akeneo · AymericPlanche · Mar 25, 2026
diff --git a/Compat/LegacySecurityFactoryInterface.php b/Compat/LegacySecurityFactoryInterface.php
@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace FOS\OAuthServerBundle\Compat;
+
+/**
+ * Empty stub that replaces Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface
+ * when it doesn't exist (Symfony 6.x+). Allows OAuthFactory to implement it on all Symfony versions.
+ */
+interface LegacySecurityFactoryInterface
+{
+}
diff --git a/Compat/passport_interface_polyfill.php b/Compat/passport_interface_polyfill.php
@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * Polyfill for PassportInterface, which was removed in Symfony 6.0.
+ * On Symfony 6.x, it is aliased to Passport so that type hints using
+ * PassportInterface remain valid on both Symfony versions.
+ */
+if (!interface_exists(\Symfony\Component\Security\Http\Authenticator\Passport\PassportInterface::class)) {
+    class_alias(
+        \Symfony\Component\Security\Http\Authenticator\Passport\Passport::class,
+        \Symfony\Component\Security\Http\Authenticator\Passport\PassportInterface::class
+    );
+}
diff --git a/Compat/security_factory_interface_polyfill.php b/Compat/security_factory_interface_polyfill.php
@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * Polyfill for SecurityFactoryInterface, which was removed in Symfony 6.0.
+ * Defining it as an empty interface allows OAuthFactory to safely implement it
+ * on both Symfony 5.4 and 6.x without a fatal error.
+ */
+if (!interface_exists(\Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface::class)) {
+    class_alias(
+        \FOS\OAuthServerBundle\Compat\LegacySecurityFactoryInterface::class,
+        \Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface::class
+    );
+}
diff --git a/DependencyInjection/Compiler/PasswordHasherCompilerPass.php b/DependencyInjection/Compiler/PasswordHasherCompilerPass.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace FOS\OAuthServerBundle\DependencyInjection\Compiler;
+
+use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
+use Symfony\Component\DependencyInjection\ContainerBuilder;
+use Symfony\Component\DependencyInjection\Reference;
+
+/**
+ * On Symfony 6.x, security.encoder_factory no longer exists.
+ * This compiler pass rewires the OAuthStorage to use security.user_password_hasher instead.
+ */
+class PasswordHasherCompilerPass implements CompilerPassInterface
+{
+    public function process(ContainerBuilder $container): void
+    {
+        if (!$container->hasDefinition('fos_oauth_server.storage.default')) {
+            return;
+        }
+
+        $storage = $container->getDefinition('fos_oauth_server.storage.default');
+
+        if ($container->has('security.user_password_hasher')) {
+            $storage->replaceArgument(5, new Reference('security.user_password_hasher'));
+        }
+    }
+}
diff --git a/DependencyInjection/FOSOAuthServerExtension.php b/DependencyInjection/FOSOAuthServerExtension.php
@@ -40,8 +40,11 @@ public function load(array $configs, ContainerBuilder $container)
             $loader->load(sprintf('%s.xml', $config['db_driver']));
         }
 
-        foreach (['oauth', 'security'] as $basename) {
-            $loader->load(sprintf('%s.xml', $basename));
+        $loader->load('oauth.xml');
+        $loader->load('security.xml');
+
+        if (interface_exists(\Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface::class)) {
+            $loader->load('security_legacy.xml');
         }
 
         $container->setAlias('fos_oauth_server.storage', $config['service']['storage']);

diff --git a/DependencyInjection/Security/Factory/OAuthFactory.php b/DependencyInjection/Security/Factory/OAuthFactory.php
@@ -66,6 +66,14 @@ public function getPosition()
         return 'pre_auth';
     }
 
+    /**
+     * Required by AuthenticatorFactoryInterface in Symfony 6.x (replaces getPosition()).
+     */
+    public function getPriority(): int
+    {
+        return -10;
+    }
+
     /**
      * {@inheritdoc}
      */

diff --git a/FOSOAuthServerBundle.php b/FOSOAuthServerBundle.php
@@ -14,6 +14,7 @@
 namespace FOS\OAuthServerBundle;
 
 use FOS\OAuthServerBundle\DependencyInjection\Compiler\GrantExtensionsCompilerPass;
+use FOS\OAuthServerBundle\DependencyInjection\Compiler\PasswordHasherCompilerPass;
 use FOS\OAuthServerBundle\DependencyInjection\Compiler\RequestStackCompilerPass;
 use FOS\OAuthServerBundle\DependencyInjection\FOSOAuthServerExtension;
 use FOS\OAuthServerBundle\DependencyInjection\Security\Factory\OAuthFactory;
@@ -34,9 +35,14 @@ public function build(ContainerBuilder $container)
 
