Skip to content

Commit 7ded5b2

Browse files
nicolas-grekasnicolas-grekas
committed
[SecurityBundle] Fix semantic configuration for singulars/plurals in XML
1 parent 5141a4c commit 7ded5b2

26 files changed

+321
-98
lines changed

‎DependencyInjection/Security/AccessToken/CasTokenHandlerFactory.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ public function addConfiguration(NodeBuilder $node): void
4242
{
4343
$node
4444
->arrayNode($this->getKey())
45-
->fixXmlConfig($this->getKey())
4645
->children()
4746
->scalarNode('validation_url')
4847
->info('CAS server validation URL')

‎DependencyInjection/Security/AccessToken/OidcTokenHandlerFactory.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,8 +90,8 @@ public function addConfiguration(NodeBuilder $node): void
9090
{
9191
$node
9292
->arrayNode($this->getKey())
93-
->fixXmlConfig($this->getKey())
9493
->fixXmlConfig('issuer')
94+
->fixXmlConfig('algorithm')
9595
->validate()
9696
->ifTrue(static fn ($v) => !isset($v['algorithm']) && !isset($v['algorithms']))
9797
->thenInvalid('You must set either "algorithm" or "algorithms".')
@@ -173,6 +173,7 @@ public function addConfiguration(NodeBuilder $node): void
173173
->info('JSON-encoded JWKSet used to sign the token (must contain a list of valid public keys).')
174174
->end()
175175
->arrayNode('encryption')
176+
->fixXmlConfig('algorithm')
176177
->canBeEnabled()
177178
->children()
178179
->booleanNode('enforce')

‎DependencyInjection/Security/AccessToken/OidcUserInfoTokenHandlerFactory.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,6 @@ public function addConfiguration(NodeBuilder $node): void
6363
{
6464
$node
6565
->arrayNode($this->getKey())
66-
->fixXmlConfig($this->getKey())
6766
->beforeNormalization()
6867
->ifString()
6968
->then(fn ($v) => ['claim' => 'sub', 'base_uri' => $v])

‎DependencyInjection/Security/Factory/AccessTokenFactory.php‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,11 +43,10 @@ public function addConfiguration(NodeDefinition $node): void
4343
{
4444
parent::addConfiguration($node);
4545

46-
$builder = $node->children();
46+
$builder = $node->fixXmlConfig('token_extractor')->children();
4747
$builder
4848
->scalarNode('realm')->defaultNull()->end()
4949
->arrayNode('token_extractors')
50-
->fixXmlConfig('token_extractors')
5150
->beforeNormalization()
5251
->ifString()
5352
->then(fn ($v) => [$v])

‎DependencyInjection/Security/Factory/RememberMeFactory.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ public function getKey(): string
126126
public function addConfiguration(NodeDefinition $node): void
127127
{
128128
$builder = $node
129+
->fixXmlConfig('signature_property', 'signature_properties')
129130
->fixXmlConfig('user_provider')
130131
->children()
131132
;

‎Resources/config/schema/security-1.0.xsd‎

Lines changed: 37 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -9,40 +9,19 @@
99
<xsd:complexType name="config">
1010
<xsd:choice maxOccurs="unbounded">
1111
<xsd:element name="access-decision-manager" type="access_decision_manager" minOccurs="0" maxOccurs="1" />
12-
<xsd:element name="password_hashers" type="password_hashers" minOccurs="0" maxOccurs="1" />
13-
<xsd:element name="password_hasher" type="password_hasher" minOccurs="0" maxOccurs="unbounded" />
14-
<xsd:element name="providers" type="providers" minOccurs="0" maxOccurs="1" />
12+
<xsd:element name="password-hasher" type="password_hasher" minOccurs="0" maxOccurs="unbounded" />
1513
<xsd:element name="provider" type="provider" minOccurs="0" maxOccurs="unbounded" />
16-
<xsd:element name="firewalls" type="firewalls" minOccurs="0" maxOccurs="1" />
1714
<xsd:element name="firewall" type="firewall" minOccurs="0" maxOccurs="unbounded" />
1815
<xsd:element name="rule" type="rule" minOccurs="0" maxOccurs="unbounded" />
1916
<xsd:element name="role" type="role" minOccurs="0" maxOccurs="unbounded" />
2017
</xsd:choice>
2118
<xsd:attribute name="access-denied-url" type="xsd:string" />
2219
<xsd:attribute name="session-fixation-strategy" type="session_fixation_strategy" />
2320
<xsd:attribute name="hide-user-not-found" type="xsd:boolean" />
24-
<xsd:attribute name="always-authenticate-before-granting" type="xsd:boolean" />
21+
<xsd:attribute name="expose-security-errors" type="access_decision_manager_expose_security_level" />
2522
<xsd:attribute name="erase-credentials" type="xsd:boolean" />
2623
</xsd:complexType>
2724

28-
<xsd:complexType name="password_hashers">
29-
<xsd:sequence>
30-
<xsd:element name="password_hasher" type="password_hasher" minOccurs="1" maxOccurs="unbounded" />
31-
</xsd:sequence>
32-
</xsd:complexType>
33-
34-
<xsd:complexType name="providers">
35-
<xsd:sequence>
36-
<xsd:element name="provider" type="provider" minOccurs="1" maxOccurs="unbounded" />
37-
</xsd:sequence>
38-
</xsd:complexType>
39-
40-
<xsd:complexType name="firewalls">
41-
<xsd:sequence>
42-
<xsd:element name="firewall" type="firewall" minOccurs="1" maxOccurs="unbounded" />
43-
</xsd:sequence>
44-
</xsd:complexType>
45-
4625
<xsd:simpleType name="session_fixation_strategy">
4726
<xsd:restriction base="xsd:string">
4827
<xsd:enumeration value="none" />
@@ -55,7 +34,6 @@
5534
<xsd:attribute name="strategy" type="access_decision_manager_strategy" />
5635
<xsd:attribute name="service" type="xsd:string" />
5736
<xsd:attribute name="strategy-service" type="xsd:string" />
58-
<xsd:attribute name="expose-security-errors" type="access_decision_manager_expose_security_level" />
5937
<xsd:attribute name="allow-if-all-abstain" type="xsd:boolean" />
6038
<xsd:attribute name="allow-if-equal-granted-denied" type="xsd:boolean" />
6139
</xsd:complexType>
@@ -196,12 +174,16 @@
196174
<xsd:attribute name="name" type="xsd:string" use="required" />
197175
<xsd:attribute name="path" type="xsd:string" />
198176
<xsd:attribute name="domain" type="xsd:string" />
177+
<xsd:attribute name="secure" type="xsd:boolean" />
178+
<xsd:attribute name="samesite" type="remember_me_samesite" />
179+
<xsd:attribute name="partitioned" type="xsd:boolean" />
199180
</xsd:complexType>
200181

201182
<xsd:complexType name="switch_user">
202183
<xsd:attribute name="provider" type="xsd:string" />
203184
<xsd:attribute name="parameter" type="xsd:string" />
204185
<xsd:attribute name="role" type="xsd:string" />
186+
<xsd:attribute name="target-route" type="xsd:string" />
205187
</xsd:complexType>
206188

207189
<xsd:complexType name="anonymous">
@@ -304,6 +286,7 @@
304286
<xsd:attribute name="success-handler" type="xsd:string" />
305287
<xsd:attribute name="failure-handler" type="xsd:string" />
306288
<xsd:attribute name="provider" type="xsd:string" />
289+
<xsd:attribute name="secret" type="xsd:string" />
307290
</xsd:complexType>
308291

309292
<xsd:complexType name="access_token">
@@ -321,59 +304,66 @@
321304
<xsd:complexType name="oidc_token_handler">
322305
<xsd:sequence>
323306
<xsd:choice minOccurs="0" maxOccurs="1">
324-
<xsd:element name="oidc-user-info" type="oidc_user_info"></xsd:element>
325-
<xsd:element name="oidc" type="oidc"></xsd:element>
307+
<xsd:element name="oidc-user-info" type="oidc_user_info" />
308+
<xsd:element name="oidc" type="oidc" />
326309
</xsd:choice>
327310
</xsd:sequence>
328-
<xsd:attribute name="oidc-user-info" type="xsd:anyURI"></xsd:attribute>
311+
<xsd:attribute name="oidc-user-info" type="xsd:string" />
329312
</xsd:complexType>
330313

331314
<xsd:complexType name="oidc_user_info">
332-
<xsd:attribute name="base-uri" type="xsd:anyURI" use="required" />
315+
<xsd:sequence>
316+
<xsd:element name="discovery" minOccurs="0" maxOccurs="1">
317+
<xsd:complexType>
318+
<xsd:sequence>
319+
<xsd:element name="cache" minOccurs="0" maxOccurs="1">
320+
<xsd:complexType>
321+
<xsd:attribute name="id" type="xsd:string" />
322+
</xsd:complexType>
323+
</xsd:element>
324+
</xsd:sequence>
325+
</xsd:complexType>
326+
</xsd:element>
327+
</xsd:sequence>
328+
<xsd:attribute name="base-uri" type="xsd:string" use="required" />
333329
<xsd:attribute name="claim" type="xsd:string" />
334330
<xsd:attribute name="client" type="xsd:string" />
335331
</xsd:complexType>
336332

