phpyamlauth0symfony4hwioauthbundle

Symfony 4 + HWIOAuthBundle: No user provider on logout


I'm stuck trying to implement user management in a Symfony4 project with this bundle and Auth0. Currently, I have a couple of problems: one of them is that, when I log out, I am greeted by: There is no user provider for user "HWI\Bundle\OAuthBundle\Security\Core\User\OAuthUser". This is while using the path /auth0/logout. The thing is that I have a User class that extends the OAuthUser class, and I figured that would be enough. Is it not? (I also have the default HWI OAuthUserProvider in the services.yaml file, but that's because disabling it or enabling it there doesn't seem to change anything.)

I've gotten really, really confused on how to set up user providers and with documentation being confusing (I was using a file, the resource owner, from a tutorial, until my senior developer showed me that the recommended file in the actual repo was very different, for example.) So here is what I have so far:

services.yaml

# Put parameters here that don't need to change on each machine where the app is deployed
# https://symfony.com/doc/current/best_practices/configuration.html#application-related-configuration
parameters:
    locale: 'en'

services:
    # default configuration for services in *this* file
    _defaults:
        autowire: true      # Automatically injects dependencies in your services.
        autoconfigure: true # Automatically registers your services as commands, event subscribers, etc.
        public: false       # Allows optimizing the container by removing unused services; this also means
                            # fetching services directly from the container via $container->get() won't work.
                            # The best practice is to be explicit about your dependencies anyway.

    hwi_oauth.user.provider.entity:
        class: HWI\Bundle\OAuthBundle\Security\Core\User\OAuthUserProvider

    my.oauth_user_provider:
        class: App\Providers\OAuthProvider
        autowire: false
        arguments: 
            - '@session'
            - '@doctrine'
            - '@service_container'

    # makes classes in src/ available to be used as services
    # this creates a service per class whose id is the fully-qualified class name
    App\:
        resource: '../src/*'
        exclude: '../src/{Entity,Migrations,Tests,Kernel.php}'

    # controllers are imported separately to make sure services can be injected
    # as action arguments even if you don't extend any base controller class
    App\Controller\:
        resource: '../src/Controller'
        tags: ['controller.service_arguments']

    App\EventListener\:
        resource: '../src/EventListener'

    # App\EventListener\UserEventListener:
        # tags: 
            # - { name: 'kernel.event_listener', event: 'hwi_oauth.connect.completed' }

    # add more service definitions when explicit configuration is needed
    # please note that last definitions always *replace* previous ones

security.yaml

security:
    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    providers:
        # in_memory: { memory: ~ }
        # user_provider:
           # entity:
              #  class: App\Entity\User
              #  property: email
        my_provider: 
            id: my.oauth_user_provider

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        # main:
           # pattern:    ^/
           #  anonymous: ~
           # http_basic: ~
            # provider: user_provider
            # form_login:
                # login_path: login
                # check_path: login
        secured_area:
            pattern: ^/
            anonymous: ~
            oauth:
                resource_owners:
                    auth0: "/auth0/callback"
                login_path:        /login
                use_forward:       false
                failure_path:      /login
                oauth_user_provider:
                    service: my.oauth_user_provider

            logout:
                path:   /auth0/logout
                target: /
        main:
            anonymous: ~
    access_control:
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/secured, roles: ROLE_OAUTH_USER }

    role_hierarchy:
        ROLE_ADMIN:     ROLE_USER
        ROLE_DEVELOPER: ROLE_ADMIN


    encoders:
        App\Entity\User: bcrypt

hwi_oauth.yaml

hwi_oauth:
    firewall_names: [secured_area]
    resource_owners:
        auth0:
            type:                oauth2
            class:               'App\Auth0ResourceOwner'
            client_id:           "%env(AUTH0_CLIENT_ID)%"
            client_secret:       "%env(AUTH0_CLIENT_SECRET)%"
            base_url:            "https://%env(AUTH0_DOMAIN)%"
            scope: "openid email profile"
            paths:
                identifier: sub
                firstname: given_name
                middlename: middle_name
                lastname: family_name
                email_verified: email_verified
                dob: birthdate
                identities: https://www.example.org/identities

I am really puzzled by what is going on here. What am I missing? And if it's in the docs, can someone point me to the specific point the solution is described? I've looked at several questions here on Stack Overflow, but they either talk about Symfony 2, which I'm not using, or they have answers that don't apply, like adding "hwi_oauth.user.provider" under providers in security.yaml, but if I do that then I get a problem of having too many providers. (And if I try to explicitly set the provider by having it say "provider" instead of "oauth_user_provider" it leads me down a rabbit hole of saying child nodes aren't configured, and in my searches I haven't found anything to explain just what the error message means.) I'm at the point where I'm tearing what little hair I have left out. What am I missing? What part of the documentation have I not read or have misread? I'm not sure where to turn next.


Solution

  • So as it turned out, even though I had the User class extending the OAuthUser class, and my user provider extending HWI's user provider, my user provider was calling a function (loadUserByUsername) that was only in the default, so I had to just write my own in my own provider to override that. That solved one problem, but now I have to figure out why my User, when I log in, is all NULL. But that's a separate issue, I think.