如何从Symfony2应用程序获取第三方应用程序会话数据？

Question

In order to implement cross application authentication (getting logged in in my Symfony2 app if the user already logged in in an other application), I made a Symfony2 listener class that checks if specific data concerning the user is in the session. This data comes from a non-Symfony2 (but PHP) app.

The problem is that the session data from the other app is not present in the session object I use in my class.

Here is the listener (simplified) class:

<?php
class OldAppAuthenticationListener
{
    /** @var \Symfony\Component\Security\Core\SecurityContext */
    private $context;

    public function __construct(SecurityContext $context)
    {
        $this->context = $context;
    }

    public function onKernelRequest(GetResponseEvent $event)
    {
        if (HttpKernel::MASTER_REQUEST != $event->getRequestType()) {
            // don't do anything if it's not the master request
            return;
        }

        if (!$this->context->isGranted('IS_AUTHENTICATED_FULLY')) {
            $request = $event->getRequest();
            $session = $request->getSession();

            $userName = $session->get('nomUtilisateur');

            $token = new PreAuthenticatedToken($userName, null, 'secured_area', array('ROLE_USER'));

            $session->set('_security_secured_area',  serialize($token));
        }
    }
}

It is registered in services.yml like this:

services:
    my_app.listener.old_app_authentication:
        class: Acme\MyAppBundle\Listener\MyAppAuthenticationListener
        arguments: ["@security.context"]
        tags:
            - { name: kernel.event_listener, event: kernel.request }

But the $session->get('nomUtilisateur') always returns NULL (and $session->all() and $_SESSION only return some Symfony2 specific vars) although the other app stores all this data in the session.

Of course, I use the same cookie session domain for both apps (as configured in config.yml) and I can easily check that the PHPSESSID is the same.

So here is my question: why are the old app session variables not available and how can I get them from my listener class?

Answer 1

As stated here , Symfony2 uses session bags to store session stuff. This means that you have to directly access the $_SESSION superglobal for such a functionality.

Answer 2

For me the solution was to use directly the php session fonctions. also I had to check if session name, domain and save path are the same on both applications.

In my symfony I had to add:
session_save_path('c:/wamp/tmp');
session_name(_SESSION_ID_);
session_start();
and then use $_SESSION

an other way that was given to me, but I didn't use is to use the sessions files directly like this:

"The trick was using the session cookie sent by the browser.

For example, an old web application, written in PHP, sent a cookie called IntranetSession to the browser. As I knew where does PHP store the session files, I simply opened that file, and decoded its contents with session_decode(). The drawbacks of this is that session_decode() puts its output directly into $_SESSION, overwriting you current session data (even the stuff put there by Symfony). Basically the rule is as follows:

$sessionData = file_get_contents($sessionFile);<br>
$tmpSess = $_SESSION;<br>
session_decode($sessionData);<br>
$otherAppSession = $_SESSION;<br>
$_SESSION = $tmpSess;<br>

"

hope this helps!