@@ -115,14 +115,41 @@ Upgrade the Password
115115
116116Upon successful login, the Security system checks whether a better algorithm
117117is available to hash the user's password. If it is, it'll hash the correct
118- password using the new hash. You can enable this behavior by implementing how
119- this newly hashed password should be stored:
118+ password using the new hash. If you use a Guard authenticator, you first need to
119+ `provide the original password to the Security system <Provide the Password when using Guards >`_.
120+
121+ You can enable the upgrade behavior by implementing how this newly hashed
122+ password should be stored:
120123
121124* `When using Doctrine's entity user provider <Upgrade the Password when using Doctrine >`_
122125* `When using a custom user provider <Upgrade the Password when using a custom User Provider >`_
123126
124127After this, you're done and passwords are always hashed as secure as possible!
125128
129+ Provide the Password when using Guard
130+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
131+
132+ When you're using a custom :doc: `guard authenticator </security/guard_authentication >`,
133+ you need to implement :class: `Symfony\\ Component\\ Security\\ Guard\\ PasswordAuthenticatedInterface `.
134+ This interface defines a ``getPassword() `` method that returns the password
135+ for this login request. This password is used in the migration process::
136+
137+ // src/Security/CustomAuthenticator.php
138+ namespace App\Security;
139+
140+ use Symfony\Component\Security\Guard\PasswordAuthenticatedInterface;
141+ // ...
142+
143+ class CustomAuthenticator extends AbstractGuardAuthenticator implements PasswordAuthenticatedInterface
144+ {
145+ // ...
146+
147+ public function getPassword($credentials): ?string
148+ {
149+ return $credentials['password'];
150+ }
151+ }
152+
126153Upgrade the Password when using Doctrine
127154~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
128155
@@ -184,7 +211,7 @@ Trigger Password Migration From a Custom Encoder
184211If you're using a custom password encoder, you can trigger the password
185212migration by returning ``true `` in the ``needsRehash() `` method::
186213
187- // src/Security/UserProvider .php
214+ // src/Security/CustomPasswordEncoder .php
188215 namespace App\Security;
189216
190217 // ...
0 commit comments