Z

src/Symfony/Component/Security/Core/Authorization/SwitchUserAuthorizationCheckerInterface.php

+namespace Symfony\Component\Security\Core\Authorization;
+
+/**
+ * The AuthorizationCheckerInterface.


ro0NL

im not sure separate handling of the two tokens makes sense (thus two twig functions etc.)

alternatively what about a default fallback mechanism? If the current token doesnt grant access, test the source token, if any. Optionally the security bundle could add configuration to white- and/or blacklist specific attributes. Does that make sense?

ro0NL · 2018-10-11T09:05:34Z

src/Symfony/Component/Security/Core/Authorization/SwitchUserAuthorizationCheckerInterface.php

+/**
+ * @author Fabien Papet <[email protected]>
+ */
+interface SwitchUserAuthorizationCheckerInterface


this duplicates AuthorizationCheckerInterface basically, which looks odd

FabienPapet · 2018-10-12T16:56:17Z

I'm not sure about using fallbacks. I think using a single is_granted can be confusing and can lead to errors (from a DX point of view).

Maybe other Symfony contributors have an idea ?

xabbuh · 2019-03-08T10:44:36Z

I am not sure I understand the use case here. Can you elaborate a bit?

FabienPapet · 2019-03-08T12:26:40Z

The use case is pretty simple.
I have an app where I have a User, a user admin and an administrator.

The user admin can switch into a user. and sometimes on several screens, there are some actions that only the user admin can do. And I have to check the impersonator roles to acheive that

xabbuh · 2019-03-08T12:43:10Z

So if I understand this correctly, we are looking for a shortcut for is_granted('ROLE_ALLOWED_TO_SWITCH')?

FabienPapet · 2019-03-08T12:49:39Z

No, because we can have different levels for user impersonation. And I want to check the roles of impersonator

xabbuh · 2019-03-08T13:00:48Z

What do you mean with different levels in this context?

I am sorry to bother you with these questions but I would like to better understand the use case to see whether or not this fits in the Symfony core.

FabienPapet · 2019-03-08T13:10:13Z

That totally fine 👍
I mean the impersonator can be for example a manager, or a member of the application support.
Both manager and support can impersonate a user, but the manager can do some actions that the support team can not. I want to check this on the user list. Not sure if it's fully clear now

OskarStark · 2019-03-08T18:52:16Z

I think this is not the goal of the impersonating. You should be the impersonated user with the exact roles, no matter from which role you did the impersonation...
But if I understand you correct, this is the goal of the PR, right?

FabienPapet · 2019-03-11T09:47:00Z

It is :)

HeahDude · 2019-03-11T10:37:00Z

src/Symfony/Component/Security/Core/Authorization/SwitchUserAuthorizationChecker.php

+     *
+     * @return TokenInterface|false The original TokenInterface instance, false if the current TokenInterface is not switched
+     */
+    private function getOriginalToken(TokenInterface $token)


As of 4.3 you can simply check that the token is an instance of SwitchUserToken and remove this method :). See #22048

Code is from october2018 it didn't exist where I did this. I'll edit this evening

HeahDude · 2019-03-11T10:41:17Z

What about a voter that checks for a IMPERSONATOR_ATTRIBUTE_X with IMPERSONATOR_ prefix configurable, it would early return false if the token is not an instance of SwitchUserToken then remove the prefix before calling its decorated auth checker (we are no tied by circular dependency anymore, but the voter should be in the SecurityBundle though)?

We could then have a Twig function impersonator_is_granted('ATTRIBUTE_X') that adds the prefix before calling is_granted in the ~~bridge~~ security bundle too?

FabienPapet · 2019-03-11T11:37:40Z

Maybe an IMPERSONATOR_ROLE_X to be consistent with RoleVoter ?

HeahDude · 2019-03-11T11:49:52Z

To be flexible this should be working with any attributes to trigger custom voters not just using roles or roles hierarchy.
Using a SwitchUserVoter would get rid of that new interface, and would be simple to implement:

// ...
class SwitchUserVoter extends Voter
{
    private $prefix = 'IMPERSONATOR_';
    private $accessDecisionManager;

    // ...
    public function supports(...)
    {
        return 0 === strpos($attribute, $this->prefix);
    }

    public function voteOnAttribute(...)
    {
        if (!$token instanceof SwitchUserToken) {
            return false;
        }

        return $this->accessDecisionManager->decide($token->getOriginalToken(), [substr($attribute, strlen($this->prefix))], $subject);
    }
}

That would allow both:

{% is_granted('EDIT_POST', post) or impersonator_is_granted('MANAGE_POST', post) %}

{# or with a custom prefix X_ #}
{% is_granted(['EDIT_POST', 'X_MANAGE_POST'], post) %}

Plus the second example is valid for any call of isGranted() anywhere (that's what I mean by more flexible), while we can decorate the method easily in twig, in raw PHP it requires a new contract.

