认证(Authentication)

use Symfony\Component\Security\Http\Firewall\ListenerInterface;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
 
class SomeAuthenticationListener implements ListenerInterface
{
    /**
     * @var TokenStorageInterface
     */
    private $tokenStorage;
 
    /**
     * @var AuthenticationManagerInterface
     */
    private $authenticationManager;
 
    /**
     * @var string Uniquely identifies the secured area
     * 用作唯一识别受保护区域的字符串
     */
    private $providerKey;
 
    // ...
 
    public function handle(GetResponseEvent $event)
    {
        $request = $event->getRequest();
 
        $username = ...;
        $password = ...;
 
        $unauthenticatedToken = new UsernamePasswordToken(
            $username,
            $password,
            $this->providerKey
        );
 
        $authenticatedToken = $this
            ->authenticationManager
            ->authenticate($unauthenticatedToken);
 
        $this->tokenStorage->setToken($authenticatedToken);

use Symfony\Component\Security\Core\Authentication\AuthenticationProviderManager;
 
// instances of Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface
// 由AuthenticationProviderInterface的实例组成的数组
$providers = array(...);
 
$authenticationManager = new AuthenticationProviderManager($providers);
 
try {
    $authenticatedToken = $authenticationManager
        ->authenticate($unauthenticatedToken);
} catch (AuthenticationException $failed) {
    // authentication failed
}

use Symfony\Component\Security\Core\Authentication\Provider\DaoAuthenticationProvider;
use Symfony\Component\Security\Core\User\UserChecker;
use Symfony\Component\Security\Core\User\InMemoryUserProvider;
use Symfony\Component\Security\Core\Encoder\EncoderFactory;
 
$userProvider = new InMemoryUserProvider(
    array(
        'admin' => array(
            // password is "foo"
            'password' => '5FZ2Z8QIkA7UTZ4BYkoC+GsReLf569mSKDsfods6LYQ8t+a8EW9oaircfMpmaLbPBh4FOBiiFyLfuZmTSUwzZg==',
            'roles'    => array('ROLE_ADMIN'),
        ),
    )
);
 
// for some extra checks: is account enabled, locked, expired, etc.?
// 做特殊检查：账号是否开启、锁定、过期？
$userChecker = new UserChecker();
 
// an array of password encoders (see below)
// password encoder的数组
$encoderFactory = new EncoderFactory(...);
 
$provider = new DaoAuthenticationProvider(
    $userProvider,
    $userChecker,
    'secured_area',
    $encoderFactory
);
 
$provider->authenticate($unauthenticatedToken);

use Symfony\Component\Security\Core\Encoder\EncoderFactory;
use Symfony\Component\Security\Core\Encoder\MessageDigestPasswordEncoder;
 
$defaultEncoder = new MessageDigestPasswordEncoder('sha512', true, 5000);
$weakEncoder = new MessageDigestPasswordEncoder('md5', true, 1);
 
$encoders = array(
    'Symfony\\Component\\Security\\Core\\User\\User' => $defaultEncoder,
    'Acme\\Entity\\LegacyUser'                       => $weakEncoder,
 
    // ...
);
 
$encoderFactory = new EncoderFactory($encoders);

use Symfony\Component\Security\Core\Encoder\BasePasswordEncoder;
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
 
class FoobarEncoder extends BasePasswordEncoder
{
    public function encodePassword($raw, $salt)
    {
        if ($this->isPasswordTooLong($raw)) {
            throw new BadCredentialsException('Invalid password.');
        }
 
        // ...
    }
 
    public function isPasswordValid($encoded, $raw, $salt)
    {
        if ($this->isPasswordTooLong($raw)) {
            return false;
        }
 
        // ...
}

// a Acme\Entity\LegacyUser instance
// LegacyUser实例
$user = ...;
 
// the password that was submitted, e.g. when registering
// 提交过来的密码，比如在注册时
$plainPassword = ...;
 
$encoder = $encoderFactory->getEncoder($user);
 
// will return $weakEncoder (see above)
// 返回$weakEncoder
$encodedPassword = $encoder->encodePassword($plainPassword, $user->getSalt());
 
$user->setPassword($encodedPassword);
 
// ... save the user 存储user对象

// fetch the Acme\Entity\LegacyUser
// 取出LegacyUser
$user = ...;
 
// the submitted password, e.g. from the login form
// 从登录表单提交的密码
$plainPassword = ...;
 
$validPassword = $encoder->isPasswordValid(
    $user->getPassword(), // the encoded password
    $plainPassword,       // the submitted password
    $user->getSalt()
);