337333
<xsd:complexType name="oidc">
338334
<xsd:choice maxOccurs="unbounded">
339-
<xsd:element name="issuers" type="oidc_issuers" minOccurs="0" maxOccurs="1" />
340-
<xsd:element name="issuer" type="password_hasher" minOccurs="0" maxOccurs="unbounded" />
335+
<xsd:element name="issuer" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
336+
<xsd:element name="algorithm" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
341337
<xsd:element name="encryption" type="oidc_encryption" />
342338
</xsd:choice>
343339
<xsd:attribute name="claim" type="xsd:string" />
344340
<xsd:attribute name="audience" type="xsd:string" use="required" />
345-
<xsd:attribute name="algorithm" type="xsd:string" use="required" />
346-
<xsd:attribute name="key" type="xsd:string" use="required" />
341+
<xsd:attribute name="algorithm" type="xsd:string" />
342+
<xsd:attribute name="key" type="xsd:string" />
343+
<xsd:attribute name="keyset" type="xsd:string" />
347344
</xsd:complexType>
348345

349346
<xsd:complexType name="oidc_encryption">
350347
<xsd:choice maxOccurs="unbounded">
351-
<xsd:element name="algorithms" type="oidc_encryption_algorithms" minOccurs="1" maxOccurs="1" />
348+
<xsd:element name="algorithm" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
352349
</xsd:choice>
353350
<xsd:attribute name="enabled" type="xsd:boolean" />
354351
<xsd:attribute name="enforce" type="xsd:boolean" />
355352
<xsd:attribute name="keyset" type="xsd:string" use="required" />
356353
</xsd:complexType>
357354

358-
<xsd:complexType name="oidc_encryption_algorithms">
359-
<xsd:sequence>
360-
<xsd:element name="algorithm" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
361-
</xsd:sequence>
362-
</xsd:complexType>
363-
364-
<xsd:complexType name="oidc_issuers">
365-
<xsd:sequence>
366-
<xsd:element name="issuer" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
367-
</xsd:sequence>
368-
</xsd:complexType>
369-
370355
<xsd:complexType name="login_throttling">
371356
<xsd:attribute name="limiter" type="xsd:string" />
372357
<xsd:attribute name="max-attempts" type="xsd:integer" />
358+
<xsd:attribute name="interval" type="xsd:string" />
359+
<xsd:attribute name="lock-factory" type="xsd:string" />
373360
</xsd:complexType>
374361

375362
<xsd:complexType name="remember_me">
376363
<xsd:sequence minOccurs="0">
364+
<xsd:choice minOccurs="0" maxOccurs="unbounded">
365+
<xsd:element name="signature-property" type="xsd:string" />
366+
</xsd:choice>
377367
<xsd:choice minOccurs="0" maxOccurs="unbounded">
378368
<xsd:element name="user-provider" type="xsd:string" />
379369
</xsd:choice>
@@ -442,7 +432,7 @@
442432
<xsd:element name="method" type="xsd:string" minOccurs="0" maxOccurs="unbounded" />
443433
<xsd:element name="role" type="xsd:string" minOccurs="0" maxOccurs="unbounded" />
444434
<xsd:element name="allow-if" type="xsd:string" minOccurs="0" maxOccurs="1" />
445-
<xsd:element name="attribute" type="rule_attribute" minOccurs="0" maxOccurs="1" />
435+
<xsd:element name="attribute" type="rule_attribute" minOccurs="0" maxOccurs="unbounded" />
446436
</xsd:choice>
447437
<xsd:attribute name="requires-channel" type="xsd:string" />
448438
<xsd:attribute name="path" type="xsd:string" />
@@ -452,6 +442,7 @@
452442
<xsd:attribute name="methods" type="xsd:string" />
453443
<xsd:attribute name="allow-if" type="xsd:string" />
454444
<xsd:attribute name="route" type="xsd:string" />
445+
<xsd:attribute name="request-matcher" type="xsd:string" />
455446
</xsd:complexType>
456447

457448
<xsd:complexType name="role">

‎Tests/DependencyInjection/CompleteConfigurationTestCase.php‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -726,6 +726,41 @@ public function testFirewallPatterns()
726726
$this->assertSame('(?:^/register$|^/documentation$)', $container->getDefinition($requestMatcherId)->getArgument(0));
727727
}
728728

