vendor/symfony/security-bundle/DependencyInjection/SecurityExtension.php line 721

Open in your IDE?
  1. <?php
  3. /*
  4.  * This file is part of the Symfony package.
  5.  *
  6.  * (c) Fabien Potencier <[email protected]>
  7.  *
  8.  * For the full copyright and license information, please view the LICENSE
  9.  * file that was distributed with this source code.
  10.  */
  12. namespace Symfony\Bundle\SecurityBundle\DependencyInjection;
  14. use Composer\InstalledVersions;
  15. use Symfony\Bridge\Twig\Extension\LogoutUrlExtension;
  16. use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AuthenticatorFactoryInterface;
  17. use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\FirewallListenerFactoryInterface;
  18. use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface;
  19. use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\UserProvider\UserProviderFactoryInterface;
  20. use Symfony\Bundle\SecurityBundle\Security\LegacyLogoutHandlerListener;
  21. use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
  22. use Symfony\Component\Config\FileLocator;
  23. use Symfony\Component\Console\Application;
  24. use Symfony\Component\DependencyInjection\Alias;
  25. use Symfony\Component\DependencyInjection\Argument\IteratorArgument;
  26. use Symfony\Component\DependencyInjection\Argument\ServiceClosureArgument;
  27. use Symfony\Component\DependencyInjection\ChildDefinition;
  28. use Symfony\Component\DependencyInjection\Compiler\ServiceLocatorTagPass;
  29. use Symfony\Component\DependencyInjection\ContainerBuilder;
  30. use Symfony\Component\DependencyInjection\Definition;
  31. use Symfony\Component\DependencyInjection\Extension\PrependExtensionInterface;
  32. use Symfony\Component\DependencyInjection\Loader\PhpFileLoader;
  33. use Symfony\Component\DependencyInjection\Reference;
  34. use Symfony\Component\EventDispatcher\EventDispatcher;
  35. use Symfony\Component\ExpressionLanguage\ExpressionLanguage;
  36. use Symfony\Component\HttpKernel\DependencyInjection\Extension;
  37. use Symfony\Component\HttpKernel\KernelEvents;
  38. use Symfony\Component\PasswordHasher\Hasher\NativePasswordHasher;
  39. use Symfony\Component\PasswordHasher\Hasher\Pbkdf2PasswordHasher;
  40. use Symfony\Component\PasswordHasher\Hasher\PlaintextPasswordHasher;
  41. use Symfony\Component\PasswordHasher\Hasher\SodiumPasswordHasher;
  42. use Symfony\Component\Security\Core\Authorization\Strategy\AffirmativeStrategy;
  43. use Symfony\Component\Security\Core\Authorization\Strategy\ConsensusStrategy;
  44. use Symfony\Component\Security\Core\Authorization\Strategy\PriorityStrategy;
  45. use Symfony\Component\Security\Core\Authorization\Strategy\UnanimousStrategy;
  46. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  47. use Symfony\Component\Security\Core\Encoder\NativePasswordEncoder;
  48. use Symfony\Component\Security\Core\Encoder\SodiumPasswordEncoder;
  49. use Symfony\Component\Security\Core\User\ChainUserProvider;
  50. use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
  51. use Symfony\Component\Security\Core\User\UserProviderInterface;
  52. use Symfony\Component\Security\Http\Authenticator\Debug\TraceableAuthenticatorManagerListener;
  53. use Symfony\Component\Security\Http\Event\CheckPassportEvent;
  55. /**
  56.  * SecurityExtension.
  57.  *
  58.  * @author Fabien Potencier <[email protected]>
  59.  * @author Johannes M. Schmitt <[email protected]>
  60.  */
  61. class SecurityExtension extends Extension implements PrependExtensionInterface
  62. {
  63.     private $requestMatchers = [];
  64.     private $expressions = [];
  65.     private $contextListeners = [];
  66.     /** @var list<array{int, AuthenticatorFactoryInterface|SecurityFactoryInterface}> */
  67.     private $factories = [];
  68.     /** @var list<AuthenticatorFactoryInterface|SecurityFactoryInterface> */
  69.     private $sortedFactories = [];
  70.     private $userProviderFactories = [];
  71.     private $statelessFirewallKeys = [];
  73.     private $authenticatorManagerEnabled = false;
  75.     public function prepend(ContainerBuilder $container)
  76.     {
  77.         foreach ($this->getSortedFactories() as $factory) {
  78.             if ($factory instanceof PrependExtensionInterface) {
  79.                 $factory->prepend($container);
  80.             }
  81.         }
  82.     }
  84.     public function load(array $configs, ContainerBuilder $container)
  85.     {
  86.         if (!class_exists(InstalledVersions::class)) {
  87.             trigger_deprecation('symfony/security-bundle', '5.4', 'Configuring Symfony without the Composer Runtime API is deprecated. Consider upgrading to Composer 2.1 or later.');
  88.         }
  90.         if (!array_filter($configs)) {
  91.             return;
  92.         }
  94.         $mainConfig = $this->getConfiguration($configs, $container);
  96.         $config = $this->processConfiguration($mainConfig, $configs);
  98.         // load services
  99.         $loader = new PhpFileLoader($container, new FileLocator(\dirname(__DIR__).'/Resources/config'));
  101.         $loader->load('security.php');
  102.         $loader->load('password_hasher.php');
  103.         $loader->load('security_listeners.php');
  104.         $loader->load('security_rememberme.php');
  106.         if ($this->authenticatorManagerEnabled = $config['enable_authenticator_manager']) {
  107.             if ($config['always_authenticate_before_granting']) {
  108.                 throw new InvalidConfigurationException('The security option "always_authenticate_before_granting" cannot be used when "enable_authenticator_manager" is set to true. If you rely on this behavior, set it to false.');
  109.             }
  111.             $loader->load('security_authenticator.php');
  113.             // The authenticator system no longer has anonymous tokens. This makes sure AccessListener
  114.             // and AuthorizationChecker do not throw AuthenticationCredentialsNotFoundException when no
  115.             // token is available in the token storage.
  116.             $container->getDefinition('security.access_listener')->setArgument(3, false);
  117.             $container->getDefinition('security.authorization_checker')->setArgument(3, false);
  118.             $container->getDefinition('security.authorization_checker')->setArgument(4, false);
  119.         } else {
  120.             trigger_deprecation('symfony/security-bundle', '5.3', 'Not setting the "security.enable_authenticator_manager" config option to true is deprecated.');
  122.             if ($config['always_authenticate_before_granting']) {
  123.                 $authorizationChecker = $container->getDefinition('security.authorization_checker');
  124.                 $authorizationCheckerArgs = $authorizationChecker->getArguments();
  125.                 array_splice($authorizationCheckerArgs, 1, 0, [new Reference('security.authentication.manager')]);
  126.                 $authorizationChecker->setArguments($authorizationCheckerArgs);
  127.             }
  129.             $loader->load('security_legacy.php');
  130.         }
  132.         if ($container::willBeAvailable('symfony/twig-bridge', LogoutUrlExtension::class, ['symfony/security-bundle'], true)) {
  133.             $loader->load('templating_twig.php');
  134.         }
  136.         $loader->load('collectors.php');
  137.         $loader->load('guard.php');
  139.         $container->getDefinition('data_collector.security')->addArgument($this->authenticatorManagerEnabled);
  141.         if ($container->hasParameter('kernel.debug') && $container->getParameter('kernel.debug')) {
  142.             $loader->load('security_debug.php');
  143.         }
  145.         if (!$container::willBeAvailable('symfony/expression-language', ExpressionLanguage::class, ['symfony/security-bundle'], true)) {
  146.             $container->removeDefinition('security.expression_language');
  147.             $container->removeDefinition('security.access.expression_voter');
  148.         }
  150.         // set some global scalars
  151.         $container->setParameter('security.access.denied_url', $config['access_denied_url']);
  152.         $container->setParameter('security.authentication.manager.erase_credentials', $config['erase_credentials']);
  153.         $container->setParameter('security.authentication.session_strategy.strategy', $config['session_fixation_strategy']);
  155.         if (isset($config['access_decision_manager']['service'])) {
  156.             $container->setAlias('security.access.decision_manager', $config['access_decision_manager']['service']);
  157.         } elseif (isset($config['access_decision_manager']['strategy_service'])) {
  158.             $container
  159.                 ->getDefinition('security.access.decision_manager')
  160.                 ->addArgument(new Reference($config['access_decision_manager']['strategy_service']));
  161.         } else {
  162.             $container
  163.                 ->getDefinition('security.access.decision_manager')
  164.                 ->addArgument($this->createStrategyDefinition(
  165.                     $config['access_decision_manager']['strategy'] ?? MainConfiguration::STRATEGY_AFFIRMATIVE,
  166.                     $config['access_decision_manager']['allow_if_all_abstain'],
  167.                     $config['access_decision_manager']['allow_if_equal_granted_denied']
  168.                 ));
  169.         }
  171.         $container->setParameter('security.access.always_authenticate_before_granting', $config['always_authenticate_before_granting']);
  172.         $container->setParameter('security.authentication.hide_user_not_found', $config['hide_user_not_found']);
  174.         if (class_exists(Application::class)) {
  175.             $loader->load('debug_console.php');
  176.             $debugCommand = $container->getDefinition('security.command.debug_firewall');
  177.             $debugCommand->replaceArgument(4, $this->authenticatorManagerEnabled);
  178.         }
  180.         $this->createFirewalls($config, $container);
  181.         $this->createAuthorization($config, $container);
  182.         $this->createRoleHierarchy($config, $container);
  184.         $container->getDefinition('security.authentication.guard_handler')
  185.             ->replaceArgument(2, $this->statelessFirewallKeys);
  187.         // @deprecated since Symfony 5.3
  188.         if ($config['encoders']) {
  189.             $this->createEncoders($config['encoders'], $container);
  190.         }
  192.         if ($config['password_hashers']) {
  193.             $this->createHashers($config['password_hashers'], $container);
  194.         }
  196.         if (class_exists(Application::class)) {
  197.             $loader->load('console.php');
  199.             // @deprecated since Symfony 5.3
  200.             $container->getDefinition('security.command.user_password_encoder')->replaceArgument(1, array_keys($config['encoders']));
  202.             $container->getDefinition('security.command.user_password_hash')->replaceArgument(1, array_keys($config['password_hashers']));
  203.         }
  205.         $container->registerForAutoconfiguration(VoterInterface::class)
  206.             ->addTag('security.voter');
  207.     }
  209.     /**
  210.      * @throws \InvalidArgumentException if the $strategy is invalid
  211.      */
  212.     private function createStrategyDefinition(string $strategy, bool $allowIfAllAbstainDecisions, bool $allowIfEqualGrantedDeniedDecisions): Definition
  213.     {
  214.         switch ($strategy) {
  215.             case MainConfiguration::STRATEGY_AFFIRMATIVE:
  216.                 return new Definition(AffirmativeStrategy::class, [$allowIfAllAbstainDecisions]);
  217.             case MainConfiguration::STRATEGY_CONSENSUS:
  218.                 return new Definition(ConsensusStrategy::class, [$allowIfAllAbstainDecisions, $allowIfEqualGrantedDeniedDecisions]);
  219.             case MainConfiguration::STRATEGY_UNANIMOUS:
  220.                 return new Definition(UnanimousStrategy::class, [$allowIfAllAbstainDecisions]);
  221.             case MainConfiguration::STRATEGY_PRIORITY:
  222.                 return new Definition(PriorityStrategy::class, [$allowIfAllAbstainDecisions]);
  223.         }
  225.         throw new \InvalidArgumentException(sprintf('The strategy "%s" is not supported.', $strategy));
  226.     }
  228.     private function createRoleHierarchy(array $config, ContainerBuilder $container)
  229.     {
  230.         if (!isset($config['role_hierarchy']) || 0 === \count($config['role_hierarchy'])) {
  231.             $container->removeDefinition('security.access.role_hierarchy_voter');
  233.             return;
  234.         }
  236.         $container->setParameter('security.role_hierarchy.roles', $config['role_hierarchy']);
  237.         $container->removeDefinition('security.access.simple_role_voter');
  238.     }
  240.     private function createAuthorization(array $config, ContainerBuilder $container)
  241.     {
  242.         foreach ($config['access_control'] as $access) {
  243.             $matcher = $this->createRequestMatcher(
  244.                 $container,
  245.                 $access['path'],
  246.                 $access['host'],
  247.                 $access['port'],
  248.                 $access['methods'],
  249.                 $access['ips']
  250.             );
  252.             $attributes = $access['roles'];
  253.             if ($access['allow_if']) {
  254.                 $attributes[] = $this->createExpression($container, $access['allow_if']);
  255.             }
  257.             $emptyAccess = 0 === \count(array_filter($access));
  259.             if ($emptyAccess) {
  260.                 throw new InvalidConfigurationException('One or more access control items are empty. Did you accidentally add lines only containing a "-" under "security.access_control"?');