         /** @var SecurityExtension $extension */
         $extension = $container->getExtension('security');
-        $extension->addSecurityListenerFactory(new OAuthFactory());
+        if (method_exists($extension, 'addAuthenticatorFactory')) {
+            $extension->addAuthenticatorFactory(new OAuthFactory());
+        } else {
+            $extension->addSecurityListenerFactory(new OAuthFactory());
+        }
 
         $container->addCompilerPass(new GrantExtensionsCompilerPass());
         $container->addCompilerPass(new RequestStackCompilerPass());
+        $container->addCompilerPass(new PasswordHasherCompilerPass());
     }
 }
diff --git a/Resources/config/security.xml b/Resources/config/security.xml
@@ -5,30 +5,16 @@
     xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
 
     <parameters>
-        <parameter key="fos_oauth_server.security.authentication.provider.class">FOS\OAuthServerBundle\Security\Authentication\Provider\OAuthProvider</parameter>
-        <parameter key="fos_oauth_server.security.authentication.listener.class">FOS\OAuthServerBundle\Security\Firewall\OAuthListener</parameter>
         <parameter key="fos_oauth_server.security.entry_point.class">FOS\OAuthServerBundle\Security\EntryPoint\OAuthEntryPoint</parameter>
     </parameters>
 
     <services>
-        <service id="fos_oauth_server.security.authentication.provider" class="%fos_oauth_server.security.authentication.provider.class%" public="false">
-            <argument /> <!-- user provider -->
-            <argument type="service" id="fos_oauth_server.server" />
-            <argument type="service" id="security.user_checker" />
-        </service>
-
         <service id="fos_oauth_server.security.authentication.authenticator" class="FOS\OAuthServerBundle\Security\Authentication\Authenticator\OAuthAuthenticator" public="false">
             <argument type="service" id="fos_oauth_server.server" />
             <argument type="service" id="security.user_checker" />
             <argument /> <!-- user provider -->
         </service>
 
-        <service id="fos_oauth_server.security.authentication.listener" class="%fos_oauth_server.security.authentication.listener.class%" public="false">
-            <argument type="service" id="security.token_storage"/>
-            <argument type="service" id="security.authentication.manager" />
-            <argument type="service" id="fos_oauth_server.server" />
-        </service>
-
         <service id="fos_oauth_server.security.entry_point" class="%fos_oauth_server.security.entry_point.class%" public="false">
             <argument type="service" id="fos_oauth_server.server" />
         </service>

diff --git a/Resources/config/security_legacy.xml b/Resources/config/security_legacy.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+
+<container xmlns="http://symfony.com/schema/dic/services"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
+
+    <!-- Legacy Symfony 5.x authentication system (provider + listener). Loaded only on Symfony < 6.0. -->
+    <parameters>
+        <parameter key="fos_oauth_server.security.authentication.provider.class">FOS\OAuthServerBundle\Security\Authentication\Provider\OAuthProvider</parameter>
+        <parameter key="fos_oauth_server.security.authentication.listener.class">FOS\OAuthServerBundle\Security\Firewall\OAuthListener</parameter>
+    </parameters>
+
+    <services>
+        <service id="fos_oauth_server.security.authentication.provider" class="%fos_oauth_server.security.authentication.provider.class%" public="false">
+            <argument /> <!-- user provider -->
+            <argument type="service" id="fos_oauth_server.server" />
+            <argument type="service" id="security.user_checker" />
+        </service>
+
+        <service id="fos_oauth_server.security.authentication.listener" class="%fos_oauth_server.security.authentication.listener.class%" public="false">
+            <argument type="service" id="security.token_storage"/>
+            <argument type="service" id="security.authentication.manager" />
+            <argument type="service" id="fos_oauth_server.server" />
+        </service>
+    </services>
+</container>
diff --git a/Security/Authentication/Authenticator/OAuthAuthenticator.php b/Security/Authentication/Authenticator/OAuthAuthenticator.php
@@ -63,10 +63,6 @@ public function authenticate(Request $request): Passport
      */
     public function createAuthenticatedToken(PassportInterface $passport, string $firewallName): TokenInterface
     {
-        if (!$passport instanceof Passport) {
-            throw new \RuntimeException(sprintf('Cannot create a OAuth2 authenticated token. $passport should be a %s', Passport::class));
-        }
-
         $token = $this->createToken($passport, $firewallName);
         $token->setAuthenticated(true);
 

diff --git a/Storage/OAuthStorage.php b/Storage/OAuthStorage.php
@@ -28,7 +28,6 @@
 use OAuth2\OAuth2;
 use OAuth2\OAuth2ServerException;
 use Symfony\Component\HttpFoundation\Response;
-use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
 use Symfony\Component\Security\Core\Exception\AuthenticationException;
 use Symfony\Component\Security\Core\User\UserProviderInterface;
 
