Skip to content

Commit 3ae1f9f

Browse files
OskarStarkOskarStark
committed
[SecurityBundle] Remove deprecated OIDC token handler options algorithm and key
Remove the deprecated algorithm and key options from the OIDC token handler configuration, use algorithms and keyset instead. - Add CHANGELOG entry - Add UPGRADE-8.0.md entry with before/after examples - Remove legacy test for deprecated options - No need to remove symfony/deprecation-contracts (not present)
1 parent 6ab4a14 commit 3ae1f9f

File tree

5 files changed

+38
-121
lines changed

5 files changed

+38
-121
lines changed

‎UPGRADE-8.0.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,37 @@ Security
330330
* Remove `AbstractListener::__invoke`
331331
* Remove `LazyFirewallContext::__invoke()`
332332

333+
SecurityBundle
334+
--------------
335+
336+
* Remove the deprecated `algorithm` and `key` options from the OIDC token handler configuration, use `algorithms` and `keyset` instead
337+
338+
*Before*
339+
```yaml
340+
# config/packages/security.yaml
341+
security:
342+
firewalls:
343+
main:
344+
access_token:
345+
token_handler:
346+
oidc:
347+
algorithm: 'RS256'
348+
key: 'https://example.com/.well-known/jwks.json'
349+
```
350+
351+
*After*
352+
```yaml
353+
# config/packages/security.yaml
354+
security:
355+
firewalls:
356+
main:
357+
access_token:
358+
token_handler:
359+
oidc:
360+
algorithms: ['RS256']
361+
keyset: 'https://example.com/.well-known/jwks.json'
362+
```
363+
333364
Serializer
334365
----------
335366

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ CHANGELOG
44
8.0
55
---
66

7+
* Remove the deprecated `algorithm` and `key` options from the OIDC token handler configuration, use `algorithms` and `keyset` instead
78
* Remove `LazyFirewallContext::__invoke()`
89

910
7.4

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/AccessToken/OidcTokenHandlerFactory.php

Lines changed: 4 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -92,35 +92,12 @@ public function addConfiguration(NodeBuilder $node): void
9292
->arrayNode($this->getKey())
9393
->fixXmlConfig($this->getKey())
9494
->validate()
95-
->ifTrue(static fn ($v) => !isset($v['algorithm']) && !isset($v['algorithms']))
96-
->thenInvalid('You must set either "algorithm" or "algorithms".')
95+
->ifTrue(static fn ($v) => !isset($v['algorithms']))
96+
->thenInvalid('You must set "algorithms".')
9797
->end()
9898
->validate()
99-
->ifTrue(static fn ($v) => !isset($v['discovery']) && !isset($v['key']) && !isset($v['keyset']))
100-
->thenInvalid('You must set either "discovery" or "key" or "keyset".')
101-
->end()
102-
->beforeNormalization()
103-
->ifTrue(static fn ($v) => isset($v['algorithm']) && \is_string($v['algorithm']))
104-
->then(static function ($v) {
105-
if (isset($v['algorithms'])) {
106-
throw new InvalidConfigurationException('You cannot use both "algorithm" and "algorithms" at the same time.');
107-
}
108-
$v['algorithms'] = [$v['algorithm']];
109-
unset($v['algorithm']);
110-
111-
return $v;
112-
})
113-
->end()
114-
->beforeNormalization()
115-
->ifTrue(static fn ($v) => isset($v['key']) && \is_string($v['key']))
116-
->then(static function ($v) {
117-
if (isset($v['keyset'])) {
118-
throw new InvalidConfigurationException('You cannot use both "key" and "keyset" at the same time.');
119-
}
120-
$v['keyset'] = \sprintf('{"keys":[%s]}', $v['key']);
121-
122-
return $v;
123-
})
99+
->ifTrue(static fn ($v) => !isset($v['discovery']) && !isset($v['keyset']))
100+
->thenInvalid('You must set either "discovery" or "keyset".')
124101
->end()
125102
->children()
126103
->arrayNode('discovery')
@@ -155,19 +132,11 @@ public function addConfiguration(NodeBuilder $node): void
155132
->isRequired()
156133
->scalarPrototype()->end()
157134
->end()
158-
->arrayNode('algorithm')
159-
->info('Algorithm used to sign the token.')
160-
->setDeprecated('symfony/security-bundle', '7.1', 'The "%node%" option is deprecated and will be removed in 8.0. Use the "algorithms" option instead.')
161-
->end()
162135
->arrayNode('algorithms')
163136
->info('Algorithms used to sign the token.')
164137
->isRequired()
165138
->scalarPrototype()->end()
166139
->end()
167-
->scalarNode('key')
168-
->info('JSON-encoded JWK used to sign the token (must contain a "kty" key).')
169-
->setDeprecated('symfony/security-bundle', '7.1', 'The "%node%" option is deprecated and will be removed in 8.0. Use the "keyset" option instead.')
170-
->end()
171140
->scalarNode('keyset')
172141
->info('JSON-encoded JWKSet used to sign the token (must contain a list of valid public keys).')
173142
->end()

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Security/Factory/AccessTokenFactoryTest.php

Lines changed: 1 addition & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -104,61 +104,17 @@ public function testInvalidOidcTokenHandlerConfigurationKeyMissing()
104104
$config = [
105105
'token_handler' => [
106106
'oidc' => [
107-
'algorithm' => 'RS256',
108-
'issuers' => ['https://www.example.com'],
109-
'audience' => 'audience',
110-
],
111-
],
112-
];
113-
114-
$factory = new AccessTokenFactory($this->createTokenHandlerFactories());
115-
116-
$this->expectException(InvalidConfigurationException::class);
117-
$this->expectExceptionMessage('You must set either "discovery" or "key" or "keyset".');
118-
119-
$this->processConfig($config, $factory);
120-
}
121-
122-
public function testInvalidOidcTokenHandlerConfigurationDuplicatedKeyParameters()
123-
{
124-
$config = [
125-
'token_handler' => [
126-
'oidc' => [
127-
'algorithm' => 'RS256',
128-
'issuers' => ['https://www.example.com'],
129-
'audience' => 'audience',
130-
'key' => 'key',
131-
'keyset' => 'keyset',
132-
],
133-
],
134-
];
135-
136-
$factory = new AccessTokenFactory($this->createTokenHandlerFactories());
137-
138-
$this->expectException(InvalidConfigurationException::class);
139-
$this->expectExceptionMessage('You cannot use both "key" and "keyset" at the same time.');
140-
141-
$this->processConfig($config, $factory);
142-
}
143-
144-
public function testInvalidOidcTokenHandlerConfigurationDuplicatedAlgorithmParameters()
145-
{
146-
$config = [
147-
'token_handler' => [
148-
'oidc' => [
149-
'algorithm' => 'RS256',
150107
'algorithms' => ['RS256'],
151108
'issuers' => ['https://www.example.com'],
152109
'audience' => 'audience',
153-
'keyset' => 'keyset',
154110
],
155111
],
156112
];
157113

158114
$factory = new AccessTokenFactory($this->createTokenHandlerFactories());
159115

160116
$this->expectException(InvalidConfigurationException::class);
161-
$this->expectExceptionMessage('You cannot use both "algorithm" and "algorithms" at the same time.');
117+
$this->expectExceptionMessage('You must set either "discovery" or "keyset".');
162118

163119
$this->processConfig($config, $factory);
164120
}
@@ -183,46 +139,6 @@ public function testInvalidOidcTokenHandlerConfigurationMissingAlgorithmParamete
183139
$this->processConfig($config, $factory);
184140
}
185141

186-
/**
187-
* @group legacy
188-
*
189-
* @expectedDeprecation Since symfony/security-bundle 7.1: The "key" option is deprecated and will be removed in 8.0. Use the "keyset" option instead.
190-
*/
191-
public function testOidcTokenHandlerConfigurationWithSingleAlgorithm()
192-
{
193-
$container = new ContainerBuilder();
194-
$jwk = '{"kty":"EC","crv":"P-256","x":"0QEAsI1wGI-dmYatdUZoWSRWggLEpyzopuhwk-YUnA4","y":"KYl-qyZ26HobuYwlQh-r0iHX61thfP82qqEku7i0woo","d":"iA_TV2zvftni_9aFAQwFO_9aypfJFCSpcCyevDvz220"}';
195-
$config = [
196-
'token_handler' => [
197-
'oidc' => [
198-
'algorithm' => 'RS256',
199-
'issuers' => ['https://www.example.com'],
200-
'audience' => 'audience',
201-
'key' => $jwk,
202-
],
203-
],
204-
];
205-
206-
$factory = new AccessTokenFactory($this->createTokenHandlerFactories());
207-
$finalizedConfig = $this->processConfig($config, $factory);
208-
209-
$factory->createAuthenticator($container, 'firewall1', $finalizedConfig, 'userprovider');
210-
211-
$this->assertTrue($container->hasDefinition('security.authenticator.access_token.firewall1'));
212-
$this->assertTrue($container->hasDefinition('security.access_token_handler.firewall1'));
213-
214-
$expected = [
215-
'index_0' => (new ChildDefinition('security.access_token_handler.oidc.signature'))
216-
->replaceArgument(0, ['RS256']),
217-
'index_1' => (new ChildDefinition('security.access_token_handler.oidc.jwkset'))
218-
->replaceArgument(0, \sprintf('{"keys":[%s]}', $jwk)),
219-
'index_2' => 'audience',
220-
'index_3' => ['https://www.example.com'],
221-
'index_4' => 'sub',
222-
];
223-
$this->assertEquals($expected, $container->getDefinition('security.access_token_handler.firewall1')->getArguments());
224-
}
225-
226142
public function testOidcTokenHandlerConfigurationWithMultipleAlgorithms()
227143
{
228144
$container = new ContainerBuilder();

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/AccessToken/config_oidc_jwe.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ security:
2424
claim: 'username'
2525
audience: 'Symfony OIDC'
2626
issuers: [ 'https://www.example.com' ]
27-
algorithm: 'ES256'
27+
algorithms: ['ES256']
2828
# tip: use https://mkjwk.org/ to generate a JWK
2929
keyset: '{"keys":[{"kty":"EC","d":"iA_TV2zvftni_9aFAQwFO_9aypfJFCSpcCyevDvz220","crv":"P-256","x":"0QEAsI1wGI-dmYatdUZoWSRWggLEpyzopuhwk-YUnA4","y":"KYl-qyZ26HobuYwlQh-r0iHX61thfP82qqEku7i0woo"}]}'
3030
encryption:

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy