Sign in with Slack fails to transfer logged in user to admin ui

[developkariyer]

Using Pimcore 11.3.1 (latest)

Trying to implement a Slack Login SSO mechanism. Pimcore Admin UI does not accept my token or authorization which I implemented through AbstractAuthenticator

What I did:

• Created a custom bundle and overwritten login.html.twig for "Sign in with Slack" button (OK)
• Created a SlackAuthenticator by extending AbstractAuthenticator and written methods with Slack Oauth2 logic (OK)
• Created a matching user with my Slack user (using e-mail) and tested logging in with Slack (OK, at least at log level, I can see that e-mail matches Pimcore user fine, and onAuthenticationSuccess is called)
• Could not manage transferring logged in user to Pimcore Admin UI (Full authentication is required to access this resource.)

security:
    enable_authenticator_manager: true

    providers:
        pimcore_admin:
            id: Pimcore\Security\User\UserProvider

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        # Pimcore WebDAV HTTP basic // DO NOT CHANGE!
        pimcore_webdav:
            pattern: ^/asset/webdav
            provider: pimcore_admin
            http_basic: ~

        # Slack OAuth Firewall
        slack_oauth:
            pattern: ^/slack/callback$
            provider: pimcore_admin
            stateless: false
            custom_authenticator: App\Security\SlackAuthenticator

        # Pimcore Admin Bundle firewall
        pimcore_admin: '%pimcore_admin_bundle.firewall_settings%'

    access_control:
        # Pimcore admin ACl  // DO NOT CHANGE!
        - { path: ^/admin/settings/display-custom-logo, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/2fa-verify, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login/2fa-setup, roles: ROLE_PIMCORE_USER }
        - { path: ^/admin/login/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login$, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/(login|lostpassword|deeplink|csrf-token)$, roles: PUBLIC_ACCESS }
        - { path: ^/admin, roles: ROLE_PIMCORE_USER }
        - { path: ^/asset/webdav, roles: ROLE_PIMCORE_USER }
        - { path: ^/slack/callback$, roles: PUBLIC_ACCESS }
        - { path: ^/slack/login, roles: PUBLIC_ACCESS }

    role_hierarchy:
        # Pimcore admin  // DO NOT CHANGE!
        ROLE_PIMCORE_ADMIN: [ROLE_PIMCORE_USER]

// removed "if" checks in many places for sake of readability
class SlackAuthenticator extends AbstractAuthenticator
{
    private $httpClient;
    private $urlGenerator;
    private $userProvider;

    public function __construct(PimcoreHttpClient $httpClient,UrlGeneratorInterface $urlGenerator,UserProviderInterface $userProvider,
    ) {
        $this->httpClient = $httpClient;
        $this->urlGenerator = $urlGenerator;
        $this->userProvider = $userProvider;
    }

    public function supports(Request $request): ?bool
    {
        return ($request->getPathInfo() === '/slack/callback' && $request->isMethod('GET'));
    }
    
    public function authenticate(Request $request): Passport
    {
        $code = $request->query->get('code');
        $response = $this->httpClient->post('https://slack.com/api/oauth.v2.access', [
            'form_params' => [
                'client_id' => $_SERVER['SLACK_CLIENT_ID'],
                'client_secret' => $_SERVER['SLACK_CLIENT_SECRET'],
                'code' => $code,
                'redirect_uri' => $this->urlGenerator->generate('slack_callback', [], UrlGeneratorInterface::ABSOLUTE_URL),
            ],
        ]);
        $data = json_decode($response->getBody(), true);
        $accessToken = $data['authed_user']['access_token'] ?? null;
        $user_id = $data['authed_user']['id'] ?? null;
        $response = $this->httpClient->get('https://slack.com/api/users.info', [
            'headers' => [
                'Authorization' => "Bearer {$_SERVER['SLACK_BOT_USER_OAUTH_TOKEN']}",
            ],
            'query' => [
                'user' => $user_id,
            ],
        ]);
        $userData = json_decode($response->getBody(), true);
        $email = $userData['user']['profile']['email'] ?? null;
        $user = $this->userProvider->loadUserByIdentifier($email);
        return new SelfValidatingPassport(new UserBadge($email, function () use ($user) {
            return $user;
        }));
    }

    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
    {
        return new RedirectResponse($this->urlGenerator->generate('pimcore_admin_index'));
    }

    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
    {
        return new RedirectResponse($this->urlGenerator->generate('pimcore_admin_login'));
    }
}

[developkariyer]

class SlackAuthenticator extends AdminAbstractAuthenticator

Switched from AbstractAuthenticator to AdminAbstractAuthenticator
Now works as expected.
Thanks :)

[developkariyer]

Ok, sorry for flooding.

