feat: Initial SSO support with hwi/oauth-bundle

composer.json

@@ -34,6 +34,7 @@
         "gregwar/captcha-bundle": "^2.4",
         "hidehalo/nanoid-php": "^1.1",
         "html2text/html2text": "*",
+        "hwi/oauth-bundle": "2.*",
         "incenteev/composer-parameter-handler": "^2.0",
         "intervention/image": "^2.4",
         "jfcherng/php-levenshtein-distance": "*",

config/bundles.php

@@ -24,4 +24,5 @@
     Nelmio\SecurityBundle\NelmioSecurityBundle::class => ['all' => true],
     BabDev\PagerfantaBundle\BabDevPagerfantaBundle::class => ['all' => true],
     Stof\DoctrineExtensionsBundle\StofDoctrineExtensionsBundle::class => ['all' => true],
+    HWI\Bundle\OAuthBundle\HWIOAuthBundle::class => ['all' => true],
 ];

config/packages/hwi_oauth.yaml

@@ -0,0 +1,9 @@
+# config/packages/hwi_oauth.yaml
+
+hwi_oauth:
+    resource_owners:
+        any_name:
+            type:                github
+            client_id:           <client_id>
+            client_secret:       <client_secret>
+            scope:               'user:email,public_repo'

config/packages/security.yaml

@@ -46,11 +46,23 @@ security:
             # https://symfony.com/doc/current/security/impersonating_user.html
             # switch_user: true
 
+            pattern: ^/
+            oauth:
+                resource_owners:
+                    my_github:          "/login/check-github"
+                login_path:   /login
+                use_forward:  false
+                failure_path: /login
+
+                oauth_user_provider:
+                    service: my.oauth_aware.user_provider.service
+
     # Easy way to control access for large sections of your site
     # Note: Only the *first* access control that matches will be used
     access_control:
         - { path: ^/$, roles: PUBLIC_ACCESS }
         - { path: ^/login, roles:  PUBLIC_ACCESS }
+        - { path: ^/connect, roles: PUBLIC_ACCESS }
         - { path: ^/about, roles:  PUBLIC_ACCESS }
         - { path: ^/donate, roles:  PUBLIC_ACCESS }
         - { path: ^/donation, roles:  PUBLIC_ACCESS }

config/routes.yaml

@@ -7,3 +7,18 @@ controllers:
 legacy:
     resource: .
     type:     legacy
+
+hwi_oauth_redirect:
+    resource: "@HWIOAuthBundle/Resources/config/routing/redirect.php"
+    prefix:   /connect
+
+hwi_oauth_connect:
+    resource: "@HWIOAuthBundle/Resources/config/routing/connect.php"
+    prefix:   /connect
+
+hwi_oauth_login:
+    resource: "@HWIOAuthBundle/Resources/config/routing/login.php"
+    prefix:   /login
+
+github_login:
+    path: /login/check-github

config/routes/hwi_oauth_routing.yaml

@@ -0,0 +1,11 @@
+hwi_oauth_redirect:
+    resource: "@HWIOAuthBundle/Resources/config/routing/redirect.php"
+    prefix:   /connect
+
+hwi_oauth_connect:
+    resource: "@HWIOAuthBundle/Resources/config/routing/connect.php"
+    prefix:   /connect
+
+hwi_oauth_login:
+    resource: "@HWIOAuthBundle/Resources/config/routing/login.php"
+    prefix:   /login

config/services.yaml

@@ -447,6 +447,12 @@ services:
         class: App\Model\MockupProvider\ProfileMockups
         tags: [ 'app.mockup_provider' ]
 
+    hwi_oauth.user.provider.entity:
+        class: HWI\Bundle\OAuthBundle\Security\Core\User\EntityUserProvider
+        arguments:
+            $class: App\Entity\Member
+            $properties:
+                'github': 'github'
+
     App\Form\DataTransformer\LocationRequestToLocationTransformer: ~
     App\Form\DataTransformer\DateTransformer: ~
-

src/Kernel.php

@@ -8,4 +8,11 @@
 class Kernel extends BaseKernel
 {
     use MicroKernelTrait;
+
+    public function registerBundles()
+    {
+        $bundles = [
+            new HWI\Bundle\OAuthBundle\HWIOAuthBundle(),
+        ];
+    }
 }

symfony.lock

@@ -219,6 +219,19 @@
     "html2text/html2text": {
         "version": "4.3.1"
     },
+    "hwi/oauth-bundle": {
+        "version": "2.4",
+        "recipe": {
+            "repo": "github.com/symfony/recipes-contrib",
+            "branch": "main",
+            "version": "2.0",
+            "ref": "20154480d558409ad3eb9de3644817c81fad2268"
+        },
+        "files": [
+            "config/packages/hwi_oauth.yaml",
+            "config/routes/hwi_oauth_routing.yaml"
+        ]
+    },
     "incenteev/composer-parameter-handler": {
         "version": "v2.1.4"
     },

templates/security/login.html.twig

@@ -184,6 +184,9 @@
                                         class="o-button o-button--full">{{ 'indexpageloginsubmit' | trans }}</button>
                             </div>
                         </form>
+                        <a href="{{ path('hwi_oauth_service_redirect', {'service': 'github' }) }}">
+                            <span>Login with SSO</span>
+                        </a>
                     </div>
                     <div class="card o-card">
                         <div class="card-body p-2">