PHPackages                             iserranodev/certificate-auth-bundle - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. iserranodev/certificate-auth-bundle

ActiveComposer-plugin[Authentication & Authorization](/categories/authentication)

iserranodev/certificate-auth-bundle
===================================

Symfony bundle for X.509 client certificate authentication with configurable user lookup, pluggable identifier transformation, and role-based redirects.

1.0.1(1mo ago)04↓88.9%MITPHPPHP >=8.1

Since Jun 1Pushed 1mo agoCompare

[ Source](https://github.com/ISerranoDev/Certificate-Authentication)[ Packagist](https://packagist.org/packages/iserranodev/certificate-auth-bundle)[ RSS](/packages/iserranodev-certificate-auth-bundle/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (2)Dependencies (5)Versions (3)Used By (0)

CertificateAuthBundle
=====================

[](#certificateauthbundle)

Bundle de Symfony para autenticación mediante certificados digitales X.509 (DNIe, FNMT, etc.). Totalmente configurable y sin dependencias externas más allá de Symfony y Doctrine.

Instalación
-----------

[](#instalación)

```
composer require iserranodev/certificate-auth-bundle
```

Al instalar, el bundle crea automáticamente:

- `config/packages/certificate_auth.yaml` — configuración del bundle
- `config/routes/certificate_auth.yaml` — registro de rutas

Si usas Symfony Flex, el bundle se registra automáticamente. Si no, añádelo manualmente:

```
// config/bundles.php
return [
    // ...
    CertificateAuthBundle\CertificateAuthBundle::class => ['all' => true],
];
```

Configuración
-------------

[](#configuración)

Edita `config/packages/certificate_auth.yaml` (creado automáticamente):

```
certificate_auth:
    # REQUERIDO: tu clase de entidad User
    user_class: App\Entity\User\User

    # Campo de la entidad para buscar por el serial del certificado (default: nif)
    # user_identifier_field: nif

    # Rutas de redirección (opcionales, tienen valores por defecto)
    # dashboard_route: app_dashboard
    # failure_route: app_login

    # Service ID que transforma el identificador antes de buscarlo en BD
    # identifier_transformer: App\Security\MyTransformer
```

El único parámetro obligatorio es `user_class`. Todo lo demás tiene valores por defecto razonables.

Configuración automática de Security
------------------------------------

[](#configuración-automática-de-security)

El bundle **registra automáticamente** el firewall, el provider y el checker en `security.yaml` mediante `PrependExtensionInterface`. No necesitas añadir nada manualmente en `security.yaml`.

El bundle inyecta esta configuración:

```
# Esto lo hace el bundle automáticamente, NO lo añadas tú
security:
    providers:
        certificate_auth_provider:
            id: certificate_auth.provider
    firewalls:
        certificate_auth:
            pattern: ^/certificado
            user_checker: certificate_auth.checker
            custom_authenticators:
                - certificate_auth.authenticator
```

Si necesitas personalizar el firewall (por ejemplo, cambiar el pattern), puedes sobreescribirlo en tu propio `security.yaml`, ya que la configuración del bundle se inyecta con `prependExtensionConfig` (menor prioridad que tu config).

Configuración completa (referencia)
-----------------------------------

[](#configuración-completa-referencia)

```
certificate_auth:
    # REQUERIDO
    user_class: App\Entity\User\User

    # Campo de búsqueda (default: nif)
    user_identifier_field: nif

    # Ruta de login por certificado
    login_route_path: '/certificado/iniciar-sesion'
    login_route_name: 'certificate_auth_login'

    # Rutas de redirección
    dashboard_route: app_dashboard
    failure_route: app_login

    # Redirecciones por rol
    role_redirects:
        ROLE_BASCULISTA: basculista_dis_list
        ROLE_ADMIN: admin_panel

    # Transformer del identificador
    identifier_transformer: null

    # Headers SSL
    ssl_client_verify_header: SSL_CLIENT_VERIFY
    ssl_client_dn_header: SSL_CLIENT_S_DN

    # Parseo del DN
    serial_number_prefix: 'IDCES-'
    dn_serial_field: serialNumber

    # Verificación de usuario
    check_user_enabled: true
    user_disabled_message: 'Tu usuario ha sido desactivado.'

    # Mensajes
    messages:
        no_certificate: 'No se ha encontrado ningún certificado.'
        no_user_found: 'No se han encontrado usuarios relacionados con sus certificados.'
        invalid_certificate: 'El certificado no es válido.'
```

Transformación del identificador
--------------------------------

[](#transformación-del-identificador)

Por defecto, el bundle busca el identificador del certificado (NIF, etc.) directamente en la base de datos sin transformarlo.

