With this configuration listed below I've experienced some weird issue I cannot resolve alone since i'm too new in Symfony.
security:
encoders:
App\Api\User\Entity\User:
algorithm: bcrypt
cost: 12
# https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
providers:
users:
id: 'App\Api\Auth\Provider\AuthProvider'
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
# Api will be stateless, a token will be generated
api_login:
pattern: /api/login
stateless: true
context: api
anonymous: true
provider: users
form_login:
check_path: /api/login
username_parameter: email
password_parameter: password
success_handler: lexik_jwt_authentication.handler.authentication_success
failure_handler: lexik_jwt_authentication.handler.authentication_failure
require_previous_session: false
# For web calls no need to be stateless
web_login:
pattern: /login
stateless: false
context: web
anonymous: true
provider: users
guard:
entry_point: 'App\User\Auth\Guard\LoginAuthenticator'
authenticators:
- 'App\Api\Auth\Guard\LoginAuthenticator'
form_login:
login_path: /login
check_path: /login
api:
provider: users
context: api
pattern: ^/api
stateless: true
anonymous: true
guard:
authenticators:
- lexik_jwt_authentication.jwt_token_authenticator
web:
provider: users
context: web
pattern: ^(/user|/template)
stateless: false
anonymous: true
guard:
authenticators:
- 'App\Api\Auth\Guard\LoginAuthenticator'
main:
pattern: ^/
anonymous: ~
logout:
path: /logout
target: /login
# Easy way to control access for large sections of your site
# Note: Only the *first* access control that matches will be used
access_control:
- { path: ^/api, roles: ROLE_USER }
- { path: ^/user/*, roles: ROLE_USER }
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
I've :
- A back office with secured area with stateful mode
- An API with secured area with stateless mode (JWT token)
Now Here what is working :
- I can connect with my HTML form and see my roles and my data (email)
When I'm connected (HTML) I'm instantly redirect on /user/profile endpoint and see my informations
I can call my API login endpoint and get the JWT token
Here what's not working
- From API call, I've a token that have no username (null) in it
- If y try to access on secured area from api I got an error listed below
My decoded token :
{"alg":"RS256"}{"roles":["ROLE_USER"],"username":null,"iat":1527787676,"exp":1527791276}
The error:
{
"code": 401,
"message": "Unable to find key \"username\" in the token payload."
}
Any idea ?