Issue 1:
I found something that I don't think is a bug by itself, but doesn't really strike me as completely correct behaviour neither.

When I dump the security configuration on the console, I will not see any authentication mechanism configurations, like form_login, x509, http_basic etc, but after I clear the cache without warming up, these configuration settings are correctly dumped.

$ php app/console config:dump-reference security
firewalls: # Required

# Prototype
name:
pattern: ~
host: ~
.......
anonymous:
key: 54a5a642d6404
switch_user:
provider: ~
parameter: _switch_user
role: ROLE_ALLOWED_TO_SWITCH
access_control:
requires_channel: null

# use the urldecoded format
path: null # Example: ^/path to resource/
host: null

$

$ php app/console clear:cache --no-warmup
$ php app/console config:dump-reference security
firewalls: # Required

# Prototype
name:
pattern: ~
host: ~
.......
anonymous:
key: 54a5a642d6404
switch_user:
provider: ~
parameter: _switch_user
role: ROLE_ALLOWED_TO_SWITCH
x509:
provider: ~
user: SSL_CLIENT_S_DN_Email
credentials: SSL_CLIENT_S_DN
simple_preauth:
provider: ~
authenticator: ~
form_login:
provider: ~
remember_me: true
success_handler: ~
.......
access_control:
requires_channel: null

# use the urldecoded format
path: null # Example: ^/path to resource/
host: null

$

The reason for this is that the authentication security listeners are added through the addSecurityListenerFactory() in the securityBundle::build() method, which only gets called when creating a new cache.

Once the cache has been build, the security listener factories aren't added so the MainConfiguration cannot find their configuration.

I think the configuration dump should be consistent regardless if it was cached or not. Maybe there could be a way to add the securityListenerFactories at some other place so the configurations will always show up?

Issue 2:
Here is the output I get before and after clearing the cache, and the diff. As you can see the difference is huge. If I run the command again, the output comes back to the initial state (the one with the fewer lines) I think it should be the same.

Before clearing the cache

# Default configuration for "SecurityBundle"
security:
access_denied_url: null # Example: /foo/error403

# strategy can be: none, migrate, invalidate
session_fixation_strategy: migrate
hide_user_not_found: true
always_authenticate_before_granting: false
erase_credentials: true
access_decision_manager:
strategy: affirmative
allow_if_all_abstain: false
allow_if_equal_granted_denied: true
acl:

# any name configured in doctrine.dbal section
connection: null
cache:
id: ~
prefix: sf2_acl_
provider: ~
tables:
class: acl_classes
entry: acl_entries
object_identity: acl_object_identities
object_identity_ancestors: acl_object_identity_ancestors
security_identity: acl_security_identities
voter:
allow_if_object_identity_unavailable: true
encoders:

# Examples:
Acme\DemoBundle\Entity\User1: sha512
Acme\DemoBundle\Entity\User2:
algorithm: sha512
encode_as_base64: true
iterations: 5000

# Prototype
class:
algorithm: ~

# Name of hashing algorithm for PBKDF2 (i.e. sha256, sha512, etc..) See hash_algos() for a list of supported algorithms.
hash_algorithm: sha512
key_length: 40
ignore_case: false
encode_as_base64: true
iterations: 5000
cost: 13
id: ~
providers: # Required

# Examples:
my_memory_provider:
memory:
users:
foo:
password: foo
roles: ROLE_USER
bar:
password: bar
roles: [ROLE_USER, ROLE_ADMIN]
my_entity_provider:
entity:
class: SecurityBundle:User
property: username

# Prototype
name:
id: ~
chain:
providers: []
firewalls: # Required

# Prototype
name:
pattern: ~
host: ~
methods: []
security: true
request_matcher: ~
access_denied_url: ~
access_denied_handler: ~
entry_point: ~
provider: ~
stateless: false
context: ~
logout:
csrf_parameter: _csrf_token
csrf_token_generator: ~
csrf_token_id: logout
path: /logout
target: /
success_handler: ~
invalidate_session: true
delete_cookies:

