发布于 2015-08-27 16:40:51 | 225 次阅读 | 评论: 0 | 来源: 网络整理
A lot of authentication modules are already provided by some web servers, including Apache. These modules generally set some environment variables that can be used to determine which user is accessing your application. Out of the box, Symfony supports most authentication mechanisms. These requests are called pre authenticated requests because the user is already authenticated when reaching your application.
When using client certificates, your webserver is doing all the authentication
process itself. With Apache, for example, you would use the
SSLVerifyClient Require directive.
Enable the x509 authentication for a particular firewall in the security configuration:
# app/config/security.yml
security:
firewalls:
secured_area:
pattern: ^/
x509:
provider: your_user_provider
<!-- app/config/security.xml -->
<?xml version="1.0" ?>
<srv:container xmlns="http://symfony.com/schema/dic/security"
xmlns:srv="http://symfony.com/schema/dic/services">
<config>
<firewall name="secured_area" pattern="^/">
<x509 provider="your_user_provider"/>
</firewall>
</config>
</srv:container>
// app/config/security.php
$container->loadFromExtension('security', array(
'firewalls' => array(
'secured_area' => array(
'pattern' => '^/'
'x509' => array(
'provider' => 'your_user_provider',
),
),
),
));
By default, the firewall provides the SSL_CLIENT_S_DN_Email variable to
the user provider, and sets the SSL_CLIENT_S_DN as credentials in the
PreAuthenticatedToken.
You can override these by setting the user and the credentials keys
in the x509 firewall configuration respectively.
注解
An authentication provider will only inform the user provider of the username
that made the request. You will need to create (or use) a “user provider” that
is referenced by the provider configuration parameter (your_user_provider
in the configuration example). This provider will turn the username into a User
object of your choice. For more information on creating or configuring a user
provider, see:
2.6 新版功能: REMOTE_USER pre authenticated firewall was introduced in Symfony 2.6.
A lot of authentication modules, like auth_kerb for Apache provide the username
using the REMOTE_USER environment variable. This variable can be trusted by
the application since the authentication happened before the request reached it.
To configure Symfony using the REMOTE_USER environment variable, simply enable the
corresponding firewall in your security configuration:
# app/config/security.yml
security:
firewalls:
secured_area:
pattern: ^/
remote_user:
provider: your_user_provider
<!-- app/config/security.xml -->
<?xml version="1.0" ?>
<srv:container xmlns="http://symfony.com/schema/dic/security"
xmlns:srv="http://symfony.com/schema/dic/services">
<config>
<firewall name="secured_area" pattern="^/">
<remote-user provider="your_user_provider"/>
</firewall>
</config>
</srv:container>
// app/config/security.php
$container->loadFromExtension('security', array(
'firewalls' => array(
'secured_area' => array(
'pattern' => '^/'
'remote_user' => array(
'provider' => 'your_user_provider',
),
),
),
));
The firewall will then provide the REMOTE_USER environment variable to
your user provider. You can change the variable name used by setting the user
key in the remote_user firewall configuration.
注解
Just like for X509 authentication, you will need to configure a “user provider”. See the note previous note for more information.