Set token client side with Rest API in Symfony2

2
votes

I made a Rest API with symfony2 on one server (S1).

I made an application with symfony2 on one server (S2).

S1 : Works well. It gives json response of user's informations, depends of url given.

S2 : Works well. Ask url with curl. Use wsse in the http header for retrieve important user's informations.

I want log in my users (from S2) using S1 database. But when i am in S2, after the json response with user's informations, i don't know what i need to do and how do it...

Application side : - Symfony2

API side : - Symfony2 - FOSUserBundle - FOSRestBundle - JMS

It's the first time i try to make an Rest API, so maybe i don't understand well how it works.

Thank's in advance.

EDIT : For more details.

  • 1 : User 1 use a log in form and send it.
  • 2 : S2 Create a http header with x-wsse parameter (Nonce / Timestamp / Username / Password...)
  • 3 : S2 send this header to S1 with curl
  • 4 : S1 retrieve datas and if the header have good informations, send back the user's informations (in json) or make some actions
  • 5 : S2 retrieve jsons informations of the user from S1.
  • 6 : I can display the page like i want to the User 1

Now my problem is that i need to do the same thing for a new page, but i don't want ask my user for a password and a username a second time because for him, he is log in.

Hope it's more clear.

EDIT 2 : My problem resume in one sentence.

In Symfony2, with wsse authentication, how can i get a user's token and send it to client side after authentication on the API.

:p

2
apirestsymfonycurlwsse

2 Answers

0
votes

You need to create a custom authentication. Fortunately for you, this Symfony cookbok entry will show you how to do it with WSSE:

http://symfony.com/doc/current/cookbook/security/custom_authentication_provider.html

0
votes

Your S1 application returns a token when you authenticate from the S2 app, right ?

Then all you need to do is store this token somewhere in your S1 app (an entity, redis, ... Whatever), and when a foreign app (such as your S2 app) ask for a resource while providing this request with a token, you just gotta check out if the token exists and is valid.

If it is, then you can authenticate the user on the S1 with Symfony's security component.