HeahDude · 2019-03-11T11:53:48Z

The prefix would be easier to decorate also in Security and ControllerTrait helpers.

HeahDude · 2019-03-11T13:10:19Z

src/Symfony/Component/Security/Core/Authorization/Voter/SwitchRoleVoter.php

+class SwitchRoleVoter implements VoterInterface
+{
+    /**
+     * @var AccessDecisionManager


Can be removed since this is inferred from the controller.

from the constructor* right ?

Yes this auto correction is amazing some time :D

HeahDude · 2019-03-11T13:11:54Z

src/Symfony/Component/Security/Core/Authorization/Voter/SwitchRoleVoter.php

+                continue;
+            }
+
+            return $this->accessDecisionManager->decide($token->getOriginalToken(), [substr($attribute, \strlen($this->prefix))], $subject);


if (VoterInterface::ACCESS_GRANTED === $result = $this->accessDecisionManager->decide($token->getOriginalToken(), [substr($attribute, \strlen($this->prefix))], $subject)) { return $result; }

Ah no this should just decorate the call forget that comment.

Hmm I think this is more complex, the current logic prevents passing two prefixed attributes, you should extend Voter to simplify the decoration or handle this case too IMHO.

Without extending, you could go with:

$attributes = array_map(function ($attribute) { return substr($attribute, \strlen($this->prefix)); }, array_filter($attributes, function ($attribute) { return 0 === strpos($attribute, $this->prefix) })); })); if (!$attributes) { return $result; } return $this->accessDecisionManager->decide($token->getOriginalToken(), $attributes, $subject);

WDYT?

fabpot · 2020-08-11T10:15:02Z

Closing as I don't think this feature (as explained by @OskarStark) should be in core.

carsonbot added Status: Needs Review Feature Deprecation labels Oct 9, 2018

FabienPapet changed the title ~~Add is_granted feature for impersonator on AuthorizationChecker~~ [Security Bundle]Add is_granted feature for impersonator on AuthorizationChecker Oct 9, 2018

OskarStark requested changes Oct 10, 2018

View reviewed changes

carsonbot added Status: Needs Work and removed Status: Needs Review labels Oct 10, 2018

OskarStark approved these changes Oct 10, 2018

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Work labels Oct 10, 2018

FabienPapet changed the title ~~[Security Bundle]Add is_granted feature for impersonator on AuthorizationChecker~~ [Security][SecurityBundle] Add is_granted feature for impersonator on AuthorizationChecker Oct 11, 2018

ro0NL reviewed Oct 11, 2018

View reviewed changes

nicolas-grekas added this to the next milestone Oct 14, 2018

HeahDude reviewed Mar 11, 2019

View reviewed changes

HeahDude suggested changes Mar 11, 2019

View reviewed changes

carsonbot added Status: Needs Work and removed Status: Reviewed labels Mar 11, 2019

add switchuserrole voter

40e136b

fabpot closed this Aug 11, 2020

FabienPapet deleted the add-isgranted-impersonator branch August 11, 2020 11:57

nicolas-grekas modified the milestones: next, 5.2 Oct 5, 2020

[Security][SecurityBundle] Add is_granted feature for impersonator on AuthorizationChecker #28794

[Security][SecurityBundle] Add is_granted feature for impersonator on AuthorizationChecker #28794

Conversation

FabienPapet commented Oct 9, 2018 • edited Loading

Todo

stof commented Oct 10, 2018

FabienPapet commented Oct 10, 2018 • edited Loading

FabienPapet commented Oct 10, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ro0NL left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FabienPapet commented Oct 12, 2018 • edited Loading

xabbuh commented Mar 8, 2019

FabienPapet commented Mar 8, 2019

xabbuh commented Mar 8, 2019

FabienPapet commented Mar 8, 2019

xabbuh commented Mar 8, 2019

FabienPapet commented Mar 8, 2019

OskarStark commented Mar 8, 2019

FabienPapet commented Mar 11, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

HeahDude commented Mar 11, 2019 • edited Loading

FabienPapet commented Mar 11, 2019

HeahDude commented Mar 11, 2019 • edited Loading

HeahDude commented Mar 11, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

HeahDude Mar 11, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fabpot commented Aug 11, 2020

FabienPapet commented Oct 9, 2018 •

edited

Loading

FabienPapet commented Oct 10, 2018 •

edited

Loading

FabienPapet commented Oct 12, 2018 •

edited

Loading

HeahDude commented Mar 11, 2019 •

edited

Loading

HeahDude commented Mar 11, 2019 •

edited

Loading

HeahDude Mar 11, 2019 •

edited

Loading