[SecurityBundle] Authentication entry point is only registered with firewall exception listener, not with authentication listeners
bug #12296 [SecurityBundle] Authentication entry point is only registered with firewall exception listener, not with authentication listeners (rjkip)

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #12296).

Discussion
----------

[SecurityBundle] Authentication entry point is only registered with firewall exception listener, not with authentication listeners

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | when relying on this configuration behaviour
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #12261
| License       | MIT
| Doc PR        | —

See symfony/symfony#12261.

I configured a different firewall entry point for one firewall. However, when authentication had to be performed, it still called BasicAuthenticationEntryPoint::start() instead of my service's start(). My service was instantiated, yet never used.

The issue appears to be that the entry point is registered with the firewall's exception listener, but not with the BasicAuthenticationListener. This means that when the BasicAuthenticationListener determines the user has  provided wrong credentials, BasicAuthenticationEntryPoint is still used. Only in case of an exception would my  entry point service be used.

In my opinion, this is not correct behaviour. Can someone confirm this? Are there currently tests that pertain to the `entry_point` configuration on which I can base a test?

---

Test setup:

```yaml
# security.yml
security:
    firewalls:
        api:
            pattern: ^/api/
            http_basic: ~
            entry_point: my.service
        default:
            anonymous: ~
```

Commits
-------

92c8dfb [SecurityBundle] Authentication entry point is only registered with firewall exception listener, not with authentication listeners