Prevent empty userIdentifier

Author: ajgarlag

src/Security/Authenticator/OAuth2Authenticator.php

@@ -16,6 +16,8 @@
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\User\AttributesBasedUserProviderInterface;
+use Symfony\Component\Security\Core\User\ChainUserProvider;
 use Symfony\Component\Security\Core\User\UserInterface;
 use Symfony\Component\Security\Core\User\UserProviderInterface;
 use Symfony\Component\Security\Http\Authenticator\AuthenticatorInterface;
@@ -70,6 +72,14 @@ public function authenticate(Request $request): Passport
 
         /** @var string $userIdentifier */
         $userIdentifier = $psr7Request->getAttribute('oauth_user_id', '');
+        if ('' === $userIdentifier) {
+            /**
+             * BC layer for Symfony < 8.0
+             */
+            if (is_a(ChainUserProvider::class, AttributesBasedUserProviderInterface::class, true)) {
+                throw OAuth2AuthenticationFailedException::create('The access token has either an empty or missing "oauth_user_id" attribute.');
+            }
+        }
 
         /** @var string $accessTokenId */
         $accessTokenId = $psr7Request->getAttribute('oauth_access_token_id');
@@ -81,7 +91,10 @@ public function authenticate(Request $request): Passport
         $oauthClientId = $psr7Request->getAttribute('oauth_client_id', '');
 
         $userLoader = function (string $userIdentifier) use ($oauthClientId): UserInterface {
-            if ('' === $userIdentifier || $oauthClientId === $userIdentifier) {
+            if (
+                $oauthClientId === $userIdentifier
+                || ('' === $userIdentifier && is_a(ChainUserProvider::class, AttributesBasedUserProviderInterface::class, true)) // BC layer for Symfony < 8.0
+            ) {
                 return new ClientCredentialsUser($oauthClientId);
             }
 

tests/Unit/OAuth2AuthenticatorTest.php

@@ -97,6 +97,8 @@ public function testAuthenticateCreatePassportWithClientCredentialsUser(): void
     {
         $serverRequest = (new ServerRequest('GET', '/foo'))
             ->withAttribute('oauth_access_token_id', 'accessTokenId')
+            ->withAttribute('oauth_user_id', 'clientId')
+            ->withAttribute('oauth_client_id', 'clientId')
         ;
 
         $httpMessageFactory = $this->createMock(HttpMessageFactoryInterface::class);