Don’t hand out token to disabled/locked users

[ddeboer]

PR #277 added preAuth checks so disabled and locked users are now properly denied authentication.

However, these checks only apply after the user has received an OAuth token. So disabled/locked users are still able to retrieve an OAuth token (through password grant type). I think the OAuth server should not hand out tokens to such users. So does it make sense to add the UserChecker to checkUserCredentials too? If you agree, I can open up a PR for this.

[codemedic]

Please can this PR be reviewd.... it will be a great addition to the bundle! I have been looking around for a similar functionality.

[abulford]

I agree that this should be the behaviour and would welcome its implementation. I'd be happy to submit a PR if you've not already made the changes yourself, @ddeboer, and there's agreement that this functionality should be implemented.

[ddeboer]

@abulford I wanted to wait for a go from (some of) the bundle maintainers before doing any further work, but please go ahead and submit your PR. We can then structure any disagreements around your PR.

[abulford]

OK, well I'm on holiday at the moment until Tuesday week, so will look in to putting something together when I get back. I'm obviously also very happy for one of the bundle maintainers to have a go, though!

[aitboudad]

Hi, Any news about this, in this case should I throw OAuth2AuthenticateException or just returning false ?

[karolsojko]

+1 - having the same problem

[dadamssg]

+1

[hlecorche]

+1

[mkosiedowski]

+1 any news about this issue?

[abstractk]

+1

[thomas2411]

+1

[ThomasBerends]

@ddeboer @abulford Is there any news on this? We've just discovered this in one of our API's and are figuring out how to fix this. A solution in FOSOAuthServerBundle itself would of course be very welcome.

[maltehuebner]

+1

[ziobudda]

Any news about this problem ?

[t3ran13]

+1

[Kubitini]

+1

[fabsalito]

Any news on this? +1

[sukhrobkhakimov]

I think we can create a custom user provider and add checks there. This is a workaround until we have a better solution from the maintainers.

// config.yml
fos_oauth_server:
    ....
    service:
        user_provider: %your_service_name_here%

// Custom UserProvider
public function loadUserByUsername($username)
{
    $repository = $this->entityManager->getRepository('YourBundle:User');
    $user = $repository->fetchActiveByUsername($username);

    if (!$user || !$user->isEnabled() || $user->isBlocked()) {
        throw new UsernameNotFoundException($this->translator->trans('user.not_found'));
    }

    return $user;
}

[pzienowicz]

+1

[patrykzurawik]

+1

[alfons56]

+1

[glennthehuman]

@abulford OK, well I'm on holiday at the moment until Tuesday week, so will look in to putting something together when I get back. I'm obviously also very happy for one of the bundle maintainers to have a go, though!

Did you ever come back from that holiday?

[soorajlv]

Any update on this issue? Is there any way we can prevent the user from getting the token other than custom user providers?