OidcTokenHandler first arg instance of AlgorithmManager

symfony · louismariegaborit · Sep 15, 2023 · Sep 15, 2023 · Sep 15, 2023 · Sep 15, 2023
commit 6e047ba8ad50d6ede10d78fde81530b0487575de
@@ -39,13 +39,19 @@ public function create(ContainerBuilder $container, string $id, array|string $co
         // @see Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SignatureAlgorithmFactory
         // for supported algorithms
         if (\in_array($config['algorithm'], ['ES256', 'ES384', 'ES512'], true)) {
-            $tokenHandlerDefinition->replaceArgument(0, new Reference('security.access_token_handler.oidc.signature.'.$config['algorithm']));
+            $algorithmDefinition = new Reference('security.access_token_handler.oidc.signature.'.$config['algorithm']);
         } else {
-            $tokenHandlerDefinition->replaceArgument(0, (new ChildDefinition('security.access_token_handler.oidc.signature'))
+            $algorithmDefinition = (new ChildDefinition('security.access_token_handler.oidc.signature'))
                 ->replaceArgument(0, $config['algorithm'])
-            );
+            ;
         }
 
+        $algorithmManagerDefinition = $container->setDefinition($id.'.algorithm_manager', (new ChildDefinition('security.access_token_handler.oidc.algorithm_manager'))
+            ->replaceArgument(0, [$algorithmDefinition])
+        );
+
+        $tokenHandlerDefinition->replaceArgument(0, $algorithmManagerDefinition);
+
         if (!isset($config['jwks_url']) && !isset($config['key'])) {
             throw new LogicException('You should defined key or jwks_url parameter in configuration.');
         }

@@ -12,6 +12,7 @@
 namespace Symfony\Component\DependencyInjection\Loader\Configurator;
 
 use Jose\Component\Core\Algorithm;
+use Jose\Component\Core\AlgorithmManager;
 use Jose\Component\Core\JWK;
 use Jose\Component\Core\JWKSet;
 use Jose\Component\Signature\Algorithm\ES256;
@@ -97,6 +98,12 @@
                 abstract_arg('signature algorithm'),
             ])
 
+        ->set('security.access_token_handler.oidc.algorithm_manager', AlgorithmManager::class)
+            ->abstract()
+            ->args([
+                abstract_arg('signature algorithms'),
+            ])
+
         ->set('security.access_token_handler.oidc.signature.ES256', ES256::class)
             ->parent('security.access_token_handler.oidc.signature')
             ->args(['index_0' => 'ES256'])

@@ -38,15 +38,23 @@ final class OidcTokenHandler implements AccessTokenHandlerInterface
 {
     use OidcTrait;
 
+    private AlgorithmManager $algorithmManager;
+
     public function __construct(
-        private Algorithm $signatureAlgorithm,
+        private Algorithm|AlgorithmManager $signatureAlgorithm,
         private JWK|JWKSet $jwk,
         private string $audience,
         private array $issuers,
         private string $claim = 'sub',
         private ?LoggerInterface $logger = null,
         private ClockInterface $clock = new Clock(),
     ) {
+        if ($this->signatureAlgorithm instanceof Algorithm) {
+            trigger_deprecation('symfony/security-http', '7.1', 'First argument must be instance of %s, %s given.', AlgorithmManager::class, Algorithm::class);
+            $this->algorithmManager = new AlgorithmManager([$this->signatureAlgorithm]);
+        } else {
+            $this->algorithmManager = $signatureAlgorithm;
+        }
     }
 
     public function getUserBadgeFrom(string $accessToken): UserBadge
@@ -57,7 +65,7 @@ public function getUserBadgeFrom(string $accessToken): UserBadge
 
         try {
             // Decode the token
-            $jwsVerifier = new JWSVerifier(new AlgorithmManager([$this->signatureAlgorithm]));
+            $jwsVerifier = new JWSVerifier($this->algorithmManager);
             $serializerManager = new JWSSerializerManager([new CompactSerializer()]);
             $jws = $serializerManager->unserialize($accessToken);
             $claims = json_decode($jws->getPayload(), true);
@@ -77,7 +85,7 @@ public function getUserBadgeFrom(string $accessToken): UserBadge
 
             // Verify the headers
             $headerCheckerManager = new Checker\HeaderCheckerManager([
-                new Checker\AlgorithmChecker([$this->signatureAlgorithm->name()]),
+                new Checker\AlgorithmChecker($this->algorithmManager->list()),
             ], [
                 new JWSTokenSupport(),
             ]);

@@ -5,6 +5,7 @@ CHANGELOG
 ---
 
  * Add `#[IsCsrfTokenValid]` attribute
+ * Deprecate passing a Algorithm object as the 1st argument to the constructor of `Symfony\Component\Security\Http\AccessToken\Oidc\OidcTokenHandler`
 
 7.0
 ---

@@ -54,7 +54,7 @@ public function testGetsUserIdentifierFromSignedToken(string $claim, string $exp
         $loggerMock->expects($this->never())->method('error');
 
         $userBadge = (new OidcTokenHandler(
-            new ES256(),
+            new AlgorithmManager([new ES256()]),
             $jwk,
             self::AUDIENCE,
             ['https://www.example.com'],
@@ -90,7 +90,7 @@ public function testThrowsAnErrorIfTokenIsInvalid(string $token)
         $this->expectExceptionMessage('Invalid credentials.');
 
         (new OidcTokenHandler(
-            new ES256(),
+            new AlgorithmManager([new ES256()]),
             $this->getJWK(),
             self::AUDIENCE,
             ['https://www.example.com'],
@@ -149,7 +149,7 @@ public function testThrowsAnErrorIfUserPropertyIsMissing()
         $this->expectExceptionMessage('Invalid credentials.');
 
         (new OidcTokenHandler(
-            new ES256(),
+            new AlgorithmManager([new ES256()]),
             self::getJWK(),
             self::AUDIENCE,
             ['https://www.example.com'],

@@ -17,6 +17,7 @@
     ],
     "require": {
         "php": ">=8.2",
+        "symfony/deprecation-contracts": "^2.5|^3",
         "symfony/http-foundation": "^6.4|^7.0",
         "symfony/http-kernel": "^6.4|^7.0",
         "symfony/polyfill-mbstring": "~1.0",
-Original file line number
+Diff line change
@@ Expand Up / @@ -5,6 +5,7 @@ CHANGELOG @@
     ---
      * Add `#[IsCsrfTokenValid]` attribute
+     * Deprecate passing a Algorithm object as the 1st argument to the constructor of `Symfony\Component\Security\Http\AccessToken\Oidc\OidcTokenHandler`
 .0
     ---
@@ Expand Down @@