Symfony2 custom password encoder and password hash update

Question

I'm learning Symfony2 by moving some wordpress blog to Symfony. I'm stuck with login procedure. Wordpress uses non standard password hashing like $P$.... and I want to check users against old password hash when they login and when password is correct, rehash it to bcrypt. So far I created custome encoder class to use with symfony security mechanism.

<?php
namespace Pkr\BlogUserBundle\Service\Encoder;

use PHPassLib\Application\Context;
use Symfony\Component\Security\Core\Encoder\BCryptPasswordEncoder;
use Symfony\Component\Security\Core\Encoder\PasswordEncoderInterface;
use Symfony\Component\Security\Core\Util\SecureRandom;

class WpTransitionalEncoder implements PasswordEncoderInterface
{

    public function __construct($cost = 13)
    {
        $secure = new SecureRandom();
        $this->_bcryptEncoder = new BCryptPasswordEncoder($secure, $cost);
    }

    public function isPasswordValid($encoded, $raw, $salt)
    {
        if (preg_match('^\$P\$', $encoded)) {
            $context = new Context();
            $context->addConfig('portable');
            return $context->verify($raw, $encoded);
        }
        return $this->_bcryptEncoder->isPasswordValid($encoded, $raw, $salt);
    }

    public function encodePassword($raw, $salt)
    {
        return $this->_bcryptEncoder->encodePassword($raw, $salt);
    }
}

I'm using it as a service:

#/src/Pkr/BlogUserBundle/Resources/config/services.yml
services:
    pkr_blog_user.wp_transitional_encoder:
        class: Pkr\BlogUserBundle\Service\Encoder\WpTransitionalEncoder

And in security.yml:

#/app/config/security.yml
security:
encoders:
    Pkr\BlogUserBoundle\Entity\User:
        id:   pkr_blog_user.wp_transitional_encoder
        cost: 15

My questions are:

How do I pass parameters to my encoder service form within security.yml?

I'm asking because cost: 15 does not work.

Where should I put password hash update logic? I was thinking that maby just after password validation something like this:

public function isPasswordValid($encoded, $raw, $salt)
{
    if (preg_match('^\$P\$', $encoded)) {
        $context = new Context();
        $context->addConfig('portable');
        $isValid = $context->verify($raw, $encoded);
        if ($isValid) {
            // put logic here...
        }
        return $isValid;
    }
    return $this->_bcryptEncoder->isPasswordValid($encoded, $raw, $salt);
}

but it seem somehow like wrong place for it. So what is the right way?

score 2 · Accepted Answer · edited May 23 '17 at 12:17

I'll answer my own question.

I placed parameters for my encoder service inside config.yml

pkr_blog_user:
    password_encoder:
        cost: 17

They will be passed to my bundle extension class:

# /src/Pkr/BlogUserBundle/DependencyInjection/PkrBlogUserExtension.php
namespace Pkr\BlogUserBundle\DependencyInjection;

use Symfony\Component\DependencyInjection\ContainerBuilder;
use Symfony\Component\Config\FileLocator;
use Symfony\Component\HttpKernel\DependencyInjection\Extension;
use Symfony\Component\DependencyInjection\Loader;

/**
* This is the class that loads and manages your bundle configuration
*
* To learn more see {@link http://symfony.com/doc/current/cookbook/bundles/extension.html}
*/
class PkrBlogUserExtension extends Extension
{
    /**
    * {@inheritDoc}
    */
    public function load(array $configs, ContainerBuilder $container)
    {
        $configuration = new Configuration();
        $config = $this->processConfiguration($configuration, $configs);

        $loader = new Loader\YamlFileLoader($container, new FileLocator(__DIR__.'/../Resources/config'));
        $loader->load('services.yml');

        if ($config['password_encoder']['cost'] < 10) {
            $config['password_encoder']['cost'] = sprintf('%02d', $config['password_encoder']['cost']);
        }
        $container->setParameter('pkr_blog_user.wp_transitional_encoder.cost', $config['password_encoder']['cost']);

    }
}

I found out that I could use my own authentication success handler so there is a good place to put password rehash logic. Unfortunately when using custom handler symfony2 won't pass config to class constructor but I found a way to make it work. I described it here:

https://stackoverflow.com/a/15988399/1089412

Symfony2 custom password encoder and password hash update

1 Answers1