👍 For 5.2

HUGE thanks Wouter for spending your time with this last-second change. My apologies for not catching it sooner. I do think it's important, as the error if you don't have any entrypoints (but you have some custom authenticators) is poor as is trying to debugwhy one entrypoint is being used (e.g. fromform_login) but your custom authenticator'sstart() method is being ignored.

There is one case that the PR doesn't address yet:

security:  firewalls:    main:      http_basic: ~      custom_authenticator: App\Security\CustomAuthenticatorWithEntrypointInterface

What should happen in this case (where no specificentry_point has been chosen)? Right now, the new compiler pass is written to just usehttp_basic. I think it should throw an exception. I don't think this should be treated any differently than 2custom_authenticators that both have the entrypoint interface. To say it differently, we should collect the entire collection of "potential entry points" (from built-in authenticators and custom authenticators) and if that collection > 1, we throw an exception and tell the user which options they can choose from.

WDYT? I think it's not too difficult - I think we would need to:

A) Do not throw this Exception inside ofSecurityExtension -https://github.com/symfony/symfony/blob/5.x/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php#L606

B) InSecurityExtension, we would probably return the entrypoint from-> configuredEntryPoint() as a Reference to some fake service - e.g.security.FIREWALLNAME.entrypoint (this is maybe important the entrypoint is also passed to the security config object -https://github.com/symfony/symfony/blob/5.x/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php#L501 ). Then, later in the compiler pass, we'll figure out thereal entrypoint, and set an alias for that fake service that points to the real entrypoint.

C) Also in SecurityExtension, in addition to the'security.'.$firewallName.'_custom_authenticators' parameter, we would set another parameter that held a key->value of all entrypoints for that firewall - e.g.['form_login' => 'SERVICE ID FOR THIS ENTRYPOINT', 'http_basic' => 'SERVICE ID FOR THIS ENTRYPONT'].

D) Finally, this would give us everything we need in the compiler pass to get a full list of the entrypoints and, if there were more than 1, throw a really nice exception with all the possible keys :).

Let me know if you'd like to chat with this or need any helping pushing it through!

Thank you!

I just tested this extensively - it works perfectly. The internals to get this working are a bit complex, but I'm super happy with the end result: if more than 1 authentication mechanism supplies an "entry point", then you get a clear error instructed you to choose one.

Some tests are failing