### Con transformer personalizado

[](#con-transformer-personalizado)

```
namespace App\Security;

use CertificateAuthBundle\Transformer\IdentifierTransformerInterface;

class Sha256Transformer implements IdentifierTransformerInterface
{
    public function transform(string $identifier): string
    {
        return hash('sha256', $identifier);
    }
}
```

```
certificate_auth:
    identifier_transformer: App\Security\Sha256Transformer
```

### Con EncryptBundle u otro servicio

[](#con-encryptbundle-u-otro-servicio)

```
namespace App\Security;

use CertificateAuthBundle\Transformer\IdentifierTransformerInterface;
use ISerranoDev\EncryptBundle\Service\EncryptService;

class EncryptTransformer implements IdentifierTransformerInterface
{
    public function __construct(
        private readonly EncryptService $encryptService
    ) {}

    public function transform(string $identifier): string
    {
        return $this->encryptService->hashData($identifier);
    }
}
```

Configuración del servidor web
------------------------------

[](#configuración-del-servidor-web)

### Apache

[](#apache)

```
SSLCACertificateFile /path/to/FNMT_CA_bundle.crt

    SSLVerifyClient require
    SSLVerifyDepth 5

    SSLVerifyClient none

```

### Nginx + PHP-FPM

[](#nginx--php-fpm)

```
server {
    listen 443 ssl;

    ssl_client_certificate  /path/to/FNMT_CA_bundle.crt;
    ssl_verify_client       optional;

    location /certificado {
        fastcgi_param SSL_CLIENT_VERIFY $ssl_client_verify;
        fastcgi_param SSL_CLIENT_S_DN   $ssl_client_s_dn;

        fastcgi_pass unix:/run/php/php-fpm.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
    }
}
```

Extensibilidad
--------------

[](#extensibilidad)

### Personalizar el UserChecker

[](#personalizar-el-userchecker)

```
namespace App\Security;

use CertificateAuthBundle\Security\CertificateChecker as BaseChecker;
use Symfony\Component\Security\Core\User\UserInterface;

class CustomCertificateChecker extends BaseChecker
{
    public function checkPreAuth(UserInterface $user): void
    {
        parent::checkPreAuth($user);
        // Tu lógica adicional...
    }
}
```

### Personalizar el extractor de datos del certificado

[](#personalizar-el-extractor-de-datos-del-certificado)

```
namespace App\Security;

use CertificateAuthBundle\Security\CertificateDataExtractor as BaseExtractor;
use Symfony\Component\HttpFoundation\Request;

class CustomDataExtractor extends BaseExtractor
{
    public function extract(Request $request): ?string
    {
        // Tu lógica personalizada
    }
}
```

### Sobreescribir el firewall

[](#sobreescribir-el-firewall)

Si el pattern `^/certificado` no te sirve, simplemente define tu firewall en `security.yaml` con la misma key `certificate_auth` y tu config tendrá prioridad:

```
security:
    firewalls:
        certificate_auth:
            pattern: ^/mi-ruta-custom
            user_checker: certificate_auth.checker
            custom_authenticators:
                - certificate_auth.authenticator
```

Servicios registrados
---------------------

[](#servicios-registrados)

Service IDClase`certificate_auth.authenticator``CertificateAuthenticator``certificate_auth.provider``CertificateProvider``certificate_auth.checker``CertificateChecker``certificate_auth.data_extractor``CertificateDataExtractor``certificate_auth.login_controller``CertificateLoginController`Requisitos
----------

[](#requisitos)

- PHP >= 8.1
- Symfony 6.x o 7.x
- Doctrine ORM

###  Health Score

37

—

LowBetter than 81% of packages

Maintenance90

Actively maintained with recent releases

Popularity3

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity43

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

52d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/147074538?v=4)[Ismael Serrano](/maintainers/ISerranoDev)[@ISerranoDev](https://github.com/ISerranoDev)

---

Top Contributors

[![ISerranoDev](https://avatars.githubusercontent.com/u/147074538?v=4)](https://github.com/ISerranoDev "ISerranoDev (1 commits)")

### Embed Badge

![Health badge](/badges/iserranodev-certificate-auth-bundle/health.svg)

```
[![Health](https://phpackages.com/badges/iserranodev-certificate-auth-bundle/health.svg)](https://phpackages.com/packages/iserranodev-certificate-auth-bundle)
```

###  Alternatives

[rcsofttech/audit-trail-bundle

Enterprise-grade, high-performance Symfony audit trail bundle. Automatically track Doctrine entity changes with split-phase architecture, multiple transports (HTTP, Queue, Doctrine), and sensitive data masking.

1189.8k](/packages/rcsofttech-audit-trail-bundle)[easycorp/easyadmin-bundle

Admin generator for Symfony applications

4.3k17.9M400](/packages/easycorp-easyadmin-bundle)[2lenet/crudit-bundle

The easy like Crud'it Bundle.

1616.4k14](/packages/2lenet-crudit-bundle)[kimai/kimai

Kimai - Time Tracking

4.8k9.0k1](/packages/kimai-kimai)[oro/platform

Business Application Platform (BAP)

645143.5k116](/packages/oro-platform)[open-dxp/opendxp

Content & Product Management Framework (CMS/PIM)

9421.6k64](/packages/open-dxp-opendxp)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)