  261.             }
  263.             $container->getDefinition('security.access_map')
  264.                       ->addMethodCall('add', [$matcher, $attributes, $access['requires_channel']]);
  265.         }
  267.         // allow cache warm-up for expressions
  268.         if (\count($this->expressions)) {
  269.             $container->getDefinition('security.cache_warmer.expression')
  270.                 ->replaceArgument(0, new IteratorArgument(array_values($this->expressions)));
  271.         } else {
  272.             $container->removeDefinition('security.cache_warmer.expression');
  273.         }
  274.     }
  276.     private function createFirewalls(array $config, ContainerBuilder $container)
  277.     {
  278.         if (!isset($config['firewalls'])) {
  279.             return;
  280.         }
  282.         $firewalls = $config['firewalls'];
  283.         $providerIds = $this->createUserProviders($config, $container);
  285.         $container->setParameter('security.firewalls', array_keys($firewalls));
  287.         // make the ContextListener aware of the configured user providers
  288.         $contextListenerDefinition = $container->getDefinition('security.context_listener');
  289.         $arguments = $contextListenerDefinition->getArguments();
  290.         $userProviders = [];
  291.         foreach ($providerIds as $userProviderId) {
  292.             $userProviders[] = new Reference($userProviderId);
  293.         }
  294.         $arguments[1] = $userProviderIteratorsArgument = new IteratorArgument($userProviders);
  295.         $contextListenerDefinition->setArguments($arguments);
  296.         $nbUserProviders = \count($userProviders);
  298.         if ($nbUserProviders > 1) {
  299.             $container->setDefinition('security.user_providers', new Definition(ChainUserProvider::class, [$userProviderIteratorsArgument]))
  300.                 ->setPublic(false);
  301.         } elseif (0 === $nbUserProviders) {
  302.             $container->removeDefinition('security.listener.user_provider');
  303.         } else {
  304.             $container->setAlias('security.user_providers', new Alias(current($providerIds)))->setPublic(false);
  305.         }
  307.         if (1 === \count($providerIds)) {
  308.             $container->setAlias(UserProviderInterface::class, current($providerIds));
  309.         }
  311.         $customUserChecker = false;
  313.         // load firewall map
  314.         $mapDef = $container->getDefinition('security.firewall.map');
  315.         $map = $authenticationProviders = $contextRefs = [];
  316.         foreach ($firewalls as $name => $firewall) {
  317.             if (isset($firewall['user_checker']) && 'security.user_checker' !== $firewall['user_checker']) {
  318.                 $customUserChecker = true;
  319.             }
  321.             $configId = 'security.firewall.map.config.'.$name;
  323.             [$matcher, $listeners, $exceptionListener, $logoutListener] = $this->createFirewall($container, $name, $firewall, $authenticationProviders, $providerIds, $configId);
  325.             $contextId = 'security.firewall.map.context.'.$name;
  326.             $isLazy = !$firewall['stateless'] && (!empty($firewall['anonymous']['lazy']) || $firewall['lazy']);
  327.             $context = new ChildDefinition($isLazy ? 'security.firewall.lazy_context' : 'security.firewall.context');
  328.             $context = $container->setDefinition($contextId, $context);
  329.             $context
  330.                 ->replaceArgument(0, new IteratorArgument($listeners))
  331.                 ->replaceArgument(1, $exceptionListener)
  332.                 ->replaceArgument(2, $logoutListener)
  333.                 ->replaceArgument(3, new Reference($configId))
  334.             ;
  336.             $contextRefs[$contextId] = new Reference($contextId);
  337.             $map[$contextId] = $matcher;
  338.         }
  340.         $container->setAlias('security.firewall.context_locator', (string) ServiceLocatorTagPass::register($container, $contextRefs));
  342.         $mapDef->replaceArgument(0, new Reference('security.firewall.context_locator'));
  343.         $mapDef->replaceArgument(1, new IteratorArgument($map));
  345.         if (!$this->authenticatorManagerEnabled) {
  346.             // add authentication providers to authentication manager
  347.             $authenticationProviders = array_map(function ($id) {
  348.                 return new Reference($id);
  349.             }, array_values(array_unique($authenticationProviders)));
  351.             $container
  352.                 ->getDefinition('security.authentication.manager')
  353.                 ->replaceArgument(0, new IteratorArgument($authenticationProviders));
  354.         }
  356.         // register an autowire alias for the UserCheckerInterface if no custom user checker service is configured
  357.         if (!$customUserChecker) {
  358.             $container->setAlias('Symfony\Component\Security\Core\User\UserCheckerInterface', new Alias('security.user_checker', false));
  359.         }
  360.     }
  362.     private function createFirewall(ContainerBuilder $container, string $id, array $firewall, array &$authenticationProviders, array $providerIds, string $configId)
  363.     {
  364.         $config = $container->setDefinition($configId, new ChildDefinition('security.firewall.config'));
  365.         $config->replaceArgument(0, $id);
  366.         $config->replaceArgument(1, $firewall['user_checker']);
  368.         // Matcher
  369.         $matcher = null;
  370.         if (isset($firewall['request_matcher'])) {
  371.             $matcher = new Reference($firewall['request_matcher']);
  372.         } elseif (isset($firewall['pattern']) || isset($firewall['host'])) {
  373.             $pattern = $firewall['pattern'] ?? null;
  374.             $host = $firewall['host'] ?? null;
  375.             $methods = $firewall['methods'] ?? [];
  376.             $matcher = $this->createRequestMatcher($container, $pattern, $host, null, $methods);
  377.         }
  379.         $config->replaceArgument(2, $matcher ? (string) $matcher : null);
  380.         $config->replaceArgument(3, $firewall['security']);
  382.         // Security disabled?
  383.         if (false === $firewall['security']) {
  384.             return [$matcher, [], null, null];
  385.         }
  387.         $config->replaceArgument(4, $firewall['stateless']);
  389.         $firewallEventDispatcherId = 'security.event_dispatcher.'.$id;
  391.         // Provider id (must be configured explicitly per firewall/authenticator if more than one provider is set)
  392.         $defaultProvider = null;
  393.         if (isset($firewall['provider'])) {
  394.             if (!isset($providerIds[$normalizedName = str_replace('-', '_', $firewall['provider'])])) {
  395.                 throw new InvalidConfigurationException(sprintf('Invalid firewall "%s": user provider "%s" not found.', $id, $firewall['provider']));
  396.             }
  397.             $defaultProvider = $providerIds[$normalizedName];
  399.             if ($this->authenticatorManagerEnabled) {
  400.                 $container->setDefinition('security.listener.'.$id.'.user_provider', new ChildDefinition('security.listener.user_provider.abstract'))
  401.                     ->addTag('kernel.event_listener', ['dispatcher' => $firewallEventDispatcherId, 'event' => CheckPassportEvent::class, 'priority' => 2048, 'method' => 'checkPassport'])
  402.                     ->replaceArgument(0, new Reference($defaultProvider));
  403.             }
  404.         } elseif (1 === \count($providerIds)) {
  405.             $defaultProvider = reset($providerIds);
  406.         }
  408.         $config->replaceArgument(5, $defaultProvider);
