Mapping
-------

 [FAIL] The entity-class League\Bundle\OAuth2ServerBundle\Model\AccessToken mapping is invalid:
 * The target entity 'League\Bundle\OAuth2ServerBundle\Model\Client' specified on League\Bundle\OAuth2ServerBundle\Model\AccessToken#client is unknown or not an entity.


 [FAIL] The entity-class League\Bundle\OAuth2ServerBundle\Model\AuthorizationCode mapping is invalid:
 * The target entity 'League\Bundle\OAuth2ServerBundle\Model\Client' specified on League\Bundle\OAuth2ServerBundle\Model\AuthorizationCode#client is unknown or not an entity.


 [FAIL] The entity-class League\Bundle\OAuth2ServerBundle\Model\RefreshToken mapping is invalid:
 * The target entity 'League\Bundle\OAuth2ServerBundle\Model\AccessToken' specified on League\Bundle\OAuth2ServerBundle\Model\RefreshToken#accessToken is unknown or not an entity.


Database
--------

                                                                                                                       
 [OK] The database schema is in sync with the mapping files.                                                           
                                                

firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        api_token:
            pattern: ^/api/token$
            security: false
        api:
            pattern: ^/rest
            security: true
            stateless: true
            oauth2: true // <--- doesn't seem to ask for auth
        main:
            remember_me:
                secret: '%kernel.secret%'
                lifetime: 604800 # 1 week in seconds
                path: /
            lazy: true
            switch_user: { role: CAN_SWITCH_USER }
            provider: app_user_provider
            login_throttling:
                max_attempts: 10
                interval: '10 minutes'
            custom_authenticator:
                - App\Security\LoginFormAuthenticator
            user_checker: App\Security\UserChecker
            logout:
                path: dashboard_logout
                target: dashboard_login

<?php

namespace App\Controller;

use Sensio\Bundle\FrameworkExtraBundle\Configuration\IsGranted;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;

#[Route('/rest')]
class RestController extends AbstractController
{

    #[Route('', name: 'rest_index', defaults: ["oauth2_scopes"=>["EMAIL", "PREFERENCES"]])]
    public function index(): Response
    {
        return new JsonResponse(['data'=>['a', 'b', 'c']]);
    }

}

Unable to read key from file /var/oauth/private.key

app.oauth2:
    host: "%api_host%"
    resource: '@LeagueOAuth2ServerBundle/Resources/config/routes.php'
    type: php

app.oauth2_token:
    host: "%api_host%"
    path: /oauth/v2/token
    methods: POST
    controller: League\Bundle\OAuth2ServerBundle\Controller\TokenController::indexAction

The service "security.authenticator.oauth2.api" has a dependency on a non-existent service "Symfony\Component\Security\Core\User\UserProviderInterface".

[...]
    providers:
        app_user_provider:
            entity:
                class: App\Entity\User
        app_user_provider2:
[...]
    firewalls:                
        api:
            pattern: ^/api
            security: true
            stateless: true
            provider: app_user_provider
            oauth2: true
[...]

<?php

declare(strict_types=1);

use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;

return static function (ContainerConfigurator $containerConfigurator): void {
    $containerConfigurator->extension('league_oauth2_server',
        [
            'authorization_server' => [
                'private_key' => __DIR__ . '/../../var/oauth/private.key',
                'private_key_passphrase' => null,
                'encryption_key' => '%env(OAUTH2_ENCRYPTION_KEY)%',
                'encryption_key_type' => 'plain',
                'access_token_ttl' => 'PT1H',
                'refresh_token_ttl' => 'P1M',
                'auth_code_ttl' => 'PT10M',
                'enable_client_credentials_grant' => true,
                'enable_password_grant' => true,
                'enable_refresh_token_grant' => true,
                'enable_auth_code_grant' => true,
                'require_code_challenge_for_public_clients' => true
            ],
            'resource_server' => ['public_key' => __DIR__ . '/../../var/oauth/public.key'],
            'scopes' => ['available' => ['default_scope'], 'default' => ['default_scope']],
            'persistence' => ['doctrine' => ['entity_manager' => 'default']],
            'role_prefix' => 'ROLE_OAUTH2_',
            'client' => ['classname' => 'League\Bundle\OAuth2ServerBundle\Model\Client']
        ]);
};

