Skip to content

Commit 8130dd3

Browse files
xabbuhxabbuh
committed
Merge branch '7.4' into 8.0
* 7.4: [Console] ensure `SHELL_VERBOSITY` is always restored properly [Console] Add support for `Cursor` helper in invokable commands [MonologBridge] Improve error when HttpClient contract is installed but not the component simplify LogoutListenerTest forbid HTTP method override of GET, HEAD, CONNECT and TRACE [HttpClient] Add option `auto_upgrade_http_version` to control how the request HTTP version is handled in `HttplugClient` and `Psr18Client` [Security] Allow multiple OIDC discovery endpoints [AssetMapper] Fix links to propshaft Document BC break in AbstractController::render
2 parents a7e0330 + d300919 commit 8130dd3

File tree

3 files changed

+105
-16
lines changed

3 files changed

+105
-16
lines changed

‎DependencyInjection/Security/AccessToken/OidcTokenHandlerFactory.php‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -47,16 +47,18 @@ public function create(ContainerBuilder $container, string $id, array|string $co
4747

4848
// disable JWKSet argument
4949
$tokenHandlerDefinition->replaceArgument(1, null);
50-
$tokenHandlerDefinition->addMethodCall(
51-
'enableDiscovery',
52-
[
53-
new Reference($config['discovery']['cache']['id']),
54-
(new ChildDefinition('security.access_token_handler.oidc_discovery.http_client'))
55-
->replaceArgument(0, ['base_uri' => $config['discovery']['base_uri']]),
56-
"$id.oidc_configuration",
57-
"$id.oidc_jwk_set",
58-
]
59-
);
50+
51+
$clients = [];
52+
foreach ($config['discovery']['base_uri'] as $uri) {
53+
$clients[] = (new ChildDefinition('security.access_token_handler.oidc_discovery.http_client'))
54+
->replaceArgument(0, ['base_uri' => $uri]);
55+
}
56+
57+
$tokenHandlerDefinition->addMethodCall('enableDiscovery', [
58+
new Reference($config['discovery']['cache']['id']),
59+
$clients,
60+
"$id.oidc_configuration",
61+
]);
6062

6163
return;
6264
}
@@ -92,7 +94,7 @@ public function create(ContainerBuilder $container, string $id, array|string $co
9294
;
9395
}
9496

95-
$firewall = substr($id, strlen('security.access_token_handler.'));
97+
$firewall = substr($id, \strlen('security.access_token_handler.'));
9698
$container->getDefinition('security.access_token_handler.oidc.command.generate')
9799
->addMethodCall('addGenerator', [
98100
$firewall,
@@ -125,10 +127,11 @@ public function addConfiguration(NodeBuilder $node): void
125127
->arrayNode('discovery')
126128
->info('Enable the OIDC discovery.')
127129
->children()
128-
->scalarNode('base_uri')
130+
->arrayNode('base_uri')
131+
->acceptAndWrap(['string'])
129132
->info('Base URI of the OIDC server.')
130133
->isRequired()
131-
->cannotBeEmpty()
134+
->scalarPrototype()->end()
132135
->end()
133136
->arrayNode('cache')
134137
->children()

‎Tests/DependencyInjection/Fixtures/php/access_token_oidc_user_info_multiple_discovery.php‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<?php
2+
3+
$container->loadFromExtension('security', [
4+
'providers' => [
5+
'default' => [
6+
'memory' => null,
7+
],
8+
],
9+
'firewalls' => [
10+
'firewall1' => [
11+
'provider' => 'default',
12+
'access_token' => [
13+
'token_handler' => [
14+
'oidc_user_info' => [
15+
'base_uri' => [
16+
'https://www.example.com/realms/demo/protocol/openid-connect/userinfo',
17+
'https://www.github.com/realms/demo/protocol/openid-connect/userinfo',
18+
],
19+
'discovery' => [
20+
'cache' => [
21+
'id' => 'oidc_cache',
22+
],
23+
],
24+
],
25+
],
26+
],
27+
],
28+
],
29+
]);

‎Tests/DependencyInjection/Security/Factory/AccessTokenFactoryTest.php‎

Lines changed: 60 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,7 +261,6 @@ public function testInvalidOidcTokenHandlerConfigurationMissingAlgorithm()
261261
public function testOidcTokenHandlerConfigurationWithDiscovery()
262262
{
263263
$container = new ContainerBuilder();
264-
$jwkset = '{"keys":[{"kty":"EC","crv":"P-256","x":"FtgMtrsKDboRO-Zo0XC7tDJTATHVmwuf9GK409kkars","y":"rWDE0ERU2SfwGYCo1DWWdgFEbZ0MiAXLRBBOzBgs_jY","d":"4G7bRIiKih0qrFxc0dtvkHUll19tTyctoCR3eIbOrO0"},{"kty":"EC","crv":"P-256","x":"0QEAsI1wGI-dmYatdUZoWSRWggLEpyzopuhwk-YUnA4","y":"KYl-qyZ26HobuYwlQh-r0iHX61thfP82qqEku7i0woo","d":"iA_TV2zvftni_9aFAQwFO_9aypfJFCSpcCyevDvz220"}]}';
265264
$config = [
266265
'token_handler' => [
267266
'oidc' => [
@@ -299,10 +298,68 @@ public function testOidcTokenHandlerConfigurationWithDiscovery()
299298
'enableDiscovery',
300299
[
301300
new Reference('oidc_cache'),
302-
(new ChildDefinition('security.access_token_handler.oidc_discovery.http_client'))
301+
[
302+
(new ChildDefinition('security.access_token_handler.oidc_discovery.http_client'))
303303
->replaceArgument(0, ['base_uri' => 'https://www.example.com/realms/demo/']),
304+
],
305+
'security.access_token_handler.firewall1.oidc_configuration',
306+
],
307+
],
308+
];
309+
$this->assertEquals($expectedArgs, $container->getDefinition('security.access_token_handler.firewall1')->getArguments());
310+
$this->assertEquals($expectedCalls, $container->getDefinition('security.access_token_handler.firewall1')->getMethodCalls());
311+
}
312+
313+
public function testOidcTokenHandlerConfigurationWithMultipleDiscoveryBaseUri()
314+
{
315+
$container = new ContainerBuilder();
316+
$config = [
317+
'token_handler' => [
318+
'oidc' => [
319+
'discovery' => [
320+
'base_uri' => [
321+
'https://www.example.com/realms/demo/',
322+
'https://www.api.com/realms/api/',
323+
],
324+
'cache' => [
325+
'id' => 'oidc_cache',
326+
],
327+
],
328+
'algorithms' => ['RS256', 'ES256'],
329+
'issuers' => ['https://www.example.com'],
330+
'audience' => 'audience',
331+
],
332+
],
333+
];
334+
335+
$factory = new AccessTokenFactory($this->createTokenHandlerFactories());
336+
$finalizedConfig = $this->processConfig($config, $factory);
337+
338+
$factory->createAuthenticator($container, 'firewall1', $finalizedConfig, 'userprovider');
339+
340+
$this->assertTrue($container->hasDefinition('security.authenticator.access_token.firewall1'));
341+
$this->assertTrue($container->hasDefinition('security.access_token_handler.firewall1'));
342+
343+
$expectedArgs = [
344+
'index_0' => (new ChildDefinition('security.access_token_handler.oidc.signature'))
345+
->replaceArgument(0, ['RS256', 'ES256']),
346+
'index_1' => null,
347+
'index_2' => 'audience',
348+
'index_3' => ['https://www.example.com'],
349+
'index_4' => 'sub',
350+
];
351+
$expectedCalls = [
352+
[
353+
'enableDiscovery',
354+
[
355+
new Reference('oidc_cache'),
356+
[
357+
(new ChildDefinition('security.access_token_handler.oidc_discovery.http_client'))
358+
->replaceArgument(0, ['base_uri' => 'https://www.example.com/realms/demo/']),
359+
(new ChildDefinition('security.access_token_handler.oidc_discovery.http_client'))
360+
->replaceArgument(0, ['base_uri' => 'https://www.api.com/realms/api/']),
361+
],
304362
'security.access_token_handler.firewall1.oidc_configuration',
305-
'security.access_token_handler.firewall1.oidc_jwk_set',
306363
],
307364
],
308365
];

0 commit comments

Comments
 (0)