escapestudios/EscapeWSSEAuthenticationBundle — pull request #55 by xelaris (2014-12-05 00:16:51+00:00)
Title: Enable specific provider for WSSE authentication.

This pull request adds the 'provider' configuration node, to use a specific provider for WSSE authentication. See example at http://symfony.com/doc/current/book/security.html#using-multiple-user-providers, where a specific provider is used for http_basic authentication.

The configuration is utilized by \Symfony\Bundle\SecurityBundle\DependencyInjection\SecurityExtension::createAuthenticationListeners() (line 399 in SF 2.6.1)

$userProvider = isset($firewall[$key]['provider']) ? $this->getUserProviderId($firewall[$key]['provider']) : $defaultProvider;

E.g. this configuration node is added by \Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AbstractFactory for form based authentication (FormLoginFactory and SimpleFormFactory) and by HttpBasicFactory.

Since the password for WSSE has to be stored unhashed, as against to other authentication mechanisms like http basic, the same user provider can not be used for both mechanisms and thus it would be worthwhile to separate the providers.