<?php

declare(strict_types=1);

use App\Entity\User;
use App\ValueObject\Role;
use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;

return static function (ContainerConfigurator $containerConfigurator): void {
    $containerConfigurator->extension(
        'security',
        [
            'enable_authenticator_manager' => true,
            'encoders' => [
                User::class => [
                    'algorithm' => 'auto',
                ],
            ],
            'providers' => [
                'api_user_provider' => [
                    'entity' => [
                        'class' => User::class,
                        'property' => 'email'
                    ],
                ]
            ],
            'firewalls' => [
                'api_token' => [
                    'pattern' => '^/api/token$',
                    'security' => false,
                ],
                'register' => [
                    'pattern' => '^/api/users',
                    'security' => false,
                ],
                'api' => [
                    'pattern' => '^/api',
                    'stateless' => true,
                    'provider' => 'api_user_provider',
                    'security' => true,
                    'oauth2' => true,
                ],
            ],
            'access_control' => [
                [
                    'path' => '^/api',
                    'roles' => [Role::IS_AUTHENTICATED_FULLY],
                ],
            ],
        ]
    );
};

grant_type: password,
client_id: 876b7...,
client_secret: bd108bd7c8...,
username: [email protected],
password: 12345678

{
    "error": "invalid_grant",
    "error_description": "The user credentials were incorrect.",
    "message": "The user credentials were incorrect."
}

league_oauth2_server:
  authorization_server: # Required
    private_key: 'D:\apps\toto\toto_Portail\certs\oauthserver.key' # Required, Example: /var/oauth/private.key
    private_key_passphrase: '@3O3E39EHD80'
    encryption_key: 'def00000cc93d67e8f289313a9ea381f7f1860a439f05777ae0b7e30fb7053957fd88adf980d3c0da011560baece72be2f0ea0d22722ea19ac524c905ca7d6c135ab88ba'
    encryption_key_type:  plain # One of "plain"; "defuse"
    access_token_ttl:     PT1H
    refresh_token_ttl:    P1M
    auth_code_ttl:        PT10M
    enable_client_credentials_grant: true
    enable_password_grant: true
    enable_refresh_token_grant: true
    enable_auth_code_grant: true
    require_code_challenge_for_public_clients: true
    enable_implicit_grant: true
    persist_access_token: true

  resource_server:      # Required
    public_key: 'D:\apps\toto\toto_Portail\certs\oauthserver_pub.key' # Required, Example: /var/oauth/public.key
  scopes:
    available: [EMAIL, PREFERENCES,SUPER_USER]
    default: [SUPER_USER]
  persistence:          # Required
    doctrine:
      entity_manager: default
  role_prefix:          ROLE_OAUTH2_
  client:
    classname:        League\Bundle\OAuth2ServerBundle\Model\Client

security:
    enable_authenticator_manager: true
    role_hierarchy:
        ROLE_OAUTH2_SUPER_USER: [ROLE_OAUTH2_EMAIL, ROLE_OAUTH2_PREFERENCES]
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
        App\Entity\User:
            algorithm: auto

    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
        # used to reload user from session & other features (e.g. switch_user)
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        api_token:
            pattern: ^/api/token$
            security: false
        api:
            pattern: ^/api
            security: true
            stateless: true
            oauth2: true
        main:
            lazy: true
            provider: app_user_provider
            form_login:
                # "login" is the name of the route created previously
                login_path: login
                check_path: login
                enable_csrf: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/authorize, roles: IS_AUTHENTICATED_REMEMBERED }
        - { path: ^/, roles: ROLE_USER }

hwi_oauth:
    firewall_names: [secured_area]
    resource_owners:
        portail:
            type:                oauth2
            class:               \HWI\Bundle\OAuthBundle\OAuth\ResourceOwner\GenericOAuth2ResourceOwner
            client_id:           '%env(resolve:OAUTH_CLIENT_ID)%'
            client_secret:       '%env(resolve:OAUTH_CLIENT_SECRET)%'
            access_token_url:    '%env(resolve:OAUTH_URL)%/token'
            authorization_url:   '%env(resolve:OAUTH_URL)%/authorize'
            infos_url:           '%env(resolve:OAUTH_URL)%/resource'
            scope:               "SUPER_USER"
            user_response_class: HWI\Bundle\OAuthBundle\OAuth\Response\PathUserResponse
            paths:
                identifier: username
                nickname:   nickname
                firstname:  first_name
                lastname:   last_name
                realname:   ["first_name", "last_name"]
                email:      email
            options:
                csrf: true
    http:
        client: httplug.client.hwi_special # Default to httplug.client.default

security:
    # https://symfony.com/doc/current/security/experimental_authenticators.html
    # enable_authenticator_manager: false
    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    providers:
        app_user_provider:
            id: portail.user_provider
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        secured_area:
            anonymous: true
            oauth:
                resource_owners:
                    portail: "/login/check-custom"
                login_path:        /connect/portail
                use_forward:       false
                failure_path:      /login
                oauth_user_provider:
                    service: portail.user_provider



    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/connect/, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/dialog/, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin, role: ROLE_USER}
        - { path: ^/, role: ROLE_USER }

<?php

namespace Ntrx\UserBundle\Security;

use Doctrine\ORM\EntityManagerInterface;
use Symfony\Component\DependencyInjection\ParameterBag\ParameterBagInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\Security;
use Symfony\Component\Security\Http\Authenticator\AbstractLoginFormAuthenticator;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\RememberMeBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Credentials\PasswordCredentials;
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
use Symfony\Component\Security\Http\Util\TargetPathTrait;


class LoginFormAuthenticator extends AbstractLoginFormAuthenticator
{
	use TargetPathTrait;

	public const LOGIN_ROUTE = 'ntrx_userbundle_login';

	private EntityManagerInterface $entityManager;
	private UrlGeneratorInterface $urlGenerator;
	private string $userClass;


	public function __construct(EntityManagerInterface $entityManager, UrlGeneratorInterface $urlGenerator, ParameterBagInterface $params) {
		$this->entityManager = $entityManager;
		$this->urlGenerator = $urlGenerator;
		$this->userClass = $params->get('ntrx_user.user_class');
	}


	protected function getLoginUrl(Request $request): string {
		return $this->urlGenerator->generate(self::LOGIN_ROUTE);
	}


	public function supports(Request $request): bool {
		return $request->isMethod('POST') && $this->getLoginUrl($request) === $request->getPathInfo();
	}


	public function authenticate(Request $request): Passport {
		$credentials = $this->getCredentials($request);

		$passport = new Passport(
			new UserBadge($credentials['email'], function ($userIdentifier) {
				$user = $this->entityManager->getRepository($this->userClass)->findOneBy(['email' => $userIdentifier]);
				return $user;
			}),
			new PasswordCredentials($credentials['password']),
			[new RememberMeBadge(), new CsrfTokenBadge('authenticate', $credentials['csrf_token'])]
		);

		return $passport;
	}


	public function createToken(Passport $passport, string $firewallName): TokenInterface {
		return new UsernamePasswordToken($passport->getUser(), $firewallName, $passport->getUser()->getRoles());
	}


	public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response {
		$targetPath = $this->getTargetPath($request->getSession(), $firewallName);
		if ($targetPath) {
			return new RedirectResponse($targetPath);
		}

		return new RedirectResponse($this->urlGenerator->generate(self::LOGIN_ROUTE));
	}


	public function onAuthenticationFailure(Request $request, AuthenticationException $exception): Response {
		dd('failure', $exception);
	}


	public function start(Request $request, AuthenticationException $authException = null): Response {
		$url = $this->getLoginUrl($request);
		return new RedirectResponse($url);
	}


	public function isInteractive(): bool {
		return true;
	}


	/*
	 * Private methods
	 */
	private function getCredentials(Request $request): array {
		$credentials = [
			'email' => $request->request->get('email'),
			'password' => $request->request->get('password'),
			'csrf_token' => $request->request->get('_csrf_token'),
		];

		$request->getSession()->set(Security::LAST_USERNAME, $credentials['email']);

		return $credentials;
	}
}

<?php

namespace Ntrx\UserBundle\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\DependencyInjection\ParameterBag\ParameterBagInterface;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;


