I have the same problem and I decided to use it using BeSimpleSsoAuthBundle, but you need to make a few changes: Suppose your user object is already implemented in your UserBundle, with a unique sgid attribute that you must override: 1- BeSimple \ SsoAuthBundle \ Security \ Core \ User:
<?php namespace Application\UserBundle\Security\BeSimple\SpawnedUserProvider; use BeSimple\SsoAuthBundle\Security\Core\User\SpawnedUserProvider; use Symfony\Component\Security\Core\User\UserInterface; use Symfony\Component\Security\Core\User\User; use Symfony\Component\HttpFoundation\RedirectResponse; class SsoUserProvider extends SpawnedUserProvider { private $roles; private $entityManager; private $securityContext; public function __construct($em, $securityContext) { $this->em = $em; $this->securityContext = $securityContext; } public function loadUserByUsername($username) { $session = $this->securityContext; $qb = $this->em->createQueryBuilder(); $qb->select("u") ->from('ApplicationUserBundle:User', 'u') ->where('u.sgid = :sgid') ->AndWhere('u.status = 1') ->setParameter("sgid", $username); $result = $qb->getQuery()->getOneOrNullResult(); if ($result == NULL) { $session->getFlashBag()->add('error', 'Vous ne pouvez pas vous connecter car votre compte est désactivé'); return new RedirectResponse('login'); } $user_name = $result->getFirstName().' '.$result->getLastName(); $session->set('userId', $result->getId()); if ($result->getUserType() == 1) { $this->roles = array('ROLE_ADMIN'); }else if ($result->getUserType() == 0){ $this->roles = array('ROLE_USER'); }else{ $session->getFlashBag()->add('error', 'Vous ne pouvez pas vous connecter car votre compte n\'a pas de rôle'); return new RedirectResponse('logout'); } return $this->spawnUser($user_name); } public function refreshUser(UserInterface $user) { if (!$user instanceof User) { throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', get_class($user))); } return $this->spawnUser($user->getUsername()); } public function supportsClass($class) { return $class === 'Symfony\Component\Security\Core\User\User'; } private function spawnUser($username) {
2- Override also BeSimple \ SsoAuthBundle \ Security \ Core \ Authentication \ Provider:
<?php namespace Application\UserBundle\Security\BeSimple\Authentication\Provider; use Symfony\Component\Security\Core\User\UserInterface; use Symfony\Component\Security\Core\Exception\UsernameNotFoundException; use Symfony\Component\Security\Core\Exception\BadCredentialsException; use BeSimple\SsoAuthBundle\Security\Core\User\UserFactoryInterface; use BeSimple\SsoAuthBundle\Security\Core\Authentication\Provider\SsoAuthenticationPr ovider; class AppAuthenticationProvider extends SsoAuthenticationProvider { private $userProvider; private $createUsers; private $hideUserNotFound; protected function provideUser($username, array $attributes = array()) { try { $user = $this->retrieveUser($username); } catch (UsernameNotFoundException $notFound) { if ($this->createUsers && $this->userProvider instanceof UserFactoryInterface) { $user = $this->createUser($username, $attributes); } elseif ($this->hideUserNotFound) { throw new BadCredentialsException('Bad credentials', 0, $notFound); } else { throw $notFound; } } return $user; } }
3- When a user logs into your application, save the necessary information in a session:
<?php namespace Application\UserBundle\Security\Authentication\Handler; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\RedirectResponse; use Symfony\Component\Routing\Router; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\SecurityContext; use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface; use Doctrine\ORM\EntityManager; class LoginSuccessHandler implements AuthenticationSuccessHandlerInterface { protected $router, $security, $entityManager; public function __construct(Router $router, SecurityContext $security, EntityManager $entityManager) { $this->router = $router; $this->security = $security; $this->entityManager = $entityManager; } public function onAuthenticationSuccess(Request $request, TokenInterface $token) { $session = $request->getSession(); $attributes = $this->security->getToken()->getAttributes(); $sgid = $attributes['sso:validation']['sgid']; $em = $this->entityManager; $qb = $em->createQueryBuilder(); $qb->select("u") ->from('ApplicationUserBundle:User', 'u') ->where('u.sgid = :sgid') ->AndWhere('u.status = 1') ->setParameter("sgid", $sgid); $result = $qb->getQuery()->getOneOrNullResult();
4- Now define the security list in the application / UserBundle / Ressources / config / security _listeners.yml:
parameters: security.authentication.provider.sso.class: Application\UserBundle\Security\BeSimple\Authentication\Provider\AppAuthenticationProvider services: security.authentication.provider.sso: class: %security.authentication.provider.sso.class% public: false arguments: ['', '@security.user_checker', '', '', false]
5- BeSimple configuration should be like this:
be_simple_sso_auth: admin_sso: protocol: id: cas version: 2 server: id: cas login_url: https://adresse ip:8443/cas-server-webapp-4.0.0/login logout_url: https://adresse ip:8443/cas-server-webapp-4.0.0/logout validation_url: https://adresse ip:8443/cas-server-webapp-4.0.0/serviceValidate services: spawned_user_provider: class: Application\UserBundle\Security\BeSimple\SpawnedUserProvider\SsoUserProvider arguments: [@doctrine.orm.entity_manager, @session]
6- .yml options
be_simple.sso_auth.client.option.curlopt_ssl_verifypeer.value: false be_simple.sso_auth.client.option.curlopt_sslversion.value: 4 (Optionale)
7- Security.yml
main: pattern: ^/admin context: marketshare_context logout: path: /admin/logout target: / #provider: sso trusted_sso: manager: admin_sso login_action: ApplicationUserBundle:TrustedSso:login logout_action: false login_path: /admin/login check_path: /admin/check always_use_default_target_path: true default_target_path: /admin/potentiel failure_path: /admin/logout