Symfony应用从PHP5.6迁移至7.4后登录失败问题求助

问题背景 #

同事基于PHP 5.6开发的Symfony考勤管理系统，迁移至PHP 7.4+Symfony 4环境后，仅能通过MySQL user表中硬编码的通用密码登录，输入用户LDAP密码时提示Bad credentials。旧环境中LDAP密码登录正常，但当前代码未发现任何LDAP连接配置，已尝试修改加密方式、检查WampServer及php.ini设置，问题仍未解决。

user表字段包括：id、id_externalsoft、username、password、salt、roles(DC2Type:array)等。

当前security.yml配置 #

# app/config/security.yml

security:
  encoders:
    Symfony\Component\Security\Core\User\User: plaintext
    AbsenseBundle\Entity\User: plaintext

  role_hierarchy:
    ROLE_ADMIN: ROLE_USER
    ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

  providers:
    main:
      entity:
        class: AbsenseBundle:User
  firewalls:
    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false
    main:
      pattern: ^/
      anonymous: true
      provider: main
      form_login:
        login_path: login
        check_path: login_check
      logout:
        path: logout
        target: /login
      remember_me:
        secret: "%secret%"
        lifetime: 604800 # 1 week in seconds
        path: /
        # by default, the feature is enabled by checking a
        # checkbox in the login form (see below), uncomment the
        # following line to always enable it.
        #always_remember_me: true
  access_control:
    - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/calcul/evolution, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/admin, roles: ROLE_ADMIN }
    - { path: ^/, roles: ROLE_USER }

    #- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }

登录失败日志 #

[2023-10-03 11:50:45] php.INFO: User Deprecated: The "Symfony\Component\Debug\DebugClassLoader" class is deprecated since Symfony 4.4, use "Symfony\Component\ErrorHandler\DebugClassLoader" instead. {"exception":"[object] (ErrorException(code: 0): User Deprecated: The \"Symfony\\Component\\Debug\\DebugClassLoader\" class is deprecated since Symfony 4.4, use \"Symfony\\Component\\ErrorHandler\\DebugClassLoader\" instead. at C:\\wamp64\\apps\\absense\\vendor\\symfony\\symfony\\src\\Symfony\\Component\\Debug\\DebugClassLoader.php:16)"} []
[2023-10-03 11:50:45] request.INFO: Matched route "login_check". {"route":"login_check","route_parameters":{"_route":"login_check"},"request_uri":"https://xxx/absense/web/app_dev.php/login_check","method":"POST"} []
[2023-10-03 11:50:45] php.INFO: User Deprecated: Creating Doctrine\ORM\Mapping\UnderscoreNamingStrategy without making it number aware is deprecated and will be removed in Doctrine ORM 3.0. {"exception":"[object] (ErrorException(code: 0): User Deprecated: Creating Doctrine\\ORM\\Mapping\\UnderscoreNamingStrategy without making it number aware is deprecated and will be removed in Doctrine ORM 3.0. at C:\\wamp64\\apps\\absense\\vendor\\doctrine\\orm\\lib\\Doctrine\\ORM\\Mapping\\UnderscoreNamingStrategy.php:66)"} []
[2023-10-03 11:50:45] doctrine.DEBUG: SELECT u0_.id AS id_0, u0_.id_externalsoft AS id_externalsoft_1, u0_.username AS username_2, u0_.password AS password_3, u0_.salt AS salt_4, u0_.roles AS roles_5, u0_.admin AS admin_6, u0_.isrh AS isrh_7, u0_.seeall AS seeall_8, u0_.adlogin AS adlogin_9, u0_.adlogin2 AS adlogin2_10, u0_.name AS name_11, u0_.prename AS prename_12, u0_.mail AS mail_13, u0_.canaccess AS canaccess_14, u0_.MaPST AS MaPST_15 FROM user u0_ WHERE u0_.username = ? OR u0_.adlogin = ? OR u0_.adlogin2 = ? ["u125960","u125960","u125960"] []
[2023-10-03 11:50:45] doctrine.DEBUG: SELECT t0.notif_x_cases AS notif_x_cases_1, t0.email_x_cases AS email_x_cases_2, t0.notif_interview AS notif_interview_3, t0.email_interview AS email_interview_4, t0.notif_x_days AS notif_x_days_5, t0.email_x_days AS email_x_days_6, t0.notif_other AS notif_other_7, t0.email_other AS email_other_8, t0.email_x_retard AS email_x_retard_9, t0.notif_x_retard AS notif_x_retard_10, t0.user_id AS user_id_11 FROM user_settings t0 WHERE t0.user_id = ? [252] []
[2023-10-03 11:50:45] security.INFO: Authentication request failed. {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\BadCredentialsException(code: 0): Bad credentials. at C:\\wamp64\\apps\\absense\\vendor\\symfony\\symfony\\src\\Symfony\\Component\\Security\\Core\\Authentication\\Provider\\UserAuthenticationProvider.php:86, Symfony\\Component\\Security\\Core\\Exception\\BadCredentialsException(code: 0): The presented password is invalid. at C:\\wamp64\\apps\\absense\\vendor\\symfony\\symfony\\src\\Symfony\\Component\\Security\\Core\\Authentication\\Provider\\DaoAuthenticationProvider.php:65)"} []
[2023-10-03 11:50:45] security.DEBUG: Authentication failure, redirect triggered. {"failure_path":"login"} []
[...] 

排查方向 #

1. 找回旧环境的LDAP认证逻辑

   • 旧环境（PHP5.6+Symfony2/3）大概率通过自定义UserProvider或AuthenticationProvider实现LDAP验证，迁移时未同步该代码。检查旧项目AbsenseBundle下是否有Security相关自定义类，比如LdapUserProvider.php或LdapAuthenticationProvider.php。
   • 查看旧项目的services.yml或config.yml，是否存在LDAP服务配置（如ldap.client）及相关认证服务的注册信息。

2. 检查User实体的认证逻辑

   • 当前security.yml配置的是entity provider，仅校验数据库中存储的密码。若旧环境是先查数据库获取用户，再去LDAP验证密码，需自定义UserChecker或修改User实体的checkCredentials方法（若实现了AdvancedUserInterface）。
   • 查看AbsenseBundle\Entity\User类，是否包含调用LDAP服务验证密码的逻辑。

3. Symfony版本迁移兼容性调整

   • Symfony4对Security组件做了重构，旧的自定义认证类可能需要适配新接口。比如UserProviderInterface方法签名变化，或AuthenticationProvider实现逻辑需更新。
   • 当前encoders设为plaintext，需确认旧环境是否是LDAP验证通过后，再匹配数据库加密密码，或是user表的password字段仅为占位符，实际不参与校验。

4. LDAP扩展与基础配置检查

   • 确认PHP7.4已启用ldap扩展（查看php.ini中extension=ldap是否开启，Wamp中需勾选LDAP扩展）。
   • 检查项目中是否存在硬编码的LDAP服务器地址、端口、域信息，旧代码可能未通过配置文件存储这些信息。

内容的提问来源于stack exchange，提问作者Bruno Paiva