/**
 * Login controller.
 */
class LoginController extends AbstractController
{
	/**
	 * @Route("/login", name="ntrx_userbundle_login", methods={"GET", "POST"})
	 */
	public function login(AuthenticationUtils $authenticationUtils, ParameterBagInterface $params): Response {
		if ($this->getUser()) {
			return $this->redirectToRoute($params->get('ntrx_user.login_redirect'));
		}

		// get the login error if there is one
		$error = $authenticationUtils->getLastAuthenticationError();
		// last username entered by the user
		$lastEmail = $authenticationUtils->getLastUsername();

		return $this->render('@NtrxUser/login/login.html.twig', ['last_email' => $lastEmail, 'error' => $error]);
	}

	/**
	 * @Route("/logout", name="ntrx_userbundle_logout")
	 */
	public function logout() {
		throw new \LogicException('This method can be blank - it will be intercepted by the logout key on your firewall.');
	}
}

security:
    password_hashers:
        App\Entity\User:
            algorithm: auto
            cost: 4
        Symfony\Component\Security\Core\User\User: plaintext

    enable_authenticator_manager: true

    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email

    firewalls:
        // [...]

        api_token:
            pattern: ^/oauth/token
            security: false

        api:
            pattern: ^/api
            security: true
            stateless: true
            provider: app_user_provider
            # custom_authenticators:
            #     - Ntrx\UserBundle\Security\LoginFormAuthenticator
            oauth2: true
            # entry_point: oauth2
            logout:
                path: ntrx_userbundle_logout
                target: application_controller_home
                invalidate_session: true

        main:
            security: true
            stateless: true
            provider: app_user_provider
            custom_authenticators: [Ntrx\UserBundle\Security\LoginFormAuthenticator]
            # oauth2: true
            # entry_point: oauth2
            logout:
                path: ntrx_userbundle_logout
                target: application_controller_home
                invalidate_session: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/oauth/authorize, roles: IS_AUTHENTICATED_REMEMBERED }
        - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }

security:
    enable_authenticator_manager: true
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
        app_user_provider:
            entity:
                class: Clean\Implementation\Entity\UserOrmEntity
                property: email
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        token:
            pattern: ^/token
            security: false
        api:
            pattern: ^/api/
            security: true
            stateless: true
            oauth2: true
        main:
            form_login:
                login_path: login
                check_path: login
            logout:
                path: logout

            # activate different ways to authenticate
            # https://symfony.com/doc/current/security.html#the-firewall

            # https://symfony.com/doc/current/security/impersonating_user.html
            # switch_user: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/authorize, roles: IS_AUTHENTICATED_REMEMBERED }
        - { path: ^/api, roles: ROLE_USER }
    # Use hierarchy to manage different access levels
    # https://symfony.com/doc/current/security.html#hierarchical-roles
#    role_hierarchy:
#        ROLE_DISTRIBUTOR: ROLE_USER
#        ROLE_ADMIN: [ ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH ]
#    role_hierarchy:
#        ROLE_OAUTH2_SUPER_USER: [ROLE_OAUTH2_EMAIL, ROLE_OAUTH2_PREFERENCES]

when@test:
    security:
        password_hashers:
            # By default, password hashers are resource intensive and take time. This is
            # important to generate secure password hashes. In tests however, secure hashes
            # are not important, waste resources and increase test times. The following
            # reduces the work factor to the lowest possible values.
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: auto
                cost: 4 # Lowest possible value for bcrypt
                time_cost: 3 # Lowest possible value for argon
                memory_cost: 10 # Lowest possible value for argon

