Symfony2自定义密码编码器(bcrypt)

Question

我编写了自己的密码编码器,它实现了PasswordEncoderInterface:

class BCryptPasswordEncoder implements PasswordEncoderInterface {
    protected $encoder;

    public function __construct(BCryptEncoder $encoder) {
        $this->encoder = $encoder;
    }

    public function encodePassword($raw, $salt) {
        return $this->encoder->encodeString($raw, $salt);
    }

    public function isPasswordValid($encoded, $raw, $salt) {
        return $this->encoder->encodeString($raw, $salt) == $encoded;
    }
}

编码器注册为具有id的服务bcrypt.password.encoder.但我不知道,如何告诉symfony使用它.目前app/config/security.yml看起来像这样:

security:
    encoders:
        Symfony\Component\Security\Core\User\User: plaintext

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

    providers:
        neo4j:
          id: security.user.provider.neo4j
    firewalls:
        dev:
            pattern:  ^/(_(profiler|wdt)|css|images|js)/
            security: false
        secured_area:
            provider: neo4j
            pattern:    ^/.*
            form_login:
                check_path: /login_check
                login_path: /login
            logout:
                path:   /logout
                target: /
            anonymous: ~
    access_control:
        - { path: ^/login, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/.*, role: ROLE_ADMIN }

顺便说一下,我没有使用任何学说实体.

编辑:Symfony\Component\Security\Core\User\User是我的UserObject.我修改security.yml了一下:

encoders:
    Symfony\Component\Security\Core\User\User: 
        id: bcrypt.password.encoder

这会导致致命错误:

Catchable Fatal Error: Argument 1 passed to EMC3\Bundle\UserBundle\Neo4jUserProvider::__construct() must be an instance of EMC3\Bundle\UserBundle\UserManager, instance of EMC3\Bundle\UserBundle\BCryptEncoder given, called in /var/www/emc3/app/cache/dev/appDevDebugProjectContainer.php on line 227 and defined in /var/www/emc3/src/EMC3/Bundle/UserBundle/Neo4jUserProvider.php line 29

这对我没有任何意义.

Answer 1

从Symfony 2.2开始,BCrypt 本机支持,因此您可以轻松配置它:

security:
    encoders:
        Symfony\Component\Security\Core\User\User:
            algorithm: bcrypt
            cost: 7

如果你有足够快的服务器,你可能想要调高成本.

Answer 2

截至2011年11月,在Symfony 2.2之前,这不是直接支持的.

相反,重新发明轮子,我建议你使用河豚密码编码器管束我写的(ElnurBlowfishPasswordEncoderBundle),它解决了同样的问题.或者,至少,你可以看到它是如何实现的.

如果您使用的是Symfony 2.2或更高版本,请参阅Seldaek的配置说明.