IBX-8356: Reworked Ibexa\Core\MVC\Symfony\Security\Authentication\AuthenticatorInterface usages to comply with Symfony-based authentication

[konradoboza]

🎫 Issue	IBX-8356

Related PRs:

• IBX-8356: Reworked JWT GraphQL firewall configuration to comply with Symfony-based authentication recipes-dev#124
• IBX-8356: Removed Ibexa\Core\MVC\Symfony\Security\Authentication\AuthenticatorInterface to be replaced with Symfony-based authentication core#375

Description:

After going through multiple approaches we realized that Authentication mutation should not authenticate user. Instead we simply compare credentials without any security voodoo at this point and return newly generated JWT Token. From now on, it can be used as Authorization: Bearer <token_here> header to perform any operations in Ibexa Repository.

Example query:
Generating token via GraphQL mutation (fully backwards compatible with what it was before):

mutation CreateToken {
  createToken(username: "admin", password: "publish") {
    token
    message
  }
}

produces:

{
  "data": {
    "createToken": {
      "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MTkzMTk2MjIsImV4cCI6MTcxOTMyMzIyMiwicm9sZXMiOltdLCJ1c2VybmFtZSI6ImFkbWluIn0.PCPl-PhXU2RYEOSyr13usg4D_NyqijBt4CMO9smTpHU",
      "message": null
    }
  }
}

Then use the token as in:

curl -H "Content-Type: application/json" -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MTkzMTk2MjIsImV4cCI6MTcxOTMyMzIyMiwicm9sZXMiOltdLCJ1c2VybmFtZSI6ImFkbWluIn0.PCPl-PhXU2RYEOSyr13usg4D_NyqijBt4CMO9smTpHU' --data @json.json http://localhost:8001/graphql

where json.json file might contain some query (to increase readability):

{
    "query": "mutation {createFolder(language: eng_GB, parentLocationId: 2, input: {name: \"ddd\"}) {id}}"
}

Response should look mor or less as follows:

{"data":{"createFolder":{"id":"RG9tYWluQ29udGVudDo="}}}

For QA:

All related to JWT in GraphQL needs to be checked.

Documentation:

We should probably mention dropped code even though query and their responses are the same.

[adamwojs]

@konradoboza Could you please provide example of request with authentication using JWT?

[konradoboza]

@adamwojs since you cannot perform such queries via GraphiQL client (no way to specify additional headers), the only way is to make a cURL request with Authorization: Bearer <here_goes_your_jwt_token> formatted header. Unfortunately, I discovered some issues here, so making this one as work in progress again. For your reference I give some example query below:

curl -H "Content-Type: application/json" -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MTkyMTY5MzEsImV4cCI6MTcxOTIyMDUzMSwicm9sZXMiOlsiUk9MRV9VU0VSIl0sInVzZXJuYW1lIjoiYWRtaW4ifQ.VZp7Hs6p9qg_xWEJZVXz0PlAwjmUr87hCS_56Z05eBU' --data '{"query": "mutation {createFolder(language: eng_GB, parentLocationId: 2, input: {name: \"test folder\"}) {id}}"} ' localhost:8003/graphql

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud