3 namespace Wallabag\ApiBundle\Security\Authentication\Provider
;
5 use Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface
;
6 use Symfony\Component\Security\Core\User\UserProviderInterface
;
7 use Symfony\Component\Security\Core\Exception\AuthenticationException
;
8 use Symfony\Component\Security\Core\Exception\NonceExpiredException
;
9 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface
;
10 use Wallabag\ApiBundle\Security\Authentication\Token\WsseUserToken
;
12 class WsseProvider
implements AuthenticationProviderInterface
14 private $userProvider;
17 public function __construct(UserProviderInterface
$userProvider, $cacheDir)
19 $this->userProvider
= $userProvider;
20 $this->cacheDir
= $cacheDir;
22 // If cache directory does not exist we create it
23 if (!is_dir($this->cacheDir
)) {
24 mkdir($this->cacheDir
, 0777, true);
28 public function authenticate(TokenInterface
$token)
30 $user = $this->userProvider
->loadUserByUsername($token->getUsername());
33 throw new AuthenticationException('Bad credentials. Did you forgot your username?');
36 if ($user && $this->validateDigest($token->digest
, $token->nonce
, $token->created
, $user->getPassword())) {
37 $authenticatedToken = new WsseUserToken($user->getRoles());
38 $authenticatedToken->setUser($user);
40 return $authenticatedToken;
43 throw new AuthenticationException('The WSSE authentication failed.');
46 protected function validateDigest($digest, $nonce, $created, $secret)
48 // Check created time is not in the future
49 if (strtotime($created) > time()) {
50 throw new AuthenticationException('Back to the future...');
53 // Expire timestamp after 5 minutes
54 if (time() - strtotime($created) > 300) {
55 throw new AuthenticationException('Too late for this timestamp... Watch your watch.');
58 // Validate nonce is unique within 5 minutes
59 if (file_exists($this->cacheDir
.'/'.$nonce) && file_get_contents($this->cacheDir
.'/'.$nonce) +
300 > time()) {
60 throw new NonceExpiredException('Previously used nonce detected');
63 file_put_contents($this->cacheDir
.'/'.$nonce, time());
66 $expected = base64_encode(sha1(base64_decode($nonce).$created.$secret, true));
68 if ($digest !== $expected) {
69 throw new AuthenticationException('Bad credentials ! Digest is not as expected.');
72 return $digest === $expected;
75 public function supports(TokenInterface
$token)
77 return $token instanceof WsseUserToken
;