729+
public function testAccessTokenOidc()
730+
{
731+
$container = $this->getContainer('access_token_oidc');
732+
733+
$this->assertTrue($container->hasDefinition('security.authenticator.access_token.firewall1'));
734+
$this->assertTrue($container->hasDefinition('security.access_token_handler.firewall1'));
735+
736+
$def = $container->getDefinition('security.access_token_handler.firewall1');
737+
$this->assertSame('audience', $def->getArgument(2));
738+
$this->assertSame(['https://www.example.com'], $def->getArgument(3));
739+
$this->assertSame('sub', $def->getArgument(4));
740+
}
741+
742+
public function testAccessTokenOidcWithEncryption()
743+
{
744+
$container = $this->getContainer('access_token_oidc_encryption');
745+
746+
$this->assertTrue($container->hasDefinition('security.authenticator.access_token.firewall1'));
747+
$this->assertTrue($container->hasDefinition('security.access_token_handler.firewall1'));
748+
749+
$def = $container->getDefinition('security.access_token_handler.firewall1');
750+
$this->assertSame(['RS256'], $def->getArgument(0)->getArgument(0));
751+
}
752+
753+
public function testAccessTokenOidcUserInfoWithDiscovery()
754+
{
755+
if ('xml' === $this->getFileExtension()) {
756+
$this->markTestSkipped('OIDC user info discovery is not supported by the XML schema.');
757+
}
758+
$container = $this->getContainer('access_token_oidc_user_info_discovery');
759+
760+
$this->assertTrue($container->hasDefinition('security.authenticator.access_token.firewall1'));
761+
$this->assertTrue($container->hasDefinition('security.access_token_handler.firewall1'));
762+
}
763+
729764
protected function getContainer($file)
730765
{
731766
$file .= '.'.$this->getFileExtension();

‎Tests/DependencyInjection/Fixtures/php/access_token_oidc.php‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?php
2+
3+
$container->loadFromExtension('security', [
4+
'providers' => [
5+
'default' => [
6+
'memory' => null,
7+
],
8+
],
9+
'firewalls' => [
10+
'firewall1' => [
11+
'provider' => 'default',
12+
'access_token' => [
13+
'token_handler' => [
14+
'oidc' => [
15+
'algorithms' => ['RS256'],
16+
'issuers' => ['https://www.example.com'],
17+
'audience' => 'audience',
18+
'keyset' => '{"keys":[{"kty":"RSA","n":"abc","e":"AQAB"}]}',
19+
],
20+
],
21+
],
22+
],
23+
],
24+
]);
25+

‎Tests/DependencyInjection/Fixtures/php/access_token_oidc_encryption.php‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<?php
2+
3+
$container->loadFromExtension('security', [
4+
'providers' => [
5+
'default' => [
6+
'memory' => null,
7+
],
8+
],
9+
'firewalls' => [
10+
'firewall1' => [
11+
'provider' => 'default',
12+
'access_token' => [
13+
'token_handler' => [
14+
'oidc' => [
15+
'algorithms' => ['RS256'],
16+
'issuers' => ['https://www.example.com'],
17+
'audience' => 'audience',
18+
'keyset' => '{"keys":[{"kty":"RSA","n":"abc","e":"AQAB"}]}',
19+
'encryption' => [
20+
'enabled' => true,
21+
'keyset' => '{"keys":[{"kty":"RSA","n":"abc","e":"AQAB","d":"def"}]}',
22+
'algorithms' => ['RSA-OAEP'],
23+
],
24+
],
25+
],
26+
],
27+
],
28+
],
29+
]);
30+

‎Tests/DependencyInjection/Fixtures/php/access_token_oidc_user_info_discovery.php‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?php
2+
3+
$container->loadFromExtension('security', [
4+
'providers' => [
5+
'default' => [
6+
'memory' => null,
7+
],
8+
],
9+
'firewalls' => [
10+
'firewall1' => [
11+
'provider' => 'default',
12+
'access_token' => [
13+
'token_handler' => [
14+
'oidc_user_info' => [
15+
'base_uri' => 'https://www.example.com/realms/demo/protocol/openid-connect/userinfo',
16+
'discovery' => [
17+
'cache' => [
18+
'id' => 'oidc_cache',
19+
],
20+
],
21+
],
22+
],
23+
],
24+
],
25+
],
26+
]);
27+

0 commit comments

Comments
 (0)