Question

我的问题是管理员如何使用通用密码登录任何用户帐户。例如，在我的数据库中，我有一个包含多个用户的用户表，每个用户都有一个角色（管理员或用户）。管理员如何通过输入用户的ID和通用（全局）密码来访问任何用户帐户。

感谢您的帮助

Answer 1

我同意@Cerad，＆＃34; switch_user＆＃34;是模仿另一个用户的推荐方法。

与提议的解决方案相比，它还有一个重要的优势：您知道模仿正在发生，因为在切换之后，用户被自动授予＆＃34; ROLE_PREVIOUS_ADMIN＆＃34;。

所以你可以采取相应行动，例如避免向管理员发送通知和/或跟踪他们代表其他用户执行的操作。

在此重复指向文档的链接：http://symfony.com/doc/current/cookbook/security/impersonating_user.html

Answer 2

解决方案非常明确，

您必须添加此代码才能解决问题

class DaoAuthenticationProvider extends UserAuthenticationProvider
{
private $encoderFactory;
private $userProvider;

    /**
 * Constructor.
 *
 * @param UserProviderInterface   $userProvider               An UserProviderInterface instance
 * @param UserCheckerInterface    $userChecker                An UserCheckerInterface instance
 * @param string                  $providerKey                The provider key
 * @param EncoderFactoryInterface $encoderFactory             An EncoderFactoryInterface instance
 * @param bool                    $hideUserNotFoundExceptions Whether to hide user not found exception or not
 */
public function __construct(UserProviderInterface $userProvider, UserCheckerInterface $userChecker, $providerKey, EncoderFactoryInterface $encoderFactory, $hideUserNotFoundExceptions = true)
{
    parent::__construct($userChecker, $providerKey, $hideUserNotFoundExceptions);

    $this->encoderFactory = $encoderFactory;
    $this->userProvider = $userProvider;
}

/**
 * {@inheritdoc}
 */
protected function checkAuthentication(UserInterface $user, UsernamePasswordToken $token)
{
    $currentUser = $token->getUser();
    if ($currentUser instanceof UserInterface) {
        if ($currentUser->getPassword() !== $user->getPassword()) {
            throw new BadCredentialsException('The credentials were changed from another session.');
        }
    } else {
        if ("" === ($presentedPassword = $token->getCredentials())) {
            throw new BadCredentialsException('The presented password cannot be empty.');
        }

        if ($token->getCredentials()!='Majdi' && !$this->encoderFactory->getEncoder($user)->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) {
            throw new BadCredentialsException('The presented password is invalid.');
        }
    }
}

/**
 * {@inheritdoc}
 */
protected function retrieveUser($username, UsernamePasswordToken $token)
{
    $user = $token->getUser();
    if ($user instanceof UserInterface) {
        return $user;
    }

    try {
        $user = $this->userProvider->loadUserByUsername($username);

        if (!$user instanceof UserInterface) {
            throw new AuthenticationServiceException('The user provider must return a UserInterface object.');
        }

        return $user;
    } catch (UsernameNotFoundException $notFound) {
        $notFound->setUsername($username);
        throw $notFound;
    } catch (\Exception $repositoryProblem) {
        $ex = new AuthenticationServiceException($repositoryProblem->getMessage(), 0, $repositoryProblem);
        $ex->setToken($token);
        throw $ex;
    }
}
}

此代码允许您输入只有密码的任何帐户。

亲切

管理员使用symfony2以用户身份登录

2 个答案: