Symfony 3.3, authentication, bcrypt, bad credentials

Question

I am developing a Symfony 3.3 web app which includes a few bundles.

I am trying to define a way to register an admin user in the databases as it follows. I am able to create the user in the database, but afterward I am not able to login as that user: I always get bad credentials. Although I am aware that things could be arranged in better ways, I would like to understand what I fail to see.

So I have an AdminBundle, therein I have defined a User class:

<?php

namespace myApp\AdminBundle\Entity;


use FOS\UserBundle\Model\User as BaseUser;
use Doctrine\ORM\Mapping as ORM;


/**
 * @ORM\Entity
 * @ORM\Table(name="fos_user")
 */
class User extends BaseUser
{
    /**
     * @ORM\Id
     * @ORM\Column(type="integer")
     * @ORM\GeneratedValue(strategy="AUTO")
     */
    protected $id;

    public function __construct()
    {
        parent::__construct();

    }
}
?>

and a registerAction

    /**
    * register main user/admin
    *
    * @Route("/register/{nameuser}", name="Jus_Admin_register")
    * @Method("GET")
    * @Template()
    */
    public function registerAction($nameuser)
        {

    $user = new User();
    $user->setUsername($nameuser);
    $user->setEmail('[email protected]');
    $plainPassword = 'pw';
    $encoder = $this->get('security.encoder_factory')->getEncoder($user);
    $encoded = $encoder->encodePassword($user, $plainPassword);

    $user->setPassword($encoded);
    $user->setEnabled(TRUE);
    $user->setSuperAdmin(TRUE);
    $userManager = $this->container->get('fos_user.user_manager');
    $userManager->updateUser($user);

     return $this->render('myAppAdminBundle:Admin:login.html.twig');      
}

My security.yml has:

security:
    encoders:
        myApp\AdminBundle\Entity\User:
            algorithm: bcrypt
            cost: 10
            iterations: 1

   role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

   providers:
       our_db_provider:
            entity:
               class: myApp\AdminBundle\Entity\User
               property: username
....
   firewalls:
       admin_area:
           pattern:   ^/myApp/Admin
           anonymous: ~
           form_login:
              login_path: /myApp/Admin/login
              check_path: /myApp/Admin/login_check
           logout:
              path:   /myApp/Admin/logout
              target: /myApp/Admin/admin
           http_basic:
              realm: "Admin reserved"

           context: primary_auth

and my config.yml has (indeed I am not sure whether I need the following at all):

fos_user:
   db_driver: orm # other valid values are 'mongodb' and 'couchdb'
   firewall_name: admin_area
   user_class: myApp\AdminBundle\Entity\User\
   from_email:
       address: "%mailer_user%"
       sender_name: "%mailer_user%"

If I call http://localhost/myApp/Admin/register/admin, the following record is inserted into the table fos_user:

--
-- Dumping data for table `fos_user`
--

INSERT INTO `fos_user` (`id`, `username`, `username_canonical`, `email`, `email_canonical`, `enabled`, `salt`, `password`, `last_login`, `confirmation_token`, `password_requested_at`, `roles`) VALUES
(1, 'admin', 'admin', '[email protected]', '[email protected]', 1, NULL, '$2y........yq', NULL, NULL, NULL, 'a:1:{i:0;s:16:\"ROLE_SUPER_ADMIN\";}');

However, I am not able to login. Logs says:

[2017-08-.. ....] security.INFO: Authentication request failed. {"exception":"[object] (Symfony\Component\Security\Core\Exception\BadCredentialsException(code: 0): Bad credentials. at /..../vendor/symfony/symfony/src/Symfony/Component/Security/Core/Authentication/Provider/UserAuthenticationProvider.php:91, Symfony\Component\Security\Core\Exception\BadCredentialsException(code: 0): The presented password is invalid. at /...../vendor/symfony/symfony/src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php:67)"} []

thanks, I appreciate your help

ps. my app works pretty well, if I use an in_memory security provider

Max P. Max P. · Accepted Answer · 2017-08-19T11:40:00

There is no need to hash password manually. It is hashed by user manager on update. Just set plain password.

$user = new User();
...
$user->setPlainPassword('pw');
...
$userManager->updateUser($user);

If you want to hash it manually then fix encodePassword call. It accepts 2 arguments: plain password and salt

$encoded = $encoder->encodePassword('pw', $user->getSalt());

https://github.com/symfony/security-core/blob/master/Encoder/PasswordEncoderInterface.php#L29

Symfony 3.3, authentication, bcrypt, bad credentials

1 Answers