  410.         // Register Firewall-specific event dispatcher
  411.         $container->register($firewallEventDispatcherId, EventDispatcher::class)
  412.             ->addTag('event_dispatcher.dispatcher', ['name' => $firewallEventDispatcherId]);
  414.         // Register listeners
  415.         $listeners = [];
  416.         $listenerKeys = [];
  418.         // Channel listener
  419.         $listeners[] = new Reference('security.channel_listener');
  421.         $contextKey = null;
  422.         $contextListenerId = null;
  423.         // Context serializer listener
  424.         if (false === $firewall['stateless']) {
  425.             $contextKey = $firewall['context'] ?? $id;
  426.             $listeners[] = new Reference($contextListenerId = $this->createContextListener($container, $contextKey, $this->authenticatorManagerEnabled ? $firewallEventDispatcherId : null));
  427.             $sessionStrategyId = 'security.authentication.session_strategy';
  429.             if ($this->authenticatorManagerEnabled) {
  430.                 $container
  431.                     ->setDefinition('security.listener.session.'.$id, new ChildDefinition('security.listener.session'))
  432.                     ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
  433.             }
  434.         } else {
  435.             $this->statelessFirewallKeys[] = $id;
  436.             $sessionStrategyId = 'security.authentication.session_strategy_noop';
  437.         }
  438.         $container->setAlias(new Alias('security.authentication.session_strategy.'.$id, false), $sessionStrategyId);
  440.         $config->replaceArgument(6, $contextKey);
  442.         // Logout listener
  443.         $logoutListenerId = null;
  444.         if (isset($firewall['logout'])) {
  445.             $logoutListenerId = 'security.logout_listener.'.$id;
  446.             $logoutListener = $container->setDefinition($logoutListenerId, new ChildDefinition('security.logout_listener'));
  447.             $logoutListener->replaceArgument(2, new Reference($firewallEventDispatcherId));
  448.             $logoutListener->replaceArgument(3, [
  449.                 'csrf_parameter' => $firewall['logout']['csrf_parameter'],
  450.                 'csrf_token_id' => $firewall['logout']['csrf_token_id'],
  451.                 'logout_path' => $firewall['logout']['path'],
  452.             ]);
  454.             // add default logout listener
  455.             if (isset($firewall['logout']['success_handler'])) {
  456.                 // deprecated, to be removed in Symfony 6.0
  457.                 $logoutSuccessHandlerId = $firewall['logout']['success_handler'];
  458.                 $container->register('security.logout.listener.legacy_success_listener.'.$id, LegacyLogoutHandlerListener::class)
  459.                     ->setArguments([new Reference($logoutSuccessHandlerId)])
  460.                     ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
  461.             } else {
  462.                 $logoutSuccessListenerId = 'security.logout.listener.default.'.$id;
  463.                 $container->setDefinition($logoutSuccessListenerId, new ChildDefinition('security.logout.listener.default'))
  464.                     ->replaceArgument(1, $firewall['logout']['target'])
  465.                     ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
  466.             }
  468.             // add CSRF provider
  469.             if (isset($firewall['logout']['csrf_token_generator'])) {
  470.                 $logoutListener->addArgument(new Reference($firewall['logout']['csrf_token_generator']));
  471.             }
  473.             // add session logout listener
  474.             if (true === $firewall['logout']['invalidate_session'] && false === $firewall['stateless']) {
  475.                 $container->setDefinition('security.logout.listener.session.'.$id, new ChildDefinition('security.logout.listener.session'))
  476.                     ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
  477.             }
  479.             // add cookie logout listener
  480.             if (\count($firewall['logout']['delete_cookies']) > 0) {
  481.                 $container->setDefinition('security.logout.listener.cookie_clearing.'.$id, new ChildDefinition('security.logout.listener.cookie_clearing'))
  482.                     ->addArgument($firewall['logout']['delete_cookies'])
  483.                     ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
  484.             }
  486.             // add custom listeners (deprecated)
  487.             foreach ($firewall['logout']['handlers'] as $i => $handlerId) {
  488.                 $container->register('security.logout.listener.legacy_handler.'.$i, LegacyLogoutHandlerListener::class)
  489.                     ->addArgument(new Reference($handlerId))
  490.                     ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
  491.             }
  493.             // register with LogoutUrlGenerator
  494.             $container
  495.                 ->getDefinition('security.logout_url_generator')
  496.                 ->addMethodCall('registerListener', [
  497.                     $id,
  498.                     $firewall['logout']['path'],
  499.                     $firewall['logout']['csrf_token_id'],
  500.                     $firewall['logout']['csrf_parameter'],
  501.                     isset($firewall['logout']['csrf_token_generator']) ? new Reference($firewall['logout']['csrf_token_generator']) : null,
  502.                     false === $firewall['stateless'] && isset($firewall['context']) ? $firewall['context'] : null,
  503.                 ])
  504.             ;
  505.         }
  507.         // Determine default entry point
  508.         $configuredEntryPoint = $firewall['entry_point'] ?? null;
  510.         // Authentication listeners
  511.         $firewallAuthenticationProviders = [];
  512.         [$authListeners, $defaultEntryPoint] = $this->createAuthenticationListeners($container, $id, $firewall, $firewallAuthenticationProviders, $defaultProvider, $providerIds, $configuredEntryPoint, $contextListenerId);
  514.         if (!$this->authenticatorManagerEnabled) {
  515.             $authenticationProviders = array_merge($authenticationProviders, $firewallAuthenticationProviders);
  516.         } else {
  517.             // $configuredEntryPoint is resolved into a service ID and stored in $defaultEntryPoint
  518.             $configuredEntryPoint = $defaultEntryPoint;
  520.             // authenticator manager
  521.             $authenticators = array_map(function ($id) {
  522.                 return new Reference($id);
  523.             }, $firewallAuthenticationProviders);
  524.             $container
  525.                 ->setDefinition($managerId = 'security.authenticator.manager.'.$id, new ChildDefinition('security.authenticator.manager'))
  526.                 ->replaceArgument(0, $authenticators)
  527.                 ->replaceArgument(2, new Reference($firewallEventDispatcherId))
  528.                 ->replaceArgument(3, $id)
  529.                 ->replaceArgument(7, $firewall['required_badges'] ?? [])
  530.                 ->addTag('monolog.logger', ['channel' => 'security'])
  531.             ;
  533.             $managerLocator = $container->getDefinition('security.authenticator.managers_locator');
  534.             $managerLocator->replaceArgument(0, array_merge($managerLocator->getArgument(0), [$id => new ServiceClosureArgument(new Reference($managerId))]));
  536.             // authenticator manager listener
  537.             $container
  538.                 ->setDefinition('security.firewall.authenticator.'.$id, new ChildDefinition('security.firewall.authenticator'))
  539.                 ->replaceArgument(0, new Reference($managerId))
  540.             ;
  542.             if ($container->hasDefinition('debug.security.firewall') && $this->authenticatorManagerEnabled) {
  543.                 $container
  544.                     ->register('debug.security.firewall.authenticator.'.$id, TraceableAuthenticatorManagerListener::class)
  545.                     ->setDecoratedService('security.firewall.authenticator.'.$id)
  546.                     ->setArguments([new Reference('debug.security.firewall.authenticator.'.$id.'.inner')])
  547.                     ->addTag('kernel.reset', ['method' => 'reset'])
  548.                 ;
  549.             }
  551.             // user checker listener
  552.             $container
  553.                 ->setDefinition('security.listener.user_checker.'.$id, new ChildDefinition('security.listener.user_checker'))
  554.                 ->replaceArgument(0, new Reference('security.user_checker.'.$id))
  555.                 ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
  557.             $listeners[] = new Reference('security.firewall.authenticator.'.$id);
  559.             // Add authenticators to the debug:firewall command
  560.             if ($container->hasDefinition('security.command.debug_firewall')) {
  561.                 $debugCommand = $container->getDefinition('security.command.debug_firewall');
  562.                 $debugCommand->replaceArgument(3, array_merge($debugCommand->getArgument(3), [$id => $authenticators]));
  563.             }
  564.         }
  566.         $config->replaceArgument(7, $configuredEntryPoint ?: $defaultEntryPoint);
  568.         $listeners = array_merge($listeners, $authListeners);
  570.         // Switch user listener
  571.         if (isset($firewall['switch_user'])) {
  572.             $listenerKeys[] = 'switch_user';
  573.             $listeners[] = new Reference($this->createSwitchUserListener($container, $id, $firewall['switch_user'], $defaultProvider, $firewall['stateless']));
  574.         }
  576.         // Access listener
  577.         $listeners[] = new Reference('security.access_listener');
  579.         // Exception listener
  580.         $exceptionListener = new Reference($this->createExceptionListener($container, $firewall, $id, $configuredEntryPoint ?: $defaultEntryPoint, $firewall['stateless']));
  582.         $config->replaceArgument(8, $firewall['access_denied_handler'] ?? null);
  583.         $config->replaceArgument(9, $firewall['access_denied_url'] ?? null);
  585.         $container->setAlias('security.user_checker.'.$id, new Alias($firewall['user_checker'], false));
  587.         foreach ($this->getSortedFactories() as $factory) {
  588.             $key = str_replace('-', '_', $factory->getKey());
  589.             if ('custom_authenticators' !== $key && \array_key_exists($key, $firewall)) {
  590.                 $listenerKeys[] = $key;
  591.             }
  592.         }
  594.         if ($firewall['custom_authenticators'] ?? false) {
  595.             foreach ($firewall['custom_authenticators'] as $customAuthenticatorId) {
  596.                 $listenerKeys[] = $customAuthenticatorId;
  597.             }
  598.         }
  600.         $config->replaceArgument(10, $listenerKeys);
  601.         $config->replaceArgument(11, $firewall['switch_user'] ?? null);
  603.         return [$matcher, $listeners, $exceptionListener, null !== $logoutListenerId ? new Reference($logoutListenerId) : null];
  604.     }
  606.     private function createContextListener(ContainerBuilder $container, string $contextKey, ?string $firewallEventDispatcherId)
  607.     {
  608.         if (isset($this->contextListeners[$contextKey])) {
  609.             return $this->contextListeners[$contextKey];
  610.         }
  612.         $listenerId = 'security.context_listener.'.\count($this->contextListeners);
  613.         $listener = $container->setDefinition($listenerId, new ChildDefinition('security.context_listener'));
  614.         $listener->replaceArgument(2, $contextKey);
  615.         if (null !== $firewallEventDispatcherId) {
  616.             $listener->replaceArgument(4, new Reference($firewallEventDispatcherId));
  617.             $listener->addTag('kernel.event_listener', ['event' => KernelEvents::RESPONSE, 'method' => 'onKernelResponse']);
  618.         }
  620.         return $this->contextListeners[$contextKey] = $listenerId;
  621.     }
  623.     private function createAuthenticationListeners(ContainerBuilder $container, string $id, array $firewall, array &$authenticationProviders, ?string $defaultProvider, array $providerIds, ?string $defaultEntryPoint, ?string $contextListenerId = null)
  624.     {
  625.         $listeners = [];
  626.         $hasListeners = false;
  627.         $entryPoints = [];
  629.         foreach ($this->getSortedFactories() as $factory) {
  630.             $key = str_replace('-', '_', $factory->getKey());
  632.             if (isset($firewall[$key])) {
  633.                 $userProvider = $this->getUserProvider($container, $id, $firewall, $key, $defaultProvider, $providerIds, $contextListenerId);
  635.                 if ($this->authenticatorManagerEnabled) {
  636.                     if (!$factory instanceof AuthenticatorFactoryInterface) {
  637.                         throw new InvalidConfigurationException(sprintf('Cannot configure AuthenticatorManager as "%s" authentication does not support it, set "security.enable_authenticator_manager" to `false`.', $key));
  638.                     }
  640.                     $authenticators = $factory->createAuthenticator($container, $id, $firewall[$key], $userProvider);
  641.                     if (\is_array($authenticators)) {
  642.                         foreach ($authenticators as $authenticator) {
  643.                             $authenticationProviders[] = $authenticator;
  644.                             $entryPoints[] = $authenticator;
  645.                         }
  646.                     } else {
  647.                         $authenticationProviders[] = $authenticators;
  648.                         $entryPoints[$key] = $authenticators;
  649.                     }
  650.                 } else {
  651.                     [$provider, $listenerId, $defaultEntryPoint] = $factory->create($container, $id, $firewall[$key], $userProvider, $defaultEntryPoint);
  653.                     $listeners[] = new Reference($listenerId);
  654.                     $authenticationProviders[] = $provider;
  655.                 }
  657.                 if ($factory instanceof FirewallListenerFactoryInterface) {
  658.                     $firewallListenerIds = $factory->createListeners($container, $id, $firewall[$key]);
  659.                     foreach ($firewallListenerIds as $firewallListenerId) {
  660.                         $listeners[] = new Reference($firewallListenerId);
  661.                     }
  662.                 }
  664.                 $hasListeners = true;
  665.             }
  666.         }
  668.         // the actual entry point is configured by the RegisterEntryPointPass
  669.         $container->setParameter('security.'.$id.'._indexed_authenticators', $entryPoints);
  671.         if (false === $hasListeners && !$this->authenticatorManagerEnabled) {
  672.             throw new InvalidConfigurationException(sprintf('No authentication listener registered for firewall "%s".', $id));
  673.         }
  675.         return [$listeners, $defaultEntryPoint];
  676.     }
  678.     private function getUserProvider(ContainerBuilder $container, string $id, array $firewall, string $factoryKey, ?string $defaultProvider, array $providerIds, ?string $contextListenerId): string
  679.     {
  680.         if (isset($firewall[$factoryKey]['provider'])) {
  681.             if (!isset($providerIds[$normalizedName = str_replace('-', '_', $firewall[$factoryKey]['provider'])])) {
