Faking authentication on Symfony2 tests - get('security.context')->getToken() on Controller returns differnt token than the one set up in the TestCase

Question

I'm writing symfony functional tests for a Symfony 2.0 application that uses the FOSFacebookBundle (v2.0). The controllers I'm testing check for authentication like so:

if($this->get('security.context')->isGranted('IS_AUTHENTICATED_FULLY')){...}

So I need the test's $client (of type Symfony\Bundle\FrameworkBundle\Client) to be authenticated.

Supposedly I need to create a valid token and set it on the $client's security.context, session, and cookieJar for $client to be authenticated, right?

The issue is that the security.context in the controllers return a different token from the valid one I set up on the test's $client.

Does anyone know why the token gets reset after making the request?

Here's how I'm setting this up in the test case class:

use FOS\FacebookBundle\Security\Authentication\Provider\FacebookProvider;
use FOS\FacebookBundle\Security\Authentication\Token\FacebookUserToken;
use Symfony\Component\BrowserKit\Cookie;

$providerKey = 'public';

$facebookMock = $this->getMockBuilder('\Facebook')
    ->disableOriginalConstructor()
    ->getMock();
$facebookMock->expects($this->once())
    ->method('getUser')
    ->will($this->returnValue('DevTestUsername'));

$facebookProvider = new FacebookProvider($providerKey, $facebookMock);

$tokenMock = new FacebookUserToken(
    'public', 
    'DevTestUsername', 
    array('ROLE_MEMBER', 'ROLE_MANAGER', 'ROLE_USER')
);

$authenticatedToken = $facebookProvider->authenticate($tokenMock);

$client->getContainer()->get('security.context')->setToken($authenticatedToken);
$client->getContainer()->get('session')->set('_security_public', serialize($authenticatedToken));
$client->getContainer()->get('session')->save();

$client->getCookieJar()->set(new Cookie(session_name(), $client->getContainer()->get('session')->getId()));

After this setup, on the test case this returns true:

if($client->getContainer()->get('security.context')->isGranted('IS_AUTHENTICATED_FULLY')){...}

But on the controllers, it returns false

if($this->get('security.context')->isGranted('IS_AUTHENTICATED_FULLY')){...}

Am I setting up things wrong in the security.context or in the session?

Here's the application's security config:

security:
    factories:
        - "%kernel.root_dir%/../vendor/bundles/FOS/FacebookBundle/Resources/config/security_factories.xml"

    encoders:
        FOS\UserBundle\Model\UserInterface: sha512

    role_hierarchy:
        ROLE_ADMIN:       [ROLE_USER, ROLE_ALLOWED_TO_SWITCH]
        ROLE_SUPER_ADMIN: [ROLE_ADMIN]

    providers:
        chain_provider:
            providers: [fos_userbundle, facebook_provider]
        fos_userbundle:
            id: fos_user.user_manager
        facebook_provider:
            id: facebook.user

    firewalls:
        public:
            pattern:   ^/.*
            fos_facebook:
                provider: facebook_provider
                app_url: "http://apps.facebook.com/myapp"
                server_url: "http://myapp.local/"
                login_path: /login
                check_path: /login_check
                default_target_path: /target
            form_login:
                provider: fos_userbundle
                csrf_provider: form.csrf_provider
                login_path: /login
                check_path: /login_check
            anonymous: true
            switch_user: { role: ROLE_ADMIN }
            logout:
                target: http://myapp.com
                handlers: ["fos_facebook.logout_handler"]
            context: primary_auth

The facebook.id service is a class that implements the Symfony\Component\Security\Core\User\UserProviderInterface

This class uses facebook's php api (BaseFacebook class) to make a call to the facebook graph api (BaseFacebook->api('/me')), but this never happens, as I don't get past Symfony's security.

Any comments, pointers or links to resources greatly appreciated. Thanks!

Answer 1

The issue is a bug in Symfony 2.0

I noticed that $this->contextKey equals 'primary_auth' inside method: \Symfony\Component\Security\Http\Firewall\ContextListener::handle(GetResponseEvent $event)

so in my test suite I do:

$client->getContainer()->get('session')->set('_security_primary_auth', serialize($authenticatedToken));

instead of

$client->getContainer()->get('session')->set('_security_public', serialize($authenticatedToken));

(this issue is documented here: https://github.com/symfony/symfony/issues/5228 (read the whole thing))

Answer 2

Maybe the easiest way is to start by opening a dev account on Facebook, then go to the dev website. On top of it, you'll find tools. One of them is the "token debugger". It can create token for you. You can also copy-paste one of the token you get with your call, and the tool will display the content of the token.

It's usefull to understand what's happening and to see if the token you get has the value you think it has.