跨域场景下如何实现Symfony应用复用另一Symfony应用的认证与授权机制？

首先明确：你的方案完全可行！这是典型的集中式认证服务架构，完美匹配你现在多应用共享认证体系的场景，既能复用example1.dev已有的用户数据和角色系统，又不用在example2.dev重复造轮子。下面我给你一步步拆解在example2.dev上的实现步骤：

1. 实现请求拦截与Token校验逻辑 #

在example2.dev中，我们需要在请求到达业务控制器前，拦截并检查请求头里的JWT Token，再转发到example1.dev的接口验证有效性并获取用户数据。推荐用Symfony的EventSubscriber来做全局拦截：

// src/EventSubscriber/JwtValidationSubscriber.php
namespace App\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Contracts\HttpClient\HttpClientInterface;

class JwtValidationSubscriber implements EventSubscriberInterface
{
    private $httpClient;
    private $authWhoamiUrl;

    public function __construct(HttpClientInterface $httpClient, string $authWhoamiUrl)
    {
        $this->httpClient = $httpClient;
        $this->authWhoamiUrl = $authWhoamiUrl; // 配置为example1.dev/api/whoami
    }

    public static function getSubscribedEvents(): array
    {
        return [
            RequestEvent::class => 'onKernelRequest',
        ];
    }

    public function onKernelRequest(RequestEvent $event): void
    {
        $request = $event->getRequest();
        
        // 跳过公开接口（比如注册、首页等），根据你的实际路由调整
        if ($this->isPublicRoute($request)) {
            return;
        }

        // 提取Authorization头中的Bearer Token
        $authHeader = $request->headers->get('Authorization');
        if (!$authHeader || !str_starts_with($authHeader, 'Bearer ')) {
            throw new UnauthorizedHttpException('Bearer', '请携带有效的JWT Token');
        }

        $token = substr($authHeader, 7);

        // 调用example1.dev的接口验证Token并拉取用户数据
        try {
            $response = $this->httpClient->request('GET', $this->authWhoamiUrl, [
                'headers' => ['Authorization' => "Bearer $token"],
            ]);

            if ($response->getStatusCode() !== 200) {
                throw new UnauthorizedHttpException('Bearer', 'Token无效或已过期');
            }

            $userData = $response->toArray();
            // 将用户数据存入请求属性，供后续控制器/授权逻辑使用
            $request->attributes->set('auth_user', $userData);
        } catch (\Exception $e) {
            $event->setResponse(new JsonResponse(['error' => $e->getMessage()], 401));
        }
    }

    private function isPublicRoute($request): bool
    {
        $publicRoutes = ['/api/public/*', '/login', '/'];
        foreach ($publicRoutes as $route) {
            if (fnmatch($route, $request->getPathInfo())) {
                return true;
            }
        }
        return false;
    }
}

然后在services.yaml中配置这个订阅者，注入HttpClient和认证接口地址：

# config/services.yaml
services:
    App\EventSubscriber\JwtValidationSubscriber:
        arguments:
            $authWhoamiUrl: '%env(AUTH_WHOAMI_URL)%' # 在.env中配置为example1.dev/api/whoami
        tags:
            - { name: kernel.event_subscriber }

2. 整合Symfony Security实现规范授权（可选但推荐） #

如果你想利用Symfony的Security组件做更严谨的授权（比如角色校验、注解控制访问），可以把从example1获取的用户数据转换成Symfony标准的User对象：

第一步：创建自定义User类 #

// src/Security/ApiUser.php
namespace App\Security;

use Symfony\Component\Security\Core\User\UserInterface;

class ApiUser implements UserInterface
{
    private $id;
    private $username;
    private $roles = [];

    public function __construct(array $userData)
    {
        $this->id = $userData['id'];
        $this->username = $userData['username'];
        $this->roles = $userData['roles'] ?? [];
        // 确保至少有一个基础角色，符合Symfony Security要求
        if (empty($this->roles)) {
            $this->roles[] = 'ROLE_USER';
        }
    }

    // 实现UserInterface的必填方法
    public function getRoles(): array
    {
        return $this->roles;
    }

    public function eraseCredentials() {}

    public function getUserIdentifier(): string
    {
        return $this->username;
    }

    // 自定义getter
    public function getId(): int
    {
        return $this->id;
    }
}

第二步：创建自定义UserProvider #

// src/Security/ApiUserProvider.php
namespace App\Security;

use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\Exception\UserNotFoundException;
use Symfony\Contracts\HttpClient\HttpClientInterface;

class ApiUserProvider implements UserProviderInterface
{
    private $httpClient;
    private $authWhoamiUrl;

    public function __construct(HttpClientInterface $httpClient, string $authWhoamiUrl)
    {
        $this->httpClient = $httpClient;
        $this->authWhoamiUrl = $authWhoamiUrl;
    }

    public function loadUserByIdentifier(string $token): UserInterface
    {
        try {
            $response = $this->httpClient->request('GET', $this->authWhoamiUrl, [
                'headers' => ['Authorization' => "Bearer $token"],
            ]);

            if ($response->getStatusCode() !== 200) {
                throw new UserNotFoundException('Token无效');
            }

            $userData = $response->toArray();
            return new ApiUser($userData);
        } catch (\Exception $e) {
            throw new UserNotFoundException($e->getMessage());
        }
    }

    public function refreshUser(UserInterface $user): UserInterface
    {
        // 刷新用户数据时重新调用example1的接口
        return $this->loadUserByIdentifier($user->getUserIdentifier());
    }

    public function supportsClass(string $class): bool
    {
        return ApiUser::class === $class;
    }
}

第三步：配置Security.yaml #

# config/packages/security.yaml
security:
    providers:
        api_user_provider:
            id: App\Security\ApiUserProvider
    firewalls:
        main:
            pattern: ^/api
            stateless: true
            custom_authenticator: App\Security\ApiAuthenticator
            provider: api_user_provider

    access_control:
        - { path: ^/api/admin, roles: ROLE_ADMIN } # 管理员角色才能访问
        - { path: ^/api, roles: ROLE_USER } # 普通用户角色即可访问

最后创建对应的ApiAuthenticator处理Token提取逻辑（核心和之前的EventSubscriber类似，只是整合到Security体系中），这里就不展开了。

• 服务器间通信权限：因为example2是后端调用example1的接口，不需要处理浏览器CORS，但要确保example1的防火墙允许example2的服务器IP访问，或者不对认证接口做IP限制。
• 缓存优化：频繁调用example1会增加延迟，建议用Symfony的Cache组件缓存Token对应的用户数据，有效期设为5-15分钟，平衡性能和数据实时性。
• 容错处理：如果example1服务不可用，example2可以暂时使用缓存的用户数据，或者返回503服务不可用，避免自身业务受影响。
• 密钥安全：这种方案不需要在example2存储JWT签名密钥，所有验证都由example1完成，大幅降低了密钥泄露的风险，比本地验证更安全。

内容的提问来源于stack exchange，提问作者khgasd652k