Thank you @wouterj.

EDIT : Opened a dedicated issue here

Hello there,

Simple thought about the way this has been resolved :

I believe we can do this as a "bugfix" in 6.2 directly, based on this reasoning from the blog post: "To avoid any BC break, the limit is set to 4096 characters, which should be more than enough for normal usages."

For most usages, it will probably be enough, but it implies there will be some case where it won't.
For instance, with oauth2, the implementation of knpuniversity/oauth2-client-bundle which states in the documentation (here) to send your oauth2 access token directly as the user badge "identifier" :

return new SelfValidatingPassport(

    new UserBadge($accessToken->getToken(), function() use ($accessToken, $client) {

[...]

Later, you're supposed to retrieve your identifier in a user provider or in the closure of user badge to construct your "user".

Passing your token in the UserBadge construct will instantly trigger the hard coded security test provided by this commit :

if (\strlen($userIdentifier) > self::MAX_USERNAME_LENGTH) {

            throw new BadCredentialsException('Username too long.');

        }

There aren't any explicit restriction on oauth2 token size, which can lead here to a much bigger size of 4096 chars if the token comes with a bunch of permission in it.

And I'm talking about oauth2 here as an example but it could be any other specific reason.

The fact is that, having a security test is good here, but the arbitrary 4096-character-constant-restriction which relies on "it should be more than enough for normal usages" is a bit hard, because it only relies on personal apreciation.

There should be a way, for people who know the risks, to easily override or bypass that restrictrion or to change the value of MAX_USERNAME_LENGTH, but the fact that it is a class constant accessed with the "self::" keyword makes it difficult due to the fact a constant is, by definition, made to stay untouched.

A long term solution could be to add a configuration parameter to properly override MAX_USERNAME_LENGTH if set.
A short term solution could be to, at least, use the "static::" keyword in the test. In that way, it would be possible to extends UserBadge with a custom class, and redefine MAX_USERNAME_LENGTH inside the extending class.

if (\strlen($userIdentifier) > static::MAX_USERNAME_LENGTH) {

            throw new BadCredentialsException('Username too long.');

        }

Z.