@@ -60,9 +59,9 @@ class OAuthStorage implements IOAuth2RefreshTokens, IOAuth2GrantUser, IOAuth2Gra
     protected $userProvider;
 
     /**
-     * @var EncoderFactoryInterface
+     * @var object|null EncoderFactoryInterface (Symfony 5.x) or UserPasswordHasherInterface (Symfony 6.x)
      */
-    protected $encoderFactory;
+    protected $passwordHandler;
 
     /**
      * @var array [uri] => GrantExtensionInterface
@@ -71,14 +70,14 @@ class OAuthStorage implements IOAuth2RefreshTokens, IOAuth2GrantUser, IOAuth2Gra
 
     public function __construct(ClientManagerInterface $clientManager, AccessTokenManagerInterface $accessTokenManager,
         RefreshTokenManagerInterface $refreshTokenManager, AuthCodeManagerInterface $authCodeManager,
-        UserProviderInterface $userProvider = null, EncoderFactoryInterface $encoderFactory = null)
+        UserProviderInterface $userProvider = null, object $passwordHandler = null)
     {
         $this->clientManager = $clientManager;
         $this->accessTokenManager = $accessTokenManager;
         $this->refreshTokenManager = $refreshTokenManager;
         $this->authCodeManager = $authCodeManager;
         $this->userProvider = $userProvider;
-        $this->encoderFactory = $encoderFactory;
+        $this->passwordHandler = $passwordHandler;
 
         $this->grantExtensions = [];
     }
@@ -152,13 +151,23 @@ public function checkUserCredentials(IOAuth2Client $client, $username, $password
         }
 
         try {
-            $user = $this->userProvider->loadUserByUsername($username);
+            if (method_exists($this->userProvider, 'loadUserByIdentifier')) {
+                $user = $this->userProvider->loadUserByIdentifier($username);
+            } else {
+                $user = $this->userProvider->loadUserByUsername($username);
+            }
         } catch (AuthenticationException $e) {
             return false;
         }
 
-        $encoder = $this->encoderFactory->getEncoder($user);
-        if ($encoder->isPasswordValid($user->getPassword(), $password, $user->getSalt())) {
+        if ($this->passwordHandler instanceof \Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface) {
+            $valid = $this->passwordHandler->isPasswordValid($user, $password);
+        } else {
+            $encoder = $this->passwordHandler->getEncoder($user);
+            $valid = $encoder->isPasswordValid($user->getPassword(), $password, $user->getSalt());
+        }
+
+        if ($valid) {
             return [
                 'data' => $user,
             ];

diff --git a/composer.json b/composer.json
@@ -20,12 +20,13 @@
         }
     ],
     "require": {
-        "php": "^8.0",
+        "php": "^8.1",
         "friendsofsymfony/oauth2-php": "~1.1",
-        "symfony/dependency-injection": "^4.4 || ^5.1",
-        "symfony/framework-bundle": "^4.4 || ^5.1",
-        "symfony/security-bundle": "^4.4 || ^5.1",
-        "symfony/twig-bundle": "^4.4 || ^5.1"
+        "symfony/dependency-injection": "^5.4 || ^6.4",
+        "symfony/framework-bundle": "^5.4 || ^6.4",
+        "symfony/password-hasher": "^5.4 || ^6.4",
+        "symfony/security-bundle": "^5.4 || ^6.4",
+        "symfony/twig-bundle": "^5.4 || ^6.4"
     },
     "conflict": {
         "twig/twig": "<1.40 || >=2.0,<2.9"
@@ -40,10 +41,10 @@
         "phpstan/phpstan-phpunit": "~0.9",
         "phpunit/phpunit": "^9.0",
         "propel/propel1": "~1.6",
-        "symfony/console": "^4.4 || ^5.1",
-        "symfony/form": "^4.4 || ^5.1",
-        "symfony/phpunit-bridge": "^4.4 || ^5.1",
-        "symfony/yaml": "^4.4 || ^5.1",
+        "symfony/console": "^5.4 || ^6.4",
+        "symfony/form": "^5.4 || ^6.4",
+        "symfony/phpunit-bridge": "^5.4 || ^6.4",
+        "symfony/yaml": "^5.4 || ^6.4",
         "willdurand/propel-typehintable-behavior": "~1.0"
     },
     "suggest": {
@@ -66,6 +67,10 @@
         "psr-4": {
             "FOS\\OAuthServerBundle\\": ""
         },
+        "files": [
+            "Compat/security_factory_interface_polyfill.php",
+            "Compat/passport_interface_polyfill.php"
+        ],
         "exclude-from-classmap": [
             "/Tests/"
         ]