  682.                 throw new InvalidConfigurationException(sprintf('Invalid firewall "%s": user provider "%s" not found.', $id, $firewall[$factoryKey]['provider']));
  683.             }
  685.             return $providerIds[$normalizedName];
  686.         }
  688.         if ('remember_me' === $factoryKey && $contextListenerId) {
  689.             $container->getDefinition($contextListenerId)->addTag('security.remember_me_aware', ['id' => $id, 'provider' => 'none']);
  690.         }
  692.         if ($defaultProvider) {
  693.             return $defaultProvider;
  694.         }
  696.         if (!$providerIds) {
  697.             $userProvider = sprintf('security.user.provider.missing.%s', $factoryKey);
  698.             $container->setDefinition(
  699.                 $userProvider,
  700.                 (new ChildDefinition('security.user.provider.missing'))->replaceArgument(0, $id)
  701.             );
  703.             return $userProvider;
  704.         }
  706.         if ('remember_me' === $factoryKey || 'anonymous' === $factoryKey || 'custom_authenticators' === $factoryKey) {
  707.             if ('custom_authenticators' === $factoryKey) {
  708.                 trigger_deprecation('symfony/security-bundle', '5.4', 'Not configuring explicitly the provider for the "%s" firewall is deprecated because it\'s ambiguous as there is more than one registered provider. Set the "provider" key to one of the configured providers, even if your custom authenticators don\'t use it.', $id);
  709.             }
  711.             return 'security.user_providers';
  712.         }
  714.         throw new InvalidConfigurationException(sprintf('Not configuring explicitly the provider for the "%s" %s on "%s" firewall is ambiguous as there is more than one registered provider.', $factoryKey, $this->authenticatorManagerEnabled ? 'authenticator' : 'listener', $id));
  715.     }
  717.     private function createEncoders(array $encoders, ContainerBuilder $container)
  718.     {
  719.         $encoderMap = [];
  720.         foreach ($encoders as $class => $encoder) {
  721.             if (class_exists($class) && !is_a($class, PasswordAuthenticatedUserInterface::class, true)) {
  722.                 trigger_deprecation('symfony/security-bundle', '5.3', 'Configuring an encoder for a user class that does not implement "%s" is deprecated, class "%s" should implement it.', PasswordAuthenticatedUserInterface::class, $class);
  723.             }
  724.             $encoderMap[$class] = $this->createEncoder($encoder);
  725.         }
  727.         $container
  728.             ->getDefinition('security.encoder_factory.generic')
  729.             ->setArguments([$encoderMap])
  730.         ;
  731.     }
  733.     private function createEncoder(array $config)
  734.     {
  735.         // a custom encoder service
  736.         if (isset($config['id'])) {
  737.             return new Reference($config['id']);
  738.         }
  740.         if ($config['migrate_from'] ?? false) {
  741.             return $config;
  742.         }
  744.         // plaintext encoder
  745.         if ('plaintext' === $config['algorithm']) {
  746.             $arguments = [$config['ignore_case']];
  748.             return [
  749.                 'class' => 'Symfony\Component\Security\Core\Encoder\PlaintextPasswordEncoder',
  750.                 'arguments' => $arguments,
  751.             ];
  752.         }
  754.         // pbkdf2 encoder
  755.         if ('pbkdf2' === $config['algorithm']) {
  756.             return [
  757.                 'class' => 'Symfony\Component\Security\Core\Encoder\Pbkdf2PasswordEncoder',
  758.                 'arguments' => [
  759.                     $config['hash_algorithm'],
  760.                     $config['encode_as_base64'],
  761.                     $config['iterations'],
  762.                     $config['key_length'],
  763.                 ],
  764.             ];
  765.         }
  767.         // bcrypt encoder
  768.         if ('bcrypt' === $config['algorithm']) {
  769.             $config['algorithm'] = 'native';
  770.             $config['native_algorithm'] = \PASSWORD_BCRYPT;
  772.             return $this->createEncoder($config);
  773.         }
  775.         // Argon2i encoder
  776.         if ('argon2i' === $config['algorithm']) {
  777.             if (SodiumPasswordHasher::isSupported() && !\defined('SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13')) {
  778.                 $config['algorithm'] = 'sodium';
  779.             } elseif (\defined('PASSWORD_ARGON2I')) {
  780.                 $config['algorithm'] = 'native';
  781.                 $config['native_algorithm'] = \PASSWORD_ARGON2I;
  782.             } else {
  783.                 throw new InvalidConfigurationException(sprintf('Algorithm "argon2i" is not available. Use "%s" instead.', \defined('SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13') ? 'argon2id", "auto' : 'auto'));
  784.             }
  786.             return $this->createEncoder($config);
  787.         }
  789.         if ('argon2id' === $config['algorithm']) {
  790.             if (($hasSodium = SodiumPasswordHasher::isSupported()) && \defined('SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13')) {
  791.                 $config['algorithm'] = 'sodium';
  792.             } elseif (\defined('PASSWORD_ARGON2ID')) {
  793.                 $config['algorithm'] = 'native';
  794.                 $config['native_algorithm'] = \PASSWORD_ARGON2ID;
  795.             } else {
  796.                 throw new InvalidConfigurationException(sprintf('Algorithm "argon2id" is not available. Either use "%s", upgrade to PHP 7.3+ or use libsodium 1.0.15+ instead.', \defined('PASSWORD_ARGON2I') || $hasSodium ? 'argon2i", "auto' : 'auto'));
  797.             }
  799.             return $this->createEncoder($config);
  800.         }
  802.         if ('native' === $config['algorithm']) {
  803.             return [
  804.                 'class' => NativePasswordEncoder::class,
  805.                 'arguments' => [
  806.                         $config['time_cost'],
  807.                         (($config['memory_cost'] ?? 0) << 10) ?: null,
  808.                         $config['cost'],
  809.                     ] + (isset($config['native_algorithm']) ? [3 => $config['native_algorithm']] : []),
  810.             ];
  811.         }
  813.         if ('sodium' === $config['algorithm']) {
  814.             if (!SodiumPasswordHasher::isSupported()) {
  815.                 throw new InvalidConfigurationException('Libsodium is not available. Install the sodium extension or use "auto" instead.');
  816.             }
  818.             return [
  819.                 'class' => SodiumPasswordEncoder::class,
  820.                 'arguments' => [
  821.                     $config['time_cost'],
  822.                     (($config['memory_cost'] ?? 0) << 10) ?: null,
  823.                 ],
  824.             ];
  825.         }
  827.         // run-time configured encoder
  828.         return $config;
  829.     }
  831.     private function createHashers(array $hashers, ContainerBuilder $container)
  832.     {
  833.         $hasherMap = [];
  834.         foreach ($hashers as $class => $hasher) {
  835.             // @deprecated since Symfony 5.3, remove the check in 6.0
  836.             if (class_exists($class) && !is_a($class, PasswordAuthenticatedUserInterface::class, true)) {
  837.                 trigger_deprecation('symfony/security-bundle', '5.3', 'Configuring a password hasher for a user class that does not implement "%s" is deprecated, class "%s" should implement it.', PasswordAuthenticatedUserInterface::class, $class);
  838.             }
  839.             $hasherMap[$class] = $this->createHasher($hasher);
  840.         }
  842.         $container
