Prove that custom entry point isn't started with unknown credentials.
Ensure the configured entry point is used in the auth listeners

I had configured a different firewall entry point for one
firewall. However, when authentication had to be performed, it
still called BasicAuthenticationEntryPoint::start() instead of my
service's start(). My service was instantiated, yet never used.

The issue appeared to be that the entry point is registered with
the firewall's exception listener, but not with the
BasicAuthenticationListener. This means that when the
BasicAuthenticationListener determines the user has provided wrong
credentials, BasicAuthenticationEntryPoint is still used. Only in
case of an exception would my entry point service be used.

See symfony/symfony#12261.