// src/AppBundle/Entity/User.php
namespace AppBundle\Entity;
 
use Symfony\Component\Security\Core\User\UserInterface;
use Doctrine\ORM\Mapping as ORM;
 
/**
 * @ORM\Entity
 * @ORM\Table(name="user")
 */
class User implements UserInterface
{
    /**
     * @ORM\Id
     * @ORM\GeneratedValue(strategy="AUTO")
     * @ORM\Column(type="integer")
     */
    private $id;
 
    /**
     * @ORM\Column(type="string", unique=true)
     */
    private $username;
 
    /**
     * @ORM\Column(type="string", unique=true)
     */
    private $apiKey;
 
    public function getUsername()
    {
        return $this->username;
    }
 
    public function getRoles()
    {
        return ['ROLE_USER'];
    }
 
    public function getPassword()
    {
    }
    public function getSalt()
    {
    }
    public function eraseCredentials()
    {
    }
 
    // more getters/setters / 更多 getters/setters
}

// src/AppBundle/Security/TokenAuthenticator.php
namespace AppBundle\Security;
 
use Symfony\Component\Httpfoundation\Request;
use Symfony\Component\HttpFoundation\jsonResponse;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Doctrine\ORM\EntityManager;
 
class TokenAuthenticator extends AbstractGuardAuthenticator
{
    private $em;
 
    public function __construct(EntityManager $em)
    {
        $this->em = $em;
    }
 
    /**
     * Called on every request. Return whatever credentials you wAnt,
     * or null to stop authentication.
     */
    public function getCredentials(Request $request)
    {
        if (!$token = $request->headers->get('X-AUTH-TOKEN')) {
            // no token? Return null and no other methods will be called
            // 没有token就返回null，不调用其他方法
            return;
        }
 
        // What you return here will be passed to getUser() as $credentials
        // 这里你返回的值，将被作为$credentials传入getUser()
        return array(
            'token' => $token,
        );
    }
 
    public function getUser($credentials, UserProviderInterface $userProvider)
    {
        $apiKey = $credentials['token'];
 
        // if null, authentication will fail
        // 如果是空，认证失败
        // if a User object, checkCredentials() is called
        // 如果是个User对象，checkCredentials()将被调用
        return $this->em->getRepository('AppBundle:User')
            ->findOneBy(array('apiKey' => $apiKey));
    }
 
    public function checkCredentials($credentials, UserInterface $user)
    {
        // check credentials - e.g. make sure the password is valid
        // 检查credentials - 比如，确保密码是有效的
        // no credential check is needed in this case
        // 但在本例中并不需要对credential检查
        // return true to cause authentication success
        // 返回true即是认证成功
        return true;
    }
 
    public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
    {
        // on success, let the request continue
        // 成功之后，让请求继续
        return null;
    }
 
    public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
    {
        $data = array(
            'message' => strtr($exception->getMessageKey(), $exception->getMessageData())
 
            // or to translate this message
            // 或者翻译信息如下
            // $this->translator->trans($exception->getMessageKey(), $exception->getMessageData())
        );
 
        return new JsonResponse($data, 403);
    }
 
    /**
     * Called when authentication is needed, but it's not sent
     */
    public function start(Request $request, AuthenticationException $authException = null)
    {
        $data = array(
            // you might translate this message
            // 你也可以翻译这条信息
            'message' => 'Authentication Required'
        );
 
        return new JsonResponse($data, 401);
    }
 
    public function supportsRememberMe()
    {
        return false;
    }
}

// src/AppBundle/Security/TokenAuthenticator.php
// ...
 
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
 
class TokenAuthenticator extends AbstractGuardAuthenticator
{
    // ...
 
    public function getCredentials(Request $request)
    {
        // ...
 
        if ($token == 'ILuvAPIs') {
            throw new CustomUserMessageAuthenticationException(
                'ILuvAPIs is not a real API key: it\'s just a silly phrase'
            );
        }
 
        // ...
    }
 
    // ...
}