After working for a few logins with different users, it stopped working. I cannot replicate working situation. I am re-pasting latest working codes here.

Authentication is completed and token/session is created. But at some point, Admin UI decides that I am not authenticated.

security:
    enable_authenticator_manager: true
    providers:
        pimcore_admin:
            id: Pimcore\Security\User\UserProvider
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        # Pimcore WebDAV HTTP basic // DO NOT CHANGE!
        pimcore_webdav:
            pattern: ^/asset/webdav
            provider: pimcore_admin
            http_basic: ~
        # Combined Firewall for Pimcore Admin and Slack OAuth
        pimcore_admin:
            pattern: ^/admin(/.*)?$
            user_checker: Pimcore\Security\User\UserChecker
            provider: pimcore_admin
            login_throttling:
                max_attempts: 3
                interval: '1 minutes'
            logout:
                path: pimcore_admin_logout
                target: pimcore_admin_login
            form_login:
                default_target_path: pimcore_admin_index
                always_use_default_target_path: true
                login_path: pimcore_admin_login
                check_path: pimcore_admin_login_check
                username_parameter: username
                password_parameter: password
            custom_authenticators:
                - App\Security\SlackAuthenticator
                - Pimcore\Bundle\AdminBundle\Security\Authenticator\AdminTokenAuthenticator
            two_factor:
                auth_form_path: /admin/login/2fa
                check_path: /admin/login/2fa-verify
                default_target_path: /admin
                always_use_default_target_path: false
                auth_code_parameter_name: _auth_code
                trusted_parameter_name: _trusted
                multi_factor: false
    access_control:
        # Pimcore admin ACL  // DO NOT CHANGE!
        - { path: ^/admin/settings/display-custom-logo, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/2fa-verify, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login/2fa-setup, roles: ROLE_PIMCORE_USER }
        - { path: ^/admin/login/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login$, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/(login|lostpassword|deeplink|csrf-token)$, roles: PUBLIC_ACCESS }
        - { path: ^/admin, roles: ROLE_PIMCORE_USER }
        - { path: ^/asset/webdav, roles: ROLE_PIMCORE_USER }
        - { path: ^/slack/callback$, roles: PUBLIC_ACCESS }
        - { path: ^/slack/login, roles: PUBLIC_ACCESS }
    role_hierarchy:
        # Pimcore admin  // DO NOT CHANGE!
        ROLE_PIMCORE_ADMIN: [ROLE_PIMCORE_USER]

Here is my latest SlackAuthenticator

namespace App\Security;

use Pimcore\Security\User\User;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Routing\RouterInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
use Symfony\Contracts\Translation\TranslatorInterface;
use Symfony\Component\EventDispatcher\EventDispatcherInterface;
use Pimcore\Bundle\AdminBundle\Security\Authenticator\AdminAbstractAuthenticator;
use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
use GuzzleHttp\Client;
use Pimcore\Model\User\UserManager;
use Pimcore\Security\User\UserProvider;
use Pimcore\Model\User as PimcoreUser;

class SlackAuthenticator extends AdminAbstractAuthenticator
{
    public function supports(Request $request): ?bool
    {
        if (strpos($request->getPathInfo(), '/admin/login/login') !== false && $request->isMethod('GET')) {
            return true;
        }
        return false;
    }
    
    public function authenticate(Request $request): Passport
    {
        $code = $request->query->get('code');

        $userData = $this->getSlackUser($code);
        $email = $userData['user']['profile']['email'];

        $pimcoreUser = $this->searchUser($email);
        $user = new User($pimcoreUser);

        if (!$user) {
            $user = $this->createUserFromSlack($userData);
            if (!$user) {
                throw new AuthenticationException('Failed to create user from Slack data.');
            }
        }

        $this->saveUserToSession($user, $request->getSession());

        return new SelfValidatingPassport(new UserBadge($email, function () use ($user) {
            return $user;
        }));
    }

    protected function getSlackUser($code): array
    {
        return $userData; // simplified
    }

    protected function createUserFromSlack($userData): ?User
    {
        return $user; // simplified
    }

    protected function searchUser($email)
    {
        $list = new PimcoreUser\Listing();
        $list->setCondition("email = ?", [$email]);
        $list->setLimit(1);
        return $list->current();
    }
}

And here are logs

[2024-08-20T20:01:19.442839+00:00] request.INFO: Matched route "slack_login". {"route":"slack_login","route_parameters":{"_route":"slack_login","_controller":"App\\Controller\\AuthController::slackLogin"},"request_uri":"https://mesa.iwa.web.tr/slack/login","method":"GET"} []
[2024-08-20T20:01:19.443261+00:00] app.DEBUG: Resolved pimcore context for path /slack/login to default {"path":"/slack/login","context":"default"} []
[2024-08-20T20:01:21.032260+00:00] request.INFO: Matched route "pimcore_admin_login_check". {"route":"pimcore_admin_login_check","route_parameters":{"_route":"pimcore_admin_login_check","_controller":"Pimcore\\Bundle\\AdminBundle\\Controller\\Admin\\LoginController::loginCheckAction"},"request_uri":"https://mesa.iwa.web.tr/admin/login/login?code=4259060865782.761670047905.44df159dbb1e8f80de34646ede5b339b76a525fd55795966545b5ae32442cf70&state=7fdf4fd9775b7253c9ec5d7c6934077b","method":"GET"} []
[2024-08-20T20:01:21.032550+00:00] app.DEBUG: Resolved pimcore context for path /admin/login/login to admin {"path":"/admin/login/login","context":"admin"} []
[2024-08-20T20:01:21.034214+00:00] security.DEBUG: Checking for authenticator support. {"firewall_name":"pimcore_admin","authenticators":4} []
[2024-08-20T20:01:21.034418+00:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"pimcore_admin","authenticator":"App\\Security\\SlackAuthenticator"} []
[2024-08-20T20:01:21.034579+00:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"pimcore_admin","authenticator":"Pimcore\\Bundle\\AdminBundle\\Security\\Authenticator\\AdminTokenAuthenticator"} []
[2024-08-20T20:01:21.034719+00:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"pimcore_admin","authenticator":"Pimcore\\Bundle\\AdminBundle\\Security\\Authenticator\\AdminTokenAuthenticator"} []
[2024-08-20T20:01:21.034821+00:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"pimcore_admin","authenticator":"Scheb\\TwoFactorBundle\\Security\\Http\\Authenticator\\TwoFactorAuthenticator"} []
[2024-08-20T20:01:21.034924+00:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"pimcore_admin","authenticator":"Scheb\\TwoFactorBundle\\Security\\Http\\Authenticator\\TwoFactorAuthenticator"} []
[2024-08-20T20:01:21.035021+00:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"pimcore_admin","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\FormLoginAuthenticator"} []
[2024-08-20T20:01:21.035119+00:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"pimcore_admin","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\FormLoginAuthenticator"} []
[2024-08-20T20:01:21.596835+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\CheckPassportEvent" to listener "Symfony\Component\Security\Http\EventListener\LoginThrottlingListener::checkPassport". {"event":"Symfony\\Component\\Security\\Http\\Event\\CheckPassportEvent","listener":"Symfony\\Component\\Security\\Http\\EventListener\\LoginThrottlingListener::checkPassport"} []
[2024-08-20T20:01:21.596982+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\CheckPassportEvent" to listener "Symfony\Component\Security\Http\EventListener\UserProviderListener::checkPassport". {"event":"Symfony\\Component\\Security\\Http\\Event\\CheckPassportEvent","listener":"Symfony\\Component\\Security\\Http\\EventListener\\UserProviderListener::checkPassport"} []
[2024-08-20T20:01:21.597074+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\CheckPassportEvent" to listener "Symfony\Component\Security\Http\EventListener\UserProviderListener::checkPassport". {"event":"Symfony\\Component\\Security\\Http\\Event\\CheckPassportEvent","listener":"Symfony\\Component\\Security\\Http\\EventListener\\UserProviderListener::checkPassport"} []
[2024-08-20T20:01:21.597159+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\CheckPassportEvent" to listener "Symfony\Component\Security\Http\EventListener\CsrfProtectionListener::checkPassport". {"event":"Symfony\\Component\\Security\\Http\\Event\\CheckPassportEvent","listener":"Symfony\\Component\\Security\\Http\\EventListener\\CsrfProtectionListener::checkPassport"} []
[2024-08-20T20:01:21.597245+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\CheckPassportEvent" to listener "Symfony\Component\Security\Http\EventListener\UserCheckerListener::preCheckCredentials". {"event":"Symfony\\Component\\Security\\Http\\Event\\CheckPassportEvent","listener":"Symfony\\Component\\Security\\Http\\EventListener\\UserCheckerListener::preCheckCredentials"} []
[2024-08-20T20:01:21.597327+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\CheckPassportEvent" to listener "Symfony\Component\Security\Http\EventListener\CheckCredentialsListener::checkPassport". {"event":"Symfony\\Component\\Security\\Http\\Event\\CheckPassportEvent","listener":"Symfony\\Component\\Security\\Http\\EventListener\\CheckCredentialsListener::checkPassport"} []
[2024-08-20T20:01:21.597411+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\CheckPassportEvent" to listener "Scheb\TwoFactorBundle\Security\Http\EventListener\CheckTwoFactorCodeListener::checkPassport". {"event":"Symfony\\Component\\Security\\Http\\Event\\CheckPassportEvent","listener":"Scheb\\TwoFactorBundle\\Security\\Http\\EventListener\\CheckTwoFactorCodeListener::checkPassport"} []
[2024-08-20T20:01:21.598424+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\AuthenticationTokenCreatedEvent" to listener "Scheb\TwoFactorBundle\Security\TwoFactor\Event\AuthenticationTokenListener::onAuthenticationTokenCreated". {"event":"Symfony\\Component\\Security\\Http\\Event\\AuthenticationTokenCreatedEvent","listener":"Scheb\\TwoFactorBundle\\Security\\TwoFactor\\Event\\AuthenticationTokenListener::onAuthenticationTokenCreated"} []
[2024-08-20T20:01:21.598757+00:00] app.DEBUG: Notified event "security.authentication.success" to listener "Scheb\TwoFactorBundle\Security\TwoFactor\Provider\TwoFactorProviderPreparationListener::onLogin". {"event":"security.authentication.success","listener":"Scheb\\TwoFactorBundle\\Security\\TwoFactor\\Provider\\TwoFactorProviderPreparationListener::onLogin"} []
[2024-08-20T20:01:21.598864+00:00] app.DEBUG: Notified event "security.authentication.success" to listener "Scheb\TwoFactorBundle\Security\TwoFactor\Event\AuthenticationSuccessEventSuppressor::onLogin". {"event":"security.authentication.success","listener":"Scheb\\TwoFactorBundle\\Security\\TwoFactor\\Event\\AuthenticationSuccessEventSuppressor::onLogin"} []
[2024-08-20T20:01:21.598955+00:00] app.DEBUG: Notified event "security.authentication.success" to listener "Symfony\Component\Security\Http\EventListener\UserCheckerListener::postCheckCredentials". {"event":"security.authentication.success","listener":"Symfony\\Component\\Security\\Http\\EventListener\\UserCheckerListener::postCheckCredentials"} []
[2024-08-20T20:01:21.599036+00:00] security.INFO: Authenticator successful! {"token":{"Symfony\\Component\\Security\\Http\\Authenticator\\Token\\PostAuthenticationToken":"PostAuthenticationToken(user=\"[email protected]\", roles=\"ROLE_PIMCORE_ADMIN\")"},"authenticator":"App\\Security\\SlackAuthenticator"} []
[2024-08-20T20:01:21.600400+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\LoginSuccessEvent" to listener "Symfony\Component\Security\Http\EventListener\SessionStrategyListener::onSuccessfulLogin". {"event":"Symfony\\Component\\Security\\Http\\Event\\LoginSuccessEvent","listener":"Symfony\\Component\\Security\\Http\\EventListener\\SessionStrategyListener::onSuccessfulLogin"} []
[2024-08-20T20:01:21.600512+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\LoginSuccessEvent" to listener "Symfony\Component\Security\Http\EventListener\LoginThrottlingListener::onSuccessfulLogin". {"event":"Symfony\\Component\\Security\\Http\\Event\\LoginSuccessEvent","listener":"Symfony\\Component\\Security\\Http\\EventListener\\LoginThrottlingListener::onSuccessfulLogin"} []
[2024-08-20T20:01:21.600601+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\LoginSuccessEvent" to listener "Symfony\Component\Security\Http\EventListener\PasswordMigratingListener::onLoginSuccess". {"event":"Symfony\\Component\\Security\\Http\\Event\\LoginSuccessEvent","listener":"Symfony\\Component\\Security\\Http\\EventListener\\PasswordMigratingListener::onLoginSuccess"} []
[2024-08-20T20:01:21.600707+00:00] app.DEBUG: Notified event "Symfony\Component\Security\Http\Event\LoginSuccessEvent" to listener "Scheb\TwoFactorBundle\Security\Http\EventListener\SuppressRememberMeListener::onSuccessfulLogin". {"event":"Symfony\\Component\\Security\\Http\\Event\\LoginSuccessEvent","listener":"Scheb\\TwoFactorBundle\\Security\\Http\\EventListener\\SuppressRememberMeListener::onSuccessfulLogin"} []
[2024-08-20T20:01:21.600789+00:00] security.DEBUG: The "App\Security\SlackAuthenticator" authenticator set the response. Any later authenticator will not be called {"authenticator":"App\\Security\\SlackAuthenticator"} []
[2024-08-20T20:01:21.605097+00:00] security.DEBUG: Stored the security token in the session. {"key":"_security_pimcore_admin"} []
[2024-08-20T20:01:21.676497+00:00] request.INFO: Matched route "pimcore_admin_index". {"route":"pimcore_admin_index","route_parameters":{"_route":"pimcore_admin_index","_controller":"Pimcore\\Bundle\\AdminBundle\\Controller\\Admin\\IndexController::indexAction"},"request_uri":"https://mesa.iwa.web.tr/admin/?_dc=1724184081&perspective=","method":"GET"} []
[2024-08-20T20:01:21.676764+00:00] app.DEBUG: Resolved pimcore context for path /admin/ to admin {"path":"/admin/","context":"admin"} []
[2024-08-20T20:01:21.678206+00:00] security.DEBUG: Checking for authenticator support. {"firewall_name":"pimcore_admin","authenticators":4} []
[2024-08-20T20:01:21.678348+00:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"pimcore_admin","authenticator":"App\\Security\\SlackAuthenticator"} []
[2024-08-20T20:01:21.678428+00:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"pimcore_admin","authenticator":"App\\Security\\SlackAuthenticator"} []
[2024-08-20T20:01:21.678497+00:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"pimcore_admin","authenticator":"Pimcore\\Bundle\\AdminBundle\\Security\\Authenticator\\AdminTokenAuthenticator"} []
[2024-08-20T20:01:21.678566+00:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"pimcore_admin","authenticator":"Pimcore\\Bundle\\AdminBundle\\Security\\Authenticator\\AdminTokenAuthenticator"} []
[2024-08-20T20:01:21.678649+00:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"pimcore_admin","authenticator":"Scheb\\TwoFactorBundle\\Security\\Http\\Authenticator\\TwoFactorAuthenticator"} []
[2024-08-20T20:01:21.678754+00:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"pimcore_admin","authenticator":"Scheb\\TwoFactorBundle\\Security\\Http\\Authenticator\\TwoFactorAuthenticator"} []
[2024-08-20T20:01:21.678826+00:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"pimcore_admin","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\FormLoginAuthenticator"} []
[2024-08-20T20:01:21.678895+00:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"pimcore_admin","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\FormLoginAuthenticator"} []
[2024-08-20T20:01:21.683336+00:00] security.DEBUG: Access denied, the user is not fully authenticated; redirecting to authentication entry point. {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\AccessDeniedException(code: 403): Access Denied. at /var/www/iwapim/vendor/symfony/security-http/Firewall/AccessListener.php:87)"} []

[developkariyer]

Sorry, moving to Q&A