# Prototype
name:
path: null
domain: null
handlers: []
anonymous:
key: 538c9e213ae18
switch_user:
provider: ~
parameter: _switch_user
role: ROLE_ALLOWED_TO_SWITCH
access_control:
requires_channel: null

# use the urldecoded format
path: null # Example: ^/path to resource/
host: null
ips: []
methods: []
allow_if: null
roles: []
role_hierarchy:

# Prototype
id: []

After clearing the cache

# Default configuration for "SecurityBundle"
security:
access_denied_url: null # Example: /foo/error403

# strategy can be: none, migrate, invalidate
session_fixation_strategy: migrate
hide_user_not_found: true
always_authenticate_before_granting: false
erase_credentials: true
access_decision_manager:
strategy: affirmative
allow_if_all_abstain: false
allow_if_equal_granted_denied: true
acl:

# any name configured in doctrine.dbal section
connection: null
cache:
id: ~
prefix: sf2_acl_
provider: ~
tables:
class: acl_classes
entry: acl_entries
object_identity: acl_object_identities
object_identity_ancestors: acl_object_identity_ancestors
security_identity: acl_security_identities
voter:
allow_if_object_identity_unavailable: true
encoders:

# Examples:
Acme\DemoBundle\Entity\User1: sha512
Acme\DemoBundle\Entity\User2:
algorithm: sha512
encode_as_base64: true
iterations: 5000

# Prototype
class:
algorithm: ~

# Name of hashing algorithm for PBKDF2 (i.e. sha256, sha512, etc..) See hash_algos() for a list of supported algorithms.
hash_algorithm: sha512
key_length: 40
ignore_case: false
encode_as_base64: true
iterations: 5000
cost: 13
id: ~
providers: # Required

# Examples:
my_memory_provider:
memory:
users:
foo:
password: foo
roles: ROLE_USER
bar:
password: bar
roles: [ROLE_USER, ROLE_ADMIN]
my_entity_provider:
entity:
class: SecurityBundle:User
property: username

# Prototype
name:
id: ~
chain:
providers: []
memory:
users:

# Prototype
name:
password: 538c9e35acffa
roles: []
entity:
class: ~ # Required
property: null
manager_name: null
firewalls: # Required

# Prototype
name:
pattern: ~
host: ~
methods: []
security: true
request_matcher: ~
access_denied_url: ~
access_denied_handler: ~
entry_point: ~
provider: ~
stateless: false
context: ~
logout:
csrf_parameter: _csrf_token
csrf_token_generator: ~
csrf_token_id: logout
path: /logout
target: /
success_handler: ~
invalidate_session: true
delete_cookies:

# Prototype
name:
path: null
domain: null
handlers: []
anonymous:
key: 538c9e35ad418
switch_user:
provider: ~
parameter: _switch_user
role: ROLE_ALLOWED_TO_SWITCH
x509:
provider: ~
user: SSL_CLIENT_S_DN_Email
credentials: SSL_CLIENT_S_DN
simple_preauth:
provider: ~
authenticator: ~
fr3d_ldap: []
cas:
provider: ~
remember_me: true
success_handler: ~
failure_handler: ~
check_path: null
use_forward: false
require_previous_session: true

# domain name of the cas application
cas_server: ~ # Required

# port to use when connecting to the CAS application. Defaults to 443.
cas_port: 443

# path to the certification authority that issued the certificate for your authentication server.
ca_certificate: ~ # Required

# will be used to trigger the redirection to CAS
login_path: ~ # Required
always_use_default_target_path: false
default_target_path: /
target_path_parameter: _target_path
use_referer: false
failure_path: null
failure_forward: false
failure_path_parameter: _failure_path
form_login:
provider: ~
remember_me: true
success_handler: ~
failure_handler: ~
check_path: /login_check
use_forward: false
require_previous_session: true
username_parameter: _username
password_parameter: _password
csrf_parameter: _csrf_token
intention: authenticate
post_only: true
always_use_default_target_path: false
default_target_path: /
login_path: /login
target_path_parameter: _target_path
use_referer: false
failure_path: null
failure_forward: false
failure_path_parameter: _failure_path
csrf_provider: ~
simple_form:
provider: ~
remember_me: true
success_handler: ~
failure_handler: ~
check_path: /login_check
use_forward: false
require_previous_session: true
username_parameter: _username
password_parameter: _password
csrf_parameter: _csrf_token
intention: authenticate
post_only: true
authenticator: ~
always_use_default_target_path: false
default_target_path: /
login_path: /login
target_path_parameter: _target_path
use_referer: false
failure_path: null
failure_forward: false
failure_path_parameter: _failure_path
csrf_provider: ~
http_basic:
provider: ~
realm: 'Secured Area'
http_digest:
provider: ~
realm: 'Secured Area'
key: ~ # Required
remember_me:
key: ~ # Required
token_provider: ~
user_providers: []
name: REMEMBERME
lifetime: 31536000
path: /
domain: null
secure: false
httponly: true
always_remember_me: false
remember_me_parameter: _remember_me
access_control:
requires_channel: null

# use the urldecoded format
path: null # Example: ^/path to resource/
host: null
ips: []
methods: []
allow_if: null
roles: []
role_hierarchy:

# Prototype
id: []

Diff

72a73,83
> memory:
> users:
>
> # Prototype
> name:
> password: 538c9e35acffa
> roles: []
> entity:
> class: ~ # Required
> property: null
> manager_name: null
104c115
< key: 538c9e213ae18

---
> key: 538c9e35ad418
108a120,218
> x509:
> provider: ~
> user: SSL_CLIENT_S_DN_Email
> credentials: SSL_CLIENT_S_DN
> simple_preauth:
> provider: ~
> authenticator: ~
> fr3d_ldap: []
> cas:
> provider: ~
> remember_me: true
> success_handler: ~
> failure_handler: ~
> check_path: null
> use_forward: false
> require_previous_session: true
>
> # domain name of the cas application
> cas_server: ~ # Required
>
> # port to use when connecting to the CAS application. Defaults to 443.
> cas_port: 443
>
> # path to the certification authority that issued the certificate for your authentication server.
> ca_certificate: ~ # Required
>
> # will be used to trigger the redirection to CAS
> login_path: ~ # Required
> always_use_default_target_path: false
> default_target_path: /
> target_path_parameter: _target_path
> use_referer: false
> failure_path: null
> failure_forward: false
> failure_path_parameter: _failure_path
> form_login:
> provider: ~
> remember_me: true
> success_handler: ~
> failure_handler: ~
> check_path: /login_check
> use_forward: false
> require_previous_session: true
> username_parameter: _username
> password_parameter: _password
> csrf_parameter: _csrf_token
> intention: authenticate
> post_only: true
> always_use_default_target_path: false
> default_target_path: /
> login_path: /login
> target_path_parameter: _target_path
> use_referer: false
> failure_path: null
> failure_forward: false
> failure_path_parameter: _failure_path
> csrf_provider: ~
> simple_form:
> provider: ~
> remember_me: true
> success_handler: ~
> failure_handler: ~
> check_path: /login_check
> use_forward: false
> require_previous_session: true
> username_parameter: _username
> password_parameter: _password
> csrf_parameter: _csrf_token
> intention: authenticate
> post_only: true
> authenticator: ~
> always_use_default_target_path: false
> default_target_path: /
> login_path: /login
> target_path_parameter: _target_path
> use_referer: false
> failure_path: null
> failure_forward: false
> failure_path_parameter: _failure_path
> csrf_provider: ~
> http_basic:
> provider: ~
> realm: 'Secured Area'
> http_digest:
> provider: ~
> realm: 'Secured Area'
> key: ~ # Required
> remember_me:
> key: ~ # Required
> token_provider: ~
> user_providers: []
> name: REMEMBERME
> lifetime: 31536000
> path: /
> domain: null
> secure: false
> httponly: true
> always_remember_me: false
> remember_me_parameter: _remember_me