3 namespace Drupal\Core\EventSubscriber;
5 use Drupal\Core\Authentication\AuthenticationProviderFilterInterface;
6 use Drupal\Core\Authentication\AuthenticationProviderChallengeInterface;
7 use Drupal\Core\Authentication\AuthenticationProviderInterface;
8 use Drupal\Core\Session\AccountProxyInterface;
9 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
10 use Symfony\Component\HttpKernel\Event\GetResponseEvent;
11 use Symfony\Component\HttpKernel\Event\GetResponseForExceptionEvent;
12 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
13 use Symfony\Component\HttpKernel\HttpKernelInterface;
14 use Symfony\Component\HttpKernel\KernelEvents;
17 * Authentication subscriber.
19 * Trigger authentication during the request.
21 class AuthenticationSubscriber implements EventSubscriberInterface {
24 * Authentication provider.
26 * @var \Drupal\Core\Authentication\AuthenticationProviderInterface
28 protected $authenticationProvider;
31 * Authentication provider filter.
33 * @var \Drupal\Core\Authentication\AuthenticationProviderFilterInterface|null
38 * Authentication challenge provider.
40 * @var \Drupal\Core\Authentication\AuthenticationProviderChallengeInterface|null
42 protected $challengeProvider;
47 * @var \Drupal\Core\Session\AccountProxyInterface
49 protected $accountProxy;
52 * Constructs an authentication subscriber.
54 * @param \Drupal\Core\Authentication\AuthenticationProviderInterface $authentication_provider
55 * An authentication provider.
56 * @param \Drupal\Core\Session\AccountProxyInterface $account_proxy
59 public function __construct(AuthenticationProviderInterface $authentication_provider, AccountProxyInterface $account_proxy) {
60 $this->authenticationProvider = $authentication_provider;
61 $this->filter = ($authentication_provider instanceof AuthenticationProviderFilterInterface) ? $authentication_provider : NULL;
62 $this->challengeProvider = ($authentication_provider instanceof AuthenticationProviderChallengeInterface) ? $authentication_provider : NULL;
63 $this->accountProxy = $account_proxy;
67 * Authenticates user on request.
69 * @param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event
72 * @see \Drupal\Core\Authentication\AuthenticationProviderInterface::authenticate()
74 public function onKernelRequestAuthenticate(GetResponseEvent $event) {
75 if ($event->getRequestType() === HttpKernelInterface::MASTER_REQUEST) {
76 $request = $event->getRequest();
77 if ($this->authenticationProvider->applies($request)) {
78 $account = $this->authenticationProvider->authenticate($request);
80 $this->accountProxy->setAccount($account);
84 // No account has been set explicitly, initialize the timezone here.
85 date_default_timezone_set(drupal_get_user_timezone());
90 * Denies access if authentication provider is not allowed on this route.
92 * @param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event
95 public function onKernelRequestFilterProvider(GetResponseEvent $event) {
96 if (isset($this->filter) && $event->getRequestType() === HttpKernelInterface::MASTER_REQUEST) {
97 $request = $event->getRequest();
98 if ($this->authenticationProvider->applies($request) && !$this->filter->appliesToRoutedRequest($request, TRUE)) {
99 throw new AccessDeniedHttpException('The used authentication method is not allowed on this route.');
105 * Respond with a challenge on access denied exceptions if appropriate.
107 * On a 403 (access denied), if there are no credentials on the request, some
108 * authentication methods (e.g. basic auth) require that a challenge is sent
111 * @param \Symfony\Component\HttpKernel\Event\GetResponseForExceptionEvent $event
112 * The exception event.
114 public function onExceptionSendChallenge(GetResponseForExceptionEvent $event) {
115 if (isset($this->challengeProvider) && $event->getRequestType() === HttpKernelInterface::MASTER_REQUEST) {
116 $request = $event->getRequest();
117 $exception = $event->getException();
118 if ($exception instanceof AccessDeniedHttpException && !$this->authenticationProvider->applies($request) && (!isset($this->filter) || $this->filter->appliesToRoutedRequest($request, FALSE))) {
119 $challenge_exception = $this->challengeProvider->challengeException($request, $exception);
120 if ($challenge_exception) {
121 $event->setException($challenge_exception);
130 public static function getSubscribedEvents() {
131 // The priority for authentication must be higher than the highest event
132 // subscriber accessing the current user. Especially it must be higher than
133 // LanguageRequestSubscriber as LanguageManager accesses the current user if
134 // the language module is enabled.
135 $events[KernelEvents::REQUEST][] = ['onKernelRequestAuthenticate', 300];
137 // Access check must be performed after routing.
138 $events[KernelEvents::REQUEST][] = ['onKernelRequestFilterProvider', 31];
139 $events[KernelEvents::EXCEPTION][] = ['onExceptionSendChallenge', 75];