Bug - Custom AccessDecisionManager not getting list of voters as first argument in __construct

[SaliBhdr]

Symfony version(s) affected: 5.2.*

Description
After I write my own AccessDecisionManager and extend it from the security bundle's Symfony\Component\Security\Core\Authorization\AccessDecisionManager, all voters logic were not working anymore. What I expect is to get $voters array as the first argument of __construct like the parent AccessDecisionManager.

How to reproduce
Make your Own AccessDecisionManager and add it to security.yaml :

    access_decision_manager:
        service: App\Security\AccessDecisionManager

Could you provide a reproducer app so we can see the big picture? You could do something wrong in other part of your configuration.
For fast checks please inspect what debug:container security.access.decision_manager returns. Secondly you can inspect Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\AddSecurityVotersPass::process() (personally, I use xdebug for a such problems debugging) and go line by line to see what happens as this compiler pass is responsible for injecting voters.

[SaliBhdr]

@marbulk

when I use default decision manager the debug:container security.access.decision_manager returns this:

 // This service is a private alias for the service
 // debug.security.access.decision_manager

Information for Service "debug.security.access.decision_manager"
================================================================

 Decorates the original AccessDecisionManager class to log information about the security voters and the decisions made by them.

 ---------------- ------------------------------------------------------------------------------
  Option           Value                                                                        
 ---------------- ------------------------------------------------------------------------------
  Service ID       debug.security.access.decision_manager
  Class            Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager
  Tags             -
  Public           no
  Synthetic        no
  Lazy             no
  Shared           yes
  Abstract         no
  Autowired        no
  Autoconfigured   no
 ---------------- ------------------------------------------------------------------------------


 ! [NOTE] The "security.access.decision_manager" service or alias has been removed or inlined when the container was    
 !        compiled.   

After using custom decision manager the debug:container security.access.decision_manager returns this:

 // This service is a private alias for the service
 // debug.security.access.decision_manager

Information for Service "debug.security.access.decision_manager"
================================================================

 Decorates the original AccessDecisionManager class to log information about the security voters and the decisions made by them.

 ---------------- ------------------------------------------------------------------------------
  Option           Value                                                                        
 ---------------- ------------------------------------------------------------------------------
  Service ID       debug.security.access.decision_manager
  Class            Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager
  Tags             -
  Public           no
  Synthetic        no
  Lazy             no
  Shared           yes
  Abstract         no
  Autowired        no
  Autoconfigured   no
 ---------------- ------------------------------------------------------------------------------


 ! [NOTE] The "security.access.decision_manager" service or alias has been removed or inlined when the container was    
 !        compiled.         

I used xdebug on custom access decision manager and the process never enters the process() method of Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\AddSecurityVotersPass class.

Is there a workaround?

I need to get the list of all voters including the RoleVoter class. So that I could manage voters decisions by my own logic.

Thank you. I forgot that in a dev environment the security.access.decision_manager service is decorated with a traceable manager. Please check debug:container debug.security.access.decision_manager.inner --show-arguments output.
The information about AddSecurityVotersPass never being entered is worrying (PS. remember that the compiler passes are executed only when any of so called resources have been "touched" since the last container compilation. You can just add an empty comment in this AddSecurityVotersPass and it will be considered as "touched").

In the evening I will try to reproduce this locally with a skeleton app.

[SaliBhdr]

@marbulk

Thank you for your reply.

Here is the output of debug:container debug.security.access.decision_manager.inner --show-arguments:

 // This service is a private alias for the service App\Security\AccessDecisionManager

Information for Service "App\Security\AccessDecisionManager"
============================================================

 ---------------- ------------------------------------
  Option           Value                              
 ---------------- ------------------------------------
  Service ID       App\Security\AccessDecisionManager
  Class            App\Security\AccessDecisionManager
  Tags             -
  Public           no
  Synthetic        no
  Lazy             no
  Shared           yes
  Abstract         no
  Autowired        yes
  Autoconfigured   yes
  Arguments        Array (0 element(s)) //$voters
                   affirmative //$strategy
                   0 //$allowIfAllAbstainDecisions
                   1 //$allowIfEqualGrantedDeniedDecisions
                   Service(request_stack) // this line is added in my custom decision manager to check some params in request

 ---------------- ------------------------------------


 ! [NOTE] The "debug.security.access.decision_manager.inner" service or alias has been removed or inlined when the      
 !        container was compiled. 

New Update:

As you said in the previous comment, I added a comment to AddSecurityVotersPass and the process entered the process() method of AddSecurityVotersPass. So in line 38 :

        if (!$container->hasDefinition('security.access.decision_manager')) {
            return;
        }

The condition returns true so the code hits return; and does nothing.

Another new Update:

After The problem above, I found out that the custom access decision manager needs to be configured as a service with tag name security.access.decision_manager. after adding the config to services.yaml, The above condition has passed and I was able to get the voters in the construct method of custom access decision manager. I think Symfony documentation needs to be updated for this matter. Here is the configuration to register custom access decision manager as service:

services:
    security.access.decision_manager:
        class: App\Security\AccessDecisionManager
        public: false
        tags:
            - { name: security.access.decision_manager }
        arguments:
            - []

Important: So here is the golden question. Why is this happening and is this the right approach?

I can't see a tag with a name security.access.decision_manager in the Security Bundle so it's awkward it's working. I think you unconsciously did something that made it work but I can't see it as you are providing only small chunks of your configuration.

However I can see some inaccuracies. In the issue description you have:

    access_decision_manager:
        service: App\Security\AccessDecisionManager

but then you declare a class App\Security\AccessDecisionManager as a service with id security.access.decision_manager. You did not provide a full services.yaml file but by default all classes in src/ directory are registered as a service with id being their FQCN. Example: class App\Security\AccessDecisionManager will be registered as a service with id = App\Security\AccessDecisionManager. Right now you have 2 managers (services) in the container that reference the same class: id = security.access.decision_manager and id = App\Security\AccessDecisionManager.

This is what I suspect that has happend:

• in security.yaml you have: service: App\Security\AccessDecisionManager
• in services.yaml you declare service security.access.decision_manager using class App\Security\AccessDecisionManager
• bundle configuration (extension) is always processed first, your app configuration in processed as last. Bundle aliases the service with id App\Security\AccessDecisionManager with alias security.access.decision_manager. Then the configuration of your app is processed -> service security.access.decision_manager added by Symfony is removed and replaced with the one from you services.yaml
• compiler pass processes fine and injects voters

However the above does not explain why you don't get voters just with configuring access_decision_manager in your security.yaml. So I think this is still not resolved problem.

Ok, I know what is the case. When configuring custom decision manager in security.yaml the security.access.decision_manager service is removed from Container Builder's definitions array and this string becomes an alias to your custom manager. This way the if statement at the beginning of AddSecurityVotersPass will resolve to true as there is no security.access.decision_manager definition any more.

It worked for you when you declared security.access.decision_manager in services.yaml because this way you re-added this definition with this id to the Container Builder.
Right now, when you have custom access decision manager you will have to manage all the dependencies by yourself.
I think the issue can be closed now.

[SaliBhdr]

@marbulk

Well, do you think this kind of behavior is not strange? I mean doesn't it suppose to be registered from the beginning and not removed until the end of the application? Why is it needed to be added and then removed and cause this kind of behavior?

What I'm trying to say is that if Symfony allows us to register a custom AccessDecisionManager it should behave as default decision manager and pass the same args to the custom one. Or maybe it should provide an option in security.yaml to pass the args there and not be removed from the container in the first place. I don't know I'm just guessing. Because This made me spin around in circles over and over again without finding proper documentation.

Thanks for your reply, it helped me so much to know where to look exactly.

if Symfony allows us to register a custom AccessDecisionManager it should behave as default decision manager and pass the same args to the custom one.

When setting

access_decision_manager:
        service: <service_id>

you are basically telling Symfony "I don't want your manager. I have my own manager and please use it.". However during the container compilation, bundles and you app can manipulate the content of the container and for that reason Symfony doesn't know what the actual manager will be in the end and it has to have some kind of "link" to the manager it will fetch from the container after it is compiled and this link is a string security.access.decision_manager which links to the actual manager.

if Symfony allows us to register a custom AccessDecisionManager

no, Symfony doesn't allow to register custom AccessDecisionManager. I allows to register custom implementation of AccessDecisionManagerInterface.

Summarizing, you can do what you did with creating a service with the same id in your services .yaml but this way you will get only voters as the first argument. You will not get the remaining 3 arguments if you configured them in security.yaml but as this is your custom class then you can inject them yourself.

[SaliBhdr]

@marbulk

Yes, you're right. Thanks for the reply. I think we can close this issue now. have a nice day.

[sarbanha]

I encountered this issue with different symptoms!

Although I knew the service is automatically registered but I did this in service.yml:

    App\Security\SpecialAccessDecisionManager:
        class: App\Security\SpecialAccessDecisionManager  
        autowire: false
        autoconfigure: false
        public: false

then I added decision manager to security.yml:

security:
    access_decision_manager:
        service: App\Security\SpecialAccessDecisionManager

As you can see below, arguments haven't been passed to the decision manager:

[root@dev7 rouzonline.test]# bin/console debug:container debug.security.access.decision_manager.inner --show-arguments                            

 // This service is a private alias for the service                                                                     
 // App\Security\SpecialAccessDecisionManager                                                                           

Information for Service "App\Security\SpecialAccessDecisionManager"
===================================================================

 Description of SpecialAccessDecisionManager

 ---------------- ------------------------------------------- 
  Option           Value                                      
 ---------------- ------------------------------------------- 
  Service ID       App\Security\SpecialAccessDecisionManager  
  Class            App\Security\SpecialAccessDecisionManager  
  Tags             -                                          
  Public           no                                         
  Synthetic        no                                         
  Lazy             no                                         
  Shared           yes                                        
  Abstract         no                                         
  Autowired        no                                         
  Autoconfigured   no                                         
 ---------------- ------------------------------------------- 


 ! [NOTE] The "debug.security.access.decision_manager.inner" service or alias has been removed or inlined when the      
 !        container was compiled.                                                                                       

[root@dev7 rouzonline.test]#

When I use default AccessDecisionManager voters are passed. I need to implement special authorization so I need to create my own decision manager. By the way, my decision manager implements AccessDecisionManagerInterface

I also checked \SecurityBundle\DependencyInjection\Compiler\AddSecurityVotersPass->process() , it is not being called when my decision manager is set.

Any idea?