Pimcore 11.3 Slack SSO登录后无法跳转Admin UI认证问题

问题背景 #

使用Pimcore 11.3版本实现Slack登录SSO机制，基于AbstractAuthenticator完成的认证逻辑已正常运行，但无法被Pimcore Admin UI识别。

已完成操作 #

• 创建自定义Bundle并覆盖login.html.twig模板，添加“通过Slack登录”按钮，功能正常
• 继承AbstractAuthenticator编写SlackAuthenticator类，实现Slack OAuth2相关逻辑，功能正常
• 创建与Slack用户邮箱匹配的Pimcore用户，测试时日志显示邮箱匹配正常，onAuthenticationSuccess方法已被调用

当前问题 #

完成Slack认证跳转至Pimcore Admin UI时，页面提示Full authentication is required to access this resource.，无法正常进入后台。

相关配置代码 #

security.yaml配置 #

security:
    enable_authenticator_manager: true

    providers:
        pimcore_admin:
            id: Pimcore\Security\User\UserProvider

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        # Pimcore WebDAV HTTP basic // DO NOT CHANGE!
        pimcore_webdav:
            pattern: ^/asset/webdav
            provider: pimcore_admin
            http_basic: ~

        # Slack OAuth Firewall
        slack_oauth:
            pattern: ^/slack/callback$
            provider: pimcore_admin
            stateless: false
            custom_authenticator: App\Security\SlackAuthenticator

        # Pimcore Admin Bundle firewall
        pimcore_admin: '%pimcore_admin_bundle.firewall_settings%'

    access_control:
        # Pimcore admin ACl  // DO NOT CHANGE!
        - { path: ^/admin/settings/display-custom-logo, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/2fa-verify, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login/2fa-setup, roles: ROLE_PIMCORE_USER }
        - { path: ^/admin/login/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login$, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/(login|lostpassword|deeplink|csrf-token)$, roles: PUBLIC_ACCESS }
        - { path: ^/admin, roles: ROLE_PIMCORE_USER }
        - { path: ^/asset/webdav, roles: ROLE_PIMCORE_USER }
        - { path: ^/slack/callback$, roles: PUBLIC_ACCESS }
        - { path: ^/slack/login, roles: PUBLIC_ACCESS }

    role_hierarchy:
        # Pimcore admin  // DO NOT CHANGE!
        ROLE_PIMCORE_ADMIN: [ROLE_PIMCORE_USER]

SlackAuthenticator代码 #

// 为了可读性移除了部分判断逻辑
class SlackAuthenticator extends AbstractAuthenticator
{
    private $httpClient;
    private $urlGenerator;
    private $userProvider;

    public function __construct(PimcoreHttpClient $httpClient,UrlGeneratorInterface $urlGenerator,UserProviderInterface $userProvider,
    ) {
        $this->httpClient = $httpClient;
        $this->urlGenerator = $urlGenerator;
        $this->userProvider = $userProvider;
    }

    public function supports(Request $request): ?bool
    {
        return ($request->getPathInfo() === '/slack/callback' && $request->isMethod('GET'));
    }
    
    public function authenticate(Request $request): Passport
    {
        $code = $request->query->get('code');
        $response = $this->httpClient->post('https://slack.com/api/oauth.v2.access', [
            'form_params' => [
                'client_id' => $_SERVER['SLACK_CLIENT_ID'],
                'client_secret' => $_SERVER['SLACK_CLIENT_SECRET'],
                'code' => $code,
                'redirect_uri' => $this->urlGenerator->generate('slack_callback', [], UrlGeneratorInterface::ABSOLUTE_URL),
            ],
        ]);
        $data = json_decode($response->getBody(), true);
        $accessToken = $data['authed_user']['access_token'] ?? null;
        $user_id = $data['authed_user']['id'] ?? null;
        $response = $this->httpClient->get('https://slack.com/api/users.info', [
            'headers' => [
                'Authorization' => "Bearer {$_SERVER['SLACK_BOT_USER_OAUTH_TOKEN']}",
            ],
            'query' => [
                'user' => $user_id,
            ],
        ]);
        $userData = json_decode($response->getBody(), true);
        $email = $userData['user']['profile']['email'] ?? null;
        $user = $this->userProvider->loadUserByIdentifier($email);
        return new SelfValidatingPassport(new UserBadge($email, function () use ($user) {
            return $user;
        }));
    }

    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
    {
        return new RedirectResponse($this->urlGenerator->generate('pimcore_admin_index'));
    }

    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
    {
        return new RedirectResponse($this->urlGenerator->generate('pimcore_admin_login'));
    }
}

解决方案 #

问题核心是：独立的slack_oauth防火墙与Pimcore Admin防火墙会话不共享，Slack认证生成的会话仅在slack_oauth上下文生效，跳转至Admin后无法被识别。

修改步骤 #

1. 合并防火墙配置：移除独立的slack_oauth防火墙，将Slack认证器直接添加到pimcore_admin防火墙中
2. 调整访问规则顺序：将Slack相关路径的访问规则移至Admin路径规则之前，确保优先匹配

修改后的security.yaml配置：

security:
    enable_authenticator_manager: true

    providers:
        pimcore_admin:
            id: Pimcore\Security\User\UserProvider

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        # Pimcore WebDAV HTTP basic // DO NOT CHANGE!
        pimcore_webdav:
            pattern: ^/asset/webdav
            provider: pimcore_admin
            http_basic: ~

        # Pimcore Admin Bundle firewall
        pimcore_admin: '%pimcore_admin_bundle.firewall_settings%'
            custom_authenticators:
                - App\Security\SlackAuthenticator

    access_control:
        # Pimcore admin ACl  // DO NOT CHANGE!
        - { path: ^/admin/settings/display-custom-logo, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/2fa-verify, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login/2fa-setup, roles: ROLE_PIMCORE_USER }
        - { path: ^/admin/login/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login$, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/(login|lostpassword|deeplink|csrf-token)$, roles: PUBLIC_ACCESS }
        - { path: ^/slack/callback$, roles: PUBLIC_ACCESS }
        - { path: ^/slack/login, roles: PUBLIC_ACCESS }
        - { path: ^/admin, roles: ROLE_PIMCORE_USER }
        - { path: ^/asset/webdav, roles: ROLE_PIMCORE_USER }

    role_hierarchy:
        # Pimcore admin  // DO NOT CHANGE!
        ROLE_PIMCORE_ADMIN: [ROLE_PIMCORE_USER]

调整认证器支持范围 #

修改SlackAuthenticator的supports方法，确保在Admin防火墙上下文下能正确识别Slack相关请求：

public function supports(Request $request): ?bool
{
    return str_starts_with($request->getPathInfo(), '/slack/') && $request->isMethod('GET');
}

修改后，Slack认证的会话将直接在Admin防火墙上下文创建，跳转后Admin UI可正常识别登录状态。

内容的提问来源于stack exchange，提问作者Umut Demirhan