Symfony2 custom user provider can't retrieve user - email

Question

I followed this guide to implement my own custom user login. Unfortunately it says Bad credentials during login. This exception comes from line 72 of Symfony\Component\Security\Core\Authentication\Provider\UserAuthenticationProvider. This exception gets thrown because it can't retrieve the user.
What I changed for my custom needs is that the users do not have a username. They will login with their email address. But I think that would be no problem to implement.
security.yml:
security:
encoders:
Acme\UserBundle\Entity\User: plaintext
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
administrators:
entity: { class: AcmeUserBundle:User }
firewalls:
secured_area:
pattern: ^/
anonymous: ~
form_login: ~
access_control:
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: ROLE_USER }
UserRepository:
class UserRepository extends EntityRepository implements UserProviderInterface
{
public function loadUserByUsername($username)
{
$q = $this
->createQueryBuilder('u')
->where('u.email = :email')
->setParameter('email', $username)
->getQuery();
try {
// The Query::getSingleResult() method throws an exception
// if there is no record matching the criteria.
$user = $q->getSingleResult();
} catch (NoResultException $e) {
$message = sprintf(
'Unable to find an active admin AcmeUserBundle:User object identified by "%s".',
$username
);
throw new UsernameNotFoundException($message, 0, $e);
}
return $user;
}
public function refreshUser(UserInterface $user)
{
$class = get_class($user);
if (!$this->supportsClass($class)) {
throw new UnsupportedUserException(
sprintf(
'Instances of "%s" are not supported.',
$class
)
);
}
return $this->find($user->getId());
}
public function supportsClass($class)
{
return $this->getEntityName() === $class
|| is_subclass_of($class, $this->getEntityName());
}
}
login.twig.html:
{% if error %}
<div>{{ error.message }}</div>
{% endif %}
<form action="{{ path('login_check') }}" method="post">
<legend>Login</legend>
<label for="email">Email:</label>
<input type="email" id="email" name="_email" value="{{ email }}"
<label for="password">Password:</label>
<input type="password" id="password" name="_password" />
<button type="submit">Login</button>
</form>
What have I done wrong here? In UserRepository it clearly queries the email as username, so why can't it find the user? I have the speculation that it has something to do with the csrf_token? How can I add it to the controller and twig file? Is this the problem at all oder is it anything else I did wrong?

Answer 1

By default Symfony security uses _username and _password parameters to authenticate user via form submit. You can see it in security configuration reference
form_login:
username_parameter: _username
password_parameter: _password
So you need to place _username field name insteadof _email.