  843.             ->getDefinition('security.password_hasher_factory')
  844.             ->setArguments([$hasherMap])
  845.         ;
  846.     }
  848.     private function createHasher(array $config)
  849.     {
  850.         // a custom hasher service
  851.         if (isset($config['id'])) {
  852.             return $config['migrate_from'] ?? false ? [
  853.                 'instance' => new Reference($config['id']),
  854.                 'migrate_from' => $config['migrate_from'],
  855.             ] : new Reference($config['id']);
  856.         }
  858.         if ($config['migrate_from'] ?? false) {
  859.             return $config;
  860.         }
  862.         // plaintext hasher
  863.         if ('plaintext' === $config['algorithm']) {
  864.             $arguments = [$config['ignore_case']];
  866.             return [
  867.                 'class' => PlaintextPasswordHasher::class,
  868.                 'arguments' => $arguments,
  869.             ];
  870.         }
  872.         // pbkdf2 hasher
  873.         if ('pbkdf2' === $config['algorithm']) {
  874.             return [
  875.                 'class' => Pbkdf2PasswordHasher::class,
  876.                 'arguments' => [
  877.                     $config['hash_algorithm'],
  878.                     $config['encode_as_base64'],
  879.                     $config['iterations'],
  880.                     $config['key_length'],
  881.                 ],
  882.             ];
  883.         }
  885.         // bcrypt hasher
  886.         if ('bcrypt' === $config['algorithm']) {
  887.             $config['algorithm'] = 'native';
  888.             $config['native_algorithm'] = \PASSWORD_BCRYPT;
  890.             return $this->createHasher($config);
  891.         }
  893.         // Argon2i hasher
  894.         if ('argon2i' === $config['algorithm']) {
  895.             if (SodiumPasswordHasher::isSupported() && !\defined('SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13')) {
  896.                 $config['algorithm'] = 'sodium';
  897.             } elseif (\defined('PASSWORD_ARGON2I')) {
  898.                 $config['algorithm'] = 'native';
  899.                 $config['native_algorithm'] = \PASSWORD_ARGON2I;
  900.             } else {
  901.                 throw new InvalidConfigurationException(sprintf('Algorithm "argon2i" is not available. Either use "%s" or upgrade to PHP 7.2+ instead.', \defined('SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13') ? 'argon2id", "auto' : 'auto'));
  902.             }
  904.             return $this->createHasher($config);
  905.         }
  907.         if ('argon2id' === $config['algorithm']) {
  908.             if (($hasSodium = SodiumPasswordHasher::isSupported()) && \defined('SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13')) {
  909.                 $config['algorithm'] = 'sodium';
  910.             } elseif (\defined('PASSWORD_ARGON2ID')) {
  911.                 $config['algorithm'] = 'native';
  912.                 $config['native_algorithm'] = \PASSWORD_ARGON2ID;
  913.             } else {
  914.                 throw new InvalidConfigurationException(sprintf('Algorithm "argon2id" is not available. Either use "%s", upgrade to PHP 7.3+ or use libsodium 1.0.15+ instead.', \defined('PASSWORD_ARGON2I') || $hasSodium ? 'argon2i", "auto' : 'auto'));
  915.             }
  917.             return $this->createHasher($config);
  918.         }
  920.         if ('native' === $config['algorithm']) {
  921.             return [
  922.                 'class' => NativePasswordHasher::class,
  923.                 'arguments' => [
  924.                     $config['time_cost'],
  925.                     (($config['memory_cost'] ?? 0) << 10) ?: null,
  926.                     $config['cost'],
  927.                 ] + (isset($config['native_algorithm']) ? [3 => $config['native_algorithm']] : []),
  928.             ];
  929.         }
  931.         if ('sodium' === $config['algorithm']) {
  932.             if (!SodiumPasswordHasher::isSupported()) {
  933.                 throw new InvalidConfigurationException('Libsodium is not available. Install the sodium extension or use "auto" instead.');
  934.             }
  936.             return [
  937.                 'class' => SodiumPasswordHasher::class,
  938.                 'arguments' => [
  939.                     $config['time_cost'],
  940.                     (($config['memory_cost'] ?? 0) << 10) ?: null,
  941.                 ],
  942.             ];
  943.         }
  945.         // run-time configured hasher
  946.         return $config;
  947.     }
  949.     // Parses user providers and returns an array of their ids
  950.     private function createUserProviders(array $config, ContainerBuilder $container): array
  951.     {
  952.         $providerIds = [];
  953.         foreach ($config['providers'] as $name => $provider) {
  954.             $id = $this->createUserDaoProvider($name, $provider, $container);
  955.             $providerIds[str_replace('-', '_', $name)] = $id;
  956.         }
  958.         return $providerIds;
  959.     }
  961.     // Parses a <provider> tag and returns the id for the related user provider service
  962.     private function createUserDaoProvider(string $name, array $provider, ContainerBuilder $container): string
  963.     {
  964.         $name = $this->getUserProviderId($name);
  966.         // Doctrine Entity and In-memory DAO provider are managed by factories
  967.         foreach ($this->userProviderFactories as $factory) {
  968.             $key = str_replace('-', '_', $factory->getKey());
  970.             if (!empty($provider[$key])) {
  971.                 $factory->create($container, $name, $provider[$key]);
  973.                 return $name;
  974.             }
  975.         }
  977.         // Existing DAO service provider
  978.         if (isset($provider['id'])) {
  979.             $container->setAlias($name, new Alias($provider['id'], false));
  981.             return $provider['id'];
  982.         }
  984.         // Chain provider
  985.         if (isset($provider['chain'])) {
  986.             $providers = [];
  987.             foreach ($provider['chain']['providers'] as $providerName) {
  988.                 $providers[] = new Reference($this->getUserProviderId($providerName));
  989.             }
  991.             $container
  992.                 ->setDefinition($name, new ChildDefinition('security.user.provider.chain'))
  993.                 ->addArgument(new IteratorArgument($providers));
  995.             return $name;
  996.         }
  998.         throw new InvalidConfigurationException(sprintf('Unable to create definition for "%s" user provider.', $name));
  999.     }
  1001.     private function getUserProviderId(string $name): string
  1002.     {
  1003.         return 'security.user.provider.concrete.'.strtolower($name);
  1004.     }
  1006.     private function createExceptionListener(ContainerBuilder $container, array $config, string $id, ?string $defaultEntryPoint, bool $stateless): string
  1007.     {
  1008.         $exceptionListenerId = 'security.exception_listener.'.$id;
  1009.         $listener = $container->setDefinition($exceptionListenerId, new ChildDefinition('security.exception_listener'));
  1010.         $listener->replaceArgument(3, $id);
  1011.         $listener->replaceArgument(4, null === $defaultEntryPoint ? null : new Reference($defaultEntryPoint));
  1012.         $listener->replaceArgument(8, $stateless);
  1014.         // access denied handler setup
  1015.         if (isset($config['access_denied_handler'])) {
  1016.             $listener->replaceArgument(6, new Reference($config['access_denied_handler']));
  1017.         } elseif (isset($config['access_denied_url'])) {
  1018.             $listener->replaceArgument(5, $config['access_denied_url']);
  1019.         }
