{"action":"created","issue":{"url":"https://api.github.com/repos/Maks3w/FR3DLdapBundle/issues/76","labels_url":"https://api.github.com/repos/Maks3w/FR3DLdapBundle/issues/76/labels{/name}","comments_url":"https://api.github.com/repos/Maks3w/FR3DLdapBundle/issues/76/comments","events_url":"https://api.github.com/repos/Maks3w/FR3DLdapBundle/issues/76/events","html_url":"https://github.com/Maks3w/FR3DLdapBundle/issues/76","id":53398621,"number":76,"title":"No chaining provider and no persisted entities - auth workflow locks LDAP account","user":{"login":"Saaha","id":10400904,"avatar_url":"https://avatars.githubusercontent.com/u/10400904?v=3","gravatar_id":"","url":"https://api.github.com/users/Saaha","html_url":"https://github.com/Saaha","followers_url":"https://api.github.com/users/Saaha/followers","following_url":"https://api.github.com/users/Saaha/following{/other_user}","gists_url":"https://api.github.com/users/Saaha/gists{/gist_id}","starred_url":"https://api.github.com/users/Saaha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Saaha/subscriptions","organizations_url":"https://api.github.com/users/Saaha/orgs","repos_url":"https://api.github.com/users/Saaha/repos","events_url":"https://api.github.com/users/Saaha/events{/privacy}","received_events_url":"https://api.github.com/users/Saaha/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-01-05T14:03:15Z","updated_at":"2015-01-06T08:00:30Z","closed_at":null,"body":"Hello there,\r\n\r\nFirst, sorry of my writing, I'll do my best.\r\nI created an application which uses **FR3DLdapBundle** for authentication. The initial need it's to NOT persist the user in DB and reload him directly from LDAP database on each request (that's the bundle does). The goal it's to not duplicate the LDAP DB in a web app. \r\nIn that way, the documentation told me that you can disable the chaining provider with FOS to avoid persistance, so I did. I just override the *LdapManager* for return a personnal instance of *User* when the method *createUser* is called by the LdapManager. \r\n\r\n```php\r\nnamespace NameSpace\\SecurityBundle\\Security\\User;\r\nuse FR3D\\LdapBundle\\Model\\UserManagerInterface;\r\nuse NameSpace\\SecurityBundle\\Entity\\User;\r\n\r\nclass UserManager implements UserManagerInterface {\r\n\tpublic function createUser() {\r\n\t\treturn new User();\r\n\t}\r\n}\r\n ```\r\n\r\nNext, my issue. In the process of authentication (tell me if I get wrong), the user is searched in LDAP as : `$user = $this->userProvider->loadUserByUsername($username);` in *LDAPAuthenticationProvider*. The first time, no session token exists, then the *User* is created, hydrated and binded to LDAP to determine if ID are corrects. \r\n\r\n```php\r\nif (!$this->ldapManager->bind($user, $presentedPassword)) {\r\n     throw new BadCredentialsException('The presented password is invalid.');\r\n}\r\n```\r\nIt's ok for me. But when Symfony redirects, for instance, to home page after successfully authentication, the *User* is re-searched in LDAP, the token is re-created from *UserAuthenticationProvider* in method *authenticate*  but while my entity is not persited, the password do not exist any longer and *bind* method will failed. In result, the account is locked in my LDAP DB, not good ! The method `checkAuthtication` there, `$currentUser->getPassword()` is *null* (I tried `$token->getCredentials()` as mentionned in other issue).\r\n```php\r\nprotected function checkAuthentication(UserInterface $user, UsernamePasswordToken $token)\r\n{\r\n        $currentUser = $token->getUser();\r\n        if ($currentUser instanceof UserInterface) {\r\n            if (!$this->ldapManager->bind($currentUser, $currentUser->getPassword())) {\r\n                throw new BadCredentialsException('The credentials were changed from another session.');\r\n            }\r\n        } else { ... }\r\n}\r\n```\r\n\r\nSo what am I missing ? \r\nIs there a way to keep credentials in session to revalid bind when *User* naviguate ? It seems, the bundle doest not cover this case ?\r\n\r\nI tried many (many !) debug with *var_dump* in Symfony components, bundle to analyse the behavior. I could precise any point if needed (but not the solution : ))"},"comment":{"url":"https://api.github.com/repos/Maks3w/FR3DLdapBundle/issues/comments/68836580","html_url":"https://github.com/Maks3w/FR3DLdapBundle/issues/76#issuecomment-68836580","issue_url":"https://api.github.com/repos/Maks3w/FR3DLdapBundle/issues/76","id":68836580,"user":{"login":"Saaha","id":10400904,"avatar_url":"https://avatars.githubusercontent.com/u/10400904?v=3","gravatar_id":"","url":"https://api.github.com/users/Saaha","html_url":"https://github.com/Saaha","followers_url":"https://api.github.com/users/Saaha/followers","following_url":"https://api.github.com/users/Saaha/following{/other_user}","gists_url":"https://api.github.com/users/Saaha/gists{/gist_id}","starred_url":"https://api.github.com/users/Saaha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Saaha/subscriptions","organizations_url":"https://api.github.com/users/Saaha/orgs","repos_url":"https://api.github.com/users/Saaha/repos","events_url":"https://api.github.com/users/Saaha/events{/privacy}","received_events_url":"https://api.github.com/users/Saaha/received_events","type":"User","site_admin":false},"created_at":"2015-01-06T08:00:30Z","updated_at":"2015-01-06T08:00:30Z","body":"`$token->getCredentials()` return the password filled by the user while the process of authentication starts (before redirect). I actually tried to replace `$currentUser->getPassword()` by `$token->getCredentials()` but no changes. I my opinion the problem is deeper in the process."}}