[Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED #31189

wouterj · 2019-04-20T17:23:12Z

Q	A
Branch?	master
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	yes
Tests pass?	yes
Fixed tickets	#29848
License	MIT
Doc PR	symfony/symfony-docs#11487

This continues work of @HeahDude and finally finishes one of the code PRs I've been working on during the ⭐️ EUFOSSA Hackathon.

Changes

The PRs modifies some of the attributes used by the AuthenticatedVoter:

New IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED attributes are introduced to indicate the user either impersonated, anonymous or rembered.
~~IS_AUTHENTICATED_ANONYMOUSLY actually meant "is authenticated, either anonymous or fully". As this is confusing, it is replaced by IS_AUTHENTICATED.~~
~~All is_*() functions in expressions are deprecated in favor of is_granted('IS_*'). It's not worth duplicating the AuthenticatedVoter logic in two places now we have shorter IS_* attributes~~

Before

if ($authorizationChecker->isGranted('ROLE_PREVIOUS_ADMIN')) {
    // ...
}

~~security: # ... access_control: - { path: ^/protected, roles: 'IS_AUTHENTICATED_ANONYMOUSLY' }~~

After

if ($authorizationChecker->isGranted('IS_IMPERSONATOR')) {
    // ...
}

~~security: # ... access_control: - { path: ^/protected, roles: 'IS_AUTHENTICATED' }~~

Discussion

The only thing I'm wondering is how we combine this with the is_authenticated() expression function:

symfony/src/Symfony/Component/Security/Core/Authorization/ExpressionLanguageProvider.php

Lines 33 to 37 in 98929dc

new ExpressionFunction('is_authenticated', function () {

return '$token && !$trust_resolver->isAnonymous($token)';

}, function (array $variables) {

return $variables['token'] && !$variables['trust_resolver']->isAnonymous($variables['token']);

}),

As you can see, the IS_AUTHENTICATED attribute and is_authenticated() expression function do not have the same meaning. Should we somehow deprecate the current behavior of is_authenticated() or should we find another name for IS_AUTHENTICATED (that would be a shame imo).

chalasr · 2019-04-20T17:36:51Z

Looks great, thanks.
About the expression function, we could add a $allowAnonymous (or better name) argument to it and deprecate not passing it as false explicitly (using func_num_args() etc for detection), the argument would default to true in 5.0 to match the new IS_AUTHENTICATED attr for access controls.

wouterj · 2019-04-20T18:11:53Z

Thanks for the suggestion @chalasr! I've updated the PR. Also realized that I forgot to do the same for IS_AUTHENTICATED_REMEMBERED, so added that as well.

wouterj · 2019-04-20T18:29:25Z

Actually, I've decided to take another step and deprecate all is_*() functions except from is_granted(). Now is_granted() is introduced in Symfony 4.2 and the attribute names are shorter & easier, I think it is not worth duplicating all logic of AuthenticatedVoter in the expression language provider.

chalasr · 2019-04-20T18:34:51Z

AbstractController::isGranted() doesn't have such shortcuts, dropping them for expressions seems consistent. Works for me 👍

wouterj · 2019-04-24T20:14:18Z

Didn't realize 4.3 release was soo close. I've updated the PR to 4.4 and added a documentation PR. Ready for review when 4.3 is released

UPGRADE-5.0.md

src/Symfony/Component/Security/CHANGELOG.md

nicolas-grekas · 2019-09-27T09:43:20Z

IS_AUTHENTICATED_ANONYMOUSLY actually meant "is authenticated, either anonymous or fully". As this is confusing, it is replaced by IS_AUTHENTICATED.

I'm not sure the new version is more clear: having role inheritance in mind, the current wording is clear to me. The new one might make me think one is authenticated not-anonymously.

wouterj · 2019-09-27T10:07:54Z

Hmm, I completely forgot about this PR. Sorry! Let's see how we can continue and what we manage to get into 4.4/5.0 before the freeze:

The PRs modifies some of the attributes used by the AuthenticatedVoter:

New IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED attributes are introduced to indicate the user either impersonated, anonymous or rembered.

IS_AUTHENTICATED_ANONYMOUSLY actually meant "is authenticated, either anonymous or fully". As this is confusing, it is replaced by IS_AUTHENTICATED.

All is_*() functions in expressions are deprecated in favor of is_granted('IS_*'). It's not worth duplicating the AuthenticatedVoter logic in two places now we have shorter IS_* attributes

From what I see above, people seem to agree on (1) and (3). So let's remove change (2) from this PR, to allow this to be merged?

(2) seems up for debate and now I think about this, I think it's indeed a confusing change, people would maybe think that IS_AUTHENTICATED is IS_AUTHENTICATED_FULLY. @HeahDude as you made this change in your first commit to the branch, can you maybe share your ideas?

nicolas-grekas · 2019-11-05T16:09:14Z

Moving to milestone "next", meaning for 5.1 or later.

fabpot · 2020-02-04T13:49:33Z

@wouterj I'd like that we move forward with all your PRs/issues/big plans related to security. Whenever you have time, ping me and we will see how to make it work for 5.1.

wouterj · 2020-02-22T17:17:37Z

Travis build seems failing with low deps

Yeah, the bundle requires ^4.4|^5.0. As the functional tests used is_anonymous(), there are 2 options: Change requirement to ^5.1 (only to make the tests pass, the bundle still supports 4.4) or use the deprecated function in the functional tests. What do you want me to do?

chalasr · 2020-02-22T17:25:43Z

@wouterj Bumping to ^5.1 looks good to me.

wouterj · 2020-02-22T18:30:49Z

Thanks for the quick response. I've bumped the requirement. The tests should now pass

wouterj · 2020-02-22T18:57:42Z

status: needs review

HeahDude

Looks good, thanks for finishing this

src/Symfony/Component/Security/Core/Tests/Authorization/ExpressionLanguageTest.php

src/Symfony/Component/Security/Core/Authorization/ExpressionLanguageProvider.php

fabpot · 2020-02-24T16:06:07Z

Thank you @wouterj.

…guage functions (wouterj) This PR was merged into the 5.1-dev branch. Discussion ---------- [Security] Use new IS_* attributes in the expression language functions | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | no | Deprecations? | no | Tickets | n/a | License | MIT | Doc PR | n/a #31189 has been merged which introduces some new attributes (`IS_ANONYMOUS` & friends). We can now modify the code behind the `is_*()` expression language functions to use these new attributes. This avoids any possibility of having them out of sync. In case you - just like me - are interested why `isGranted("IS_AUTHENTICATED_FULLY")` wasn't used before: These functions were implemented without `auth_checker` being available. The auth checker variable was introduced in 4.2 by #27305, so now we can use this. Commits ------- 3f0c599 Use new IS_* attributes in the expression language functions

This PR was merged into the 5.1-dev branch. Discussion ---------- [Security] Deprecated ROLE_PREVIOUS_ADMIN | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | no | Deprecations? | yes | Tickets | n/a | License | MIT | Doc PR | symfony/symfony-docs#11487 `ROLE_PREVIOUS_ADMIN` is added to the token roles if the session is an impersonation. Since #31189 we have the `IS_IMPERSONATOR` attribute which can be used for the same reason. I propose to deprecate the `ROLE_PREVIOUS_ADMIN`: * This is not what roles are for ([resulting in hacking this exception in `AbstractToken`](https://github.com/symfony/symfony/blob/5.0/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php#L275-L277)) * The role isn't very descriptive * I don't like having 2 ways of doing exactly the same thing * While every application with impersonation enabled probably needs to be updated, the update is as simple as replacing `ROLE_PREVIOUS_ADMIN` with `IS_IMPERSONATOR`: `find ./ -type f -exec sed -i 's/ROLE_PREVIOUS_ADMIN/IS_IMPERSONATOR/g' {} +` --- I'm a bit unsure on how to deprecate this role, but I think having it in `RoleVoter` is probably the safest (`isGranted()` and variants + `AccessDecisionManager#decide()` all use this voter to check if the token has this role). Commits ------- dce55f3 Deprecated ROLE_PREVIOUS_ADMIN

This PR was merged into the 5.1-dev branch. Discussion ---------- [Security] Deprecated ROLE_PREVIOUS_ADMIN | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | no | Deprecations? | yes | Tickets | n/a | License | MIT | Doc PR | symfony/symfony-docs#11487 `ROLE_PREVIOUS_ADMIN` is added to the token roles if the session is an impersonation. Since symfony/symfony#31189 we have the `IS_IMPERSONATOR` attribute which can be used for the same reason. I propose to deprecate the `ROLE_PREVIOUS_ADMIN`: * This is not what roles are for ([resulting in hacking this exception in `AbstractToken`](https://github.com/symfony/symfony/blob/5.0/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php#L275-L277)) * The role isn't very descriptive * I don't like having 2 ways of doing exactly the same thing * While every application with impersonation enabled probably needs to be updated, the update is as simple as replacing `ROLE_PREVIOUS_ADMIN` with `IS_IMPERSONATOR`: `find ./ -type f -exec sed -i 's/ROLE_PREVIOUS_ADMIN/IS_IMPERSONATOR/g' {} +` --- I'm a bit unsure on how to deprecate this role, but I think having it in `RoleVoter` is probably the safest (`isGranted()` and variants + `AccessDecisionManager#decide()` all use this voter to check if the token has this role). Commits ------- dce55f352a Deprecated ROLE_PREVIOUS_ADMIN

…S and IS_REMEMBERED attributes (wouterj) This PR was merged into the master branch. Discussion ---------- [Security] Documented new IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED attributes Changes the documentation to no longer use security attributes/functions that will be deprecated in symfony/symfony#31189 . It's funny to see how the docs were also confusing about the old attributes, as wrong attributes were used. While doing these changes, I've also rewritten some parts to no longer talk about attributes as something the users have (like roles), but instead as something the user is matched against. Commits ------- 0e2b406 Documented new security attributes

carsonbot added Status: Needs Review Security Feature Deprecation labels Apr 20, 2019

wouterj force-pushed the security/is-impersonator branch from 71f08d8 to 234dc0d Compare April 20, 2019 17:24

chalasr added this to the next milestone Apr 20, 2019

wouterj force-pushed the security/is-impersonator branch from 234dc0d to 48d4813 Compare April 20, 2019 18:10

wouterj force-pushed the security/is-impersonator branch 2 times, most recently from 19ed26f to 7b9b167 Compare April 20, 2019 18:28

wouterj force-pushed the security/is-impersonator branch from 7b9b167 to 613789f Compare April 24, 2019 19:41

wouterj mentioned this pull request Apr 24, 2019

[Security] Documented new IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED attributes symfony/symfony-docs#11487

Merged

linaori suggested changes Apr 27, 2019

View reviewed changes

UPGRADE-5.0.md Outdated Show resolved Hide resolved

src/Symfony/Component/Security/CHANGELOG.md Outdated Show resolved Hide resolved

carsonbot added Status: Needs Work and removed Status: Needs Review labels Apr 27, 2019

chalasr mentioned this pull request Aug 13, 2019

Update expressions.rst symfony/symfony-docs#12132

Merged

nicolas-grekas modified the milestones: next, 4.4 Oct 27, 2019

nicolas-grekas modified the milestones: 4.4, next Nov 5, 2019

chalasr mentioned this pull request Feb 20, 2020

[Security][DX] Simplify IS_AUTHENTICATED_* attributes #29848

Closed

wouterj force-pushed the security/is-impersonator branch from a17ee3a to 2fb0a98 Compare February 22, 2020 11:32

Added IS_ANONYMOUS, IS_REMEMBERED, IS_IMPERSONATOR

6c522a7

wouterj force-pushed the security/is-impersonator branch from 28606e1 to 4038d6c Compare February 22, 2020 17:18

wouterj force-pushed the security/is-impersonator branch from 4038d6c to fda7e0a Compare February 22, 2020 18:30

carsonbot added Status: Needs Review and removed Status: Needs Work labels Feb 22, 2020

HeahDude reviewed Feb 22, 2020

View reviewed changes

src/Symfony/Component/Security/Core/Tests/Authorization/ExpressionLanguageTest.php Outdated Show resolved Hide resolved

chalasr approved these changes Feb 22, 2020

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels Feb 22, 2020

nicolas-grekas reviewed Feb 23, 2020

View reviewed changes

src/Symfony/Component/Security/Core/Authorization/ExpressionLanguageProvider.php Outdated Show resolved Hide resolved

wouterj force-pushed the security/is-impersonator branch from fda7e0a to 6c522a7 Compare February 23, 2020 16:37

wouterj changed the title ~~[Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED and deprecated is_*() expression functions~~ [Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED Feb 23, 2020

fabpot approved these changes Feb 24, 2020

View reviewed changes

fabpot merged commit 6178c63 into symfony:master Feb 24, 2020

wouterj deleted the security/is-impersonator branch February 24, 2020 16:10

This was referenced Feb 24, 2020

[Security] Use new IS_* attributes in the expression language functions #35854

Merged

[Security] Deprecated ROLE_PREVIOUS_ADMIN #35858

Merged

wouterj mentioned this pull request Feb 25, 2020

[Security] Deprecated AuthenticationTrustResolver #35860

Closed

nicolas-grekas modified the milestones: next, 5.1 May 4, 2020

fabpot mentioned this pull request May 5, 2020

Release v5.1.0-BETA1 #36713

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED #31189

[Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED #31189

wouterj commented Apr 20, 2019 •

edited

Loading

chalasr commented Apr 20, 2019

wouterj commented Apr 20, 2019

wouterj commented Apr 20, 2019

chalasr commented Apr 20, 2019 •

edited

Loading

wouterj commented Apr 24, 2019

nicolas-grekas commented Sep 27, 2019 •

edited

Loading

wouterj commented Sep 27, 2019 •

edited

Loading

nicolas-grekas commented Nov 5, 2019

fabpot commented Feb 4, 2020

wouterj commented Feb 22, 2020

chalasr commented Feb 22, 2020

wouterj commented Feb 22, 2020 •

edited

Loading

wouterj commented Feb 22, 2020

HeahDude left a comment

fabpot commented Feb 24, 2020

	new ExpressionFunction('is_authenticated', function () {
	return '$token && !$trust_resolver->isAnonymous($token)';
	}, function (array $variables) {
	return $variables['token'] && !$variables['trust_resolver']->isAnonymous($variables['token']);
	}),

[Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED #31189

[Security] Add IS_IMPERSONATOR, IS_ANONYMOUS and IS_REMEMBERED #31189

Conversation

wouterj commented Apr 20, 2019 • edited Loading

Changes

Discussion

chalasr commented Apr 20, 2019

wouterj commented Apr 20, 2019

wouterj commented Apr 20, 2019

chalasr commented Apr 20, 2019 • edited Loading

wouterj commented Apr 24, 2019

nicolas-grekas commented Sep 27, 2019 • edited Loading

wouterj commented Sep 27, 2019 • edited Loading

nicolas-grekas commented Nov 5, 2019

fabpot commented Feb 4, 2020

wouterj commented Feb 22, 2020

chalasr commented Feb 22, 2020

wouterj commented Feb 22, 2020 • edited Loading

wouterj commented Feb 22, 2020

HeahDude left a comment

Choose a reason for hiding this comment

fabpot commented Feb 24, 2020

wouterj commented Apr 20, 2019 •

edited

Loading

chalasr commented Apr 20, 2019 •

edited

Loading

nicolas-grekas commented Sep 27, 2019 •

edited

Loading

wouterj commented Sep 27, 2019 •

edited

Loading

wouterj commented Feb 22, 2020 •

edited

Loading