  1021.         return $exceptionListenerId;
  1022.     }
  1024.     private function createSwitchUserListener(ContainerBuilder $container, string $id, array $config, ?string $defaultProvider, bool $stateless): string
  1025.     {
  1026.         $userProvider = isset($config['provider']) ? $this->getUserProviderId($config['provider']) : $defaultProvider;
  1028.         if (!$userProvider) {
  1029.             throw new InvalidConfigurationException(sprintf('Not configuring explicitly the provider for the "switch_user" listener on "%s" firewall is ambiguous as there is more than one registered provider.', $id));
  1030.         }
  1032.         $switchUserListenerId = 'security.authentication.switchuser_listener.'.$id;
  1033.         $listener = $container->setDefinition($switchUserListenerId, new ChildDefinition('security.authentication.switchuser_listener'));
  1034.         $listener->replaceArgument(1, new Reference($userProvider));
  1035.         $listener->replaceArgument(2, new Reference('security.user_checker.'.$id));
  1036.         $listener->replaceArgument(3, $id);
  1037.         $listener->replaceArgument(6, $config['parameter']);
  1038.         $listener->replaceArgument(7, $config['role']);
  1039.         $listener->replaceArgument(9, $stateless);
  1041.         return $switchUserListenerId;
  1042.     }
  1044.     private function createExpression(ContainerBuilder $container, string $expression): Reference
  1045.     {
  1046.         if (isset($this->expressions[$id = '.security.expression.'.ContainerBuilder::hash($expression)])) {
  1047.             return $this->expressions[$id];
  1048.         }
  1050.         if (!$container::willBeAvailable('symfony/expression-language', ExpressionLanguage::class, ['symfony/security-bundle'], true)) {
  1051.             throw new \RuntimeException('Unable to use expressions as the Symfony ExpressionLanguage component is not installed. Try running "composer require symfony/expression-language".');
  1052.         }
  1054.         $container
  1055.             ->register($id, 'Symfony\Component\ExpressionLanguage\Expression')
  1056.             ->setPublic(false)
  1057.             ->addArgument($expression)
  1058.         ;
  1060.         return $this->expressions[$id] = new Reference($id);
  1061.     }
  1063.     private function createRequestMatcher(ContainerBuilder $container, ?string $path = null, ?string $host = null, ?int $port = null, array $methods = [], ?array $ips = null, array $attributes = []): Reference
  1064.     {
  1065.         if ($methods) {
  1066.             $methods = array_map('strtoupper', $methods);
  1067.         }
  1069.         if (null !== $ips) {
  1070.             foreach ($ips as $ip) {
  1071.                 $container->resolveEnvPlaceholders($ip, null, $usedEnvs);
  1073.                 if (!$usedEnvs && !$this->isValidIps($ip)) {
  1074.                     throw new \LogicException(sprintf('The given value "%s" in the "security.access_control" config option is not a valid IP address.', $ip));
  1075.                 }
  1077.                 $usedEnvs = null;
  1078.             }
  1079.         }
  1081.         $id = '.security.request_matcher.'.ContainerBuilder::hash([$path, $host, $port, $methods, $ips, $attributes]);
  1083.         if (isset($this->requestMatchers[$id])) {
  1084.             return $this->requestMatchers[$id];
  1085.         }
  1087.         // only add arguments that are necessary
  1088.         $arguments = [$path, $host, $methods, $ips, $attributes, null, $port];
  1089.         while (\count($arguments) > 0 && !end($arguments)) {
  1090.             array_pop($arguments);
  1091.         }
  1093.         $container
  1094.             ->register($id, 'Symfony\Component\HttpFoundation\RequestMatcher')
  1095.             ->setPublic(false)
  1096.             ->setArguments($arguments)
  1097.         ;
  1099.         return $this->requestMatchers[$id] = new Reference($id);
  1100.     }
  1102.     /**
  1103.      * @deprecated since Symfony 5.4, use "addAuthenticatorFactory()" instead
  1104.      */
  1105.     public function addSecurityListenerFactory(SecurityFactoryInterface $factory)
  1106.     {
  1107.         trigger_deprecation('symfony/security-bundle', '5.4', 'Method "%s()" is deprecated, use "addAuthenticatorFactory()" instead.', __METHOD__);
  1109.         $this->factories[] = [[
  1110.             'pre_auth' => -10,
  1111.             'form' => -30,
  1112.             'http' => -40,
  1113.             'remember_me' => -50,
  1114.             'anonymous' => -60,
  1115.         ][$factory->getPosition()], $factory];
  1116.         $this->sortedFactories = [];
  1117.     }
  1119.     public function addAuthenticatorFactory(AuthenticatorFactoryInterface $factory)
  1120.     {
  1121.         $this->factories[] = [method_exists($factory, 'getPriority') ? $factory->getPriority() : 0, $factory];
  1122.         $this->sortedFactories = [];
  1123.     }
  1125.     public function addUserProviderFactory(UserProviderFactoryInterface $factory)
  1126.     {
  1127.         $this->userProviderFactories[] = $factory;
  1128.     }
  1130.     /**
  1131.      * {@inheritdoc}
  1132.      */
  1133.     public function getXsdValidationBasePath()
  1134.     {
  1135.         return __DIR__.'/../Resources/config/schema';
  1136.     }
  1138.     public function getNamespace()
  1139.     {
  1140.         return 'http://symfony.com/schema/dic/security';
  1141.     }
  1143.     public function getConfiguration(array $config, ContainerBuilder $container)
  1144.     {
  1145.         // first assemble the factories
  1146.         return new MainConfiguration($this->getSortedFactories(), $this->userProviderFactories);
  1147.     }
  1149.     private function isValidIps($ips): bool
  1150.     {
  1151.         $ipsList = array_reduce((array) $ips, static function (array $ips, string $ip) {
  1152.             return array_merge($ips, preg_split('/\s*,\s*/', $ip));
  1153.         }, []);
  1155.         if (!$ipsList) {
  1156.             return false;
  1157.         }
  1159.         foreach ($ipsList as $cidr) {
  1160.             if (!$this->isValidIp($cidr)) {
  1161.                 return false;
  1162.             }
  1163.         }
  1165.         return true;
  1166.     }
  1168.     private function isValidIp(string $cidr): bool
  1169.     {
  1170.         $cidrParts = explode('/', $cidr);
  1172.         if (1 === \count($cidrParts)) {
  1173.             return false !== filter_var($cidrParts[0], \FILTER_VALIDATE_IP);
  1174.         }
  1176.         $ip = $cidrParts[0];
  1177.         $netmask = $cidrParts[1];
  1179.         if (!ctype_digit($netmask)) {
  1180.             return false;
  1181.         }
  1183.         if (filter_var($ip, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV4)) {
  1184.             return $netmask <= 32;
  1185.         }
  1187.         if (filter_var($ip, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV6)) {
  1188.             return $netmask <= 128;
  1189.         }
  1191.         return false;
  1192.     }
  1194.     /**
  1195.      * @return array<int, SecurityFactoryInterface|AuthenticatorFactoryInterface>
  1196.      */
  1197.     private function getSortedFactories(): array
  1198.     {
  1199.         if (!$this->sortedFactories) {
  1200.             $factories = [];
  1201.             foreach ($this->factories as $i => $factory) {
  1202.                 $factories[] = array_merge($factory, [$i]);
  1203.             }
  1205.             usort($factories, function ($a, $b) {
  1206.                 return $b[0] <=> $a[0] ?: $a[2] <=> $b[2];
  1207.             });
  1209.             $this->sortedFactories = array_column($factories, 1);
  1210.         }
  1212.         return $this->sortedFactories;
  1213.     }
  1214. }