<?php

namespace App\EventSubscriber;

use League\Bundle\OAuth2ServerBundle\Event\AuthorizationRequestResolveEvent;
use League\Bundle\OAuth2ServerBundle\OAuth2Events;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\RequestStack;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;

class AuthorizationRequestResolverSubscriber implements EventSubscriberInterface
{
    public const SESSION_AUTHORIZATION_RESULT = '_app.oauth2.authorization_result';

    private RequestStack $requestStack;
    private UrlGeneratorInterface $urlGenerator;

    public function __construct(RequestStack $requestStack, UrlGeneratorInterface $urlGenerator)
    {
        $this->requestStack = $requestStack;
        $this->urlGenerator = $urlGenerator;
    }

    public static function getSubscribedEvents(): array
    {
        return [
            OAuth2Events::AUTHORIZATION_REQUEST_RESOLVE => 'onAuthorizationRequestResolve',
        ];
    }

    public function onAuthorizationRequestResolve(AuthorizationRequestResolveEvent $event): void
    {
        $request = $this->requestStack->getCurrentRequest();

        if ($request->getSession()->has(self::SESSION_AUTHORIZATION_RESULT)) {
            $event->resolveAuthorization(
                $request->getSession()->get(self::SESSION_AUTHORIZATION_RESULT)
            );
            $request->getSession()->remove(self::SESSION_AUTHORIZATION_RESULT);

        } else {
            $url = $this->urlGenerator->generate('app_consent', $request->query->all());

            $response = new RedirectResponse($url);
            $event->setResponse($response);
        }

    }
}

 `/**
 * @Route("/api", name="app_api")
 * @return Response
 */
public function index(): Response
{
    $user = $this->security->getUser();
    $userInfo = [];
    $userInfo['username'] = $user->getId();
    $userInfo['nickname'] = $user->getUserIdentifier();
    $userInfo['email'] = $user->getEmail();
    $userInfo['realusername'] = $user->getUsername();
    $userInfo['roles'] = $user->getRoles();

    return new JsonResponse($userInfo);
}`

 /**
 * @Route("/api/logout", name="app_api_logout", methods="GET")
 * @param Request $request
 * @return RedirectResponse
 */
public function userLogoutAction(Request $request)
{
    $error = "";
    $user = $this->security->getUser()->getUserIdentifier();
    $uri = $request->query->get('uri').'/logout';

    $tokenObj = $this->em->getRepository(AccessToken::class)->findBy(['userIdentifier' => $user]);

    if(!empty($user)){
        if (!empty($tokenObj)) {
            foreach ($tokenObj as $token) {
                $refreshToken = $this->em->getRepository(RefreshToken::class)->findBy(['accessToken' => $token->getIdentifier()]);

                if (!empty($tokenObj)) {
                    foreach ($refreshToken as $rtoken) {
                        $rtoken->revoke();
                        $this->em->flush();
                    }
                    $token->revoke();
                    $this->em->flush();
                }

            }
        }

    } else {
        $error = "Can't find access token";
    }

    $response = new RedirectResponse($uri);
    $response->headers->clearCookie("PHPSESSID");
    return $response;
}

# Full path to the private key file.
# How to generate a private key: https://oauth2.thephpleague.com/installation/#generating-public-and-private-keys
private_key:   "%kernel.project_dir%/../config/oauth/private.key"

# Passphrase of the private key, if any
private_key_passphrase: mypassphrase

# The plain string or the ascii safe string used to create a Defuse\Crypto\Key to be used as an encryption key.
# How to generate an encryption key: https://oauth2.thephpleague.com/installation/#string-password
encryption_key: 3FX/FO/IJD6nXqFp0mcU31uuLPTeA9zNUPazkngXQnk=

# The type of value of 'encryption_key'
encryption_key_type:  plain # One of "plain"; "defuse"

# How long the issued access token should be valid for.
# The value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters
access_token_ttl:     PT1H

# How long the issued refresh token should be valid for.
# The value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters
refresh_token_ttl:    P1M

# How long the issued auth code should be valid for.
# The value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters
auth_code_ttl:        PT10M

# Whether to enable the client credentials grant
enable_client_credentials_grant: true

# Whether to enable the password grant
enable_password_grant: true

# Whether to enable the refresh token grant
enable_refresh_token_grant: true

# Whether to enable the authorization code grant
enable_auth_code_grant: true

# Whether to require code challenge for public clients for the auth code grant
require_code_challenge_for_public_clients: true

# Full path to the public key file
# How to generate a public key: https://oauth2.thephpleague.com/installation/#generating-public-and-private-keys
public_key:  "%kernel.project_dir%/../config/oauth/public.key"

  # Name of the entity manager that you wish to use for managing clients and tokens.
  entity_manager:       default
in_memory:            ~