Laminas Authentication login TTL/persistence

Questions Components & MVC
1

How to configure a login (with Authentication module) to automaticaly logout after 1 hour?

I tried below in global.php without succes.

// Session configuration.

    'session_config' => [
        'cookie_lifetime'     => 60*60*1, // Session cookie will expire in 1 hour Org 60*60*1
        'gc_maxlifetime'      => 60*60*1, // How long to store session data on server (for 1 month) 60*60*24*30.        
    ],
2

Is that the entire config you are using?

Do you have this option?

'use_cookies'         => true,
3

I tried below (no succes)

'session_containers' => [
    Laminas\Session\Container::class,
],
'session_storage' => [
    'type' => Laminas\Session\Storage\SessionArrayStorage::class,
],
'session_config' => [
    'cache_expire' => 1,
    'cookie_httponly' => true,
    'cookie_lifetime' => 1,
    'gc_maxlifetime' => 1,
    'remember_me_seconds' => 1,
    'use_cookies' => true,
    'cookie_secure'	=> true,
],
4

What kind of module is this? Is it your own or from a third party?

laminas-authentication creates a separate session container and if no default session manager is set, the configuration is not used. (But please check this carefully again, because I’m not 100% sure).

5

I mean Laminas-authentication :slight_smile:

How do you mean deafult session manager is set? in the example above (global config) the session manager is set, or am i wrong?

How to set the TTL of a login of the laminas-authentication session? I can’t find anything in the documentation…

6

What does your factory for LaminasAuthentication look like (the entire factory code)?

Also, I think (I’ve not used laminas session in awhile) that you may need to enable the default session manager option.

Add this option to your session_config

'enable_default_container_manager' => true,

If I remember correctly that should set the initially created Session Manager as the default for all container instances. Like I said its been awhile since I used it. To see the creation context you will have to read through all of the factories provided by LaminasSession and track down what your missing.

To fill in some of what @froschdesign mentioned. There are several components that create custom session containers. These containers consume the SessionManager. If you do not provide an instance they will all use a static instance that they create internally if I remember correctly. Which may or may not use the config supplied.

Seems as if I had problems using the MVC identity controller plugin at one point due to this exact issue. Since I did not provide an explicit factory laminas-di (which I did not realize was running) was creating the AuthenticationService with defaults and returning it to ServiceManager which split my session usage. It’s hard to recall now, was a few years ago.

I would start by enabling the default manager option. Then if that is not the desired behavior let us know.

7

Thanks Tyrsson,

Unfortunately that was not the solution :frowning:
My factory:

namespace Authenticatie\Controller\Factory;

use Psr\Container\ContainerInterface;
use Laminas\ServiceManager\Factory\FactoryInterface;
use Laminas\Authentication\Adapter\DbTable\CallbackCheckAdapter;
use Authenticatie\Controller\AuthenticatieController;

 class AuthenticatieControllerFactory implements FactoryInterface
{
public function __invoke(ContainerInterface $container,
    $requestedName, array $options = null)
{

    $adapter = new CallbackCheckAdapter($container->get('DbAdapter'));
    
    $adapter->setTableName('users');
    $adapter->setIdentityColumn('email');
    $adapter->setCredentialColumn('password');
    
    // Instantiate the controller and inject dependencies
    return new AuthenticatieController($adapter);
    }
}
8

That is the factory for your controller. We need to see the factory for the AuthenticationService. In this factory you are setting up the adapter, which should be handled in the AuthenticationService factory (usually).

How are you checking to see if the identity is still authenticated?

Do you have laminas-di installed in this project?

If there was an AuthenticationService factory present I would expect to see something like this in your controller factory.

$auth = $container->get(AuthenticationService::class);

You need a factory for the AuthenticationService just like you need a factory for the controller.

Here is a link to a factory for the AuthenticationService from a couple years back where @froschdesign helped me with a related issue regarding the AuthenticationService.

9

Thanks! But can someone explain why this service is Nesscesessy, because in the “default” library code the service is provided:

10

Correct, the service class is there, but no factory and if no adapter is provided, the service class does not work.

11

@froschdesign the laminas-di component strikes again.

I’ve spoken with this user via a slack message and have confirmed that laminas-di is/was present in the application. Instead of rehashing all of this maybe this thread will help them since it was at least partially the exact issue they are facing.

1 Like
12

Like mentioned above i made a factory for AuthenticationService and registrated it as a service. Now it works correctly and the settings in global.php regarding the TTL times are also working! Thanks @froschdesign and @Tyrsson for the help! I am now doing some (extra) deep dive into some basics of Laminas :slight_smile: